diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7efceeef..f2d36cec4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,12 +8,79 @@ tag a release. Nightlies use auto-generated notes and do not read this file.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Newest first.
 
 ## [Unreleased]
+### Added
+- **Parallel battlescape turns (optional).** Both players can now act during the
+  same X-Com side instead of taking alternating half-turns. Turn it on from the
+  HOST window before starting a session ("Parallel Battlescape Turns"); it covers
+  co-op PVE and PVE2 missions. The host machine runs the simulation and the
+  joining player's clicks are forwarded to it, so both squads move, shoot and
+  throw against one battlefield, and the side ends only once BOTH players have
+  pressed END TURN (the button shows how many players are ready). A player whose
+  soldiers are all down or mind-controlled counts as ready automatically. Reserve
+  TU settings are now per-player rather than mirrored. If either player is on an
+  older build, or the mission is PVP, the session falls back to the classic
+  alternating turns with no change in behaviour.
+- **"Please wait for <player>'s action to finish."** In parallel turns, a
+  banner above the toolbar now names the player whose action is running while
+  your own input is blocked, so a busy moment no longer looks like a bug. It
+  clears the instant their action ends and never shows for your own actions.
+- **Desync detection with one-click reporting.** The two machines now verify
+  the entire battle state against each other after every single action. If
+  they ever disagree, both players get a dialog naming exactly what diverged
+  ("items diverged at action 242: grenade"), a diagnostic zip is saved
+  automatically, and the dialog offers OPEN FOLDER and REPORT ON GITHUB
+  (pre-filled issue) buttons. Nothing is uploaded without you.
+- **Crash reporter.** If the game crashed last time, the next launch offers to
+  bundle the crash details (dump, log, system info) into a zip for reporting -
+  BUNDLE / NOT NOW / NEVER, your choice each time. Works for hard crashes the
+  classic crash dialog never sees.
+- **Mods work in parallel turns.** Battle scripts that roll random numbers
+  (randomChance/randomRange) now stay in lockstep between the two machines, so
+  scripted mods no longer carry a "may desync in co-op" caveat.
+
 ### Fixed
+- Co-op battles: a long tail of subtle desyncs between the two machines has
+  been eliminated - kneeling state after walking, squad morale after
+  casualties, doors one player walked through staying closed for the other,
+  destroyed terrain and fire/smoke drifting apart, item ids diverging after
+  explosions, a dead mind-controlled alien ending up on different sides, ammo
+  counts, and the battle ending on one machine but not the other under
+  surrender-mode mods. The per-action verification above now guards all of it.
+- Co-op parallel turns: explosions are now shown to the joining player in
+  the same order the host resolves them, instead of in whatever order they
+  arrive. This fixes a bug where the joining player's count of destroyed
+  mission objectives could run ahead of the host's, ending a mission early
+  before the host had actually finished it. The same objective-count fix
+  also applies to classic (non-parallel) co-op.
+- Co-op: a joining player's soldiers now earn experience for kills that
+  happen on the host's turn and are replayed to their machine, instead of
+  missing out on the experience the host's own soldiers receive for the
+  same kills.
 - Co-op SHARED campaigns: a soldier gifted between players during a battle no
   longer duplicates after the mission ends. Transferring a soldier back and forth
   in the battlescape used to leave a second copy of it in the shared roster once
   the mission finished; the shared world now moves the soldier by ownership alone,
   so the roster stays intact.
+- Co-op: a soldier killed while walking, or while a facing update was in flight,
+  could end up dead on one machine and standing on 0 HP on the other for the rest
+  of the mission.
+- Co-op: the gear of a soldier who died was left in the corpse's inventory on the
+  joining player's machine instead of dropping to the floor as it did on the host.
+- Co-op: priming or de-priming a grenade and using a medi-kit did not charge the
+  acting soldier's time units on the other player's machine, so the two views of
+  the same soldier drifted apart with every use.
+- Co-op: a walk that ended early (an interrupted or fast-forwarded move) left the
+  other player's copy of the soldier holding the wrong time units and energy.
+- Co-op: an ACTION MENU grenade prime sent across the wire with a fuse above 1
+  arrived as 1, and a de-prime arrived as an arming - the peer could be left
+  holding a live grenade the other player had just made safe.
+- Co-op skirmish (NEW BATTLE > COOP): finishing a mission - by winning it or by
+  abandoning it - now returns BOTH players to the main menu. Whichever player
+  closed their debriefing second used to be interrupted by the other's ordinary
+  exit: the host was shown a lobby whose RESUME GAME dropped them onto an empty
+  Geoscape, and the joining player got a "Server connection lost" message over
+  their debriefing. A skirmish mission ending is no longer treated as a
+  disconnection.
 - Co-op SHARED campaigns: hiring soldiers, scientists, or engineers is no longer
   blocked with "not enough store space" when a base's general stores are full but
   its living quarters have room. Personnel occupy quarters, not stores, so a
@@ -24,6 +91,13 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Newest first.
   with a line-of-sight blackout in between. The earlier menu redesign had buried
   the toggle inside the network host dialog with no way to actually begin a battle.
   An optional REACT FIRE toggle appears while hotseat is armed.
+- Co-op parallel turns: a unit's death is now applied as one atomic update on the
+  joining player's machine instead of being pieced together from several packets
+  that could arrive out of order. This removes intermittent disagreements between
+  the two players after a death - mismatched kill counts and scores at the
+  debriefing, a corpse or its dropped gear appearing with different item ids, or a
+  bystander's morale lagging a turn behind. The collapse animation still plays for
+  the watching player exactly as before; only the bookkeeping changed.
 
 <!-- Template for the next release section (keep this comment ABOVE the newest
      released section: the notes extractor reads from "## [<v>]" until the next
diff --git a/bin/common/Language/en-GB.yml b/bin/common/Language/en-GB.yml
index 1e6049098..88cf53bec 100644
--- a/bin/common/Language/en-GB.yml
+++ b/bin/common/Language/en-GB.yml
@@ -29,6 +29,35 @@ en-GB:
   STR_SAVE_UPGRADE_REJOIN_FRESH: "No other-player world was included. That player will start fresh when they rejoin."
   STR_SAVE_UPGRADE_CLIENT_FILE_NOTE: "The other player's save file you selected is no longer needed and can be archived."
   STR_SAVE_UPGRADE_LOAD_BTN: "Load upgraded save"
+  # coop (PRD-P6): action-intent deny / timeout flashes.
+  STR_COOP_PLAYER_BUSY: "Another action is running - try again"
+  STR_COOP_TURN_OVER: "The turn has already ended"
+  STR_COOP_NOT_YOUR_SOLDIER: "Not one of your soldiers"
+  STR_COOP_ACTION_REFUSED: "Action refused"
+  STR_COOP_ACTION_TIMEOUT: "No answer from the host - action dropped"
+  # coop (parallel turns): persistent map banner shown while another player's action blocks your input.
+  STR_COOP_WAIT_FOR_PLAYER_ACTION: "Please wait for {0}'s action to finish"
+  # coop (PRD-P8): end-turn readiness gate.
+  STR_COOP_END_TURN_TALLY: "END TURN {0}/{1}"
+  # coop (PRD-P2 rider): battle desync auto-report bundle. {0} is the full path
+  # of the zip, pre-wrapped onto dialog-width lines by the caller.
+  STR_COOP_DESYNC_REPORT_SAVED: "CO-OP DESYNC DETECTED{NEWLINE}The two games no longer agree. A diagnostic report (log, save and context) was saved to>{NEWLINE}{0}{NEWLINE}Please attach that file to a new issue at github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues or post it in the Discord, so the developers can reproduce and fix it."
+  # coop (PRD-I4): desync auto-report one-click UX + attribution headline.
+  STR_COOP_DESYNC_OPEN_FOLDER: "OPEN FOLDER"
+  STR_COOP_DESYNC_REPORT_GITHUB: "REPORT ON GITHUB"
+  # {0}=bucket, {1}=action seq, {2}=action kind
+  STR_COOP_DESYNC_HEADLINE_ACTION: "{0} diverged at action {1}: {2}"
+  # {0}=diverged checksum term(s), used when the per-action sync-check is inert
+  STR_COOP_DESYNC_HEADLINE_TERM: "battle state diverged: {0}"
+  # coop (PRD-I5): next-launch crash reporter. The consent prompt reuses the desync
+  # result notice (STR_COOP_DESYNC_OPEN_FOLDER / STR_COOP_DESYNC_REPORT_GITHUB) once
+  # a bundle is written. {0} in _SAVED is the zip path, pre-wrapped by the caller.
+  STR_COOP_CRASH_REPORT_PROMPT: "OpenXcom crashed the last time it ran.{NEWLINE}Bundle the crash details (dump, log, system info) for the developers?"
+  STR_COOP_CRASH_REPORT_HEADLINE: "Previous crash detected"
+  STR_COOP_CRASH_REPORT_BUNDLE: "BUNDLE"
+  STR_COOP_CRASH_REPORT_NOT_NOW: "NOT NOW"
+  STR_COOP_CRASH_REPORT_NEVER: "NEVER"
+  STR_COOP_CRASH_REPORT_SAVED: "CRASH REPORT BUNDLED{NEWLINE}A crash report (dump, log and system info) was saved to>{NEWLINE}{0}{NEWLINE}Please attach that file to a new issue at github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues or post it in the Discord, so the developers can diagnose it."
   STR_OPENXCOM: "OpenXcom"
   STR_NEW_GAME: "New Game"
   STR_LOAD_SAVED_GAME: "Load Game"
diff --git a/bin/common/Language/en-US.yml b/bin/common/Language/en-US.yml
index 0f243d0aa..7b4572877 100644
--- a/bin/common/Language/en-US.yml
+++ b/bin/common/Language/en-US.yml
@@ -29,6 +29,35 @@ en-US:
   STR_SAVE_UPGRADE_REJOIN_FRESH: "No other-player world was included. That player will start fresh when they rejoin."
   STR_SAVE_UPGRADE_CLIENT_FILE_NOTE: "The other player's save file you selected is no longer needed and can be archived."
   STR_SAVE_UPGRADE_LOAD_BTN: "Load upgraded save"
+  # coop (PRD-P6): action-intent deny / timeout flashes.
+  STR_COOP_PLAYER_BUSY: "Another action is running - try again"
+  STR_COOP_TURN_OVER: "The turn has already ended"
+  STR_COOP_NOT_YOUR_SOLDIER: "Not one of your soldiers"
+  STR_COOP_ACTION_REFUSED: "Action refused"
+  STR_COOP_ACTION_TIMEOUT: "No answer from the host - action dropped"
+  # coop (parallel turns): persistent map banner shown while another player's action blocks your input.
+  STR_COOP_WAIT_FOR_PLAYER_ACTION: "Please wait for {0}'s action to finish"
+  # coop (PRD-P8): end-turn readiness gate.
+  STR_COOP_END_TURN_TALLY: "END TURN {0}/{1}"
+  # coop (PRD-P2 rider): battle desync auto-report bundle. {0} is the full path
+  # of the zip, pre-wrapped onto dialog-width lines by the caller.
+  STR_COOP_DESYNC_REPORT_SAVED: "CO-OP DESYNC DETECTED{NEWLINE}The two games no longer agree. A diagnostic report (log, save and context) was saved to>{NEWLINE}{0}{NEWLINE}Please attach that file to a new issue at github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues or post it in the Discord, so the developers can reproduce and fix it."
+  # coop (PRD-I4): desync auto-report one-click UX + attribution headline.
+  STR_COOP_DESYNC_OPEN_FOLDER: "OPEN FOLDER"
+  STR_COOP_DESYNC_REPORT_GITHUB: "REPORT ON GITHUB"
+  # {0}=bucket, {1}=action seq, {2}=action kind
+  STR_COOP_DESYNC_HEADLINE_ACTION: "{0} diverged at action {1}: {2}"
+  # {0}=diverged checksum term(s), used when the per-action sync-check is inert
+  STR_COOP_DESYNC_HEADLINE_TERM: "battle state diverged: {0}"
+  # coop (PRD-I5): next-launch crash reporter. The consent prompt reuses the desync
+  # result notice (STR_COOP_DESYNC_OPEN_FOLDER / STR_COOP_DESYNC_REPORT_GITHUB) once
+  # a bundle is written. {0} in _SAVED is the zip path, pre-wrapped by the caller.
+  STR_COOP_CRASH_REPORT_PROMPT: "OpenXcom crashed the last time it ran.{NEWLINE}Bundle the crash details (dump, log, system info) for the developers?"
+  STR_COOP_CRASH_REPORT_HEADLINE: "Previous crash detected"
+  STR_COOP_CRASH_REPORT_BUNDLE: "BUNDLE"
+  STR_COOP_CRASH_REPORT_NOT_NOW: "NOT NOW"
+  STR_COOP_CRASH_REPORT_NEVER: "NEVER"
+  STR_COOP_CRASH_REPORT_SAVED: "CRASH REPORT BUNDLED{NEWLINE}A crash report (dump, log and system info) was saved to>{NEWLINE}{0}{NEWLINE}Please attach that file to a new issue at github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues or post it in the Discord, so the developers can diagnose it."
   STR_OPENXCOM: "OpenXcom"
   STR_NEW_GAME: "New Game"
   STR_LOAD_SAVED_GAME: "Load Game"
diff --git a/src/Battlescape/ActionMenuState.cpp b/src/Battlescape/ActionMenuState.cpp
index 18a813afc..8a8e315f9 100644
--- a/src/Battlescape/ActionMenuState.cpp
+++ b/src/Battlescape/ActionMenuState.cpp
@@ -37,6 +37,8 @@
 #include "../Savegame/HitLog.h"
 #include "Pathfinding.h"
 #include "TileEngine.h"
+#include "BattlescapeGame.h"
+#include "../CoopMod/connectionTCP.h"
 #include "../Interface/Text.h"
 
 namespace OpenXcom
@@ -189,8 +191,12 @@ ActionMenuState::ActionMenuState(BattleAction *action, int x, int y) : _action(a
 		addItem(BA_USE, weapon->getPsiAttackName().empty() ? "STR_USE_MIND_PROBE" : weapon->getPsiAttackName(), &id, Options::keyBattleActionItem1);
 	}
 
-	// COOP
-	if (_game->getSavedGame()->getSavedBattle()->getBattleGame() && _game->getSavedGame()->getSavedBattle()->getSelectedUnit())
+	// COOP. Not in parallel mode: `unit_action` exists only to drag the PEER's
+	// selected unit around, and in parallel both players are selecting their own
+	// soldiers at the same time (PRD-P5 already dropped the `selected_unit`
+	// follow for the same reason).
+	if (_game->getSavedGame()->getSavedBattle()->getBattleGame() && _game->getSavedGame()->getSavedBattle()->getSelectedUnit()
+		&& !connectionTCP::parallelTurnActive())
 	{
 		if (_game->getCoopMod()->getCoopStatic() == true && _game->getSavedGame()->getSavedBattle()->getBattleGame()->isYourTurn == 2)
 		{
@@ -417,6 +423,33 @@ void ActionMenuState::handleAction()
 						(type == BMT_STIMULANT && _action->weapon->getStimulantQuantity() > 0) ||
 						(type == BMT_PAINKILLER && _action->weapon->getPainKillerQuantity() > 0))
 					{
+						// coop (PRD-P6): a single-purpose medikit is used right here,
+						// with no MedikitState in between - so this is the confirm
+						// site the parallel client turns into an intent. The body
+						// part is picked from state both machines share.
+						int coopPart = BODYPART_TORSO;
+						if (type == BMT_HEAL && targetUnit->getFatalWounds())
+						{
+							for (int i = 0; i < BODYPART_MAX; ++i)
+							{
+								if (targetUnit->getFatalWound((UnitBodyPart)i))
+								{
+									coopPart = i;
+									break;
+								}
+							}
+						}
+						const int coopMode = type == BMT_STIMULANT ? BMA_STIMULANT
+										   : type == BMT_PAINKILLER ? BMA_PAINKILLER
+																	: BMA_HEAL;
+						BattlescapeGame* coopBg = _game->getSavedGame()->getSavedBattle()->getBattleGame();
+						if (coopBg && coopBg->coopRouteMedikit(_action, targetUnit, coopMode, coopPart))
+						{
+							// the host will heal and broadcast; nothing local runs
+							_action->type = BA_NONE;
+							return;
+						}
+
 						if (_action->spendTU(&_action->result))
 						{
 							switch (type)
@@ -543,8 +576,12 @@ void ActionMenuState::handleAction()
 		}
 	}
 
-	// COOP
-	if (_game->getCoopMod()->getCoopStatic() == true && _game->getCoopMod()->getCurrentTurn() == 2)
+	// COOP. A parallel CLIENT never sends it: `action_click` is a command to the
+	// peer ("run this action"), which is exactly what `action_intent` replaced -
+	// the client's melee/prime confirm ships an intent from
+	// BattlescapeGame::handleNonTargetAction() instead.
+	if (_game->getCoopMod()->getCoopStatic() == true && _game->getCoopMod()->getCurrentTurn() == 2
+		&& !connectionTCP::parallelInputBlocked())
 	{
 		Json::Value obj;
 		obj["state"] = "action_click";
diff --git a/src/Battlescape/BattlescapeGame.cpp b/src/Battlescape/BattlescapeGame.cpp
index 9764d7c1c..7f3cfb6e5 100644
--- a/src/Battlescape/BattlescapeGame.cpp
+++ b/src/Battlescape/BattlescapeGame.cpp
@@ -33,6 +33,7 @@
 #include "../Savegame/BattleItem.h"
 #include "../Savegame/BattleUnit.h"
 #include "../Savegame/BattleUnitStatistics.h"
+#include "../Savegame/Node.h" // coop (Phase 2b atomic unit death): node danger marking
 #include "../Savegame/SavedBattleGame.h"
 #include "../Savegame/SavedGame.h"
 #include "../Savegame/Tile.h"
@@ -58,13 +59,25 @@
 #include "UnitPanicBState.h"
 #include "UnitTurnBState.h"
 #include "UnitWalkBState.h"
+#include <algorithm> // coop (Phase 2b atomic unit death): hiddenItemIds diff
 #include <sstream>
 
 #include "../CoopMod/connectionTCP.h"
+#include "../CoopMod/SharedEcon.h" // coop (PRD-P4): Tier-A spawn id-manifest
+#include <atomic> // coop (Phase 2c): g_deathGhostDisable RED lever
 
 namespace OpenXcom
 {
 
+// coop (parallel battlescape Phase 2c - death ghost, TEST-ONLY RED lever): defined in
+// connectionTCP.cpp. ON = coopQueueDeathGhost reverts to the Phase-2b stub (instant
+// complete, no animation) so the same build can reproduce the pre-ghost behaviour.
+extern std::atomic<bool> g_deathGhostDisable;
+// coop (wire-order report alignment, Increment 3 / A2): the master lever, file-scope in
+// connectionTCP.cpp; extern-declared here (matching TestServer) to route the parallel
+// client's melee receiver-park into the display-side copy without a connectionTCP.h churn.
+extern std::atomic<bool> g_wireOrderState;
+
 bool BattlescapeGame::_debugPlay = false;
 
 // coop
@@ -175,6 +188,26 @@ bool BattleActionCost::spendTU(std::string* message)
 	return false;
 }
 
+/**
+ * Builds the action a REPLAYED (peer- or AI-originated) chain runs on.
+ *
+ * coop, PRD-P1: the replay handlers used to mutate BattlescapeGame::_currentAction
+ * - the singleton that belongs to the LOCAL player's cursor, hands panel and
+ * click handling - and to setSelectedUnit() the remote actor on top of it. The
+ * passive player's selection, stat panel and cursor were therefore driven by
+ * whatever the teammate was doing. The BStates copy the action they are given
+ * (BattleState.h:33), so a stack-local carries the replay end to end.
+ */
+BattleAction BattlescapeGame::makeReplayAction(BattleUnit* actor)
+{
+	BattleAction action;
+	action.actor = actor;
+	// coop (PRD-P5): mark the chain as replayed so display-only code (camera
+	// follow) can tell it from the local player's own action.
+	action.coopReplay = true;
+	return action;
+}
+
 void BattlescapeGame::movePlayerTarget(std::string obj_str)
 {
 
@@ -268,28 +301,38 @@ void BattlescapeGame::movePlayerTarget(std::string obj_str)
 	}
 
 	// other
-	_save->setSelectedUnit(unit);
-	_currentAction.actor = unit;
-	_currentAction.type = BA_WALK;
+	// coop (PRD-P1): replay on a stack-local action - no setSelectedUnit(), no
+	// write to the local player's _currentAction.
+	BattleAction action = makeReplayAction(unit);
+	action.type = BA_WALK;
 
-	_currentAction.targeting = false;
+	action.targeting = false;
 
-	_currentAction.target = *endpos;
+	action.target = *endpos;
 
 	// new
-	_currentAction.strafe = strafe;
-	_currentAction.run = run;
-	_currentAction.sneak = sneak;
+	action.strafe = strafe;
+	action.run = run;
+	action.sneak = sneak;
 
-	if (_save->getBattleGame()->getCoopMod()->_clientPanicHandle == true || _save->getBattleGame()->getCoopMod()->_isActiveAISync == true)
+	// coop (PRD-P1): the AI phase keeps centring unconditionally; the peer-side
+	// follow is the one the player can now switch off (default ON = pre-P1
+	// behaviour).
+	if ((_save->getBattleGame()->getCoopMod()->_clientPanicHandle == true && Options::coopFollowPeerActions)
+		|| _save->getBattleGame()->getCoopMod()->_isActiveAISync == true)
 	{
 
-		getMap()->getCamera()->centerOnPosition(_currentAction.actor->getPosition());
+		getMap()->getCamera()->centerOnPosition(action.actor->getPosition());
 	}
 
-	_save->getPathfinding()->calculate(_currentAction.actor, _currentAction.target, _currentAction.getMoveType());
+	// coop (PRD-P1): calculate() below replaces the pathfinder's path, which is
+	// what the LOCAL player's hover preview was drawn from. Drop the preview while
+	// the old path is still around to unmark, otherwise its tiles stay lit.
+	_save->getPathfinding()->removePreview();
 
-	statePushBack(new UnitWalkBState(this, _currentAction));
+	_save->getPathfinding()->calculate(action.actor, action.target, action.getMoveType());
+
+	statePushBack(new UnitWalkBState(this, action));
 
 	bool sound = true;
 
@@ -297,7 +340,7 @@ void BattlescapeGame::movePlayerTarget(std::string obj_str)
 	if (_save->getBattleGame()->getCoopMod()->getCoopGamemode() == 2 || _save->getBattleGame()->getCoopMod()->getCoopGamemode() == 3)
 	{
 
-		if (_currentAction.sneak == true)
+		if (action.sneak == true)
 		{
 			sound = false;
 		}
@@ -305,7 +348,7 @@ void BattlescapeGame::movePlayerTarget(std::string obj_str)
 
 	if (sound == true && connectionTCP::_enable_other_player_footsteps == true)
 	{
-		playUnitResponseSound(_currentAction.actor, 1); // "start moving" sound
+		playUnitResponseSound(action.actor, 1); // "start moving" sound
 	}
 }
 
@@ -388,25 +431,31 @@ void BattlescapeGame::turnPlayerTarget(std::string obj_str)
 	unit->setCoopMana(mana);
 
 	// other
-	_save->setSelectedUnit(unit);
-	_currentAction.actor = unit;
-	_currentAction.type = BA_TURN;
+	// coop (PRD-P1): replay on a stack-local action - no setSelectedUnit(), no
+	// write to the local player's _currentAction.
+	BattleAction action = makeReplayAction(unit);
+	action.type = BA_TURN;
 
 	if (isActionTypeNone == true)
 	{
-		_currentAction.type = BA_NONE;
+		action.type = BA_NONE;
 	}
 
-	_currentAction.targeting = false;
+	action.targeting = false;
 
 	bool isUnitAlreadyTurn = false;
 
-	if (_currentAction.target == *endpos)
+	// coop (PRD-P1): the "already facing there => this is a door-open, not a
+	// turn" test compares against the previous REPLAYED turn target. It used to
+	// read _currentAction.target, which only held that value because the replay
+	// wrote the singleton; _replayTurnTarget keeps it on the replay's own side.
+	if (_replayTurnTarget == *endpos)
 	{
 		isUnitAlreadyTurn = true;
 	}
 
-	_currentAction.target = *endpos;
+	action.target = *endpos;
+	_replayTurnTarget = *endpos;
 
 	if (isUnitAlreadyTurn == false)
 	{
@@ -414,13 +463,13 @@ void BattlescapeGame::turnPlayerTarget(std::string obj_str)
 		// above (setTimeUnits), so replay the turn for animation only,
 		// without charging again (chargeTUs = false). Charging here would
 		// double the turn cost on the client.
-		statePushFront(new UnitTurnBState(this, _currentAction, false));
+		statePushFront(new UnitTurnBState(this, action, false));
 	}
 	// door fix
 	else
 	{
 
-		if (_currentAction.type == BA_NONE)
+		if (action.type == BA_NONE)
 		{
 			// try to open a door
 			int door = _save->getTileEngine()->unitOpensDoor(unit, true);
@@ -434,7 +483,10 @@ void BattlescapeGame::turnPlayerTarget(std::string obj_str)
 			}
 			if (door == 4)
 			{
-				_currentAction.result = "STR_NOT_ENOUGH_TIME_UNITS";
+				// coop (PRD-P1): stays on the replay's own action. It used to be
+				// parked on _currentAction, where the LOCAL player's next
+				// non-target action popped it as a spurious warning.
+				action.result = "STR_NOT_ENOUGH_TIME_UNITS";
 			}
 		}
 	}
@@ -474,7 +526,16 @@ void BattlescapeGame::turnPlayerTargetAfter(std::string obj_str)
 	if (found_unit == false)
 		return;
 
-	unit->abortTurn();
+	// coop (PRD-P9 soak finding): never resurrect. abortTurn() writes
+	// STATUS_STANDING, so a facing correction that lands AFTER the executor's
+	// `unit_death` (the packets are independent and the death is sent from
+	// UnitDieBState::init, mid-chain) put a corpse back on its feet: dead on
+	// the executor, standing on 0 HP here, for the rest of the battle. The
+	// facing itself is still applied - a corpse has one.
+	if (!unit->isOut())
+	{
+		unit->abortTurn();
+	}
 	unit->setFaceDirection(setFaceDirection);
 	unit->setDirection(setDirection);
 
@@ -549,33 +610,40 @@ void BattlescapeGame::psi_attack(std::string obj_str)
 	unit->setCoopMana(mana);
 
 	// other
-	_save->setSelectedUnit(unit);
-	_currentAction.actor = unit;
-	_currentAction.targeting = false;
-	_currentAction.target = *endpos;
-	_currentAction.type = (BattleActionType)type;
+	// coop (PRD-P1): replay on a stack-local action - no setSelectedUnit(), no
+	// write to the local player's _currentAction.
+	BattleAction action = makeReplayAction(unit);
+	action.targeting = false;
+	action.target = *endpos;
+	action.type = (BattleActionType)type;
 
 	// coop (issue #74): resolve the actor's OWN weapon and never fabricate one -
 	// a receiver-side `new BattleItem` bumps this machine's item-id counter and
 	// permanently drifts the two machines' id spaces apart.
-	_currentAction.weapon = coopResolveWeapon(_save, unit, weapon_id, weapon_type, hand);
+	action.weapon = coopResolveWeapon(_save, unit, weapon_id, weapon_type, hand);
 
-	if (_currentAction.weapon && _currentAction.weapon == unit->getLeftHandWeapon())
+	if (action.weapon && action.weapon == unit->getLeftHandWeapon())
 	{
 		unit->setActiveLeftHand();
 	}
-	else if (_currentAction.weapon && _currentAction.weapon == unit->getRightHandWeapon())
+	else if (action.weapon && action.weapon == unit->getRightHandWeapon())
 	{
 		unit->setActiveRightHand();
 	}
 
 	// if weapon is not null
-	if (_currentAction.weapon)
+	if (action.weapon)
 	{
 
-		_currentAction.updateTU();
+		action.updateTU();
 
-		statePushBack(new PsiAttackBState(this, _currentAction));
+		statePushBack(new PsiAttackBState(this, action));
+	}
+	else
+	{
+		Log(LOG_INFO) << "coop: psi_attack replay skipped, unit " << unit_id
+					  << " has no '" << weapon_type << "' (id " << weapon_id
+					  << ") - never fabricating one (issue #74)";
 	}
 }
 
@@ -643,6 +711,14 @@ void BattlescapeGame::melee_attack(std::string obj_str)
 		}
 	}
 
+	// coop: every sibling replay handler has this guard; without it an unknown
+	// unit id (a unit this machine has already removed) dereferences null.
+	if (found_unit == false)
+	{
+		Log(LOG_INFO) << "coop: melee_attack replay skipped, no local unit " << unit_id;
+		return;
+	}
+
 	unit->setPosition(*startpos);
 
 	// stats
@@ -653,33 +729,59 @@ void BattlescapeGame::melee_attack(std::string obj_str)
 	unit->setCoopMana(mana);
 
 	// other
-	_save->setSelectedUnit(unit);
-	_currentAction.actor = unit;
-	_currentAction.targeting = false;
-	_currentAction.target = *endpos;
-	_currentAction.type = (BattleActionType)type;
+	// coop (PRD-P1): replay on a stack-local action - no setSelectedUnit(), no
+	// write to the local player's _currentAction.
+	BattleAction action = makeReplayAction(unit);
+	action.targeting = false;
+	action.target = *endpos;
+	action.type = (BattleActionType)type;
 
 	// coop (issue #74): resolve the actor's OWN weapon and never fabricate one -
 	// a receiver-side `new BattleItem` bumps this machine's item-id counter and
 	// permanently drifts the two machines' id spaces apart.
-	_currentAction.weapon = coopResolveWeapon(_save, unit, weapon_id, weapon_type, hand);
+	action.weapon = coopResolveWeapon(_save, unit, weapon_id, weapon_type, hand);
 
-	if (_currentAction.weapon && _currentAction.weapon == unit->getLeftHandWeapon())
+	if (action.weapon && action.weapon == unit->getLeftHandWeapon())
 	{
 		unit->setActiveLeftHand();
 	}
-	else if (_currentAction.weapon && _currentAction.weapon == unit->getRightHandWeapon())
+	else if (action.weapon && action.weapon == unit->getRightHandWeapon())
 	{
 		unit->setActiveRightHand();
 	}
 
 	// if weapon is not null
-	if (_currentAction.weapon)
+	if (action.weapon)
 	{
 
-		_currentAction.updateTU();
+		action.updateTU();
+
+		// coop (PRD-P3 GAP-4b): the to-hit roll is the SENDER's. Park it so this
+		// machine's TileEngine::meleeAttack replays it instead of rolling its own
+		// - two independent rolls meant one machine landed a hit the other
+		// missed, and from there the two hit streams no longer lined up at all.
+		// Parked only once the attack is definitely going to run, so a skipped
+		// replay cannot leave an orphan entry to poison the next melee.
+		if (obj.isMember("hit"))
+		{
+			// coop (wire-order Increment 3 / A2): lever-on the parallel client parks into
+			// the display-side copy (consumed by its display replay) so next_turn's
+			// state-half clear of the canonical queue cannot starve a still-queued replay.
+			// Lever-off / host: canonical queue, byte-identical.
+			if (g_wireOrderState.load(std::memory_order_relaxed)
+				&& connectionTCP::parallelTurnActive() && !connectionTCP::getHost())
+				getCoopMod()->_meleeResultsDisplay.push_back(obj["hit"].asBool() ? 1 : 0);
+			else
+				getCoopMod()->_meleeResults.push_back(obj["hit"].asBool() ? 1 : 0);
+		}
 
-		statePushBack(new MeleeAttackBState(this, _currentAction));
+		statePushBack(new MeleeAttackBState(this, action));
+	}
+	else
+	{
+		Log(LOG_INFO) << "coop: melee_attack replay skipped, unit " << unit_id
+					  << " has no '" << weapon_type << "' (id " << weapon_id
+					  << ") - never fabricating one (issue #74)";
 	}
 }
 
@@ -690,8 +792,9 @@ connectionTCP* BattlescapeGame::getCoopMod()
 
 void BattlescapeGame::setCoopTaskCompleted(bool task)
 {
-
-	_parentState->getGame()->getCoopMod()->_coop_task_completed = task;
+	// coop (PRD-P6 pre-task): now an acquire/release on a depth counter, not a
+	// bool store. Callers are unchanged - false still means "my chain started".
+	_parentState->getGame()->getCoopMod()->setCoopTaskCompleted(task);
 }
 
 int BattlescapeGame::getCoopActorID()
@@ -859,10 +962,534 @@ void BattlescapeGame::sendPacketData(std::string data)
 
 void BattlescapeGame::coopDeath(BattleUnit* unit, const RuleDamageType* damageType, bool noSound)
 {
+	// coop (parallel Phase 3, Sub-task D): coopDeath is only ever reached from the
+	// legacy unit_death packet handler (connectionTCP.cpp), which never runs in
+	// parallel mode - the host ships unit_casualty instead and the client applies
+	// it atomically (BattlescapeGame::coopApplyCasualty). Should be unreachable
+	// here; warn defensively if it is ever entered anyway. Behaviour unchanged.
+	if (connectionTCP::parallelTurnActive() && !getCoopMod()->getHost())
+	{
+		Log(LOG_WARNING) << "coop: coopDeath entered in parallel mode (should be unreachable - unit_casualty path owns death)";
+	}
+
+	// coop (PRD-P10): from here until convertUnitToCorpse runs, any BT_CORPSE item
+	// this unit owns is an OLDER one (the body item of a knockout), so the
+	// id-manifest's remap-in-place path must not claim it. See
+	// SharedEcon::noteCorpseReplayPending.
+	if (unit)
+	{
+		SharedEcon::noteCorpseReplayPending(unit->getId());
+	}
 
 	statePushNext(new UnitDieBState(this, unit, damageType, noSound, true));
 }
 
+/**
+ * coop (item 3, mint-at-apply): the world-mutating half of turning a dead unit into
+ * a corpse - identical to the body of UnitDieBState::convertUnitToCorpse minus the
+ * resetUiButton() presentation call (which stays on the animation clock). Extracted
+ * so the parallel replay client can run it at the after_unit_death packet apply
+ * (host manifest ids adopted at create by the CoopSubjectGuard below) rather than on
+ * its own animation clock, where the corpse mint straddled the chain's action_end
+ * sync-check hash. On the host and a classic client this runs from the animation as
+ * before, byte-identical.
+ */
+void BattlescapeGame::coopMintCorpse(BattleUnit* unit, bool overKill)
+{
+	Position lastPosition = unit->getPosition();
+	int size = unit->getArmor()->getSize();
+	bool dropItems = (unit->hasInventory() &&
+		(!Options::weaponSelfDestruction ||
+		(unit->getOriginalFaction() != FACTION_HOSTILE || unit->getStatus() == STATUS_UNCONSCIOUS)));
+
+	// coop (PRD-P10): the replay has reached its corpse creation, so the parked
+	// manifest is now unambiguously about the corpse the loop below mints. Cleared
+	// BEFORE removeUnconsciousBodyItem so the two can never be confused again.
+	SharedEcon::clearCorpseReplayPending(unit->getId());
+
+	// remove the unconscious body item corresponding to this unit, and if it was being carried, keep track of what slot it was in
+	if (lastPosition != TileEngine::invalid)
+	{
+		getSave()->removeUnconsciousBodyItem(unit);
+	}
+
+	// move inventory from unit to the ground
+	// coop (Phase 2a unit_casualty): capture whether itemDropInventory actually ran
+	// - this is the literal "spill" fact, NOT a mode-derived guess. It can be true
+	// even on an overKill-on-tile mint (mode 2, applyGravity below): dropItems &&
+	// getTile() does not consult overKill, so the inventory can still spill before
+	// the corpse decision runs.
+	bool coopSpill = (dropItems && unit->getTile());
+	if (coopSpill)
+	{
+		getTileEngine()->itemDropInventory(unit->getTile(), unit);
+	}
+	_coopCorpseMintSpill = coopSpill;
+
+	// remove unit-tile link
+	unit->setTile(nullptr, getSave());
+
+	if (lastPosition == TileEngine::invalid) // we're being carried
+	{
+		if (overKill)
+		{
+			getSave()->removeUnconsciousBodyItem(unit);
+			// coop (Phase 2a unit_casualty): carried + overKill -> no corpse.
+			_coopCorpseMintMode = 2;
+			_coopCorpseMintCarrierId = -1;
+		}
+		else
+		{
+			// replace the unconscious body item with a corpse in the carrying unit's inventory
+			for (auto* bi : *getSave()->getItems())
+			{
+				if (bi->getUnit() == unit)
+				{
+					auto* corpseRules = unit->getArmor()->getCorpseBattlescape()[0]; // we're in an inventory, so we must be a 1x1 unit
+					bi->convertToCorpse(corpseRules);
+					// coop (Phase 2a unit_casualty): carried convert - the body item
+					// id that was converted in place is the "corpse" this casualty
+					// produced (convertToCorpse reuses the existing item's id).
+					_coopCorpseMintMode = 1;
+					_coopCorpseMintCarrierId = bi->getId();
+					break;
+				}
+			}
+		}
+	}
+	else
+	{
+		if (!overKill)
+		{
+			// coop (PRD-P4): a Tier-A spawn. The corpse SET is deterministic (the
+			// armor's corpse list, size^2 of them) so both machines create the same
+			// items - but each mints its own ids off its own counter, and once those
+			// disagree every later id-keyed packet lands on the wrong instance. Only
+			// one of these two is ever live: the record on the host (its ids ride
+			// `after_unit_death`), the guard on the peer.
+			SharedEcon::CoopSpawnRecord coopRec("corpse", unit->getId());
+			SharedEcon::CoopSubjectGuard coopGuard(getSave(), "corpse", unit->getId());
+			int i = size * size - 1;
+			for (int y = size - 1; y >= 0; --y)
+			{
+				for (int x = size - 1; x >= 0; --x)
+				{
+					BattleItem *corpse = getSave()->createItemForTile(unit->getArmor()->getCorpseBattlescape()[i], nullptr, unit);
+					dropItem(lastPosition + Position(x,y,0), corpse, false);
+					--i;
+				}
+			}
+			// coop (Phase 2a unit_casualty): on-tile mint - the minted-ids manifest
+			// (SharedEcon::flushSpawnRecord) is the id list; this is just the mode tag.
+			_coopCorpseMintMode = 0;
+			_coopCorpseMintCarrierId = -1;
+		}
+		else
+		{
+			getSave()->getTileEngine()->applyGravity(getSave()->getTile(lastPosition));
+			// coop (Phase 2a unit_casualty): on-tile + overKill -> no corpse.
+			_coopCorpseMintMode = 2;
+			_coopCorpseMintCarrierId = -1;
+		}
+	}
+}
+
+/**
+ * coop (parallel battlescape Phase 2b - atomic unit death): the CLIENT-side
+ * atomic apply of a `unit_casualty` packet - the world-mutating half of the split
+ * with connectionTCP.cpp's `unit_casualty` handler (which owns the unit lookup for
+ * the rank-2 state watermark, abortPathCoop, and the bystander-morale apply).
+ *
+ * Every field applied here is either a host absolute (carried on @a obj) or a
+ * deterministic local the host's UnitDieBState ctor/think already ran (node
+ * danger marking, resetTurnsSince/clearVisibleTiles/clearVisibleUnits/
+ * freePatrolTarget, the FOV/lighting recalc) - nothing rolls dice, and nothing
+ * here reads the death ANIMATION (Phase 2c; this phase only queues a STUB ghost
+ * entry that completes immediately - see coopQueueDeathGhost).
+ */
+void BattlescapeGame::coopApplyCasualty(const Json::Value& obj)
+{
+	BattleUnit* unit = nullptr;
+	const int unitId = obj.get("unit_id", -1).asInt();
+	for (auto* candidate : *getSave()->getUnits())
+	{
+		if (candidate->getId() == unitId)
+		{
+			unit = candidate;
+			break;
+		}
+	}
+	if (!unit)
+	{
+		Log(LOG_INFO) << "coop (Phase 2b unit_casualty): apply skipped, no local unit " << unitId;
+		return;
+	}
+
+	CoopDeathGhost g{};
+	g.unit = unit;
+
+	// step 2: the pre-death facing, captured BEFORE it is overwritten below - the
+	// (Phase 2c) death pirouette starts from here.
+	g.dirBeforeApply = unit->getDirection();
+
+	// step 4: host-absolute stats.
+	unit->setHealth(obj.get("health", 0).asInt());
+	unit->setStunlevelCoop(obj.get("stunlevel", 0).asInt());
+	unit->setCoopEnergy(obj.get("energy", 0).asInt());
+	unit->setCoopMorale(obj.get("morale", 0).asInt());
+	unit->setCoopMana(obj.get("mana", 0).asInt());
+	unit->setTimeUnits(obj.get("tu", 0).asInt());
+
+	if (obj.isMember("fatalWounds"))
+	{
+		const Json::Value& fatalArray = obj["fatalWounds"];
+		for (int part = 0; part < BODYPART_MAX && part < (int)fatalArray.size(); ++part)
+		{
+			unit->setFatalWoundCoop(part, fatalArray[part].asInt());
+		}
+	}
+	if (obj.isMember("armor"))
+	{
+		// coop (PRD-I3 saveBlob close): mirrors the hit_unit apply (connectionTCP.cpp).
+		const Json::Value& armorArr = obj["armor"];
+		for (int side = 0; side < SIDE_MAX && side < (int)armorArr.size(); ++side)
+		{
+			unit->setArmor(armorArr[side].asInt(), (UnitSide)side);
+		}
+	}
+
+	unit->setMotionPointsCoop(obj.get("motionpoints", 0).asInt());
+	unit->setRespawn(obj.get("respawn", false).asBool());
+	unit->setDirection(obj.get("dir", unit->getDirection()).asInt());
+	unit->setFaceDirection(obj.get("faceDir", unit->getFaceDirection()).asInt());
+
+	if (obj.isMember("pos") && obj["pos"].size() >= 3)
+	{
+		const Json::Value& posArr = obj["pos"];
+		const int px = posArr[0].asInt();
+		const int py = posArr[1].asInt();
+		const int pz = posArr[2].asInt();
+		if (unit->getPosition().x != px || unit->getPosition().y != py || unit->getPosition().z != pz)
+		{
+			teleport(px, py, pz, unit);
+		}
+	}
+
+	// step 5: the host's kill ATTRIBUTION - mirrors the legacy unit_death handler
+	// (connectionTCP.cpp) exactly: additive, present-gated, never re-derived here.
+	if (obj.isMember("killedBy"))
+	{
+		unit->killedBy((UnitFaction)obj["killedBy"].asInt());
+	}
+	if (obj.isMember("murdererId"))
+	{
+		unit->setMurdererId(obj["murdererId"].asInt());
+	}
+
+	// step 6: the deterministic locals UnitDieBState's ctor ran.
+	unit->resetTurnsSince();
+	unit->clearVisibleTiles();
+	unit->clearVisibleUnits();
+	unit->freePatrolTarget();
+
+	// step 6b: node danger marking (UnitDieBState ctor, host-side) - hashed via the
+	// save blob, so the parallel client must reproduce it exactly. Uses the unit's
+	// position AFTER the teleport above (= the host's ctor position).
+	if (!getSave()->isBeforeGame() && unit->getFaction() == FACTION_HOSTILE)
+	{
+		std::vector<Node*>* nodes = getSave()->getNodes();
+		if (nodes)
+		{
+			for (auto* node : *nodes)
+			{
+				if (!node->isDummy() && Position::distanceSq(node->getPosition(), unit->getPosition()) < 4)
+				{
+					node->setType(node->getType() | Node::TYPE_DANGEROUS);
+				}
+			}
+		}
+	}
+
+	// step 7: capture the PRE-death status, THEN set the final one. Must precede
+	// step 8 - coopMintCorpse's dropItems test reads getStatus()==STATUS_UNCONSCIOUS.
+	// The host's final health/status already folds in instaKill; never re-derived.
+	g.wasUnconsciousBefore = (unit->getStatus() == STATUS_UNCONSCIOUS);
+	const UnitStatus finalStatus = getCoopMod()->intToUnitstatus(obj.get("status", 0).asInt());
+	unit->setCoopStatus(finalStatus);
+
+	// step 8: the corpse/world mutation, keyed on the host's corpse-mint mode.
+	// mode: 0 = on-tile mint, 1 = carried convert, 2 = overKill/no corpse,
+	// 3 = none (respawn/convert - convertUnit ships its own manifest separately).
+	const int corpseMode = obj["corpse"].get("mode", 3).asInt();
+	switch (corpseMode)
+	{
+	case 0:
+	{
+		Tile* mintTile = unit->getTile();
+		std::vector<int> beforeIds;
+		if (mintTile)
+		{
+			for (auto* bi : *mintTile->getInventory())
+			{
+				beforeIds.push_back(bi->getId());
+			}
+		}
+		SharedEcon::storeSpawnManifest(getSave(), "corpse", unit->getId(), obj);
+		coopMintCorpse(unit, false);
+		if (mintTile)
+		{
+			for (auto* bi : *mintTile->getInventory())
+			{
+				if (std::find(beforeIds.begin(), beforeIds.end(), bi->getId()) == beforeIds.end())
+				{
+					g.hiddenItemIds.push_back(bi->getId());
+				}
+			}
+		}
+		break;
+	}
+	case 1:
+	{
+		coopMintCorpse(unit, false);
+		const int expectedCarrierId = obj["corpse"].get("carrier_item_id", -1).asInt();
+		if (expectedCarrierId >= 0 && coopGetCorpseMintCarrierId() != expectedCarrierId)
+		{
+			Log(LOG_INFO) << "coop (Phase 2b unit_casualty): carried-body carrier id mismatch for unit "
+						  << unit->getId() << " - host " << expectedCarrierId
+						  << " local " << coopGetCorpseMintCarrierId();
+		}
+		break;
+	}
+	case 2:
+		coopMintCorpse(unit, true);
+		break;
+	case 3:
+	default:
+		break;
+	}
+
+	// step 9: the FOV/lighting recalc the host's think() _extraFrame==2 branch ran.
+	g.visibleAtApply = unit->getVisible();
+	getTileEngine()->calculateLighting(LL_ITEMS, unit->getPosition(), unit->getArmor()->getSize());
+	getTileEngine()->calculateFOV(unit->getPosition(), unit->getArmor()->getSize(), false);
+
+	// step 11: clear selection - mirrors UnitDieBState::think()'s clearUnitSelection.
+	getSave()->clearUnitSelection(unit);
+
+	// step 12: finish the ghost entry and queue it (STUB in this phase).
+	g.pos = unit->getPosition();
+	g.size = unit->getArmor()->getSize();
+	g.faction = unit->getFaction();
+	g.finalStatus = finalStatus;
+	g.direct = obj.get("direct", false).asBool();
+	g.noSound = obj.get("noSound", false).asBool();
+	g.bnd = obj.get("bnd", false).asBool();
+	g.sideSeq = static_cast<uint32_t>(obj.get("side_seq", 0).asUInt());
+	g.actionSeq = g.bnd ? UINT32_MAX : static_cast<uint32_t>(obj.get("action_seq", 0).asUInt());
+
+	coopQueueDeathGhost(g);
+}
+
+/**
+ * coop (parallel battlescape Phase 2c - death ghost): queues @a g for the display-only
+ * collapse animation. The world is ALREADY final by the time coopApplyCasualty calls
+ * this (dead, tile-unlinked, corpse minted), so this only records the ghost and seeds
+ * the victim's display OVERRIDE to the pre-death STANDING pose. The unit therefore
+ * keeps drawing standing (via the Map ghost draw, since it is tile-unlinked) until
+ * coopPollDeathGhosts() starts its animation - no blink-out between the atomic apply
+ * and the collapse, and the minted corpse/kit stay hidden (coopIsGhostHiddenItem)
+ * meanwhile. The real _status/_direction/_fallPhase are untouched (only UnitSprite/Map
+ * read the override); completion is counted in coopFinishActiveGhost(), not here.
+ */
+void BattlescapeGame::coopQueueDeathGhost(const CoopDeathGhost& g)
+{
+	// TEST-ONLY RED lever: revert to the Phase-2b stub - complete the ghost at once,
+	// no animation, corpse/kit visible immediately at apply (no override seeded).
+	if (g_deathGhostDisable.load(std::memory_order_relaxed))
+	{
+		++_coopDeathGhostsCompleted;
+		return;
+	}
+	_coopPendingGhosts.push_back(g);
+	if (g.unit)
+	{
+		g.unit->setCoopDisplayOverride(true);
+		g.unit->setCoopDisplayStatus(STATUS_STANDING);
+		g.unit->setCoopDisplayDir(g.dirBeforeApply);
+		g.unit->setCoopDisplayFallPhase(0);
+	}
+}
+
+/**
+ * coop (Phase 2c): start the next queued death ghost when the state queue is idle and
+ * the display has caught up to that death's chain. Boundary (bnd) casualties and ghosts
+ * from a previous side start as soon as the queue drains; a mid-side ghost waits until
+ * the client's display seq reaches the death's action_seq, so the collapse never plays
+ * before the killing shot's animation. One ghost at a time (they serialise like vanilla
+ * UnitDieBStates). A cheap no-op off the parallel client - the queue is only ever
+ * filled by coopApplyCasualty.
+ */
+void BattlescapeGame::coopPollDeathGhosts()
+{
+	if (_coopGhostActive || _coopPendingGhosts.empty() || isBusy())
+	{
+		return;
+	}
+	const CoopDeathGhost& head = _coopPendingGhosts.front();
+	const bool ready = head.bnd
+		|| head.sideSeq != connectionTCP::_sideSeq
+		|| connectionTCP::_clientDisplaySeq >= head.actionSeq;
+	if (!ready)
+	{
+		return;
+	}
+	_coopActiveGhost = head;
+	_coopActiveGhost.started = true;
+	_coopPendingGhosts.erase(_coopPendingGhosts.begin());
+	_coopGhostActive = true;
+	statePushBack(new UnitDieBState(this, &_coopActiveGhost));
+}
+
+/**
+ * coop (Phase 2c): the ghost-mode UnitDieBState calls this on its final frame (the
+ * display override is already cleared by then). Marks the active ghost done so
+ * coopPollDeathGhosts() can start the next one.
+ */
+void BattlescapeGame::coopFinishActiveGhost()
+{
+	_coopGhostActive = false;
+	++_coopDeathGhostsCompleted;
+}
+
+/**
+ * coop (Phase 2c): the active-or-pending ghost whose size-square footprint covers
+ * @a pos, or null. Map draws pending ghosts standing and the active ghost collapsing.
+ */
+const CoopDeathGhost* BattlescapeGame::coopGhostCoveringTile(Position pos) const
+{
+	auto covers = [&](const CoopDeathGhost& g) -> bool
+	{
+		return g.unit
+			&& pos.z == g.pos.z
+			&& pos.x >= g.pos.x && pos.x < g.pos.x + g.size
+			&& pos.y >= g.pos.y && pos.y < g.pos.y + g.size;
+	};
+	if (_coopGhostActive && covers(_coopActiveGhost))
+	{
+		return &_coopActiveGhost;
+	}
+	for (const auto& g : _coopPendingGhosts)
+	{
+		if (covers(g))
+		{
+			return &g;
+		}
+	}
+	return nullptr;
+}
+
+/**
+ * coop (Phase 2c): true if any active/pending ghost hides corpse/kit ids (Map's
+ * item-draw fast path stays on stock getTopItem() otherwise).
+ */
+bool BattlescapeGame::coopHasHiddenGhostItems() const
+{
+	if (_coopGhostActive && !_coopActiveGhost.hiddenItemIds.empty())
+	{
+		return true;
+	}
+	for (const auto& g : _coopPendingGhosts)
+	{
+		if (!g.hiddenItemIds.empty())
+		{
+			return true;
+		}
+	}
+	return false;
+}
+
+/**
+ * coop (Phase 2c): true if @a itemId is a corpse/kit id hidden by any active/pending
+ * ghost (invisible until that unit finishes its collapse).
+ */
+bool BattlescapeGame::coopIsGhostHiddenItem(int itemId) const
+{
+	if (_coopGhostActive)
+	{
+		for (int id : _coopActiveGhost.hiddenItemIds)
+		{
+			if (id == itemId) return true;
+		}
+	}
+	for (const auto& g : _coopPendingGhosts)
+	{
+		for (int id : g.hiddenItemIds)
+		{
+			if (id == itemId) return true;
+		}
+	}
+	return false;
+}
+
+/**
+ * coop (Phase 2c introspection): per-ghost display state (active first, then pending),
+ * for the harness (parallel_state.deathGhosts). status/dir/fallPhase are the DISPLAY
+ * values - so a fixture can assert the exact collapse sequence against getDeathFrames().
+ */
+Json::Value BattlescapeGame::coopDeathGhostsJson()
+{
+	Json::Value arr(Json::arrayValue);
+	auto emit = [&](const CoopDeathGhost& g, bool active)
+	{
+		if (!g.unit) return;
+		Json::Value e;
+		e["unit_id"] = g.unit->getId();
+		e["started"] = g.started;
+		e["active"] = active;
+		e["status"] = getCoopMod()->unitstatusToInt(g.unit->displayStatus());
+		e["dir"] = g.unit->displayDirection();
+		e["fallPhase"] = g.unit->displayFallingPhase();
+		e["direct"] = g.direct;
+		e["bnd"] = g.bnd;
+		e["sideSeq"] = static_cast<Json::UInt>(g.sideSeq);
+		e["actionSeq"] = static_cast<Json::UInt>(g.actionSeq);
+		arr.append(e);
+	};
+	if (_coopGhostActive)
+	{
+		emit(_coopActiveGhost, true);
+	}
+	for (const auto& g : _coopPendingGhosts)
+	{
+		emit(g, false);
+	}
+	return arr;
+}
+
+/**
+ * coop (Phase 2c introspection): the corpse/kit ids currently hidden (active + pending
+ * ghosts), for the harness (battle_state.hiddenItemIds).
+ */
+Json::Value BattlescapeGame::coopHiddenItemIdsJson() const
+{
+	Json::Value arr(Json::arrayValue);
+	if (_coopGhostActive)
+	{
+		for (int id : _coopActiveGhost.hiddenItemIds)
+		{
+			arr.append(id);
+		}
+	}
+	for (const auto& g : _coopPendingGhosts)
+	{
+		for (int id : g.hiddenItemIds)
+		{
+			arr.append(id);
+		}
+	}
+	return arr;
+}
+
 void BattlescapeGame::teleport(int x, int y, int z, BattleUnit* unit)
 {
 
@@ -912,7 +1539,16 @@ BattlescapeGame::BattlescapeGame(SavedBattleGame* save, BattlescapeState* parent
 
 	_debugPlay = false;
 
+	// coop (PRD-P6): a battle starts with a clean arbiter - action/side sequences
+	// at 0 on both machines, no pending intent left over from the last one.
+	connectionTCP::resetActionArbiter(true);
+
+	// coop (chain-atomicity Strand A): battle-start hidden-explosion casualties (UFO power
+	// source etc.) are a boundary-style pass with no admitted chain - keep any death here
+	// seq-0 rather than opening a loose chain at battle init (the arbiter was just reset).
+	coopSetBoundaryCasualty(true);
 	checkForCasualties(nullptr, BattleActionAttack{}, true);
+	coopSetBoundaryCasualty(false);
 	cancelCurrentAction();
 }
 
@@ -926,6 +1562,13 @@ BattlescapeGame::~BattlescapeGame()
 		delete bs;
 	}
 	cleanupDeleted();
+	// coop (parallel battlescape Phase 2c - atomic unit death): drop any queued death
+	// ghosts with the battle. An entry can still be pending/active if a battle ends
+	// mid-collapse (debrief/abort); the units live until SavedBattleGame is destroyed
+	// (outlives this), and the display-override fields are never serialized, so nothing
+	// else needs undoing here.
+	_coopPendingGhosts.clear();
+	_coopGhostActive = false;
 }
 
 /**
@@ -1019,6 +1662,13 @@ int BattlescapeGame::think()
 				// it's a player side && we have not handled all panicking units
 				if (!_playerPanicHandled)
 				{
+					// coop (wire-order Increment 6): flush the pending SIDESTART boundary ring +
+					// marker HERE - post-side-close-drain (_states is empty at this think point),
+					// pre-start-of-turn panic/berserk - so the host ring captures the boundary
+					// state, not a post-boundary panic TU spend. Lever-gated + sidestart-scoped
+					// inside coopFlushSidestartBoundaryEarly; lever-off it is a no-op (the normal
+					// deferred tick flush still ships the marker, byte-identical).
+					connectionTCP::coopFlushSidestartBoundaryEarly();
 
 					_playerPanicHandled = handlePanickingPlayer();
 					_save->getBattleState()->updateSoldierInfo();
@@ -1073,10 +1723,41 @@ void BattlescapeGame::init()
 }
 
 /**
- * Handles the processing of the AI states of a unit.
- * @param unit Pointer to a unit.
- */
-void BattlescapeGame::handleAI(BattleUnit* unit)
+ * coop (PRD-I0): the AI-side admit analogue.
+ *
+ * `_actionSeq` was a PLAYER-side counter: PRD-P6 stamps it where an intent is
+ * admitted, and the alien side ran completely unnumbered - so every divergence
+ * introduced by an AI action could only be attributed to "somewhere in that
+ * side", which for the sync-check means no attribution at all.
+ *
+ * handleAI has no single admit site. It has two: the BA_WALK push, and the attack
+ * block that pushes either a PsiAttackBState or a UnitTurnBState followed by the
+ * melee/projectile state (one chain, one seq). Each is the moment the AI COMMITS
+ * to an action - the exact analogue of the arbiter admitting an intent.
+ * Stamping there rather than around the whole call is deliberate: handleAI also
+ * pushes the end-of-side sentinel, and `statePushBack(0)` on an empty queue runs
+ * BattlescapeGame::endTurn() synchronously (which resets the arbiter), so a stamp
+ * taken after the call would number a chain that does not exist and land in the
+ * wrong side's namespace.
+ *
+ * The chain then closes exactly as a player chain does - the queue drains,
+ * coopChainChanged() ships `action_end`, the client reports `action_done`. None
+ * of that machinery was ever player-side-gated, so nothing had to be ungated.
+ */
+void BattlescapeGame::coopStampAiChain()
+{
+	if (!connectionTCP::parallelTurnActive() || !getHost())
+	{
+		return;
+	}
+	connectionTCP::stampAdmittedAction("ai");
+}
+
+/**
+ * Handles the processing of the AI states of a unit.
+ * @param unit Pointer to a unit.
+ */
+void BattlescapeGame::handleAI(BattleUnit* unit)
 {
 	std::ostringstream ss;
 
@@ -1191,6 +1872,7 @@ void BattlescapeGame::handleAI(BattleUnit* unit)
 		}
 		if (_save->getPathfinding()->getStartDirection() != -1)
 		{
+			coopStampAiChain(); // coop (PRD-I0), before the push - see the helper
 			statePushBack(new UnitWalkBState(this, action));
 		}
 		else if (walkToItem)
@@ -1206,6 +1888,7 @@ void BattlescapeGame::handleAI(BattleUnit* unit)
 		ss << "Attack type=" << action.type << " target=" << action.target << " weapon=" << action.weapon->getRules()->getType();
 		_parentState->debug(ss.str());
 		action.updateTU();
+		coopStampAiChain(); // coop (PRD-I0): one seq for the whole turn+attack chain
 		if (action.type == BA_MINDCONTROL || action.type == BA_PANIC || action.type == BA_USE)
 		{
 			statePushBack(new PsiAttackBState(this, action));
@@ -1261,7 +1944,9 @@ void BattlescapeGame::handleAI(BattleUnit* unit)
 bool BattlescapeGame::kneel(BattleUnit* bu)
 {
 	int tu = bu->getKneelChangeCost();
-	if (bu->getArmor()->allowsKneeling(bu->getType() == "SOLDIER") && !bu->isFloating() && ((!bu->isKneeled() && _save->getKneelReserved()) || checkReservedTU(bu, tu, 0)))
+	// coop (PRD-P8 §5): coopKneelReserveFor() is _save->getKneelReserved() for
+	// every actor but the one whose client-sent intent is running right now.
+	if (bu->getArmor()->allowsKneeling(bu->getType() == "SOLDIER") && !bu->isFloating() && ((!bu->isKneeled() && coopKneelReserveFor(bu)) || checkReservedTU(bu, tu, 0)))
 	{
 		BattleAction kneel;
 		kneel.type = BA_KNEEL;
@@ -1297,6 +1982,28 @@ void BattlescapeGame::endTurn()
 		root["state"] = "endTurn";
 		root["side"] = (int)_save->getSide();
 
+		// coop (PRD-P5 §5): the side-boundary reseed. In classic co-op the RNG seed
+		// rode `PlayerTurnYour`, the mid-side hand-off packet - which parallel mode
+		// deletes. `endTurn` is the packet that replaces it as the side-close event,
+		// so it carries the seed there. Written ONLY in parallel mode and read only
+		// when present, so the classic wire format is untouched.
+		if (connectionTCP::parallelTurnActive())
+		{
+			root["seed"] = static_cast<Json::UInt64>(RNG::getSeed());
+			// coop (GAP-10): mirror the boundary seed into the script-RNG relay so
+			// this host's newTurnUpdateScripts reseeds to the same value it shipped.
+			connectionTCP::_scriptRngSeed = RNG::getSeed();
+
+			// coop (PRD-P6): this packet is the side transition, so it is where
+			// the host advances the staleness token the client stamps on its
+			// intents - and where `_actionSeq` (with PRD-P7's
+			// `peerDisplayAckedSeq`, which must never be reset without it) goes
+			// back to 0 for the new side.
+			++connectionTCP::_sideSeq;
+			root["side_seq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+			connectionTCP::resetActionArbiter(false);
+		}
+
 		getCoopMod()->sendTCPPacketData(root.toStyledString());
 	}
 
@@ -1322,7 +2029,18 @@ void BattlescapeGame::endTurn()
 		bool exploded = false;
 
 		// check for hot grenades on the ground
-		if (_save->getSide() != FACTION_NEUTRAL && !_save->isPreview())
+		// coop (PRD-P3 GAP-9): BattleItem::fuseTimeEvent() ends in
+		// RNG::percent(getSpecialChance()), and a failed roll re-arms or disables the
+		// fuse instead of detonating - so a co-op client rolling for itself could dud
+		// a grenade the host had exploded (or vice versa) and then hold, forever, an
+		// item the host no longer has. `next_turn` repairs stats and tiles, never item
+		// existence. The client makes NO fuse rolls; the host ships the outcome.
+		const bool coopFuseClient = getCoopMod()->getCoopStatic() == true && getCoopMod()->getHost() == false;
+		const bool coopFuseHost = getCoopMod()->getCoopStatic() == true && getCoopMod()->getHost() == true;
+		Json::Value fuseExploded(Json::arrayValue);
+		Json::Value fuseRemoved(Json::arrayValue);
+		Json::Value fuseTimers(Json::arrayValue);
+		if (_save->getSide() != FACTION_NEUTRAL && !_save->isPreview() && !coopFuseClient)
 		{
 			for (BattleItem* item : *_save->getItems())
 			{
@@ -1345,6 +2063,7 @@ void BattlescapeGame::endTurn()
 				}
 				if (tile)
 				{
+					const int fuseBefore = item->getFuseTimer();
 					if (item->fuseTimeEvent())
 					{
 						if (rule->getBattleType() == BT_GRENADE) // it's a grenade to explode now
@@ -1352,12 +2071,21 @@ void BattlescapeGame::endTurn()
 							Position p = tile->getPosition().toVoxel() + Position(8, 8, -tile->getTerrainLevel() + (unit ? unit->getHeight() / 2 : 0));
 							forRemoval.push_back(std::tuple(nullptr, new ExplosionBState(this, p, BattleActionAttack::GetBeforeShoot(BA_TRIGGER_TIMED_GRENADE, unit, item))));
 							exploded = true;
+							fuseExploded.append(item->getId());
 						}
 						else
 						{
 							forRemoval.push_back(std::tuple(item, nullptr));
 						}
 					}
+					else if (coopFuseHost && item->getFuseTimer() != fuseBefore)
+					{
+						// the roll failed: fuseTimeEvent re-armed (BFT_SET) or disabled it
+						Json::Value f;
+						f["id"] = item->getId();
+						f["timer"] = item->getFuseTimer();
+						fuseTimers.append(f);
+					}
 				}
 			}
 			for (auto& p : forRemoval)
@@ -1366,18 +2094,46 @@ void BattlescapeGame::endTurn()
 				ExplosionBState* expl = std::get<ExplosionBState*>(p);
 				if (expl)
 				{
+					expl->coopSetBoundaryExpl(true); // coop (PRD-I3 SEAM-3 a)
 					statePushNext(expl);
 				}
 				else if (item->isSpecialWeapon())
 				{
 					// we can't remove special weapons, disable the fuse at least
 					item->setFuseTimer(-1);
+					if (coopFuseHost)
+					{
+						Json::Value f;
+						f["id"] = item->getId();
+						f["timer"] = -1;
+						fuseTimers.append(f);
+					}
 				}
 				else
 				{
+					if (coopFuseHost)
+					{
+						fuseRemoved.append(item->getId());
+					}
 					_save->removeItem(item);
 				}
 			}
+
+			// coop: one packet per side end, and only when something happened.
+			// Deliberately NOT folded into `next_turn` (PROTOCOL's first sketch):
+			// next_turn only crosses at the START of the player's turn, so a fuse
+			// decided when the PLAYER side ended would not reach the peer until a
+			// whole alien side had run.
+			if (coopFuseHost && (!fuseExploded.empty() || !fuseRemoved.empty() || !fuseTimers.empty()))
+			{
+				Json::Value root;
+				root["state"] = "fuse_events";
+				root["exploded"] = fuseExploded;
+				root["removed"] = fuseRemoved;
+				root["fuses"] = fuseTimers;
+				getCoopMod()->sendTCPPacketData(root.toStyledString());
+			}
+
 			if (exploded)
 			{
 				statePushBack(0);
@@ -1391,7 +2147,9 @@ void BattlescapeGame::endTurn()
 	if (t)
 	{
 		Position p = t->getPosition().toVoxel();
-		statePushNext(new ExplosionBState(this, p, BattleActionAttack{}, t));
+		ExplosionBState* bexpl = new ExplosionBState(this, p, BattleActionAttack{}, t); // coop (PRD-I3 SEAM-3 a)
+		bexpl->coopSetBoundaryExpl(true);
+		statePushNext(bexpl);
 		statePushBack(0);
 		return;
 	}
@@ -1416,7 +2174,9 @@ void BattlescapeGame::endTurn()
 		if (t)
 		{
 			Position p = t->getPosition().toVoxel();
-			statePushNext(new ExplosionBState(this, p, BattleActionAttack{}, t));
+			ExplosionBState* bexpl = new ExplosionBState(this, p, BattleActionAttack{}, t); // coop (PRD-I3 SEAM-3 a)
+			bexpl->coopSetBoundaryExpl(true);
+			statePushNext(bexpl);
 			statePushBack(0);
 			return;
 		}
@@ -1425,6 +2185,27 @@ void BattlescapeGame::endTurn()
 	_triggerProcessed.reset();
 	_endTurnProcessed.reset();
 
+	// coop (PRD-I0): the side-close phase group is done - fuses rolled and shipped
+	// (`fuse_events`), terrain explosions resolved, SavedBattleGame::endTurn() run.
+	// Everything above this line moves state with no admitted chain to attribute it
+	// to, which is why the boundary pseudo-seq exists. Armed rather than sent: the
+	// checkForCasualties() below can still push death chains, and the marker has to
+	// sit behind their packets. Reached only on the FINAL pass through endTurn() -
+	// the explosion paths above return early and re-enter.
+	//
+	// coop (PRD-I3 Option A rider): at the neutral->player transition (getSide() is
+	// now FACTION_PLAYER, having just been advanced by _save->endTurn() above) this
+	// `endturn` marker is REDUNDANT with the `sidestart` marker NextTurnState::close
+	// arms right after `next_turn`, and it would hash BEFORE `next_turn` applies on
+	// the client - violating I0's boundary hash-after-apply semantics at exactly that
+	// transition. Suppress it there; keep it for the side-closes into an alien side
+	// (player->hostile, hostile->neutral), which are NOT followed by `next_turn` and
+	// are the only place the endturn phase group's state can be attributed.
+	if (_save->getSide() != FACTION_PLAYER)
+	{
+		connectionTCP::coopArmSyncBoundary("endturn");
+	}
+
 	if (_save->getSide() == FACTION_PLAYER)
 	{
 		setupCursor();
@@ -1434,7 +2215,16 @@ void BattlescapeGame::endTurn()
 		getMap()->setCursorType(CT_NONE);
 	}
 
+	// coop (chain-atomicity Strand A): the side-close / side-start casualty pass. Deaths
+	// here (bleed-out, decay, fuse/terrain fallout picked up after the explosions) belong
+	// to the boundary, not to a mid-side chain - flag the phase so each UnitDieBState
+	// latches _coopBoundaryDeath and keeps its carriers seq-0 under the ordered endturn/
+	// sidestart marker. For an alien side-close the endturn marker is already armed above
+	// (_pendingBoundaries), but the neutral->player pass suppresses that marker, so the
+	// bracket is what keeps those bleed-out deaths off a loose chain.
+	coopSetBoundaryCasualty(true);
 	checkForCasualties(nullptr, BattleActionAttack{}, false, false);
+	coopSetBoundaryCasualty(false);
 
 	// fires could have been started, stopped or smoke could reveal/conceal units.
 	_save->getTileEngine()->calculateLighting(LL_FIRE, TileEngine::invalid, 0, true);
@@ -1506,6 +2296,42 @@ void BattlescapeGame::endTurn()
  */
 void BattlescapeGame::checkForCasualties(const RuleDamageType* damageType, BattleActionAttack attack, bool hiddenExplosion, bool terrainExplosion)
 {
+	// coop (PRD-I3 SEAM-8): on the parallel non-host client this function runs from a
+	// REPLAYED attack/explosion (ExplosionBState) purely for DISPLAY - the client is a
+	// thin client and must not RE-DECIDE any combat outcome. The victim's post-hit
+	// stats are host absolutes (hit_unit: health/stun/fatalWounds/morale/energy/mana/
+	// tu; BattleUnit::damage() itself already early-returns on any coop client), the
+	// squad-wide bystander morale rides the death packets (bystander_morale, SEAM-4),
+	// and the death is displayed by coopDeath (the UnitDieBState pushed below is a
+	// no-op ctor on the client). So the morale RE-ROLL here (murderer bonus, bystander
+	// loss/gain loop, stun morale) would race those host absolutes and diverge the
+	// per-unit unitsCombat hash. Suppress the morale writes on the parallel client
+	// only; a CLASSIC client replays the attack + runs its own damage(), so it is
+	// untouched and stays byte-identical.
+	//
+	// coop (chain-atomicity item 4, no-reroll authority - dead-vs-live map): MORALE is
+	// the ONLY checkForCasualties write that needs suppressing here. Every other combat
+	// outcome the client could re-decide is already dead on a non-host coop client BEFORE
+	// it can write victim state, so hit_unit / unit_death / after_unit_death are the sole
+	// authority for the strict unitsCombat bucket (kneeled / mind-controller id / w0..w5):
+	//   * health / stun / fatal-wounds / armor : BattleUnit::damage()  early-returns
+	//         (BattleUnit.cpp, `getCoopStatic() && !getHost()`), and TileEngine::hitUnit()
+	//         early-returns ahead of it (TileEngine.cpp) - which also kills the whole
+	//         TileEngine::explode() unit-damage loop and the melee / reaction-fire paths,
+	//         since they ALL reach a unit only through hitUnit(). hit_unit ships the
+	//         victim's post-hit absolutes instead.
+	//   * mind-controller id                   : TileEngine::psiAttack() early-returns
+	//         (non-PvP coop client); the flip rides its own host packet.
+	//   * the kill / knockout DISPOSITION       : the UnitDieBState this function pushes
+	//         below is a no-op ctor on the client (UnitDieBState.cpp, !getHost() &&
+	//         !_coop_death); the death is driven only by unit_death -> coopDeath.
+	// So the audit's "health/stun/wounds re-roll latent" premise does not hold as-built:
+	// that family needs no code, and item 4 is the morale gate below plus this record.
+	// (The residual casualty divergence a mass-casualty soak still shows is unitsCore
+	// liveness + items/itemIdCtr corpse-mint - the death-DISPLAY replay lag, chain-
+	// atomicity item 5 - NOT a re-decide of any unitsCombat value. Regression-locked by
+	// tools/coop_test/test_parallel_no_reroll.py.)
+	const bool coopThinClientNoReroll = connectionTCP::parallelTurnActive() && !getHost();
 	BattleUnit* origMurderer = attack.attacker;
 	// If the victim was killed by the murderer's death explosion, fetch who killed the murderer and make HIM the murderer!
 	if (origMurderer && (origMurderer->getSpecialAbility() == SPECAB_EXPLODEONDEATH || origMurderer->getSpecialAbility() == SPECAB_BURN_AND_EXPLODE) && origMurderer->getStatus() == STATUS_DEAD && origMurderer->getMurdererId() != 0)
@@ -1657,29 +2483,29 @@ void BattlescapeGame::checkForCasualties(const RuleDamageType* damageType, Battl
 					if ((victim->getOriginalFaction() == FACTION_PLAYER && murderer->getFaction() == FACTION_HOSTILE) ||
 						(victim->getOriginalFaction() == FACTION_HOSTILE && murderer->getFaction() == FACTION_PLAYER))
 					{
-						murderer->moraleChange(20 * modifier / 100);
+						if (!coopThinClientNoReroll) murderer->moraleChange(20 * modifier / 100);
 					}
 					// murderer will get a penalty with friendly fire
 					if (victim->getOriginalFaction() == murderer->getOriginalFaction())
 					{
 						// morale loss by friendly fire
-						murderer->moraleChange(-(2000 * moraleLossModifierWhenKilled / modifier / 100));
+						if (!coopThinClientNoReroll) murderer->moraleChange(-(2000 * moraleLossModifierWhenKilled / modifier / 100));
 					}
 					if (victim->getOriginalFaction() == FACTION_NEUTRAL)
 					{
 						if (murderer->getOriginalFaction() == FACTION_PLAYER)
 						{
 							// morale loss by xcom killing civilians
-							murderer->moraleChange(-(1000 * moraleLossModifierWhenKilled / modifier / 100));
+							if (!coopThinClientNoReroll) murderer->moraleChange(-(1000 * moraleLossModifierWhenKilled / modifier / 100));
 						}
 						else
 						{
-							murderer->moraleChange(10);
+							if (!coopThinClientNoReroll) murderer->moraleChange(10);
 						}
 					}
 				}
 
-				if (victim->getFaction() != FACTION_NEUTRAL)
+				if (victim->getFaction() != FACTION_NEUTRAL && !coopThinClientNoReroll)
 				{
 					int modifier = _save->getUnitMoraleModifier(victim);
 					int loserMod = _save->getFactionMoraleModifier(victim->getOriginalFaction() != FACTION_HOSTILE);
@@ -1750,7 +2576,7 @@ void BattlescapeGame::checkForCasualties(const RuleDamageType* damageType, Battl
 			else if (victim->getStunlevel() >= victim->getHealth() && victim->getStatus() != STATUS_UNCONSCIOUS)
 			{
 				// morale change when an enemy is stunned (only for the first time!)
-				if (getMod()->getStunningImprovesMorale() && murderer && !victim->getStatistics()->wasUnconcious)
+				if (getMod()->getStunningImprovesMorale() && murderer && !victim->getStatistics()->wasUnconcious && !coopThinClientNoReroll)
 				{
 					if ((victim->getOriginalFaction() == FACTION_PLAYER && murderer->getFaction() == FACTION_HOSTILE) ||
 						(victim->getOriginalFaction() == FACTION_HOSTILE && murderer->getFaction() == FACTION_PLAYER))
@@ -1758,137 +2584,852 @@ void BattlescapeGame::checkForCasualties(const RuleDamageType* damageType, Battl
 						// the murderer gets a morale bonus if he is of a different faction (excluding neutrals)
 						murderer->moraleChange(20);
 
-						for (auto* winner : *_save->getUnits())
-						{
-							if (!winner->isOut() && winner->getOriginalFaction() == murderer->getOriginalFaction())
-							{
-								// the winning squad gets a morale increase (the losing squad is NOT affected)
-								winner->moraleChange(10);
-							}
-						}
-					}
-				}
+						for (auto* winner : *_save->getUnits())
+						{
+							if (!winner->isOut() && winner->getOriginalFaction() == murderer->getOriginalFaction())
+							{
+								// the winning squad gets a morale increase (the losing squad is NOT affected)
+								winner->moraleChange(10);
+							}
+						}
+					}
+				}
+
+				victim->getStatistics()->wasUnconcious = true;
+				noSound = true;
+				statePushNext(new UnitDieBState(this, victim, getMod()->getDamageType(DT_NONE), noSound)); // no damage type used there
+			}
+			else
+			{
+				// piggyback of cleanup after script that change move type
+				if (victim->haveNoFloorBelow() && victim->getMovementType() != MT_FLY)
+				{
+					_save->addFallingUnit(victim);
+				}
+			}
+		}
+	}
+
+	BattleUnit* bu = _save->getSelectedUnit();
+	if (_save->getSide() == FACTION_PLAYER)
+	{
+		_parentState->resetUiButton();
+
+		if (bu && !bu->isOut())
+		{
+			_parentState->updateUiButton(bu);
+		}
+	}
+}
+
+/**
+ * Shows the infoboxes in the queue (if any).
+ */
+void BattlescapeGame::showInfoBoxQueue()
+{
+	for (auto* infoboxOKState : _infoboxQueue)
+	{
+		_parentState->getGame()->pushState(infoboxOKState);
+	}
+
+	_infoboxQueue.clear();
+}
+
+/**
+ * Sets up a mission complete notification.
+ */
+void BattlescapeGame::missionComplete()
+{
+	Game* game = _parentState->getGame();
+	if (game->getMod()->getDeployment(_save->getMissionType()))
+	{
+		std::string missionComplete = game->getMod()->getDeployment(_save->getMissionType())->getObjectivePopup();
+		if (!missionComplete.empty())
+		{
+			// coop
+			if ((game->getCoopMod()->getCoopStatic() == true && game->getCoopMod()->getHost() == true) || game->getCoopMod()->getCoopStatic() == false)
+				_infoboxQueue.push_back(new InfoboxOKState(game->getLanguage()->getString(missionComplete)));
+		}
+	}
+}
+
+/**
+ * Handles the result of non target actions, like priming a grenade.
+ */
+// ===========================================================================
+// coop (PRD-P6): action intents - the client asks, the host executes.
+// ===========================================================================
+
+/// Serializes an action as the body of an `action_intent`; defined below.
+static Json::Value coopBuildIntent(BattlescapeGame* game, SavedBattleGame* save, const BattleAction& action, const std::string& kind);
+
+/**
+ * THE executor's entry point for a player-initiated action.
+ *
+ * Factored out of the local-input tails (mapClick's move/turn/shot branches, the
+ * kneel button, handleNonTargetAction's prime/melee, the medikit presses) so the
+ * host's own clicks and a client's `action_intent` run identical code. On the
+ * host `_isActivePlayerSync` is true (the PRD-P5 executor invariant), so every
+ * chain pushed here broadcasts through the existing BState send sites and the
+ * client displays it exactly as it displays a host action in classic co-op.
+ *
+ * The kinds that have NO BattleState of their own (kneel, prime, medikit) mutate
+ * synchronously and therefore ship their classic replay packet from here - the
+ * UI handler that used to send it is not on this path.
+ */
+void BattlescapeGame::executeAction(BattleAction &action, bool calculatePath)
+{
+	if (!action.actor)
+	{
+		return;
+	}
+
+	// handleNonTargetAction() clears the type on its way out, so remember it.
+	const BattleActionType type = action.type;
+
+	switch (type)
+	{
+	case BA_WALK:
+		if (calculatePath)
+		{
+			_save->getPathfinding()->calculate(action.actor, action.target, action.getMoveType());
+		}
+		statePushBack(new UnitWalkBState(this, action));
+		break;
+
+	case BA_TURN:
+	{
+		// BA_TURN is the INTENT's dispatch key, not a BattleAction type
+		// UnitTurnBState understands: it reads `_action.type == BA_NONE` to decide
+		// whether this turn also opens a door (UnitTurnBState.cpp:155) and whether
+		// a newly spotted unit interrupts it (:199). A right-click turn is a
+		// BA_NONE turn, so that is what the state must be handed.
+		BattleAction turn = action;
+		turn.type = BA_NONE;
+		statePushBack(new UnitTurnBState(this, turn));
+		break;
+	}
+
+	case BA_KNEEL:
+		kneel(action.actor);
+		coopSendKneelPacket(action.actor);
+		break;
+
+	case BA_THROW:
+	case BA_SNAPSHOT:
+	case BA_AUTOSHOT:
+	case BA_AIMEDSHOT:
+	case BA_LAUNCH:
+		// same two pushes the mapClick targeting tail makes, in the same order
+		_states.push_back(new ProjectileFlyBState(this, action));
+		statePushFront(new UnitTurnBState(this, action)); // turn towards the target first
+		break;
+
+	case BA_MINDCONTROL:
+	case BA_PANIC:
+		statePushBack(new PsiAttackBState(this, action));
+		break;
+
+	case BA_USE:
+		if (action.weapon && action.weapon->getRules()->getBattleType() == BT_PSIAMP)
+		{
+			statePushBack(new PsiAttackBState(this, action));
+		}
+		else if (action.coopTargetUnit != -1)
+		{
+			BattleUnit* target = coopFindUnit(action.coopTargetUnit);
+			if (target && action.weapon && action.spendTU(&action.result))
+			{
+				const char* medkitState = action.coopMedikitMode == BMA_STIMULANT ? "stimulant"
+										  : action.coopMedikitMode == BMA_PAINKILLER ? "painkiller"
+																					 : "heal";
+				getTileEngine()->medikitUse(&action, target,
+					(BattleMediKitAction)action.coopMedikitMode, (UnitBodyPart)action.coopBodyPart);
+				coopSendMedikitPacket(action, target, action.coopMedikitMode, action.coopBodyPart, medkitState);
+				// decided from charge counts both machines now hold, so the peer's
+				// own medikitRemoveIfEmpty reaches the same answer.
+				getTileEngine()->medikitRemoveIfEmpty(&action);
+			}
+			_parentState->updateSoldierInfo();
+		}
+		else if (action.weapon
+				 && (action.weapon->getRules()->getBattleType() == BT_SCANNER
+					 || action.weapon->getRules()->getBattleType() == BT_MINDPROBE))
+		{
+			// the executor pays for it; the display (scanner window / unit info)
+			// is the asking machine's own business.
+			action.spendTU(&action.result);
+			_parentState->updateSoldierInfo();
+		}
+		else
+		{
+			handleNonTargetAction(action);
+		}
+		break;
+
+	case BA_HIT:
+		handleNonTargetAction(action);
+		break;
+
+	case BA_PRIME:
+	case BA_UNPRIME:
+		handleNonTargetAction(action);
+		coopSendPrimePacket(action, type);
+		break;
+
+	default:
+		break;
+	}
+	// coop (PRD-I3 SEAM-7 ii): the instant kinds (kneel/prime/medikit) have now
+	// emitted their replay packet above, so release the coopCloseActionChain hold
+	// that kept this chain's action_end behind it. A no-op for the state-pushing
+	// kinds (walk/turn/shoot - the flag was never set for them). Reaction fire does
+	// NOT re-enter executeAction, so this cannot clear a sibling chain's hold.
+	connectionTCP::coopNoteInstantExecuted();
+}
+
+/**
+ * The door every player-initiated battle action passes through.
+ *
+ * Classic co-op and single player never take a branch here - the option is off,
+ * so the caller runs its normal tail and the behaviour is byte-identical.
+ */
+bool BattlescapeGame::coopRouteAction(BattleAction &action, const std::string &kind)
+{
+	if (!connectionTCP::parallelTurnActive())
+	{
+		return false;
+	}
+
+	if (!getHost())
+	{
+		// The client never simulates. Everything it just built travels instead.
+		getCoopMod()->sendActionIntent(coopBuildIntent(this, _save, action, kind), kind);
+		return true;
+	}
+
+	// The host executes, but through the same admission gate a client intent
+	// meets - otherwise the two players would be held to different rules.
+	if (!connectionTCP::canAdmitAction())
+	{
+		// coop (PRD-P7): a chain that is nothing but locomotion is not worth making
+		// the player re-click for. The input is DEFERRED instead of refused, and the
+		// walk in the way stops being waited for. Refused deferral (a shot in
+		// flight, a side commit) keeps PRD-P6's busy flash.
+		// Serialized through the very same builder a client uses, so pending-admit
+		// has ONE shape. `kind` and `seat` are stamped here because on the client
+		// they are added by connectionTCP::sendActionIntent, which this side of the
+		// wire never visits - and coopValidateIntent/coopExecuteIntent both key off
+		// `kind`.
+		Json::Value deferred = coopBuildIntent(this, _save, action, kind);
+		deferred["kind"] = kind;
+		deferred["seat"] = connectionTCP::localSeat();
+		if (connectionTCP::coopPendIntent(connectionTCP::localSeat(), 0, kind,
+				deferred.toStyledString(), true))
+		{
+			return true;
+		}
+		// coop: the peer-busy message no longer flashes the toolbar warning widget.
+		// The executor is mid non-skippable chain here, so isBusy() is true and
+		// BattlescapeState::updateCoopWaitBanner() shows the persistent
+		// "Please wait for <player>'s action to finish" banner (suppressed when the
+		// chain is this seat's own action).
+		return true;
+	}
+	// coop (PRD-P8): the executor's own action clears its own END TURN readiness
+	// (it clearly did not mean "I am done"), and drops any reserve override left
+	// over from a client chain - what runs next is a LOCAL action, judged by this
+	// machine's own reserve.
+	connectionTCP::noteSeatActed(connectionTCP::localSeat());
+	coopClearChainReserve();
+	connectionTCP::stampAdmittedAction(kind);
+	return false;
+}
+
+/**
+ * Same door for a medikit press: the operands (which unit, which body part,
+ * heal/stim/pain) have no home in BattleAction, so they are stamped onto the
+ * co-op fields first.
+ */
+bool BattlescapeGame::coopRouteMedikit(BattleAction* action, BattleUnit* target, int medikitMode, int bodyPart)
+{
+	if (!action || !target || !connectionTCP::parallelTurnActive())
+	{
+		return false;
+	}
+	BattleAction copy = *action;
+	copy.coopTargetUnit = target->getId();
+	copy.coopMedikitMode = medikitMode;
+	copy.coopBodyPart = bodyPart;
+	return coopRouteAction(copy, "medikit");
+}
+
+/**
+ * coop (PRD-P7): may the whole queued chain be skipped past?
+ *
+ * The three states listed here are pure locomotion: their outcome is the unit's
+ * final position/facing, which the peer receives explicitly (the walk ends on an
+ * `abortPath` teleport-correct), so running them at interval 0 changes only how
+ * long the animation is on screen. Anything that ROLLS something - a projectile,
+ * an explosion, a death, a melee or psi attack - plays at its normal interval,
+ * and so does any chain that belongs to the AI or a civilian.
+ *
+ * An empty queue answers false: there is nothing to skip, and the callers use
+ * "skippable" to mean "wait for this one" rather than "the field is clear".
+ */
+bool BattlescapeGame::chainIsSkippable() const
+{
+	if (_states.empty())
+	{
+		return false;
+	}
+	for (auto* bs : _states)
+	{
+		if (bs == 0)
+		{
+			// the end-turn sentinel: the side is closing, nothing to fast-forward
+			return false;
+		}
+		BattleUnit* actor = bs->getAction().actor;
+		if (dynamic_cast<UnitWalkBState*>(bs) != 0 || dynamic_cast<UnitTurnBState*>(bs) != 0)
+		{
+			if (!actor || actor->getFaction() != FACTION_PLAYER)
+			{
+				return false;
+			}
+		}
+		else if (dynamic_cast<UnitFallBState*>(bs) != 0)
+		{
+			// UnitFallBState is constructed WITHOUT an action (BattlescapeGame.cpp
+			// :1021 / UnitWalkBState.cpp:336), so its actor is null - the units it
+			// moves are the save's falling list.
+			for (auto* u : *_save->getFallingUnits())
+			{
+				if (u && u->getFaction() != FACTION_PLAYER)
+				{
+					return false;
+				}
+			}
+		}
+		else
+		{
+			return false;
+		}
+	}
+	return true;
+}
+
+/**
+ * coop (PRD-P7): arming is refused outside a parallel player side, so classic
+ * co-op and single player never reach the interval-0 branch and stay
+ * byte-identical. Disarming always takes effect.
+ */
+void BattlescapeGame::setCoopFastForward(bool on)
+{
+	_coopFastForward = on && connectionTCP::parallelTurnActive();
+}
+
+/**
+ * coop (PRD-P7): the state queue changed - re-decide the fast-forward.
+ *
+ * Two transitions matter:
+ *  - the queue DRAINED: the chain is over, so the fast-forward lapses and (on the
+ *    executor) the chain's `action_end` marker is owed to the client.
+ *  - the chain stopped being skippable while it was being fast-forwarded, which
+ *    in practice means reaction fire interrupted a walk. The shot must play at
+ *    full speed, and the pending intents are dropped: positions and TU may have
+ *    moved a long way from what the player was looking at when they clicked.
+ */
+void BattlescapeGame::coopChainChanged()
+{
+	if (!connectionTCP::parallelTurnActive())
+	{
+		return;
+	}
+	if (_states.empty())
+	{
+		_coopFastForward = false;
+		// coop (PRD-P8 §5): the chain that owned the reserve override is over.
+		coopClearChainReserve();
+		connectionTCP::coopCloseActionChain();
+		return;
+	}
+	if (_coopFastForward && !chainIsSkippable())
+	{
+		_coopFastForward = false;
+		connectionTCP::coopDenyPendingIntents();
+	}
+}
+
+/**
+ * Serializes an action as the body of an `action_intent` (PROTOCOL.md).
+ *
+ * Deviation from the sketched shape, documented in PROTOCOL.md: the intent also
+ * carries `weapon_id`/`weapon_type`. `hand` alone cannot name the item that
+ * acted - a unit can hold two, and built-in specials live outside the hands
+ * entirely - and the host must resolve the exact instance with
+ * coopResolveWeapon, which never fabricates a BattleItem (issue #74).
+ */
+static Json::Value coopBuildIntent(BattlescapeGame* game, SavedBattleGame* save, const BattleAction &action, const std::string &kind)
+{
+	Json::Value root;
+	root["unit_id"] = action.actor ? action.actor->getId() : -1;
+	root["ba_type"] = (int)action.type;
+
+	root["target"]["x"] = action.target.x;
+	root["target"]["y"] = action.target.y;
+	root["target"]["z"] = action.target.z;
+
+	root["run"] = action.run;
+	root["strafe"] = action.strafe;
+	root["sneak"] = action.sneak;
+	root["ignore_spotted"] = action.ignoreSpottedEnemies;
+
+	root["hand"] = BattlescapeGame::coopHandOf(action.actor, action.weapon, game->getCoopWeaponHand());
+	root["weapon_id"] = action.weapon ? action.weapon->getId() : -1;
+	root["weapon_type"] = action.weapon ? action.weapon->getRules()->getType() : std::string();
+
+	root["waypoints"] = Json::Value(Json::arrayValue);
+	for (const auto& wp : action.waypoints)
+	{
+		Json::Value entry;
+		entry["x"] = wp.x;
+		entry["y"] = wp.y;
+		entry["z"] = wp.z;
+		root["waypoints"].append(entry);
+	}
+
+	// PROTOCOL.md: ALL kinds carry the sender's current reserve mode; the host
+	// applies it to THIS action's cost check only. PRD-P8 owns the rest.
+	root["reserve"] = (int)save->getTUReserved();
+	root["kneelReserve"] = save->getKneelReserved();
+
+	root["extra"] = Json::Value(Json::objectValue);
+	if (kind == "prime")
+	{
+		root["extra"]["fuse"] = action.value;
+	}
+	else if (kind == "medikit")
+	{
+		root["extra"]["target_unit"] = action.coopTargetUnit;
+		root["extra"]["action"] = action.coopMedikitMode == BMA_STIMULANT ? "stim"
+								  : action.coopMedikitMode == BMA_PAINKILLER ? "pain"
+																			 : "heal";
+		root["extra"]["bodypart"] = action.coopBodyPart;
+	}
+	else if (kind == "shoot")
+	{
+		root["extra"]["sprayTargeting"] = action.sprayTargeting;
+	}
+	return root;
+}
+
+/**
+ * Host: is this intent allowed to run at all? Ownership is the important half -
+ * a client may only ever drive its own seat's soldiers.
+ */
+std::string BattlescapeGame::coopValidateIntent(const std::string &intentJson, int seat, std::string &warning)
+{
+	Json::Reader reader;
+	Json::Value obj;
+	reader.parse(intentJson, obj);
+
+	warning = "STR_COOP_ACTION_REFUSED";
+
+	BattleUnit* unit = coopFindUnit(obj.get("unit_id", -1).asInt());
+	if (!unit)
+	{
+		return "no_unit";
+	}
+	if (unit->isOut())
+	{
+		return "unit_out";
+	}
+	if (unit->getFaction() != FACTION_PLAYER)
+	{
+		warning = "STR_COOP_NOT_YOUR_SOLDIER";
+		return "faction";
+	}
+	if (unit->getCoop() != seat)
+	{
+		warning = "STR_COOP_NOT_YOUR_SOLDIER";
+		return "ownership";
+	}
+
+	const std::string kind = obj.get("kind", "").asString();
+	if (kind == "kneel")
+	{
+		if (unit->getTimeUnits() < unit->getKneelChangeCost())
+		{
+			warning = "STR_NOT_ENOUGH_TIME_UNITS";
+			return "no_tu";
+		}
+	}
+	else if (kind == "shoot" || kind == "throw" || kind == "psi" || kind == "melee"
+			 || kind == "prime" || kind == "medikit")
+	{
+		BattleItem* weapon = coopResolveWeapon(_save, unit,
+			obj.get("weapon_id", -1).asInt(), obj.get("weapon_type", "").asString(),
+			obj.get("hand", "").asString());
+		if (!weapon)
+		{
+			// issue #74: never fabricate one to make the intent runnable.
+			return "no_weapon";
+		}
+		BattleActionCost cost((BattleActionType)obj.get("ba_type", (int)BA_NONE).asInt(), unit, weapon);
+		std::string message;
+		// An EMPTY message means haveTU() bailed on `Time <= 0` - a free action,
+		// not an unaffordable one. Denying that would refuse every zero-cost
+		// action outright, so only a real cost complaint is a refusal.
+		if (!cost.haveTU(&message) && !message.empty())
+		{
+			warning = message;
+			return "no_tu";
+		}
+	}
+
+	warning.clear();
+	return "";
+}
+
+/**
+ * Host: rebuild the client's intent as a BattleAction and run it.
+ *
+ * The action is built with makeReplayAction, i.e. `coopReplay` set: it is a PEER
+ * action as far as this machine's display is concerned, so it must not yank the
+ * host's camera (PRD-P1) - and `cameraPosition` stays unset for the same reason.
+ *
+ * PRD-P7 added `localOrigin`: a deferred intent that came from THIS machine's own
+ * click is replayed through the same serialization (so pending-admit has one
+ * shape), but it is the local player's own action, so it must NOT be flagged
+ * coopReplay - that flag is what tells the display code "somebody else did this".
+ */
+void BattlescapeGame::coopExecuteIntent(const std::string &intentJson, bool localOrigin)
+{
+	Json::Reader reader;
+	Json::Value obj;
+	reader.parse(intentJson, obj);
+
+	BattleUnit* unit = coopFindUnit(obj.get("unit_id", -1).asInt());
+	if (!unit)
+	{
+		return;
+	}
+
+	const std::string kind = obj.get("kind", "").asString();
 
-				victim->getStatistics()->wasUnconcious = true;
-				noSound = true;
-				statePushNext(new UnitDieBState(this, victim, getMod()->getDamageType(DT_NONE), noSound)); // no damage type used there
-			}
-			else
-			{
-				// piggyback of cleanup after script that change move type
-				if (victim->haveNoFloorBelow() && victim->getMovementType() != MT_FLY)
-				{
-					_save->addFallingUnit(victim);
-				}
-			}
-		}
+	BattleAction action = makeReplayAction(unit);
+	action.coopReplay = !localOrigin;
+	action.targeting = false;
+	action.type = (BattleActionType)obj.get("ba_type", (int)BA_NONE).asInt();
+	action.target = Position(obj["target"].get("x", 0).asInt(),
+							 obj["target"].get("y", 0).asInt(),
+							 obj["target"].get("z", 0).asInt());
+	action.run = obj.get("run", false).asBool();
+	action.strafe = obj.get("strafe", false).asBool();
+	action.sneak = obj.get("sneak", false).asBool();
+	action.ignoreSpottedEnemies = obj.get("ignore_spotted", false).asBool();
+	action.cameraPosition = Position(0, 0, -1);
+
+	action.weapon = coopResolveWeapon(_save, unit, obj.get("weapon_id", -1).asInt(),
+		obj.get("weapon_type", "").asString(), obj.get("hand", "").asString());
+
+	const Json::Value& wps = obj["waypoints"];
+	for (Json::ArrayIndex i = 0; i < wps.size(); ++i)
+	{
+		action.waypoints.push_back(Position(wps[i].get("x", 0).asInt(),
+											wps[i].get("y", 0).asInt(),
+											wps[i].get("z", 0).asInt()));
 	}
 
-	BattleUnit* bu = _save->getSelectedUnit();
-	if (_save->getSide() == FACTION_PLAYER)
+	const Json::Value& extra = obj["extra"];
+	if (kind == "prime")
 	{
-		_parentState->resetUiButton();
+		action.value = extra.get("fuse", -1).asInt();
+	}
+	else if (kind == "medikit")
+	{
+		const std::string mode = extra.get("action", "heal").asString();
+		action.coopTargetUnit = extra.get("target_unit", -1).asInt();
+		action.coopMedikitMode = mode == "stim" ? BMA_STIMULANT
+							   : mode == "pain" ? BMA_PAINKILLER
+												: BMA_HEAL;
+		action.coopBodyPart = extra.get("bodypart", 0).asInt();
+	}
+	else if (kind == "shoot")
+	{
+		action.sprayTargeting = extra.get("sprayTargeting", false).asBool();
+	}
 
-		if (bu && !bu->isOut())
-		{
-			_parentState->updateUiButton(bu);
-		}
+	if (kind == "shoot" || kind == "throw" || kind == "psi" || kind == "melee"
+		|| kind == "prime" || kind == "medikit" || kind == "other")
+	{
+		action.updateTU();
+	}
+
+	// PROTOCOL.md: the sender's reserve settings apply to THIS action's cost
+	// check only.
+	//
+	// PRD-P8 §5 localizes it properly. PRD-P6 swapped the values into _save around
+	// the synchronous call, which covered kneel() and everything else decided
+	// inside executeAction - but a walk's reserve check is per STEP, inside
+	// UnitWalkBState::think(), frames after this function has returned and the
+	// values were put back. A client's walk was therefore judged against the
+	// HOST's reserve for its entire length. The override below lives as long as
+	// the chain does and is keyed on the actor, so it cannot leak sideways onto
+	// another unit; the host's own UI reading of _save is left untouched, which
+	// the swap could not manage either.
+	coopClearChainReserve();
+	if (obj.isMember("reserve") || obj.isMember("kneelReserve"))
+	{
+		_coopChainReserveActive = true;
+		_coopChainReserveUnit = unit->getId();
+		_coopChainReserve = obj.isMember("reserve")
+			? (BattleActionType)obj["reserve"].asInt() : _save->getTUReserved();
+		_coopChainKneelReserve = obj.isMember("kneelReserve")
+			? obj["kneelReserve"].asBool() : _save->getKneelReserved();
+	}
+
+	executeAction(action, true);
+
+	if (_states.empty())
+	{
+		// nothing was queued (kneel, prime, medikit, a walk with no path): the
+		// chain is already over, so coopChainChanged() will never be reached.
+		coopClearChainReserve();
 	}
 }
 
 /**
- * Shows the infoboxes in the queue (if any).
+ * coop (PRD-P8 §5): the reserve a cost check must judge `bu` by.
+ *
+ * Only the actor of the running intent is answered from the override; everything
+ * else - the local player's own soldiers, the AI, a reaction-fire check - reads
+ * this machine's own setting exactly as it always did.
  */
-void BattlescapeGame::showInfoBoxQueue()
+BattleActionType BattlescapeGame::coopReserveModeFor(const BattleUnit* bu) const
 {
-	for (auto* infoboxOKState : _infoboxQueue)
+	if (_coopChainReserveActive && bu && bu->getId() == _coopChainReserveUnit)
 	{
-		_parentState->getGame()->pushState(infoboxOKState);
+		return _coopChainReserve;
+	}
+	return _save->getTUReserved();
+}
+
+bool BattlescapeGame::coopKneelReserveFor(const BattleUnit* bu) const
+{
+	if (_coopChainReserveActive && bu && bu->getId() == _coopChainReserveUnit)
+	{
+		return _coopChainKneelReserve;
 	}
+	return _save->getKneelReserved();
+}
 
-	_infoboxQueue.clear();
+void BattlescapeGame::coopClearChainReserve()
+{
+	_coopChainReserveActive = false;
+	_coopChainReserveUnit = -1;
+	_coopChainReserve = BA_NONE;
+	_coopChainKneelReserve = false;
 }
 
 /**
- * Sets up a mission complete notification.
+ * The classic `kneel` replay packet. kneel() has no BattleState of its own, so
+ * nothing else would tell the peer about it.
  */
-void BattlescapeGame::missionComplete()
+void BattlescapeGame::coopSendKneelPacket(BattleUnit* bu)
 {
-	Game* game = _parentState->getGame();
-	if (game->getMod()->getDeployment(_save->getMissionType()))
+	if (!bu || !isCoop())
 	{
-		std::string missionComplete = game->getMod()->getDeployment(_save->getMissionType())->getObjectivePopup();
-		if (!missionComplete.empty())
+		return;
+	}
+	Json::Value obj;
+	obj["state"] = "kneel";
+	obj["id"] = bu->getId();
+	// coop (PRD-I3 SEAM-1): the actor's POST-ACTION state. kneel() has no
+	// BattleState, so the peer replays it through toggeCoopKneel and re-decides -
+	// and its reserve gate (checkReservedTU / coopKneelReserveFor, keyed on the
+	// PEER's own reserve, which parallel mode does not replicate) can refuse a
+	// kneel this executor performed. The kneel cost is a constant (4 down / 8 up),
+	// so the charge only diverges when the flip itself does - the two drift
+	// together. Shipping the executor's final tu/energy AND kneeling bit lets the
+	// peer mirror the executed kneel instead of re-deciding it. Additive and
+	// presence-gated: an older peer ignores them and keeps the legacy re-decide.
+	obj["tu"] = bu->getTimeUnits();
+	obj["energy"] = bu->getEnergy();
+	obj["kneeled"] = bu->isKneeled();
+	getCoopMod()->sendTCPPacketData(obj.toStyledString());
+}
+
+/**
+ * The classic `active_grenade` replay packet, shipped with the fuse the weapon
+ * ACTUALLY ended up on - a prime that failed its TU check ships -1, so the peer
+ * mirrors the failure instead of arming a grenade the executor never armed.
+ */
+void BattlescapeGame::coopSendPrimePacket(const BattleAction &action, BattleActionType primeType)
+{
+	if (!isCoop() || !action.actor || !action.weapon)
+	{
+		return;
+	}
+	Json::Value root;
+	root["state"] = "active_grenade";
+	root["fusetimer"] = action.weapon->getFuseTimer();
+	root["hand"] = coopHandOf(action.actor, action.weapon, getCoopWeaponHand());
+	root["type"] = (int)primeType;
+	root["actor_id"] = action.actor->getId();
+	root["item_id"] = action.weapon->getId();
+	// coop (PRD-P9 soak finding, same shape as rider R2): the ACTOR's cost.
+	// Prime, unprime and medikit mutate synchronously inside a UI handler, so
+	// they push no BattleState and the peer has nothing that would charge them
+	// - it mirrored the EFFECT (fuse, wounds) but never the price, and the two
+	// copies of the soldier drifted apart by the action's TU on every use
+	// (measured: 31 vs 62 after one prime). Additive and presence-gated.
+	root["tu"] = action.actor->getTimeUnits();
+	root["energy"] = action.actor->getEnergy();
+	getCoopMod()->sendTCPPacketData(root.toStyledString());
+}
+
+/**
+ * The classic `medkit` replay packet, plus the healer/weapon identification the
+ * legacy shape never carried - without it the receiver has to guess the medikit
+ * from whatever is in ITS OWN _currentAction, which in parallel mode belongs to
+ * the other player entirely.
+ */
+void BattlescapeGame::coopSendMedikitPacket(const BattleAction &action, BattleUnit* target, int medikitMode, int bodyPart, const std::string &medkitState)
+{
+	if (!isCoop() || !target || !action.actor || !action.weapon)
+	{
+		return;
+	}
+	Json::Value obj;
+	obj["state"] = "medkit";
+	obj["actor_id"] = target->getId();     // legacy name: this is the PATIENT
+	obj["type"] = (int)action.type;
+	obj["part"] = bodyPart;
+	obj["medkit_state"] = medkitState;
+	obj["action_result"] = action.result;
+	obj["time"] = action.Time;
+	// additive (an older peer ignores them)
+	obj["healer_id"] = action.actor->getId();
+	obj["weapon_id"] = action.weapon->getId();
+	obj["weapon_type"] = action.weapon->getRules()->getType();
+	obj["hand"] = coopHandOf(action.actor, action.weapon, getCoopWeaponHand());
+	// coop (PRD-P9 soak finding, same shape as rider R2): the ACTOR's cost.
+	// Prime, unprime and medikit mutate synchronously inside a UI handler, so
+	// they push no BattleState and the peer has nothing that would charge them
+	// - it mirrored the EFFECT (fuse, wounds) but never the price, and the two
+	// copies of the soldier drifted apart by the action's TU on every use
+	// (measured: 31 vs 62 after one prime). Additive and presence-gated.
+	obj["tu"] = action.actor->getTimeUnits();
+	obj["energy"] = action.actor->getEnergy();
+	getCoopMod()->sendTCPPacketData(obj.toStyledString());
+	(void)medikitMode;
+}
+
+void BattlescapeGame::handleNonTargetAction()
+{
+	// coop (PRD-P6): prime / unprime / melee are confirmed here (the action menu
+	// only sets the type up), so this is where the parallel client turns them
+	// into an intent instead of mutating its own sim. BA_USE is deliberately NOT
+	// routed: its only local effect is updateGameStateAfterScript, which the
+	// classic replay path runs on both machines anyway.
+	if (connectionTCP::parallelTurnActive() && !_currentAction.targeting
+		&& _currentAction.result.empty() && _currentAction.actor)
+	{
+		const char* kind = nullptr;
+		if (_currentAction.type == BA_HIT)
 		{
-			// coop
-			if ((game->getCoopMod()->getCoopStatic() == true && game->getCoopMod()->getHost() == true) || game->getCoopMod()->getCoopStatic() == false)
-				_infoboxQueue.push_back(new InfoboxOKState(game->getLanguage()->getString(missionComplete)));
+			kind = "melee";
+		}
+		else if (_currentAction.type == BA_UNPRIME
+				 || (_currentAction.type == BA_PRIME && _currentAction.value > -1))
+		{
+			kind = "prime";
+		}
+
+		if (kind)
+		{
+			BattleAction action = _currentAction;
+			if (coopRouteAction(action, kind))
+			{
+				_currentAction.type = BA_NONE;
+				_currentAction.value = 0;
+				_parentState->updateSoldierInfo();
+				setupCursor();
+				return;
+			}
 		}
 	}
+
+	handleNonTargetAction(_currentAction);
 }
 
 /**
- * Handles the result of non target actions, like priming a grenade.
+ * coop (PRD-P1): the same handler on an explicit action, so a replayed peer
+ * action (coopActionClick) can run its BA_PRIME/BA_UNPRIME/BA_USE/BA_HIT
+ * follow-up without writing the LOCAL player's _currentAction. The no-argument
+ * overload above passes _currentAction, so every classic call site is unchanged.
  */
-void BattlescapeGame::handleNonTargetAction()
+void BattlescapeGame::handleNonTargetAction(BattleAction& action)
 {
-	if (!_currentAction.targeting)
+	if (!action.targeting)
 	{
 		std::string error;
-		_currentAction.cameraPosition = Position(0, 0, -1);
-		if (!_currentAction.result.empty())
+		action.cameraPosition = Position(0, 0, -1);
+		if (!action.result.empty())
 		{
-			_parentState->warning(_currentAction.result);
-			_currentAction.result = "";
+			_parentState->warning(action.result);
+			action.result = "";
 		}
-		else if (_currentAction.type == BA_PRIME && _currentAction.value > -1)
+		else if (action.type == BA_PRIME && action.value > -1)
 		{
-			if (_currentAction.spendTU(&error))
+			if (action.spendTU(&error))
 			{
-				_parentState->warning(_currentAction.weapon->getRules()->getPrimeActionMessage());
-				_currentAction.weapon->setFuseTimer(_currentAction.value);
-				playSound(_currentAction.weapon->getRules()->getPrimeSound()); // prime sound
-				_save->getTileEngine()->calculateLighting(LL_UNITS, _currentAction.actor->getPosition());
-				_save->getTileEngine()->calculateFOV(_currentAction.actor->getPosition(), _currentAction.weapon->getVisibilityUpdateRange(), false);
+				_parentState->warning(action.weapon->getRules()->getPrimeActionMessage());
+				action.weapon->setFuseTimer(action.value);
+				playSound(action.weapon->getRules()->getPrimeSound()); // prime sound
+				_save->getTileEngine()->calculateLighting(LL_UNITS, action.actor->getPosition());
+				_save->getTileEngine()->calculateFOV(action.actor->getPosition(), action.weapon->getVisibilityUpdateRange(), false);
 			}
 			else
 			{
 				_parentState->warning(error);
 			}
 		}
-		else if (_currentAction.type == BA_UNPRIME)
+		else if (action.type == BA_UNPRIME)
 		{
-			if (_currentAction.spendTU(&error))
+			if (action.spendTU(&error))
 			{
-				_parentState->warning(_currentAction.weapon->getRules()->getUnprimeActionMessage());
-				_currentAction.weapon->setFuseTimer(-1);
-				playSound(_currentAction.weapon->getRules()->getUnprimeSound()); // unprime sound
-				_save->getTileEngine()->calculateLighting(LL_UNITS, _currentAction.actor->getPosition());
-				_save->getTileEngine()->calculateFOV(_currentAction.actor->getPosition(), _currentAction.weapon->getVisibilityUpdateRange(), false);
+				_parentState->warning(action.weapon->getRules()->getUnprimeActionMessage());
+				action.weapon->setFuseTimer(-1);
+				playSound(action.weapon->getRules()->getUnprimeSound()); // unprime sound
+				_save->getTileEngine()->calculateLighting(LL_UNITS, action.actor->getPosition());
+				_save->getTileEngine()->calculateFOV(action.actor->getPosition(), action.weapon->getVisibilityUpdateRange(), false);
 			}
 			else
 			{
 				_parentState->warning(error);
 			}
 		}
-		else if (_currentAction.type == BA_USE)
+		else if (action.type == BA_USE)
 		{
-			getTileEngine()->updateGameStateAfterScript(BattleActionAttack::GetBeforeShoot(_currentAction), TileEngine::invalid);
+			getTileEngine()->updateGameStateAfterScript(BattleActionAttack::GetBeforeShoot(action), TileEngine::invalid);
 		}
-		else if (_currentAction.type == BA_HIT)
+		else if (action.type == BA_HIT)
 		{
-			if (_currentAction.haveTU(&error))
+			if (action.haveTU(&error))
 			{
-				statePushBack(new MeleeAttackBState(this, _currentAction));
+				statePushBack(new MeleeAttackBState(this, action));
 			}
 			else
 			{
 				_parentState->warning(error);
 			}
 		}
-		if (_currentAction.type != BA_HIT) // don't clear the action type if we're meleeing, let the melee action state take care of that
+		if (action.type != BA_HIT) // don't clear the action type if we're meleeing, let the melee action state take care of that
 		{
-			_currentAction.type = BA_NONE;
+			action.type = BA_NONE;
 		}
 		_parentState->updateSoldierInfo();
 	}
@@ -1987,6 +3528,14 @@ void BattlescapeGame::handleState()
 		}
 		getMap()->invalidate(); // redraw map
 	}
+	else
+	{
+		// coop (Phase 2c death ghost): the queue is idle - start the next queued
+		// death ghost if its display gate is met. Pushed via statePushBack (init now,
+		// think next tick), so the collapse begins on the following tick, matching
+		// vanilla cadence. No-op unless the parallel client has a pending ghost.
+		coopPollDeathGhosts();
+	}
 }
 
 // coop
@@ -2009,6 +3558,7 @@ void BattlescapeGame::statePushFront(BattleState* bs)
 {
 	_states.push_front(bs);
 	bs->init();
+	coopChainChanged(); // coop (PRD-P7): reaction fire lands here
 }
 
 /**
@@ -2026,6 +3576,7 @@ void BattlescapeGame::statePushNext(BattleState* bs)
 	{
 		_states.insert(++_states.begin(), bs);
 	}
+	coopChainChanged(); // coop (PRD-P7)
 }
 
 /**
@@ -2053,6 +3604,7 @@ void BattlescapeGame::statePushBack(BattleState* bs)
 	{
 		_states.push_back(bs);
 	}
+	coopChainChanged(); // coop (PRD-P7)
 }
 
 /**
@@ -2180,6 +3732,9 @@ void BattlescapeGame::popState()
 			_save->selectNextPlayerUnit(true, true);
 	}
 	_parentState->updateSoldierInfo();
+	// coop (PRD-P7): the drain point. Clears the fast-forward and, on the executor,
+	// tells the client that the chain it is displaying has no more packets coming.
+	coopChainChanged();
 }
 
 /**
@@ -2222,7 +3777,11 @@ bool BattlescapeGame::checkReservedTU(BattleUnit* bu, int tu, int energy, bool j
 {
 	BattleActionCost cost;
 	cost.actor = bu;
-	cost.type = _save->getTUReserved();         // avoid changing _tuReserved in this method
+	// coop (PRD-P8 §5): the running intent's reserve when `bu` is its actor,
+	// otherwise this machine's own - see coopReserveModeFor().
+	const BattleActionType coopReserve = coopReserveModeFor(bu);
+	const bool coopKneelReserve = coopKneelReserveFor(bu);
+	cost.type = coopReserve;                    // avoid changing _tuReserved in this method
 	cost.weapon = bu->getMainHandWeapon(false); // check TUs against slowest weapon if we have two weapons
 
 	if (_save->getSide() != bu->getFaction() || _save->getSide() == FACTION_NEUTRAL)
@@ -2270,7 +3829,7 @@ bool BattlescapeGame::checkReservedTU(BattleUnit* bu, int tu, int energy, bool j
 		cost.type = BA_AIMEDSHOT;
 		cost.updateTU();
 	}
-	const int tuKneel = (_save->getKneelReserved() && !bu->isKneeled() && bu->getArmor()->allowsKneeling(bu->getType() == "SOLDIER")) ? bu->getKneelDownCost() : 0;
+	const int tuKneel = (coopKneelReserve && !bu->isKneeled() && bu->getArmor()->allowsKneeling(bu->getType() == "SOLDIER")) ? bu->getKneelDownCost() : 0;
 	// no aimed shot available? revert to none.
 	if (cost.Time == 0 && cost.type == BA_AIMEDSHOT)
 	{
@@ -2295,7 +3854,7 @@ bool BattlescapeGame::checkReservedTU(BattleUnit* bu, int tu, int energy, bool j
 	cost.Time += tu;
 	cost.Energy += energy;
 
-	if ((cost.type != BA_NONE || _save->getKneelReserved()) && !cost.haveTU())
+	if ((cost.type != BA_NONE || coopKneelReserve) && !cost.haveTU())
 	{
 		if (!justChecking)
 		{
@@ -2312,7 +3871,7 @@ bool BattlescapeGame::checkReservedTU(BattleUnit* bu, int tu, int energy, bool j
 			}
 			else
 			{
-				switch (_save->getTUReserved())
+				switch (coopReserve)
 				{
 				case BA_SNAPSHOT:
 					_parentState->warning("STR_TIME_UNITS_RESERVED_FOR_SNAP_SHOT");
@@ -2702,6 +4261,32 @@ bool BattlescapeGame::isBusy() const
 	return !_states.empty();
 }
 
+/**
+ * coop: the OWNER unit of the action chain currently running, ignoring the
+ * consequence states (UnitDieBState / UnitFallBState / ExplosionBState) that get
+ * pushed to the FRONT of the queue mid-chain - their actor is the victim, not the
+ * unit whose action this is. Scans front-to-back for the first non-consequence
+ * state with a player actor. Works on both machines (replay pushes real states).
+ * @return the acting player unit, or 0 when idle / only consequence states remain.
+ */
+BattleUnit *BattlescapeGame::getPrimaryBusyActor() const
+{
+	for (BattleState *bs : _states)
+	{
+		if (dynamic_cast<UnitDieBState*>(bs) || dynamic_cast<UnitFallBState*>(bs)
+			|| dynamic_cast<ExplosionBState*>(bs))
+		{
+			continue;
+		}
+		BattleUnit *actor = bs->getAction().actor;
+		if (actor && actor->getFaction() == FACTION_PLAYER)
+		{
+			return actor;
+		}
+	}
+	return 0;
+}
+
 /**
  * Activates primary action (left click).
  * @param pos Position on the map.
@@ -2772,8 +4357,17 @@ void BattlescapeGame::primaryAction(Position pos)
 				getMap()->getWaypoints()->clear();
 				_parentState->getGame()->getCursor()->setVisible(false);
 				_currentAction.cameraPosition = getMap()->getCamera()->getMapOffset();
-				_states.push_back(new ProjectileFlyBState(this, _currentAction));
-				statePushFront(new UnitTurnBState(this, _currentAction));
+				// coop (PRD-P6): the spray waypoints were computed locally and ride
+				// the intent verbatim.
+				if (coopRouteAction(_currentAction, "shoot"))
+				{
+					_parentState->getGame()->getCursor()->setVisible(true);
+					_currentAction.sprayTargeting = false;
+					_currentAction.waypoints.clear();
+					setupCursor();
+					return;
+				}
+				executeAction(_currentAction, false);
 				_currentAction.sprayTargeting = false;
 				_currentAction.waypoints.clear();
 			}
@@ -2803,7 +4397,19 @@ void BattlescapeGame::primaryAction(Position pos)
 					std::find(_currentAction.actor->getVisibleUnits()->begin(), _currentAction.actor->getVisibleUnits()->end(), targetUnit) != _currentAction.actor->getVisibleUnits()->end())
 				{
 					std::string error;
-					if (_currentAction.spendTU(&error))
+					// coop (PRD-P6): a mind probe's only sim effect is the TU it
+					// costs, and in parallel mode only the executor may spend it.
+					// The read-out itself is this player's own business.
+					if (connectionTCP::parallelTurnActive() && !getHost())
+					{
+						BattleAction probe = _currentAction;
+						probe.target = pos;
+						coopRouteAction(probe, "other");
+						_parentState->getGame()->getMod()->getSoundByDepth(_save->getDepth(), _currentAction.weapon->getRules()->getHitSound())->play(-1, getMap()->getSoundAngle(pos));
+						_parentState->getGame()->pushState(new UnitInfoState(targetUnit, _parentState, false, true));
+						cancelCurrentAction();
+					}
+					else if (_currentAction.spendTU(&error))
 					{
 						_parentState->getGame()->getMod()->getSoundByDepth(_save->getDepth(), _currentAction.weapon->getRules()->getHitSound())->play(-1, getMap()->getSoundAngle(pos));
 						_parentState->getGame()->pushState(new UnitInfoState(targetUnit, _parentState, false, true));
@@ -2874,7 +4480,14 @@ void BattlescapeGame::primaryAction(Position pos)
 						getMap()->setCursorType(CT_NONE);
 						_parentState->getGame()->getCursor()->setVisible(false);
 						_currentAction.cameraPosition = getMap()->getCamera()->getMapOffset();
-						statePushBack(new PsiAttackBState(this, _currentAction));
+						// coop (PRD-P6): the confirmed psi attack.
+						if (coopRouteAction(_currentAction, "psi"))
+						{
+							_parentState->getGame()->getCursor()->setVisible(true);
+							setupCursor();
+							return;
+						}
+						executeAction(_currentAction, false);
 					}
 					else
 					{
@@ -2907,8 +4520,24 @@ void BattlescapeGame::primaryAction(Position pos)
 
 			_parentState->getGame()->getCursor()->setVisible(false);
 			_currentAction.cameraPosition = getMap()->getCamera()->getMapOffset();
-			_states.push_back(new ProjectileFlyBState(this, _currentAction));
-			statePushFront(new UnitTurnBState(this, _currentAction)); // first of all turn towards the target
+
+			// coop (PRD-P6): the confirmed shot / throw.
+			if (coopRouteAction(_currentAction,
+					_currentAction.type == BA_THROW ? "throw" : "shoot"))
+			{
+				_parentState->getGame()->getCursor()->setVisible(true);
+				if (_currentAction.type == BA_THROW || _currentAction.type == BA_LAUNCH)
+				{
+					// classic drops out of targeting after a throw/launch (see
+					// popState); no chain runs here to do it for us.
+					_currentAction.waypoints.clear();
+					cancelCurrentAction(true);
+				}
+				setupCursor();
+				return;
+			}
+
+			executeAction(_currentAction, false);
 		}
 	}
 	else
@@ -3006,6 +4635,18 @@ void BattlescapeGame::primaryAction(Position pos)
 
 			if (!bPreviewed && _save->getPathfinding()->getStartDirection() != -1)
 			{
+				// coop (PRD-P6): the confirmed move. A parallel CLIENT ships it as
+				// an `action_intent` and walks nothing; the targeting UI, the path
+				// preview and the cursor above all stayed local.
+				BattleAction walk = _currentAction;
+				walk.type = BA_WALK;
+				if (coopRouteAction(walk, "walk"))
+				{
+					_save->getPathfinding()->removePreview();
+					getMap()->setCursorType(CT_NORMAL);
+					_parentState->getGame()->getCursor()->setVisible(true);
+					return;
+				}
 
 				// coop (cursor free)
 				if (isYourTurn != 1)
@@ -3020,7 +4661,8 @@ void BattlescapeGame::primaryAction(Position pos)
 					getMap()->setCursorType(CT_NORMAL);
 				}
 
-				statePushBack(new UnitWalkBState(this, _currentAction));
+				// the path is already calculated above, hence `false`
+				executeAction(walk, false);
 				playUnitResponseSound(_currentAction.actor, 1); // "start moving" sound
 			}
 		}
@@ -3037,6 +4679,18 @@ void BattlescapeGame::secondaryAction(Position pos)
 	_currentAction.target = pos;
 	_currentAction.actor = _save->getSelectedUnit();
 	_currentAction.strafe = Options::strafe && _save->isCtrlPressed(true) && _save->getSelectedUnit()->getTurretType() > -1;
+
+	// coop (PRD-P6): the confirmed turn / door-open. Only the INTENT gets the
+	// BA_TURN dispatch key; the local tail keeps _currentAction verbatim, because
+	// UnitTurnBState branches on `_action.type == BA_NONE` (door opening, the
+	// spotted-unit interrupt, the co-op turn packet's `isActionTypeNone`) and a
+	// right click can arrive with a queued BA_HIT still in _currentAction.
+	BattleAction turn = _currentAction;
+	turn.type = BA_TURN;
+	if (coopRouteAction(turn, "turn"))
+	{
+		return;
+	}
 	statePushBack(new UnitTurnBState(this, _currentAction));
 }
 
@@ -3051,8 +4705,16 @@ void BattlescapeGame::launchAction()
 	getMap()->setCursorType(CT_NONE);
 	_parentState->getGame()->getCursor()->setVisible(false);
 	_currentAction.cameraPosition = getMap()->getCamera()->getMapOffset();
-	_states.push_back(new ProjectileFlyBState(this, _currentAction));
-	statePushFront(new UnitTurnBState(this, _currentAction)); // first of all turn towards the target
+
+	// coop (PRD-P6): the waypoints the player laid out ride the intent verbatim.
+	if (coopRouteAction(_currentAction, "shoot"))
+	{
+		_parentState->getGame()->getCursor()->setVisible(true);
+		_currentAction.waypoints.clear();
+		cancelCurrentAction(true);
+		return;
+	}
+	executeAction(_currentAction, false);
 }
 
 /**
@@ -3071,11 +4733,21 @@ void BattlescapeGame::psiButtonAction()
 		return;
 	BattleItem* item = _save->getSelectedUnit()->getSpecialWeapon(BT_PSIAMP);
 
-	// coop
+	// coop + PRD-P2: these two fallbacks mint a BattleItem that is never added to
+	// _items - it exists only to give _currentAction a weapon to point at when the
+	// unit carries no psi amp. Minting it off getCurrentItemId() advanced the
+	// REPLICATED SavedBattleGame::_itemId counter on this machine alone (the ctor
+	// post-increments), so every psi button press drifted the two machines' next item
+	// id apart - exactly the chkBattleItemId term the drift tripwire watches. Mint off
+	// a local throwaway counter instead: same object, no effect on the shared counter,
+	// and the id stays -1 so it can never collide with a real item on either side.
+	// Resolving an existing special weapon is not an alternative here - these
+	// fallbacks run precisely because getSpecialWeapon() found none.
+	int transientItemId = -1;
 	if (!item)
 	{
 
-		item = new BattleItem(_save->getMod()->getItem("STR_PSI_AMP"), _save->getCurrentItemId());
+		item = new BattleItem(_save->getMod()->getItem("STR_PSI_AMP"), &transientItemId);
 	}
 
 	// coop
@@ -3083,7 +4755,8 @@ void BattlescapeGame::psiButtonAction()
 	{
 		if (!item->getRules())
 		{
-			item = new BattleItem(_save->getMod()->getItem("ALIEN_PSI_WEAPON"), _save->getCurrentItemId());
+			transientItemId = -1;
+			item = new BattleItem(_save->getMod()->getItem("ALIEN_PSI_WEAPON"), &transientItemId);
 		}
 	}
 
@@ -3103,8 +4776,14 @@ void BattlescapeGame::psiButtonAction()
 		_currentAction.updateTU();
 		setupCursor();
 
-		// coop psi click
-		if (_parentState->getGame()->getCoopMod()->getCoopStatic() == true && _parentState->getGame()->getCoopMod()->_isActivePlayerSync == true)
+		// coop psi click. NOT in parallel mode: coopPsiButtonAction() sets up the
+		// RECEIVER's targeting cursor and _currentAction, which in parallel belong
+		// to a player who is acting at the same time (PRD-P1's rule, PRD-P6's
+		// scope). The psi attack itself replays off `psi_attack`, which carries
+		// everything, so nothing is lost.
+		if (_parentState->getGame()->getCoopMod()->getCoopStatic() == true
+			&& _parentState->getGame()->getCoopMod()->_isActivePlayerSync == true
+			&& !connectionTCP::parallelTurnActive())
 		{
 
 			Json::Value root;
@@ -3185,6 +4864,10 @@ void BattlescapeGame::psiAttackMessage(BattleActionAttack attack, BattleUnit* vi
 
 			Json::Value root;
 			root["state"] = "psi_result";
+			// coop (PRD-P3 GAP-2): marks the LEGACY flavour - an inverted PVP flip
+			// ("mine now" / "yours no more"), not a state copy. Absent means an
+			// older peer, which only ever sent this one.
+			root["pvp"] = true;
 			root["unit_id"] = victim->getId();
 
 			game->getCoopMod()->sendTCPPacketData(root.toStyledString());
@@ -3208,6 +4891,16 @@ void BattlescapeGame::moveUpDown(BattleUnit* unit, int dir)
 	{
 		_currentAction.target.z--;
 	}
+	// coop (PRD-P6): routed BEFORE the stand-up, which is itself a sim mutation
+	// the client may not make. UnitWalkBState stands a kneeling unit up on its
+	// own first step, so the executor still does it.
+	BattleAction walk = _currentAction;
+	walk.type = BA_WALK;
+	if (coopRouteAction(walk, "walk"))
+	{
+		return;
+	}
+
 	getMap()->setCursorType(CT_NONE);
 	_parentState->getGame()->getCursor()->setVisible(false);
 	if (_save->getSelectedUnit()->isKneeled())
@@ -3215,7 +4908,7 @@ void BattlescapeGame::moveUpDown(BattleUnit* unit, int dir)
 		kneel(_save->getSelectedUnit());
 	}
 	_save->getPathfinding()->calculate(_currentAction.actor, _currentAction.target, _currentAction.getMoveType());
-	statePushBack(new UnitWalkBState(this, _currentAction));
+	executeAction(walk, false);
 }
 
 /**
@@ -3315,28 +5008,50 @@ void BattlescapeGame::spawnNewUnit(BattleItem* item)
 
 void BattlescapeGame::spawnNewUnit(BattleActionAttack attack, Position position)
 {
-	if (!attack.damage_item) // no idea how this happened, but make sure we have an item
+	// coop: on a replay the carrier item is normally already gone (a grenade removes
+	// itself before spawning), so the manifest names its rule instead.
+	const RuleItem* item = _coopSpawnReplay.active && _coopSpawnReplay.carrierRule
+							   ? _coopSpawnReplay.carrierRule
+							   : (attack.damage_item ? attack.damage_item->getRules() : nullptr);
+	if (!item) // no idea how this happened, but make sure we have an item
 		return;
 
-	const RuleItem* item = attack.damage_item->getRules();
 	const Unit* type = item->getSpawnUnit();
 
 	if (!type)
 		return;
 
+	// coop (PRD-P3 GAP-1): mid-battle spawns used to be rolled AND created on both
+	// machines. Two independent RNG::percent() draws decide differently, and even
+	// when they agree the two units (plus every built-in weapon they carry) are
+	// minted out of each machine's own id counter at a different moment - the
+	// worst id-drift class there is. The host decides and ships "spawn_units";
+	// the peer re-runs this very function from that manifest and nowhere else.
+	const bool coopHost = getCoopMod()->getCoopStatic() && getCoopMod()->getHost();
+	const bool coopPeer = getCoopMod()->getCoopStatic() && !getCoopMod()->getHost();
+	if (coopPeer && !_coopSpawnReplay.active)
+	{
+		return;
+	}
+
+	// The seed is captured (not consumed) before the first roll, so replaying it on
+	// the peer reproduces this machine's draws exactly.
+	const uint64_t coopSeed = RNG::getSeed();
+
 	int chance = item->getSpawnUnitChance();
 	if (auto* conf = attack.weapon_item ? attack.weapon_item->getActionConf(attack.type) : nullptr)
 	{
 		chance = useIntNullable(conf->ammoSpawnUnitChanceOverride, chance);
 	}
 
-	if (!RNG::percent(chance))
+	// The peer only ever gets here because the host already rolled a spawn.
+	if (!_coopSpawnReplay.active && !RNG::percent(chance))
 	{
 		return;
 	}
 
 	BattleUnit* owner = attack.attacker;
-	if (owner == nullptr)
+	if (owner == nullptr && attack.damage_item)
 	{
 		owner = attack.damage_item->getOwner();
 		if (owner == nullptr)
@@ -3344,6 +5059,10 @@ void BattlescapeGame::spawnNewUnit(BattleActionAttack attack, Position position)
 			owner = attack.damage_item->getPreviousOwner();
 		}
 	}
+	if (_coopSpawnReplay.active)
+	{
+		owner = coopFindUnit(_coopSpawnReplay.ownerId);
+	}
 
 	// Check which faction the new unit will be
 	UnitFaction faction;
@@ -3369,12 +5088,22 @@ void BattlescapeGame::spawnNewUnit(BattleActionAttack attack, Position position)
 			break;
 		}
 	}
+	// coop: the faction can hang off the carrier's owner, whose local lookup may
+	// fail on the peer - so it rides the manifest and wins.
+	if (_coopSpawnReplay.active && _coopSpawnReplay.faction >= 0)
+	{
+		faction = (UnitFaction)_coopSpawnReplay.faction;
+	}
 
 	if (_save->isPreview() && faction != FACTION_PLAYER)
 	{
 		return;
 	}
 
+	// coop: first id this spawn is about to mint, so the manifest can name the
+	// whole range (the unit's built-in weapons are minted inside initUnit below).
+	const int coopFirstItemId = _save->getCurrentItemIdValue();
+
 	// Create the unit
 	BattleUnit* newUnit = _save->createTempUnit(type, faction);
 
@@ -3384,6 +5113,13 @@ void BattlescapeGame::spawnNewUnit(BattleActionAttack attack, Position position)
 	if (positionValid) // Place the unit and initialize it in the battlescape
 	{
 		int unitDirection = attack.attacker ? attack.attacker->getDirection() : RNG::generate(0, 7);
+		// coop: the two machines' tile occupancy is read at slightly different
+		// moments, so direction and item level ride the manifest rather than being
+		// re-derived. Seed replay alone would not survive an extra local RNG draw.
+		if (_coopSpawnReplay.active && _coopSpawnReplay.direction >= 0)
+		{
+			unitDirection = _coopSpawnReplay.direction;
+		}
 		// If this is a tank, arm it with its weapon
 		if (getMod()->getItem(newUnit->getType()) && getMod()->getItem(newUnit->getType())->isFixed())
 		{
@@ -3406,6 +5142,10 @@ void BattlescapeGame::spawnNewUnit(BattleActionAttack attack, Position position)
 
 		// Pick the item sets if the unit has builtInWeaponSets
 		size_t itemLevel = (size_t)(getMod()->getAlienItemLevels().at(_save->getAlienItemLevel()).at(RNG::generate(0, 9)));
+		if (_coopSpawnReplay.active && _coopSpawnReplay.itemLevel >= 0)
+		{
+			itemLevel = (size_t)_coopSpawnReplay.itemLevel;
+		}
 
 		// Initialize the unit and its position
 		newUnit->setTile(_save->getTile(position), _save);
@@ -3418,7 +5158,41 @@ void BattlescapeGame::spawnNewUnit(BattleActionAttack attack, Position position)
 		_save->initUnit(newUnit, itemLevel);
 
 		getTileEngine()->applyGravity(newUnit->getTile());
+
+		// coop: applyGravity reads the floor the blast just destroyed, and tile
+		// destruction is itself host-authoritative and arrives on its own packet -
+		// so the peer can drop the unit a level differently. The landing tile is
+		// state, not a decision: take the host's.
+		if (_coopSpawnReplay.active && _coopSpawnReplay.finalPos != TileEngine::invalid
+			&& newUnit->getPosition() != _coopSpawnReplay.finalPos)
+		{
+			Log(LOG_INFO) << "coop: spawn_units - local gravity put unit " << newUnit->getId()
+						  << " at " << newUnit->getPosition() << ", host says "
+						  << _coopSpawnReplay.finalPos << "; using the host's";
+			newUnit->setTile(_save->getTile(_coopSpawnReplay.finalPos), _save);
+			newUnit->setPosition(_coopSpawnReplay.finalPos);
+		}
+
 		getTileEngine()->calculateFOV(newUnit->getPosition()); // happens fairly rarely, so do a full recalc for units in range to handle the potential unit visible cache issues.
+
+		// coop
+		if (coopHost)
+		{
+			sendCoopSpawnManifest("unit", item, type->getType(), coopSeed, position,
+								  newUnit->getPosition(), attack.attacker, owner,
+								  (int)faction, unitDirection, (int)itemLevel,
+								  newUnit->getId(), coopFirstItemId, _save->getCurrentItemIdValue() - 1);
+		}
+		else if (_coopSpawnReplay.active)
+		{
+			if ((_coopSpawnReplay.unitId >= 0 && _coopSpawnReplay.unitId != newUnit->getId())
+				|| (_coopSpawnReplay.firstItemId >= 0 && _coopSpawnReplay.firstItemId != coopFirstItemId))
+			{
+				Log(LOG_ERROR) << "coop: spawn_units id drift - host unit " << _coopSpawnReplay.unitId
+							   << "/item " << _coopSpawnReplay.firstItemId << " vs local unit " << newUnit->getId()
+							   << "/item " << coopFirstItemId << " (rule " << type->getType() << ")";
+			}
+		}
 	}
 	else
 	{
@@ -3444,28 +5218,41 @@ void BattlescapeGame::spawnNewItem(BattleItem* item)
 
 void BattlescapeGame::spawnNewItem(BattleActionAttack attack, Position position)
 {
-	if (!attack.damage_item) // no idea how this happened, but make sure we have an item
+	// coop: see spawnNewUnit - on a replay the carrier's rule comes off the manifest.
+	const RuleItem* item = _coopSpawnReplay.active && _coopSpawnReplay.carrierRule
+							   ? _coopSpawnReplay.carrierRule
+							   : (attack.damage_item ? attack.damage_item->getRules() : nullptr);
+	if (!item) // no idea how this happened, but make sure we have an item
 		return;
 
-	const RuleItem* item = attack.damage_item->getRules();
 	const RuleItem* type = item->getSpawnItem();
 
 	if (!type)
 		return;
 
+	// coop (PRD-P3 GAP-1): host decides, peer replays. See spawnNewUnit.
+	const bool coopHost = getCoopMod()->getCoopStatic() && getCoopMod()->getHost();
+	const bool coopPeer = getCoopMod()->getCoopStatic() && !getCoopMod()->getHost();
+	if (coopPeer && !_coopSpawnReplay.active)
+	{
+		return;
+	}
+
+	const uint64_t coopSeed = RNG::getSeed();
+
 	int chance = item->getSpawnItemChance();
 	if (auto* conf = attack.weapon_item ? attack.weapon_item->getActionConf(attack.type) : nullptr)
 	{
 		chance = useIntNullable(conf->ammoSpawnItemChanceOverride, chance);
 	}
 
-	if (!RNG::percent(chance))
+	if (!_coopSpawnReplay.active && !RNG::percent(chance))
 	{
 		return;
 	}
 
 	BattleUnit* owner = attack.attacker;
-	if (owner == nullptr)
+	if (owner == nullptr && attack.damage_item)
 	{
 		owner = attack.damage_item->getOwner();
 		if (owner == nullptr)
@@ -3473,6 +5260,13 @@ void BattlescapeGame::spawnNewItem(BattleActionAttack attack, Position position)
 			owner = attack.damage_item->getPreviousOwner();
 		}
 	}
+	if (_coopSpawnReplay.active)
+	{
+		owner = coopFindUnit(_coopSpawnReplay.ownerId);
+	}
+
+	// coop: first minted id, for the manifest / the peer's drift check.
+	const int coopFirstItemId = _save->getCurrentItemIdValue();
 
 	// Create the item
 	auto* newItem = _save->createTempItem(type);
@@ -3493,6 +5287,21 @@ void BattlescapeGame::spawnNewItem(BattleActionAttack attack, Position position)
 			getTileEngine()->calculateLighting(LL_ITEMS, tile->getPosition());
 			getTileEngine()->calculateFOV(tile->getPosition(), newItem->getVisibilityUpdateRange(), false);
 		}
+
+		// coop
+		if (coopHost)
+		{
+			sendCoopSpawnManifest("item", item, type->getType(), coopSeed, position,
+								  newItem->getTile() ? newItem->getTile()->getPosition() : position,
+								  attack.attacker, owner,
+								  -1, -1, -1,
+								  -1, coopFirstItemId, _save->getCurrentItemIdValue() - 1);
+		}
+		else if (_coopSpawnReplay.active && _coopSpawnReplay.firstItemId >= 0 && _coopSpawnReplay.firstItemId != coopFirstItemId)
+		{
+			Log(LOG_ERROR) << "coop: spawn_units id drift - host item " << _coopSpawnReplay.firstItemId
+						   << " vs local item " << coopFirstItemId << " (rule " << type->getType() << ")";
+		}
 	}
 	else
 	{
@@ -3500,6 +5309,130 @@ void BattlescapeGame::spawnNewItem(BattleActionAttack attack, Position position)
 	}
 }
 
+/**
+ * coop: id -> live BattleUnit, or null. Never fabricates.
+ */
+BattleUnit* BattlescapeGame::coopFindUnit(int unitId) const
+{
+	if (unitId < 0)
+	{
+		return nullptr;
+	}
+	for (auto* u : *_save->getUnits())
+	{
+		if (u->getId() == unitId)
+		{
+			return u;
+		}
+	}
+	return nullptr;
+}
+
+/**
+ * coop (PRD-P3 GAP-1): ships one mid-battle spawn to the peer. Carries the RNG seed
+ * the host spawned from AND every value the peer must not re-derive (carrier rule,
+ * faction, owner, direction, built-in weapon item level), plus the ids the host
+ * minted so the peer can prove it minted the same ones.
+ */
+void BattlescapeGame::sendCoopSpawnManifest(const char* kind, const RuleItem* carrierRule, const std::string& rule, uint64_t seed, Position position, Position finalPos, const BattleUnit* attacker, const BattleUnit* owner, int faction, int direction, int itemLevel, int unitId, int firstItemId, int lastItemId)
+{
+	Json::Value root;
+	root["state"] = "spawn_units";
+	// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+	// client's action_end apply-barrier waits for this spawn/id-manifest (no-op off the
+	// parallel host, _openChainSeq==0).
+	connectionTCP::coopStampChainSeq(root);
+	root["seed"] = (Json::UInt64)seed;
+
+	Json::Value entry(Json::objectValue);
+	entry["kind"] = kind;
+	entry["rule"] = rule;
+	entry["carrier_rule"] = carrierRule ? carrierRule->getType() : "";
+	entry["attacker_id"] = attacker ? attacker->getId() : -1;
+	entry["owner_id"] = owner ? owner->getId() : -1;
+	entry["faction"] = faction;
+	entry["unit_id"] = unitId;
+	entry["pos"]["x"] = position.x;
+	entry["pos"]["y"] = position.y;
+	entry["pos"]["z"] = position.z;
+	entry["final_pos"]["x"] = finalPos.x;
+	entry["final_pos"]["y"] = finalPos.y;
+	entry["final_pos"]["z"] = finalPos.z;
+	entry["direction"] = direction;
+	entry["itemLevel"] = itemLevel;
+
+	Json::Value itemIds(Json::arrayValue);
+	for (int id = firstItemId; id <= lastItemId; ++id)
+	{
+		itemIds.append(id);
+	}
+	entry["item_ids"] = itemIds;
+
+	Json::Value spawns(Json::arrayValue);
+	spawns.append(entry);
+	root["spawns"] = spawns;
+
+	getCoopMod()->sendTCPPacketData(root.toStyledString());
+}
+
+/**
+ * coop (PRD-P3 GAP-1): peer-side entry point for the host's spawn manifest.
+ */
+void BattlescapeGame::spawn_units(std::string obj_str)
+{
+	Json::Reader reader;
+	Json::Value obj;
+	reader.parse(obj_str, obj);
+
+	const uint64_t seed = obj["seed"].asUInt64();
+	const Json::Value& spawns = obj["spawns"];
+
+	for (Json::ArrayIndex i = 0; i < spawns.size(); ++i)
+	{
+		const Json::Value& e = spawns[i];
+		const std::string kind = e["kind"].asString();
+		Position pos(e["pos"]["x"].asInt(), e["pos"]["y"].asInt(), e["pos"]["z"].asInt());
+
+		// The carrier item is usually already destroyed by the blast that spawned
+		// through it, so the manifest names its RULE. Nothing here ever constructs a
+		// BattleItem (issue #74).
+		const RuleItem* carrier = getMod()->getItem(e["carrier_rule"].asString());
+		if (!carrier)
+		{
+			Log(LOG_ERROR) << "coop: spawn_units - unknown carrier rule '" << e["carrier_rule"].asString() << "', skipped";
+			continue;
+		}
+
+		_coopSpawnReplay.active = true;
+		_coopSpawnReplay.carrierRule = carrier;
+		_coopSpawnReplay.faction = e.get("faction", -1).asInt();
+		_coopSpawnReplay.ownerId = e.get("owner_id", -1).asInt();
+		_coopSpawnReplay.direction = e.get("direction", -1).asInt();
+		_coopSpawnReplay.itemLevel = e.get("itemLevel", -1).asInt();
+		_coopSpawnReplay.unitId = e.get("unit_id", -1).asInt();
+		_coopSpawnReplay.firstItemId = e["item_ids"].empty() ? -1 : e["item_ids"][0u].asInt();
+		_coopSpawnReplay.finalPos = e.isMember("final_pos")
+										? Position(e["final_pos"]["x"].asInt(),
+												   e["final_pos"]["y"].asInt(),
+												   e["final_pos"]["z"].asInt())
+										: TileEngine::invalid;
+
+		RNG::setSeed(seed);
+
+		BattleActionAttack attack{ BA_NONE, coopFindUnit(e.get("attacker_id", -1).asInt()), nullptr, nullptr, };
+		if (kind == "unit")
+		{
+			spawnNewUnit(attack, pos);
+		}
+		else
+		{
+			spawnNewItem(attack, pos);
+		}
+
+		_coopSpawnReplay = CoopSpawnReplay();
+	}
+}
+
 /**
  * Spawns units from items primed before battle
  */
@@ -4274,6 +6207,10 @@ int BattlescapeGame::checkForProximityGrenadesCoop(BattleUnit* unit)
 			}
 			if (!deathTrapItem)
 			{
+				// coop (PRD-P4): Tier-A spawn. The peer is REPLAYING the host's
+				// sweep, so consume-on-create is enough here - unlike the corpse
+				// case, the manifest lands before the item is made.
+				SharedEcon::CoopSubjectGuard coopGuard(_save, "death_trap", unit->getId());
 				deathTrapItem = _save->createItemForTile(deathTrapRule, deathTrapTile);
 			}
 			if (deathTrapRule->getBattleType() == BT_PROXIMITYGRENADE)
@@ -4334,7 +6271,11 @@ int BattlescapeGame::checkForProximityGrenadesCoop(BattleUnit* unit)
 					}
 					else if (!isGrenade && fired)
 					{
-						forRemoval.push_back(item);
+						// coop (PRD-P3 GAP-8): `fired` is THIS machine's own
+						// RNG::percent(specialChance) inside fuseProximityEvent(), and
+						// a non-grenade item swept away by a proximity fuse is item
+						// EXISTENCE - a host decision. The host ships the exact set on
+						// the sweep packet's removed_items; nothing is deleted here.
 						if (g)
 						{
 							glow = true;
@@ -4348,6 +6289,9 @@ int BattlescapeGame::checkForProximityGrenadesCoop(BattleUnit* unit)
 						}
 					}
 				}
+				// coop (PRD-P3 GAP-8): always empty now - the non-grenade branch above
+				// no longer feeds it, because item existence is a host decision that
+				// arrives on the sweep packet's removed_items.
 				for (BattleItem* item : forRemoval)
 				{
 					_save->removeItem(item);
@@ -4416,6 +6360,8 @@ int BattlescapeGame::checkForProximityGrenades(BattleUnit* unit)
 			}
 			if (!deathTrapItem)
 			{
+				// coop (PRD-P4): record the id, so the two sends below can name it.
+				SharedEcon::CoopSpawnRecord coopRec("death_trap", unit->getId());
 				deathTrapItem = _save->createItemForTile(deathTrapRule, deathTrapTile);
 			}
 			if (deathTrapRule->getBattleType() == BT_PROXIMITYGRENADE)
@@ -4429,7 +6375,14 @@ int BattlescapeGame::checkForProximityGrenades(BattleUnit* unit)
 
 						Json::Value root;
 						root["state"] = "checkForProximityGrenades";
+						// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+						// client's action_end apply-barrier waits for this death-trap mint (no-op off the
+						// parallel host, _openChainSeq==0).
+						connectionTCP::coopStampChainSeq(root);
 						root["unit_id"] = unit->getId();
+						// coop (PRD-P4): absent when the trap item was already on the
+						// tile (a second unit stepping on the same trap mints nothing).
+						SharedEcon::flushSpawnRecord(root, "death_trap", unit->getId());
 
 						_save->getBattleGame()->getCoopMod()->sendTCPPacketData(root.toStyledString());
 					}
@@ -4451,7 +6404,12 @@ int BattlescapeGame::checkForProximityGrenades(BattleUnit* unit)
 
 						Json::Value root;
 						root["state"] = "checkForProximityGrenades";
+						// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+						// client's action_end apply-barrier waits for this death-trap mint (no-op off the
+						// parallel host, _openChainSeq==0).
+						connectionTCP::coopStampChainSeq(root);
 						root["unit_id"] = unit->getId();
+						SharedEcon::flushSpawnRecord(root, "death_trap", unit->getId()); // coop (PRD-P4)
 
 						_save->getBattleGame()->getCoopMod()->sendTCPPacketData(root.toStyledString());
 					}
@@ -4467,6 +6425,9 @@ int BattlescapeGame::checkForProximityGrenades(BattleUnit* unit)
 
 	bool exploded = false;
 	bool glow = false;
+	// coop (PRD-P3 GAP-8): every non-grenade item this sweep removes, so the peer
+	// can delete exactly those instead of judging for itself.
+	Json::Value coopRemoved(Json::arrayValue);
 	int size = unit->getArmor()->getSize() + 1;
 	for (int tx = -1; tx < size; tx++)
 	{
@@ -4493,6 +6454,10 @@ int BattlescapeGame::checkForProximityGrenades(BattleUnit* unit)
 
 									Json::Value root;
 									root["state"] = "checkForProximityGrenades";
+									// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+									// client's action_end apply-barrier waits for this proximity trigger (no-op off the
+									// parallel host, _openChainSeq==0).
+									connectionTCP::coopStampChainSeq(root);
 									root["unit_id"] = unit->getId();
 
 									_save->getBattleGame()->getCoopMod()->sendTCPPacketData(root.toStyledString());
@@ -4522,11 +6487,33 @@ int BattlescapeGame::checkForProximityGrenades(BattleUnit* unit)
 				}
 				for (BattleItem* item : forRemoval)
 				{
+					Json::Value e;
+					e["id"] = item->getId();
+					e["type"] = item->getRules()->getType();
+					coopRemoved.append(e);
 					_save->removeItem(item);
 				}
 			}
 		}
 	}
+
+	// coop (PRD-P3 GAP-8): ship the removal set. A sweep packet carrying
+	// removed_items tells the peer to delete exactly these; one WITHOUT it (the
+	// three sends above) is the trigger notification that makes the peer run its
+	// own scan, for the explosion states and the glow bookkeeping.
+	if (!coopRemoved.empty()
+		&& getCoopMod()->getCoopStatic() == true && getCoopMod()->getHost() == true)
+	{
+		Json::Value root;
+		root["state"] = "checkForProximityGrenades";
+		// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+		// client's action_end apply-barrier waits for these swept-item deletions (no-op off the
+		// parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(root);
+		root["unit_id"] = unit->getId();
+		root["removed_items"] = coopRemoved;
+		getCoopMod()->sendTCPPacketData(root.toStyledString());
+	}
 	return exploded ? 2 : glow ? 1
 							   : 0;
 }
@@ -4684,10 +6671,21 @@ void BattlescapeGame::clearWaypointsCoop()
 	getMap()->getWaypoints()->clear();
 }
 
-void BattlescapeGame::CoopShoot()
+void BattlescapeGame::CoopShoot(const BattleAction& action)
 {
-	_states.push_back(new ProjectileFlyBState(this, _currentAction));
-	statePushFront(new UnitTurnBState(this, _currentAction)); // first of all turn towards the target
+	// coop (PRD-P1): runs on the replay's own action - shootPlayerTarget no
+	// longer parks the peer's shot on the local player's _currentAction.
+	_states.push_back(new ProjectileFlyBState(this, action));
+	// coop (PRD-P10): chargeTUs = FALSE, matching turnPlayerTarget's replay.
+	// `actor_tu` on the shot packet is read at the TOP of the executor's
+	// ProjectileFlyBState::init(), i.e. AFTER its own UnitTurnBState has already
+	// charged the facing - so charging it again here spent the turn twice on the
+	// peer. REACTION fire is the shape that made it permanent: the executor
+	// turns for free inside ProjectileFlyBState::init (`lookAt` + the turn
+	// loop, no TU), so every replayed reaction shot billed the peer a facing
+	// cost the executor never paid, and a unit that does not shoot again keeps
+	// the deficit until the next turn's reset.
+	statePushFront(new UnitTurnBState(this, action, false)); // first of all turn towards the target
 }
 
 void BattlescapeGame::hitCoop(BattleActionAttack attack, Position center, int power, const RuleDamageType* type, bool rangeAtack, int terrainMeleeTilePart, uint64_t seed)
diff --git a/src/Battlescape/BattlescapeGame.h b/src/Battlescape/BattlescapeGame.h
index ebf7a2a82..5d9777a87 100644
--- a/src/Battlescape/BattlescapeGame.h
+++ b/src/Battlescape/BattlescapeGame.h
@@ -19,10 +19,13 @@
  */
 #include "Position.h"
 #include "../Mod/RuleItem.h"
+#include "../Mod/Unit.h" // coop (Phase 2b atomic unit death): UnitStatus/UnitFaction for CoopDeathGhost
 #include "../Engine/HelperMeta.h"
+#include <cstdint>
 #include <string>
 #include <list>
 #include <vector>
+#include <json/json.h> // coop (Phase 2b atomic unit death): coopApplyCasualty(const Json::Value&)
 
 namespace OpenXcom
 {
@@ -91,6 +94,18 @@ struct BattleAction : BattleActionCost
 	bool sprayTargeting; // Used to separate waypoint checks between confirm firing mode and the "spray" autoshot
 	BattleActionOrigin relativeOrigin = BattleActionOrigin::CENTRE; // preferred origin voxel (centre, left or right)
 	int terrainMeleeTilePart = 0; // terrain melee
+	// coop (PRD-P5): true only on the stack-local action a REPLAYED (peer- or
+	// AI-originated) chain runs on - see BattlescapeGame::makeReplayAction. The
+	// BStates copy the action they are given, so this rides the whole chain and
+	// lets display-only code tell "the local player did this" from "I am watching
+	// my teammate". Used to stop a peer action yanking the local camera.
+	bool coopReplay = false;
+	// coop (PRD-P6): the medikit operands an `action_intent` carries that have no
+	// home in BattleAction's normal fields, so ONE executeAction() can dispatch
+	// every kind. -1 = "this is not a medikit action".
+	int coopTargetUnit = -1;
+	int coopMedikitMode = -1;   // BattleMediKitAction
+	int coopBodyPart = 0;       // UnitBodyPart
 
 	/// Default constructor
 	BattleAction() : target(-1, -1, -1), targeting(false), value(0), diff(0), autoShotCounter(0), cameraPosition(0, 0, -1), desperate(false), finalFacing(-1), finalAction(false), number(0), sprayTargeting(false) { }
@@ -128,6 +143,34 @@ struct BattlescapeTally
 	int vipInField = 0;
 };
 
+/**
+ * coop (parallel battlescape Phase 2b - atomic unit death): the death-ghost entry
+ * queued by BattlescapeGame::coopApplyCasualty once a `unit_casualty` packet's
+ * apply has run - the world is ALREADY final at that point (host absolutes), so
+ * this is the record the display-side death ANIMATION will replay against
+ * (Phase 2c). Phase 2b only queues a STUB entry (`started` flips true and the
+ * entry completes immediately, no BattleState, no animation) - the fields below
+ * are captured now so 2c can add the animation without touching the apply path.
+ */
+struct CoopDeathGhost
+{
+	BattleUnit* unit;
+	Position pos;
+	int size;
+	UnitFaction faction;
+	UnitStatus finalStatus;
+	bool direct;
+	bool noSound;
+	int dirBeforeApply;
+	bool wasUnconsciousBefore;
+	bool visibleAtApply;
+	std::vector<int> hiddenItemIds;
+	uint32_t sideSeq;
+	uint32_t actionSeq;
+	bool bnd;
+	bool started = false;
+};
+
 /**
  * Battlescape game - the core game engine of the battlescape game.
  */
@@ -140,6 +183,12 @@ class BattlescapeGame
 	bool _playerPanicHandled;
 	int _AIActionCounter;
 	BattleAction _currentAction;
+	// coop (PRD-P1): turnPlayerTarget's "the unit already faces there, so this is
+	// a door-open" test used to compare against _currentAction.target, which only
+	// worked because the replay wrote the singleton action. The replay now builds
+	// a stack-local action, so it keeps its own last-target here instead of
+	// reading (and clobbering) the local player's action.
+	Position _replayTurnTarget = Position(-1, -1, -1);
 	bool _endTurnRequested;
 	bool _endConfirmationHandled;
 	bool _allEnemiesNeutralized;
@@ -157,6 +206,86 @@ class BattlescapeGame
 	std::vector<InfoboxOKState*> _infoboxQueue;
 	/// Shows the infoboxes in the queue (if any).
 	void showInfoBoxQueue();
+	// coop (PRD-P3 GAP-1): set only while spawn_units() replays a host manifest.
+	// While it is false a co-op peer refuses to spawn anything at all - the spawn
+	// chance, the spawn direction, the built-in-weapon item level and every id the
+	// spawn mints come from the host, never from this machine's RNG stream.
+	struct CoopSpawnReplay
+	{
+		bool active = false;
+		const RuleItem* carrierRule = nullptr;
+		int faction = -1;
+		int ownerId = -1;
+		int direction = -1;
+		int itemLevel = -1;
+		int unitId = -1;
+		int firstItemId = -1;
+		Position finalPos = Position(-1, -1, -1);
+	};
+	CoopSpawnReplay _coopSpawnReplay;
+	// coop (PRD-P7): "do not wait for this walk". Set by the arbiter when an input
+	// arrives while a SKIPPABLE chain is running (host) or while an action packet
+	// sits deferred behind the receive gate (client); cleared the moment _states
+	// drains or the chain stops being skippable. Only the walk/turn/fall think
+	// intervals read it - never a projectile, explosion, death or melee state.
+	bool _coopFastForward = false;
+	// coop (chain-atomicity Strand A): true while a BOUNDARY-phase checkForCasualties
+	// pass is running (endTurn side-close, neutral->player side-start, boundary fuse/
+	// terrain explosion, battle-start hidden explosion). A UnitDieBState constructed
+	// inside the bracket latches it into _coopBoundaryDeath and keeps its death carriers
+	// seq-0 (covered by the ordered boundary marker) instead of opening a loose chain.
+	// Set/cleared tightly around each boundary casualty pass; mid-side casualty passes
+	// (reaction fire, mid-side explosion, falls) leave it false so those deaths stamp.
+	bool _coopBoundaryCasualty = false;
+	// coop (PRD-P8 §5): the reserve mode the CURRENTLY RUNNING intent was sent
+	// with. Reserve is per-machine in parallel mode, so a client's chain must be
+	// judged against the client's reserve - and the walk/turn per-step checks run
+	// long after coopExecuteIntent has returned, which is why this is a chain-
+	// scoped override rather than a swap around the synchronous call.
+	// Keyed on the ACTOR so a leaked override can never reach another unit.
+	bool _coopChainReserveActive = false;
+	int _coopChainReserveUnit = -1;
+	BattleActionType _coopChainReserve = BA_NONE;
+	bool _coopChainKneelReserve = false;
+	// coop (Phase 2a unit_casualty): the corpse-mint OUTCOME captured at the mint
+	// decision - coopMintCorpse()'s branches, or the respawn/neither-branch edge
+	// case in UnitDieBState::think() which never calls coopMintCorpse - and read
+	// back by UnitDieBState::deinit() when it builds the parallel-host
+	// `unit_casualty` packet's "corpse"/"spill" fields. think() resets this to the
+	// mode-3 default immediately before every mint decision, so a respawn casualty
+	// can never read a stale mode left over from a PRIOR casualty's mint. Transient
+	// bookkeeping only - never serialized directly.
+	// mode: 0 = on-tile mint, 1 = carried convert, 2 = overKill/no corpse,
+	// 3 = none (respawn/convert, or the neither-branch edge case).
+	int _coopCorpseMintMode = 3;
+	int _coopCorpseMintCarrierId = -1;
+	bool _coopCorpseMintSpill = false;
+	// coop (parallel battlescape Phase 2b - atomic unit death): the death-ghost
+	// queue coopQueueDeathGhost() appends to. Phase 2b's queue is a STUB (every
+	// entry completes immediately - see coopQueueDeathGhost); Phase 2c drives the
+	// actual death animation off it. Cleared in the destructor.
+	std::vector<CoopDeathGhost> _coopPendingGhosts;
+	uint32_t _coopDeathGhostsCompleted = 0;
+	// coop (Phase 2c): the ghost currently animating (a copy the running ghost-mode
+	// UnitDieBState points at), and whether one is live. coopPollDeathGhosts() starts
+	// the head of _coopPendingGhosts when the state queue is idle and the display has
+	// caught up to that death's chain seq; coopFinishActiveGhost() clears it on pop.
+	CoopDeathGhost _coopActiveGhost{};
+	bool _coopGhostActive = false;
+	/// coop (Phase 2c): when idle, start the next queued death ghost if its display
+	/// gate is met. Called from handleState(); a cheap no-op off the parallel client.
+	void coopPollDeathGhosts();
+	/// The reserve settings checkReservedTU/kneel must judge `bu` by: the running
+	/// intent's when it owns this actor, otherwise this machine's own.
+	BattleActionType coopReserveModeFor(const BattleUnit* bu) const;
+	bool coopKneelReserveFor(const BattleUnit* bu) const;
+	/// Drops the chain-scoped reserve override (chain drained, or a local action
+	/// is about to run instead).
+	void coopClearChainReserve();
+	/// coop: id -> live BattleUnit (null when absent). Never fabricates.
+	BattleUnit* coopFindUnit(int unitId) const;
+	/// coop: ships one spawn manifest entry to the peer (host only).
+	void sendCoopSpawnManifest(const char* kind, const RuleItem* carrierRule, const std::string& rule, uint64_t seed, Position position, Position finalPos, const BattleUnit* attacker, const BattleUnit* owner, int faction, int direction, int itemLevel, int unitId, int firstItemId, int lastItemId);
 public:
 	bool _AISecondMove, _playedAggroSound;
 	/// is debug mode enabled in the battlescape?
@@ -171,17 +300,69 @@ class BattlescapeGame
 	int getCoopActorID();
 	int getCoopGamemode();
 	std::string getCoopWeaponHand();
+	/// Builds the stack-local BattleAction a replayed peer/AI action runs on, so
+	/// replaying never writes the singleton _currentAction (which belongs to the
+	/// LOCAL player's UI) - PRD-P1.
+	static BattleAction makeReplayAction(BattleUnit* actor);
 	void movePlayerTarget(std::string obj);
 	void turnPlayerTarget(std::string str_obj);
 	void turnPlayerTargetAfter(std::string str_obj);
 	void psi_attack(std::string str_obj);
 	void melee_attack(std::string str_obj);
+	/// coop (PRD-P3 GAP-1): applies a host "spawn_units" manifest - re-runs the very
+	/// same spawn code from the host's RNG seed, with the host's direction/itemLevel,
+	/// so the peer mints identical unit and item ids instead of rolling its own.
+	void spawn_units(std::string str_obj);
 	bool getHost();
 	bool isCoop();
 	void abortCoopPath(int x, int y, int z, int unit_id, int setDirection, int setFaceDirection);
 	void abortCoopPath2();
 	void sendPacketData(std::string data);
 	void coopDeath(BattleUnit *unit, const RuleDamageType *damageType, bool noSound);
+	/// coop (item 3, mint-at-apply): the world-mutating half of a death - corpse
+	/// item creation, inventory spill to the ground, and the unit-tile unlink -
+	/// extracted from UnitDieBState::convertUnitToCorpse so the parallel replay
+	/// client can run it at the after_unit_death packet apply (bookkeeping clock,
+	/// host manifest ids) instead of on its animation clock.
+	void coopMintCorpse(BattleUnit *unit, bool overKill);
+	/// coop (parallel battlescape Phase 2b - atomic unit death): the CLIENT-side
+	/// atomic apply of a `unit_casualty` packet - stats/position/attribution/status/
+	/// corpse-world absolutes, all host-derived, applied on the ordered bookkeeping
+	/// clock (see connectionTCP.cpp's `unit_casualty` handler for the watermark +
+	/// bystander-morale half of the split). Queues a CoopDeathGhost stub at the end
+	/// (Phase 2c wires the actual death animation off it).
+	void coopApplyCasualty(const Json::Value& obj);
+	/// coop (parallel battlescape Phase 2b - atomic unit death, STUB): records a
+	/// completed death-ghost entry. Phase 2b's world state is ALREADY final at
+	/// apply, so this stub marks the entry done immediately - no UnitDieBState, no
+	/// animation. Phase 2c replaces this body with the queued+started ghost.
+	void coopQueueDeathGhost(const CoopDeathGhost& g);
+	/// coop (Phase 2c): the ghost currently animating, or null when none is live.
+	const CoopDeathGhost* coopActiveGhost() const { return _coopGhostActive ? &_coopActiveGhost : nullptr; }
+	/// coop (Phase 2c): finish the active ghost - the ghost-mode UnitDieBState calls
+	/// this on its last frame (override already cleared). Advances the completed count.
+	void coopFinishActiveGhost();
+	/// coop (Phase 2c): the active-or-pending ghost whose footprint covers @a pos, or
+	/// null. Map draws a pending ghost's unit STANDING (its override was seeded so) and
+	/// the active ghost mid-collapse, so a dying unit never blinks out before its turn.
+	const CoopDeathGhost* coopGhostCoveringTile(Position pos) const;
+	/// coop (Phase 2c): true if any active/pending ghost has hidden corpse/kit ids -
+	/// the Map item-draw fast path stays on stock getTopItem() when this is false.
+	bool coopHasHiddenGhostItems() const;
+	/// coop (Phase 2c): true if @a itemId belongs to any active/pending ghost's hidden
+	/// set (the minted corpse + spilled kit stay invisible until the collapse ends).
+	bool coopIsGhostHiddenItem(int itemId) const;
+	/// coop (Phase 2b introspection): death-ghost entries completed so far.
+	uint32_t coopDeathGhostsCompleted() const { return _coopDeathGhostsCompleted; }
+	/// coop (Phase 2c introspection): queued-but-not-yet-completed ghosts (pending +
+	/// the one active).
+	uint32_t coopDeathGhostsPending() const { return static_cast<uint32_t>(_coopPendingGhosts.size()) + (_coopGhostActive ? 1u : 0u); }
+	/// coop (Phase 2c introspection): the per-ghost display state (pending + active),
+	/// for the harness (parallel_state.deathGhosts). Non-const: maps status via getCoopMod().
+	Json::Value coopDeathGhostsJson();
+	/// coop (Phase 2c introspection): the active ghost's hidden corpse/kit ids (union
+	/// with pending), for the harness (battle_state.hiddenItemIds).
+	Json::Value coopHiddenItemIdsJson() const;
 	// coop
 	void teleport(int x, int y, int z, BattleUnit* unit);
 	void setTileCoop(Position pos, BattleUnit &unit);
@@ -205,8 +386,77 @@ class BattlescapeGame
 	void statePushNext(BattleState *bs);
 	/// Pushes a state to the back of the list.
 	void statePushBack(BattleState *bs);
+	// ---- coop (PRD-P6): action intents ------------------------------------
+	/// THE executor's single entry point for a player-initiated action. Factored
+	/// out of the local-input tails so the host's own clicks and a client's
+	/// `action_intent` run exactly the same code. `calculatePath` is false when
+	/// the caller has already run Pathfinding::calculate for this move (the
+	/// mapClick tail has, an intent has not).
+	void executeAction(BattleAction& action, bool calculatePath = true);
+	/// The door every player-initiated action passes through. Returns TRUE when
+	/// the caller must NOT execute anything locally:
+	///  - parallel CLIENT: the action was shipped as an `action_intent`;
+	///  - parallel HOST: admission was refused, and the busy flash is up.
+	/// Classic co-op and single player always return false - untouched.
+	bool coopRouteAction(BattleAction& action, const std::string& kind);
+	/// Same door for a medikit press (the operands do not fit a BattleAction).
+	bool coopRouteMedikit(BattleAction* action, BattleUnit* target, int medikitMode, int bodyPart);
+	/// Host: "" when the intent may run, otherwise a short cause; `warning` gets
+	/// the translatable key the client is told to flash. Takes the serialized
+	/// packet (like every sibling replay handler) so jsoncpp stays out of the
+	/// battlescape headers.
+	std::string coopValidateIntent(const std::string& intentJson, int seat, std::string& warning);
+	/// Host: rebuild the intent as a BattleAction and run it through executeAction.
+	/// `localOrigin` = this machine's own deferred click (PRD-P7 pending-admit), so
+	/// the action is NOT flagged coopReplay and the camera still follows it.
+	void coopExecuteIntent(const std::string& intentJson, bool localOrigin = false);
+	// ---- coop (PRD-P7): walk fast-forward ---------------------------------
+	/// True iff EVERY queued state is a walk / turn / fall of a FACTION_PLAYER
+	/// unit - i.e. the whole chain is animation nobody has to watch. A shot, an
+	/// explosion, a death, a melee or psi state, the end-turn sentinel, or a
+	/// non-player actor all make it false. Empty queue = false (nothing to skip).
+	bool chainIsSkippable() const;
+	/// Is the current chain being fast-forwarded (walk/turn/fall interval 0)?
+	bool getCoopFastForward() const { return _coopFastForward; }
+	/// Arms/disarms the fast-forward. Arming is refused outside parallel mode, so
+	/// classic co-op and single player can never take the interval-0 branch.
+	void setCoopFastForward(bool on);
+	/// coop (chain-atomicity Strand A): boundary-casualty phase bracket. A UnitDieBState
+	/// reads coopBoundaryCasualty() at construction to decide whether its death is a
+	/// boundary death (stays seq-0) or a loose mid-side death (opens a stamped chain).
+	void coopSetBoundaryCasualty(bool b) { _coopBoundaryCasualty = b; }
+	bool coopBoundaryCasualty() const { return _coopBoundaryCasualty; }
+	/// coop (Phase 2a unit_casualty): resets the corpse-mint bookkeeping. Called
+	/// from UnitDieBState::think() immediately before its mint decision (the
+	/// respawn/convertUnit branch never calls coopMintCorpse, so this is the only
+	/// place that clears a stale mode); coopMintCorpse() then overwrites it with the
+	/// real mode/carrier/spill when it runs.
+	void coopSetCorpseMintResult(int mode, int carrierItemId, bool spill) { _coopCorpseMintMode = mode; _coopCorpseMintCarrierId = carrierItemId; _coopCorpseMintSpill = spill; }
+	/// coop (Phase 2a unit_casualty): the corpse-mint outcome of the most recent
+	/// coopMintCorpse() call (or the think() reset) - see _coopCorpseMintMode.
+	int coopGetCorpseMintMode() const { return _coopCorpseMintMode; }
+	int coopGetCorpseMintCarrierId() const { return _coopCorpseMintCarrierId; }
+	bool coopGetCorpseMintSpill() const { return _coopCorpseMintSpill; }
+	/// Re-evaluates the fast-forward after the state queue changed (a push, a pop).
+	/// On a drain it also closes the host's action chain (PROTOCOL.md `action_end`).
+	void coopChainChanged();
+	// ---- coop (PRD-P8): the running intent's reserve override (introspection) --
+	/// The reserve mode the running client intent installed, or -1 when none is.
+	int coopChainReserveMode() const { return _coopChainReserveActive ? (int)_coopChainReserve : -1; }
+	/// The actor that override is keyed on, or -1.
+	int coopChainReserveUnit() const { return _coopChainReserveActive ? _coopChainReserveUnit : -1; }
+	/// Ships the classic replay packet for a mutation that has no BattleState of
+	/// its own, so the peer still sees it. (BState-driven kinds broadcast through
+	/// their own send sites.)
+	void coopSendKneelPacket(BattleUnit* bu);
+	void coopSendPrimePacket(const BattleAction& action, BattleActionType primeType);
+	void coopSendMedikitPacket(const BattleAction& action, BattleUnit* target, int medikitMode, int bodyPart, const std::string& medkitState);
+
 	/// Handles the result of non target actions, like priming a grenade.
 	void handleNonTargetAction();
+	/// Same, on an explicit action - lets a replayed peer action (coopActionClick)
+	/// run without writing the local player's _currentAction (PRD-P1).
+	void handleNonTargetAction(BattleAction& action);
 	// coop
 	void endTurnCoop();
 	void endBattleTurnCoop();
@@ -220,6 +470,11 @@ class BattlescapeGame
 	bool checkReservedTU(BattleUnit *bu, int tu, int energy, bool justChecking = false);
 	/// Handles unit AI.
 	void handleAI(BattleUnit *unit);
+	/// coop (PRD-I0): stamps an AI chain with an `action_seq` at the moment the AI
+	/// commits to an action - the alien-side analogue of the arbiter admitting an
+	/// intent. Host + parallel mode only; see the definition for why it sits at the
+	/// push sites rather than around the handleAI call.
+	void coopStampAiChain();
 	/// Drops an item and affects it with gravity.
 	void dropItem(Position position, BattleItem *item, bool removeItem = false, bool updateLight = true);
 	/// Converts a unit into a unit of another type.
@@ -247,6 +502,8 @@ class BattlescapeGame
 	BattleAction *getCurrentAction();
 	/// Determines whether there is an action currently going on.
 	bool isBusy() const;
+	/// coop: owner unit of the running action chain, skipping consequence states.
+	BattleUnit *getPrimaryBusyActor() const;
 	/// Activates primary action (left click).
 	void primaryAction(Position pos);
 	/// Activates secondary action (right click).
@@ -340,7 +597,7 @@ class BattlescapeGame
 	// coop
 	void setWaypointCoop(int x, int y, int z);
 	void clearWaypointsCoop();
-	void CoopShoot();
+	void CoopShoot(const BattleAction& action);
 	void hitCoop(BattleActionAttack attack, Position center, int power, const RuleDamageType* type, bool rangeAtack = true, int terrainMeleeTilePart = 0, uint64_t seed = 0);
 	void centerOnPositionCoop(Position pos);
 };
diff --git a/src/Battlescape/BattlescapeState.cpp b/src/Battlescape/BattlescapeState.cpp
index 683a2c351..7bb74ecf9 100644
--- a/src/Battlescape/BattlescapeState.cpp
+++ b/src/Battlescape/BattlescapeState.cpp
@@ -260,6 +260,18 @@ BattlescapeState::BattlescapeState() :
 
 	_txtDebug = new Text(300, 10, 20, 0);
 	_txtTooltip = new Text(300, 10, x + 2, y - 10);
+	// coop (PRD-P8): the readiness tally, right-aligned so it ends flush with the
+	// END TURN button (x + 240 .. x + 272) it belongs to. Same row as the tooltip,
+	// which is left-aligned from x + 2 and only visible on hover.
+	_txtCoopEndTurn = new Text(120, 9, x + 152, y - 10);
+	_coopTallyReady = -1;
+	_coopTallySeats = -1;
+	_coopTallyLocalReady = false;
+	// coop (parallel turns): the "Please wait for <player>'s action" banner. Full
+	// map width, centered, one row above the END TURN tally (y - 10) so the two
+	// never overlap. In the map strip just above the toolbar.
+	_txtCoopWait = new Text(screenWidth, 9, 0, y - 20);
+	_coopBusyOwnerSeat = -1;
 
 	// Palette transformations
 	auto* enviro = _save->getEnviroEffects();
@@ -393,6 +405,37 @@ BattlescapeState::BattlescapeState() :
 	add(_warning, "warning", "battlescape", _icons);
 	add(_txtDebug);
 	add(_txtTooltip, "textTooltip", "battlescape", _icons);
+	// coop (PRD-P8): borrows the tooltip's interface element to get wired up at
+	// all - geometry is re-applied afterwards, because add() would otherwise move
+	// this text on top of the tooltip (the element carries x/y/w/h). Right-aligned
+	// so it ends flush with the END TURN button; hidden until a seat arms.
+	add(_txtCoopEndTurn, "textTooltip", "battlescape", _icons);
+	_txtCoopEndTurn->setWidth(120);
+	_txtCoopEndTurn->setHeight(9);
+	_txtCoopEndTurn->setX(x + 152);
+	_txtCoopEndTurn->setY(y - 10);
+	_txtCoopEndTurn->setAlign(ALIGN_RIGHT);
+	_txtCoopEndTurn->setHighContrast(true);
+	// ...and painted the SAME green the numbered enemy indicators use for their
+	// green state: `_indicatorGreen` is the `squadsightUnits` interface element,
+	// which is the exact index blinkVisibleUnitButtons() fills those buttons with
+	// (54 in xcom1, 86 in xcom2). Read off that same member rather than written
+	// as a literal, so a mod that re-colours the indicators re-colours this too.
+	_txtCoopEndTurn->setColor(_indicatorGreen);
+	_txtCoopEndTurn->setVisible(false);
+	// coop (parallel turns): the "Please wait for <player>'s action" banner. Same
+	// borrow-the-tooltip-element trick as the tally above; geometry re-applied so
+	// add() does not park it on top of the tooltip. Same yellow + font as the
+	// toolbar warning widget (interface battlescape/warning color), centered.
+	add(_txtCoopWait, "textTooltip", "battlescape", _icons);
+	_txtCoopWait->setWidth(screenWidth);
+	_txtCoopWait->setHeight(9);
+	_txtCoopWait->setX(0);
+	_txtCoopWait->setY(y - 20);
+	_txtCoopWait->setAlign(ALIGN_CENTER);
+	_txtCoopWait->setHighContrast(true);
+	_txtCoopWait->setColor(_game->getMod()->getInterface("battlescape")->getElement("warning")->color);
+	_txtCoopWait->setVisible(false);
 	add(_btnLaunch);
 	_game->getMod()->getSurfaceSet("SPICONS.DAT")->getFrame(0)->blitNShade(_btnLaunch, 0, 0);
 	add(_btnPsi);
@@ -567,6 +610,12 @@ BattlescapeState::BattlescapeState() :
 	_btnEndTurn->setTooltip("STR_END_TURN");
 	_btnEndTurn->onMouseIn((ActionHandler)&BattlescapeState::txtTooltipInEndTurn);
 	_btnEndTurn->onMouseOut((ActionHandler)&BattlescapeState::txtTooltipOut);
+	// coop (PRD-P8): the parallel END TURN is a latching readiness toggle, so the
+	// button has to be able to SHOW that it is armed. INVERT_TOGGLE only enables
+	// the explicit toggle() call updateCoopEndTurnTally() makes - mousePress and
+	// mouseRelease both look for INVERT_CLICK, so click behaviour (and therefore
+	// classic co-op and single player) is byte-identical.
+	_btnEndTurn->allowToggleInversion();
 
 	_btnAbort->onMouseClick((ActionHandler)&BattlescapeState::btnAbortClick);
 	_btnAbort->onKeyboardPress((ActionHandler)&BattlescapeState::btnAbortClick, Options::keyBattleAbort);
@@ -822,14 +871,7 @@ BattlescapeState::BattlescapeState() :
 			if (_game->getCoopMod()->_waitBH == true)
 			{
 
-				if (_game->getCoopMod()->gamePaused == 2)
-				{
-					_game->getCoopMod()->setPlayerTurn(1);
-				}
-				else
-				{
-					_game->getCoopMod()->setPlayerTurn(_battleGame->isYourTurn);
-				}
+				_game->getCoopMod()->setPlayerTurn(_battleGame->isYourTurn);
 
 			}
 
@@ -841,14 +883,7 @@ BattlescapeState::BattlescapeState() :
 			if (_game->getCoopMod()->_waitBC == true)
 			{
 
-				if (_game->getCoopMod()->gamePaused == 2)
-				{
-					_game->getCoopMod()->setPlayerTurn(1);
-				}
-				else
-				{
-					_game->getCoopMod()->setPlayerTurn(_battleGame->isYourTurn);
-				}
+				_game->getCoopMod()->setPlayerTurn(_battleGame->isYourTurn);
 
 			}
 
@@ -1342,6 +1377,10 @@ void BattlescapeState::think()
 					battle_init_coop = false;
 
 					_game->getCoopMod()->_battleInit = true;
+					// coop (parallel turns): a BUSY deny in the last ~30 frames of the
+					// previous battle could otherwise leak a half-second wait banner
+					// into this one; clear the click-sync window on battle init.
+					_game->getCoopMod()->_coopWaitDenyTicks = 0;
 					_game->getCoopMod()->coopInventory = true;
 					_game->getCoopMod()->playerInsideCoopBase = false;
 					_game->getCoopMod()->_battleWindow = false;
@@ -1403,13 +1442,18 @@ void BattlescapeState::think()
 				_save->getBattleGame()->getCoopMod()->_clientPanicHandle = false;
 			}
 
-			// game paused
-			if (_game->getCoopMod()->gamePaused != 0 && _save->isPreview() == false && _game->getCoopMod()->_battleWindow == false && _battleGame->isYourTurn != 2 && _game->getCoopMod()->_battleInit == true)
-			{
-				showCoopWarning("Multiplayer Paused");
-
-			}
-			else if (_battleGame->isYourTurn == 1 && _save->isPreview() == false && _game->getCoopMod()->_battleWindow == false && _game->getCoopMod()->_battleInit == true)
+			// coop (PRD-P5): is the parallel shared player side live? Both machines
+			// then hold isYourTurn == 2 for the whole side, which kills every
+			// "is it my turn" term below - the off-turn banners have nothing left to
+			// describe and would only squat on the warning widget (showCoopWarning
+			// posts a PERSISTENT message that is repainted every frame, so it blocks
+			// the deny/ready flashes P6/P8 put through the same widget).
+			const bool coopParallel = _game->getCoopMod()->parallelTurnActive();
+
+			// coop: off-turn "<peer>'s Turn" banner. Classic mode only - parallel mode
+			// has no off-turn side (both machines hold isYourTurn == 2), so coopParallel
+			// gates it out.
+			if (_battleGame->isYourTurn == 1 && coopParallel == false && _save->isPreview() == false && _game->getCoopMod()->_battleWindow == false && _game->getCoopMod()->_battleInit == true)
 			{
 				showCoopWarning(_game->getCoopMod()->getCurrentClientName() + "'s Turn");
 			}
@@ -1504,16 +1548,27 @@ void BattlescapeState::think()
 					_btnEndTurn->setVisible(false);
 
 					// waiting
+					// coop (PRD-P5): the three states still exist in parallel mode -
+					// 3 is the pre-_battleInit wait every turn starts in, 1 only
+					// happens while the session is paused, and 4 is the commanding
+					// spectator the gift flow keys on. Only their PERSISTENT banners
+					// are dropped (see the coopParallel comment above).
 					if (_game->getCoopMod()->_playerTurn == 3)
 					{
-						showCoopWarning("Waiting for " + _game->getCoopMod()->getCurrentClientName());
+						if (!coopParallel)
+						{
+							showCoopWarning("Waiting for " + _game->getCoopMod()->getCurrentClientName());
+						}
 						_battleGame->isYourTurn = 3;
 					}
 					// other turn
 					else if (_game->getCoopMod()->_playerTurn == 1)
 					{
 
-						showCoopWarning(_game->getCoopMod()->getCurrentClientName() + "'s Turn");
+						if (!coopParallel)
+						{
+							showCoopWarning(_game->getCoopMod()->getCurrentClientName() + "'s Turn");
+						}
 
 						_battleGame->isYourTurn = 1;
 					}
@@ -1522,7 +1577,10 @@ void BattlescapeState::think()
 					{
 						_btnEndTurn->setVisible(true);
 						_battleGame->isYourTurn = 4;
-						showCoopWarning("You are in spectator mode");
+						if (!coopParallel)
+						{
+							showCoopWarning("You are in spectator mode");
+						}
 					}
 
 
@@ -1602,8 +1660,49 @@ void BattlescapeState::think()
 
 					_battleGame->isYourTurn = 2;
 
+					// coop (PRD-P5): PARALLEL UNIT SELECTOR.
+					// Both machines run the same ownership-only scan over their own
+					// seat's soldiers - there is no active/passive split left to
+					// branch on, and neither machine ships a `selected_unit` follow
+					// packet: in parallel that packet would hijack the peer's live
+					// selection, cursor and stat panel while the peer is acting.
+					if (coopParallel)
+					{
+						const int mySeat = connectionTCP::localSeat();
+						BattleUnit* mine = nullptr;
+
+						for (auto unit : *_save->getUnits())
+						{
+							if (unit->getCoop() == mySeat && unit->getHealth() > 0
+								&& unit->isOut() == false && unit->getFaction() == FACTION_PLAYER)
+							{
+								mine = unit;
+								break;
+							}
+						}
+
+						// No soldiers left to command: commanding spectator. The
+						// state survives (connectionTCP::refreshBattleGiftControlState
+						// and the gift flow read _playerTurn == 4); only the
+						// persistent banner is dropped.
+						if (mine == nullptr && _game->getCoopMod()->isCoopSession() == true)
+						{
+							_game->getCoopMod()->setPlayerTurn(4);
+						}
+						else
+						{
+							showCoopLongWarning("Your Turn");
+
+							if (mine)
+							{
+								_save->setSelectedUnit(mine);
+								updateSoldierInfo();
+								_battleGame->getCurrentAction()->actor = mine;
+							}
+						}
+					}
 					// CLIENT UNIT SELECTOR
-					if (_game->getCoopMod()->getHost() == false)
+					else if (_game->getCoopMod()->getHost() == false)
 					{
 
 						bool found = false;
@@ -1633,7 +1732,6 @@ void BattlescapeState::think()
 						{
 
 							showCoopLongWarning("Your Turn");
-							_game->getCoopMod()->gamePaused = 0;
 
 							if (_save->getSelectedUnit())
 							{
@@ -1654,7 +1752,9 @@ void BattlescapeState::think()
 					
 
 					// HOST UNIT SELECTOR
-					if (_game->getCoopMod()->getHost() == true)
+					// (classic only - the parallel branch above already handled both
+					// machines with one ownership scan)
+					if (coopParallel == false && _game->getCoopMod()->getHost() == true)
 					{
 
 						bool found = false;
@@ -1684,7 +1784,6 @@ void BattlescapeState::think()
 						else
 						{
 							showCoopLongWarning("Your Turn");
-							_game->getCoopMod()->gamePaused = 0;
 
 							if (_save->getSelectedUnit())
 							{
@@ -1707,7 +1806,7 @@ void BattlescapeState::think()
 			}
 
 			// coop
-			if (_game->getCoopMod()->_waitBC == true && _game->getCoopMod()->_waitBH == true && _game->getCoopMod()->gamePaused == 0 && _save->isPreview() == false && _game->getCoopMod()->_battleWindow == false && _game->getCoopMod()->_battleInit == true && _battleGame->isBusy() == false && _save->getBattleGame()->getCoopMod()->_clientPanicHandle == false)
+			if (_game->getCoopMod()->_waitBC == true && _game->getCoopMod()->_waitBH == true && _save->isPreview() == false && _game->getCoopMod()->_battleWindow == false && _game->getCoopMod()->_battleInit == true && _battleGame->isBusy() == false && _save->getBattleGame()->getCoopMod()->_clientPanicHandle == false)
 			{
 
 				_game->getCoopMod()->_waitBC = false;
@@ -1783,11 +1882,27 @@ void BattlescapeState::think()
 						_game->getCoopMod()->_isActiveAISync = true;
 
 					}
+					// PVE / PVE2 (after the first hand-off to the AI)
 					else
 					{
 
-						_game->getCoopMod()->setPlayerTurn(1);
-						_game->getCoopMod()->_isActivePlayerSync = false;
+						// coop (PRD-P5): the executor invariant. In parallel mode the
+						// client holds the SAME turn state as the host (both 2, full
+						// UI, both players act) but is never the executor - every
+						// send/RNG guard in the battle states reads
+						// _isActivePlayerSync, so leaving it false here is what keeps
+						// the host the single simulation authority. PRD-P6 routes the
+						// client's input to the host as intents.
+						if (_game->getCoopMod()->parallelTurnActive())
+						{
+							_game->getCoopMod()->setPlayerTurn(2);
+							_game->getCoopMod()->_isActivePlayerSync = false;
+						}
+						else
+						{
+							_game->getCoopMod()->setPlayerTurn(1);
+							_game->getCoopMod()->_isActivePlayerSync = false;
+						}
 
 					}
 
@@ -1819,6 +1934,10 @@ void BattlescapeState::think()
 						endTurnCoop();
 
 					}
+					// PVE / PVE2 (after the first hand-off to the AI). coop (PRD-P5):
+					// this branch already IS the parallel invariant on the host side
+					// (turn 2, executor true) - the client branch above is the one
+					// that changes.
 					else
 					{
 
@@ -1827,22 +1946,17 @@ void BattlescapeState::think()
 					}
 
 				}
-		
-				// PVP
-				// This only runs in PvP mode. The XCOM player�s time units are reset here. The alien player�s time units are reset elsewhere, after the XCOM player�s turn has ended
-				/*
-				if ((_game->getCoopMod()->getCoopGamemode() == 2 || _game->getCoopMod()->getCoopGamemode() == 3) && _game->getCoopMod()->_isActivePlayerSync == true)
-				{
-					for (auto& unit : *_save->getUnits())
-					{
-						unit->resetTimeUnitsAndEnergy();
-					}
-				}
-				*/
-			
+
 			}
 
 
+			// coop (PRD-P8): the readiness lamp + tally. Cheap - it early-outs
+			// unless the counts actually moved.
+			updateCoopEndTurnTally();
+
+			// coop (parallel turns): the "Please wait for <player>'s action" banner.
+			updateCoopWaitBanner();
+
 			_animTimer->think(this, 0);
 			_gameTimer->think(this, 0);
 			if (popped)
@@ -2103,7 +2217,9 @@ void BattlescapeState::mapClick(Action *action)
 		if (_game->isRightClick(action, true) && playableUnitSelected())
 		{
 
-			// coop
+			// coop: PRD-P5's temporary parallel input gate is gone from here -
+			// PRD-P6 lets the click through and BattlescapeGame::secondaryAction
+			// turns it into an `action_intent` on the client instead of a turn.
 			if (_battleGame->isYourTurn == 1 || _battleGame->isYourTurn == 3 || _battleGame->isYourTurn == 4)
 			{
 				return;
@@ -2116,7 +2232,7 @@ void BattlescapeState::mapClick(Action *action)
 			// Off-turn left clicks must not call primaryAction, but the local gift
 			// selection above has still been updated. On our own turn the same click
 			// also proceeds through the normal unit/action selection path.
-			if ((_battleGame->isYourTurn == 1 || _battleGame->isYourTurn == 3 || _battleGame->isYourTurn == 4))
+			if (_battleGame->isYourTurn == 1 || _battleGame->isYourTurn == 3 || _battleGame->isYourTurn == 4)
 			{
 				return;
 			}
@@ -2190,7 +2306,8 @@ void BattlescapeState::setSelectedCoopUnit(int actor_id)
 
 }
 
-void BattlescapeState::coopHealing(int actor_id, int type, int part, std::string medkit_state, std::string action_result, int time)
+void BattlescapeState::coopHealing(int actor_id, int type, int part, std::string medkit_state, std::string action_result, int time,
+								   int healer_id, int weapon_id, std::string weapon_type, std::string hand)
 {
 
 	BattleUnit *unit = 0;
@@ -2208,6 +2325,49 @@ void BattlescapeState::coopHealing(int actor_id, int type, int part, std::string
 	if (!unit)
 		return;
 
+	// coop (PRD-P1 rule, applied here by PRD-P6): replay on a stack-local action
+	// carrying the HEALER's own medikit. The classic branch below runs on
+	// _currentAction, whose weapon is whatever the receiving player happens to be
+	// holding - in parallel mode that is the other player's business entirely,
+	// and medikitUse() dereferences it.
+	if (connectionTCP::parallelTurnActive())
+	{
+		BattleUnit* healer = unit;
+		if (healer_id != -1)
+		{
+			for (auto u : *_save->getUnits())
+			{
+				if (u->getId() == healer_id)
+				{
+					healer = u;
+					break;
+				}
+			}
+		}
+
+		BattleAction action = BattlescapeGame::makeReplayAction(healer);
+		action.type = (BattleActionType)type;
+		action.Time = time;
+		action.weapon = BattlescapeGame::coopResolveWeapon(_save, healer, weapon_id, weapon_type, hand);
+		if (!action.weapon)
+		{
+			Log(LOG_INFO) << "coop: medkit replay skipped, healer " << healer->getId()
+						  << " has no '" << weapon_type << "' (id " << weapon_id << ")";
+			return;
+		}
+
+		BattleMediKitAction mode = medkit_state == "stimulant" ? BMA_STIMULANT
+								 : medkit_state == "painkiller" ? BMA_PAINKILLER
+																: BMA_HEAL;
+		UnitBodyPart bodyPart = mode == BMA_HEAL ? (UnitBodyPart)part : BODYPART_TORSO;
+		_battleGame->getTileEngine()->medikitUse(&action, unit, mode, bodyPart);
+		// both machines now hold the same charge counts, so this reaches the same
+		// answer on both and the item census stays equal.
+		_battleGame->getTileEngine()->medikitRemoveIfEmpty(&action);
+		updateSoldierInfo();
+		return;
+	}
+
 	_save->setSelectedUnit(unit);
 	_battleGame->getCurrentAction()->actor = unit;
 
@@ -2257,6 +2417,40 @@ void BattlescapeState::coopActiveGranade(int actor_id, int type, std::string han
 		return;
 
 	
+	// coop (PRD-P1 rule, applied here by PRD-P6): a replayed prime must not hand
+	// THIS player's selection and _currentAction to the peer's actor. In parallel
+	// mode both players are acting at once, so doing it yanked the receiver's
+	// hands panel and stat panel mid-click. Classic keeps the old writes: its
+	// hand branches below read _currentAction->actor.
+	if (connectionTCP::parallelTurnActive())
+	{
+		BattleItem* primed = nullptr;
+		if (item_id != 0)
+		{
+			for (auto* item : *unit->getInventory())
+			{
+				if (item->getId() == item_id)
+				{
+					primed = item;
+					break;
+				}
+			}
+		}
+		else if (hand == "left")
+		{
+			primed = unit->getLeftHandWeapon();
+		}
+		else
+		{
+			primed = unit->getRightHandWeapon();
+		}
+		if (primed)
+		{
+			primed->setFuseTimer(fusetimer);
+		}
+		return;
+	}
+
 	_save->setSelectedUnit(unit);
 	_battleGame->getCurrentAction()->actor = unit;
 
@@ -2328,8 +2522,10 @@ void BattlescapeState::coopActionClick(int actor_id, std::string hand, int type,
 	if (!unit)
 		return;
 
-	_save->setSelectedUnit(unit);
-	_battleGame->getCurrentAction()->actor = unit;
+	// coop (PRD-P1): replay on a stack-local action - selecting the peer's actor
+	// and writing _currentAction used to hand this player's cursor, hands panel
+	// and stat panel to whatever the teammate clicked.
+	BattleAction action = BattlescapeGame::makeReplayAction(unit);
 
 
 	if (target_x != -1 && target_y != -1 && target_z != -1)
@@ -2337,17 +2533,17 @@ void BattlescapeState::coopActionClick(int actor_id, std::string hand, int type,
 
 		Position current_target = Position(target_x, target_y, target_z);
 
-		_battleGame->getCurrentAction()->target = current_target;
+		action.target = current_target;
 
 	}
 
 
-	_battleGame->getCurrentAction()->type = (BattleActionType)type;
+	action.type = (BattleActionType)type;
 
 	// coop (issue #74): same resolution rule as shootPlayerTarget - the actor's
 	// own weapon, never a fabricated one.
 	BattleItem* acted = BattlescapeGame::coopResolveWeapon(_save, unit, weapon_id, weapon_type, hand);
-	_battleGame->getCurrentAction()->weapon = acted;
+	action.weapon = acted;
 
 	if (acted && acted == unit->getLeftHandWeapon())
 	{
@@ -2359,33 +2555,33 @@ void BattlescapeState::coopActionClick(int actor_id, std::string hand, int type,
 	}
 
 
-	if (_battleGame->getCurrentAction()->type == BA_HIT)
+	if (action.type == BA_HIT)
 	{
 
-		_battleGame->getCurrentAction()->skillRules = nullptr;
-		_battleGame->getCurrentAction()->updateTU();
+		action.skillRules = nullptr;
+		action.updateTU();
 
 		// after update...
-		//_battleGame->getCurrentAction()->Time = time;
+		//action.Time = time;
 
 		// check beforehand if we have enough time units
-		if (!_battleGame->getCurrentAction()->haveTU(&_battleGame->getCurrentAction()->result))
+		if (!action.haveTU(&action.result))
 		{
 			// nothing
 		}
 		else if (!_game->getSavedGame()->getSavedBattle()->getTileEngine()->validMeleeRange(
-					 _battleGame->getCurrentAction()->actor->getPosition(),
-					 _battleGame->getCurrentAction()->actor->getDirection(),
-					 _battleGame->getCurrentAction()->actor,
-					 0, &_battleGame->getCurrentAction()->target))
+					 action.actor->getPosition(),
+					 action.actor->getDirection(),
+					 action.actor,
+					 0, &action.target))
 		{
-			if (!_game->getSavedGame()->getSavedBattle()->getTileEngine()->validTerrainMeleeRange(_battleGame->getCurrentAction()))
+			if (!_game->getSavedGame()->getSavedBattle()->getTileEngine()->validTerrainMeleeRange(&action))
 			{
-				_battleGame->getCurrentAction()->result = "STR_THERE_IS_NO_ONE_THERE";
+				action.result = "STR_THERE_IS_NO_ONE_THERE";
 			}
 		}
 
-		_battleGame->handleNonTargetAction();
+		_battleGame->handleNonTargetAction(action);
 
 	}
 
@@ -2588,7 +2784,22 @@ void BattlescapeState::btnKneelClick(Action *)
 		BattleUnit *bu = _save->getSelectedUnit();
 		if (bu)
 		{
-			_battleGame->kneel(bu);
+			// coop (PRD-P6): kneeling is a sim mutation, so the parallel client
+			// asks instead of doing it. The button/preview refresh below is
+			// display and stays local either way - it re-reads the unit, which
+			// the host's `kneel` broadcast will have updated by then.
+			BattleAction action;
+			action.type = BA_KNEEL;
+			action.actor = bu;
+			if (_battleGame->coopRouteAction(action, "kneel"))
+			{
+				return;
+			}
+
+			// kneel() + the classic `kneel` packet, in one place both this button
+			// and an admitted client intent go through.
+			_battleGame->executeAction(action);
+
 			toggleKneelButton(bu);
 
 			// update any path preview when unit kneels
@@ -2596,17 +2807,6 @@ void BattlescapeState::btnKneelClick(Action *)
 			{
 				_battleGame->getPathfinding()->refreshPath();
 			}
-
-			// coop
-			if (_game->getCoopMod()->getCoopStatic() == true)
-			{
-				Json::Value obj;
-				obj["state"] = "kneel";
-				obj["id"] = bu->getId();
-
-				_game->getCoopMod()->sendTCPPacketData(obj.toStyledString());
-			}
-
 		}
 	}
 }
@@ -2950,10 +3150,24 @@ void BattlescapeState::btnEndTurnClick(Action *)
 
 	}
 
+	// coop (PRD-P8): parallel mode has NO mid-side hand-off AND no side owner.
+	// BOTH machines reach this handler now (PRD-P5's client swallow is gone), and
+	// on either one the press does exactly one thing: arm or disarm THIS seat's
+	// readiness. The side is closed by connectionTCP::coopCheckSideCommit() on the
+	// executor's tick, once every seat is ready, the arbiter is idle and the
+	// peer's display has drained - PRD-P5's direct close from here (which only the
+	// host could reach, and which could not wait for the peer) moved there whole.
+	if (_game->getCoopMod()->parallelTurnActive() && _game->getCoopMod()->getCoopStatic() == true && !_save->isPreview())
+	{
+		_game->getCoopMod()->toggleEndTurnReady();
+		updateCoopEndTurnTally();
+		return;
+	}
+
 	_game->getCoopMod()->_isActivePlayerSync = false;
 
 	bool is_return = false;
-	
+
 	if (_game->getCoopMod()->getCoopStatic() == true && !_save->isPreview())
 	{
 
@@ -3699,14 +3913,7 @@ void BattlescapeState::btnReserveClick(Action *action)
 	}
 
 	// COOP
-	if (_game->getCoopMod()->getCoopStatic() == true && _battleGame->isYourTurn == 2)
-	{
-		Json::Value obj;
-		obj["state"] = "TU_COOP";
-		obj["reverse"] = (int)_save->getTUReserved();
-
-		_game->getCoopMod()->sendTCPPacketData(obj.toStyledString());
-	}
+	coopSendReserveState(false);
 
 }
 
@@ -3781,6 +3988,17 @@ bool BattlescapeState::playableUnitSelected()
 	if (_save->getSelectedUnit())
 	{
 
+		// coop (PRD-P5): in parallel mode `_isActivePlayerSync` names the EXECUTOR
+		// role (host true / client FALSE, permanently) instead of "is it my turn",
+		// so the classic test below would leave every action button, stats popup
+		// and right-click permanently dead on the client. The question that
+		// survives is ownership: is the selected soldier one of mine.
+		if (connectionTCP::parallelTurnActive())
+		{
+			return _save->getSelectedUnit()->getCoop() == connectionTCP::localSeat()
+				&& allowButtons();
+		}
+
 		if (_game->getCoopMod()->getCoopStatic() == true && _game->getCoopMod()->getCurrentTurn() == 1)
 			return true;
 
@@ -4604,7 +4822,17 @@ void BattlescapeState::shootPlayerTarget(std::string obj_str)
 	_battleGame->getCoopMod()->_coopProjectilesHost.clear();
 	_battleGame->getCoopMod()->_coopProjectilesClient = arr;
 
-	_battleGame->getCurrentAction()->waypoints.clear();
+	// coop (PRD-P3 GAP-4b): the sender's close-quarters outcome. The peer does not
+	// run the CQB check at all - the redirected aim already rides this packet's
+	// target coords - it only applies the defender's TU/energy cost, which is the
+	// one piece of state the redirect leaves behind.
+	_battleGame->getCoopMod()->_cqbBlocked = obj.get("cqb_blocked", false).asBool();
+	_battleGame->getCoopMod()->_cqbDefenderId = obj.get("cqb_defender", -1).asInt();
+
+	// coop (PRD-P1): the replayed shot carries its OWN waypoint list. Clearing
+	// and refilling _currentAction.waypoints threw away the local player's
+	// in-progress blaster waypoints every time a teammate fired.
+	std::list<Position> replayWaypoints;
 
 	// waypoints
 	for (int i = 0; i < obj["waypoints"].size(); i++)
@@ -4616,7 +4844,7 @@ void BattlescapeState::shootPlayerTarget(std::string obj_str)
 
 		Position new_waypoint = Position(pos_x, pos_y, pos_z);
 
-		_battleGame->getCurrentAction()->waypoints.push_back(new_waypoint);
+		replayWaypoints.push_back(new_waypoint);
 
 	}
 
@@ -4670,7 +4898,11 @@ void BattlescapeState::shootPlayerTarget(std::string obj_str)
 	unit->coop_no_line_fire = actor_no_line_fire;
 	unit->coop_unable_to_throw_here = actor_unable_to_throw_here;
 
-	_battleGame->getCurrentAction()->actor = unit;
+	// coop (PRD-P1): replay on a stack-local action - the peer's shot no longer
+	// lands in the local player's _currentAction (which is what made the watching
+	// player's next map click fire instead of walk).
+	BattleAction action = BattlescapeGame::makeReplayAction(unit);
+	action.waypoints = replayWaypoints;
 
 	// coop (issue #74): resolve the SHOOTER'S OWN weapon. Reading a hand blindly
 	// and then inventing a BattleItem when it was empty (a stale `hand` string,
@@ -4678,7 +4910,7 @@ void BattlescapeState::shootPlayerTarget(std::string obj_str)
 	// machine's item-id counter, drifting the two id spaces apart until the
 	// protocol's other id lookups started matching other players' gear by type.
 	BattleItem* firing = BattlescapeGame::coopResolveWeapon(_save, unit, weapon_id, weapon_type, hand);
-	_battleGame->getCurrentAction()->weapon = firing;
+	action.weapon = firing;
 
 	if (firing && firing == unit->getLeftHandWeapon())
 	{
@@ -4697,28 +4929,36 @@ void BattlescapeState::shootPlayerTarget(std::string obj_str)
 
 
 	// if weapon is not null
-	if (_battleGame->getCurrentAction()->weapon)
+	if (action.weapon)
 	{
 
-		_battleGame->getCurrentAction()->weapon->setFuseEnabled(fuse);
+		action.weapon->setFuseEnabled(fuse);
 
 		if (fusetimer != -1)
 		{
-			_battleGame->getCurrentAction()->weapon->setFuseTimer(fusetimer);
+			action.weapon->setFuseTimer(fusetimer);
 		}
 
 		
-		_battleGame->getCurrentAction()->targeting = targeting;
+		action.targeting = targeting;
 
-		_battleGame->getCurrentAction()->target = targetPos;
+		action.target = targetPos;
 
-		_battleGame->getCurrentAction()->type = (BattleActionType)type;
+		action.type = (BattleActionType)type;
 
-		_battleGame->getCurrentAction()->updateTU();
+		action.updateTU();
 
-		_battleGame->CoopShoot();
+		_battleGame->CoopShoot(action);
 
 	}
+	else
+	{
+		// coop (issue #74): no weapon resolved => skip the shot entirely. Never
+		// fabricate a BattleItem on a receiver.
+		Log(LOG_INFO) << "coop: shot replay skipped, unit " << actor_id
+					  << " has no '" << weapon_type << "' (id " << weapon_id
+					  << ") - never fabricating one (issue #74)";
+	}
 
 
 }
@@ -4822,7 +5062,11 @@ void BattlescapeState::moveCoopInventory(std::string ammos_str, std::string item
 		currentItem->setXCOMProperty(getXCOMProperty);
 		currentItem->setIsAmmo(isAmmo);
 		currentItem->setFuseEnabled(isFuseEnabled);
-		currentItem->setAmmoQuantity(getAmmoQuantity);
+		// coop (PRD-I3 SEAM-11): the wire carries the SENDER's getAmmoQuantity(), which
+		// returns 255 for a clipSize==-1 (self-powered/infinite) item - but the raw field
+		// the save serializes is -1 there, so storing 255 leaves a permanent saveBlob
+		// ammoqty divergence (host -1 / peer 255). Restore the raw sentinel for those.
+		currentItem->setAmmoQuantity(currentItem->getRules()->getClipSize() == -1 ? -1 : getAmmoQuantity);
 
 		// weapon reload
 		if (isWeaponWithAmmo == true && ammos_str != "")
@@ -4948,7 +5192,187 @@ void BattlescapeState::moveCoopInventory(std::string ammos_str, std::string item
 void BattlescapeState::showCoopWarning(const std::string &message)
 {
 	_warning->showMessage(message, -1);
-	
+
+}
+
+/**
+ * coop (PRD-P8): repaints the END TURN readiness lamp and the tally.
+ *
+ * Two surfaces, both driven from connectionTCP's seat-indexed tally:
+ *  - the END TURN button is INVERTED while THIS machine is armed, which is the
+ *    only "my press did something" feedback a latching toggle can give;
+ *  - a small right-aligned "END TURN 1/2" above the button, visible while at
+ *    least one seat is armed. Deliberately NOT on the _warning widget (PRD-P8
+ *    §4): that one fades after a few seconds, and a player who is waiting needs
+ *    the count to stay on screen.
+ *
+ * The local seat's bit is whatever this machine last set, so a client shows its
+ * own press optimistically and the host's echoed tally confirms (or quietly
+ * undoes) it.
+ */
+void BattlescapeState::updateCoopEndTurnTally()
+{
+	if (!connectionTCP::parallelTurnActive() || _save->isPreview())
+	{
+		if (_coopTallySeats != -1)
+		{
+			_txtCoopEndTurn->setVisible(false);
+			_btnEndTurn->toggle(false);
+			_coopTallyReady = _coopTallySeats = -1;
+			_coopTallyLocalReady = false;
+		}
+		return;
+	}
+
+	connectionTCP::ensureEndTurnSeats();
+	const int seats = std::max(1, connectionTCP::seatCount());
+	const int ready = connectionTCP::endTurnReadyCount();
+	const bool mine = connectionTCP::endTurnSeatReady(connectionTCP::localSeat());
+	if (ready == _coopTallyReady && seats == _coopTallySeats && mine == _coopTallyLocalReady)
+	{
+		return;
+	}
+	_coopTallyReady = ready;
+	_coopTallySeats = seats;
+	_coopTallyLocalReady = mine;
+
+	_btnEndTurn->toggle(mine);
+	if (ready > 0)
+	{
+		_txtCoopEndTurn->setText(tr("STR_COOP_END_TURN_TALLY")
+			.arg(ready).arg(seats));
+		_txtCoopEndTurn->setVisible(true);
+	}
+	else
+	{
+		_txtCoopEndTurn->setVisible(false);
+	}
+}
+
+/**
+ * coop (PRD-P8 §5): the classic reserve mirror.
+ *
+ * Classic co-op keeps ONE reserve setting across both machines, because only one
+ * of them is acting at a time. In parallel mode both are, so one player's reserve
+ * gating the other's soldiers is simply wrong - the setting becomes per-machine
+ * and the value that matters rides `action_intent` per action instead
+ * (PROTOCOL.md). Factored out of the two button handlers so the suppression is
+ * decided in exactly one place.
+ */
+void BattlescapeState::coopSendReserveState(bool kneel)
+{
+	if (_game->getCoopMod()->getCoopStatic() != true || _battleGame->isYourTurn != 2)
+	{
+		return;
+	}
+	if (connectionTCP::parallelTurnActive())
+	{
+		return;
+	}
+	Json::Value obj;
+	if (kneel)
+	{
+		obj["state"] = "kneel_reserved";
+		obj["battle_action"] = _save->getKneelReserved();
+	}
+	else
+	{
+		obj["state"] = "TU_COOP";
+		obj["reverse"] = (int)_save->getTUReserved();
+	}
+	_game->getCoopMod()->sendTCPPacketData(obj.toStyledString());
+}
+
+std::string BattlescapeState::getCoopWarningText() const
+{
+	return _warning ? _warning->getMessage() : std::string();
+}
+
+/**
+ * coop (parallel turns): drive the persistent "Please wait for <player>'s action
+ * to finish" banner in the map strip above the toolbar. Shown while another
+ * seat's action blocks this machine's input; suppressed when the running chain is
+ * this seat's own action (you are not waiting on anyone) or when idle.
+ */
+void BattlescapeState::updateCoopWaitBanner()
+{
+	connectionTCP *coop = _game->getCoopMod();
+	std::string text;
+	if (connectionTCP::parallelTurnActive() && _save->isPreview() == false
+		&& connectionTCP::_battleInit == true)
+	{
+		const int me = connectionTCP::localSeat();
+		int owner = -1;
+		if (_battleGame->isBusy())
+		{
+			// Latch the owner for the whole busy window. Consequence states (a
+			// death/fall/explosion) are pushed to the FRONT of the queue mid-chain,
+			// so re-deriving the owner every frame from the front state would
+			// mis-attribute a kill to the victim's side (my grenade killing a peer
+			// soldier would flash "wait for <peer>" during my OWN action's aftermath,
+			// and the symmetric case would wrongly suppress the banner). Resolve once
+			// - skipping consequence states - then reuse until isBusy() clears.
+			if (_coopBusyOwnerSeat == -1)
+			{
+				BattleUnit *actor = _battleGame->getPrimaryBusyActor();
+				if (actor)
+				{
+					_coopBusyOwnerSeat = actor->getCoop();
+				}
+			}
+			owner = _coopBusyOwnerSeat;
+		}
+		else
+		{
+			_coopBusyOwnerSeat = -1;   // busy window ended - drop the latch
+		}
+		if (owner >= 0 && owner != me && owner < connectionTCP::seatCount())
+		{
+			// The action currently executing belongs to another seat. This is
+			// SEAT-INDEXED and therefore already N-player-ready: seatName() reads the
+			// seat-ordered coop roster (SavedGame::getCoopPlayers()), so the day real
+			// >2-player coop exists - i.e. the transport accepts more than one client
+			// (today it does not: connectionTCP.cpp "Only 1 client supported"),
+			// getCoop() returns a seat > 1, and getCoopPlayers() carries that seat's
+			// name - this line names seats 2/3 with NO change here.
+			//
+			// The getCurrentClientName() fallback is a 2-player-only bridge for the
+			// ONE gap today: a SKIRMISH battle never populates getCoopPlayers() (only
+			// the campaign start path does, LobbyMenu::startCampaign), so seatName()
+			// is empty there. With coop hard-wired to host + one client
+			// (coop_save_owner_player_id is only ever 0/1), the "other seat" is
+			// unambiguously the peer, so getCurrentClientName() is correct. When
+			// N-player transport is added it MUST populate the seat roster (for votes,
+			// end-turn tally, etc.); once it does, seatName() wins and this fallback
+			// is never reached for owner != me. Do NOT extend this fallback to guess
+			// names for seats 2/3 - there is no data behind them yet.
+			std::string name = connectionTCP::seatName(owner);
+			if (name.empty()) name = coop->getCurrentClientName();
+			text = tr("STR_COOP_WAIT_FOR_PLAYER_ACTION").arg(name);
+		}
+		else if (owner < 0 && coop->_coopWaitDenyTicks > 0)
+		{
+			// click-sync: a BUSY deny just arrived while a mirror-packet gap left us
+			// momentarily not-busy, so no busy owner is latched. Name the peer (the
+			// executor running the non-skippable chain).
+			text = tr("STR_COOP_WAIT_FOR_PLAYER_ACTION").arg(coop->getCurrentClientName());
+		}
+	}
+	else
+	{
+		_coopBusyOwnerSeat = -1;   // not in a live parallel battle - drop the latch
+	}
+	if (coop->_coopWaitDenyTicks > 0)
+	{
+		coop->_coopWaitDenyTicks--;
+	}
+	_txtCoopWait->setText(text);
+	_txtCoopWait->setVisible(!text.empty());
+}
+
+std::string BattlescapeState::getCoopWaitText() const
+{
+	return (_txtCoopWait && _txtCoopWait->getVisible()) ? _txtCoopWait->getText() : std::string();
 }
 
 void BattlescapeState::doAbortPath()
@@ -6169,14 +6593,7 @@ void BattlescapeState::btnReserveKneelClick(Action *action)
 		}
 
 		// COOP
-		if (_game->getCoopMod()->getCoopStatic() == true && _battleGame->isYourTurn == 2)
-		{
-			Json::Value obj;
-			obj["state"] = "kneel_reserved";
-			obj["battle_action"] = _save->getKneelReserved();
-
-			_game->getCoopMod()->sendTCPPacketData(obj.toStyledString());
-		}
+		coopSendReserveState(true);
 
 	}
 }
diff --git a/src/Battlescape/BattlescapeState.h b/src/Battlescape/BattlescapeState.h
index eaceab731..6551d8ae7 100644
--- a/src/Battlescape/BattlescapeState.h
+++ b/src/Battlescape/BattlescapeState.h
@@ -80,6 +80,21 @@ class BattlescapeState : public State
 	Timer *_animTimer, *_gameTimer;
 	SavedBattleGame *_save;
 	Text *_txtDebug, *_txtTooltip;
+	// coop (PRD-P8): the end-turn readiness tally ("END TURN 1/2"), shown next to
+	// the END TURN button while a parallel side has at least one seat armed.
+	// Deliberately NOT on the _warning surface - that one fades, and the tally has
+	// to stay up for as long as somebody is waiting.
+	Text *_txtCoopEndTurn;
+	int _coopTallyReady, _coopTallySeats;
+	bool _coopTallyLocalReady;
+	// coop (parallel turns): persistent "Please wait for <player>'s action to
+	// finish" banner, in the map strip just above the toolbar. Shown while another
+	// seat's action blocks this machine's input; off the fading _warning surface.
+	Text *_txtCoopWait;
+	// Owner seat latched for the current busy window (-1 = idle/unresolved). Latched
+	// once per window so a consequence state (death/fall/explosion) pushed to the
+	// front of the queue mid-chain cannot re-attribute the banner to the victim.
+	int _coopBusyOwnerSeat;
 	Uint8 _tooltipDefaultColor;
 	Uint8 _medikitRed, _medikitGreen, _medikitBlue, _medikitOrange;
 	std::vector<State*> _popups;
@@ -110,10 +125,22 @@ class BattlescapeState : public State
 	void blinkHealthBar();
 	/// Shows the unit kneel state.
 	void toggleKneelButton(BattleUnit* unit);
+	/// coop (PRD-P8): repaints the END TURN readiness lamp + tally from the
+	/// connectionTCP tally. No-op (and hidden) outside a parallel side.
+	void updateCoopEndTurnTally();
+	/// coop: refresh the "Please wait for <player>'s action" banner (per frame).
+	void updateCoopWaitBanner();
   public:
+	/// coop (PRD-P8 §5): the classic reserve mirror packet (`TU_COOP` /
+	/// `kneel_reserved`). Suppressed in parallel mode, where reserve is a
+	/// per-machine setting and travels per-action on `action_intent` instead.
+	void coopSendReserveState(bool kneel);
 	// coop
 	void setSelectedCoopUnit(int actor_id);
-	void coopHealing(int actor_id, int type, int part, std::string medkit_state, std::string action_result, int time);
+	// coop (PRD-P6): healer_id/weapon_* are additive - an older peer omits them
+	// and the classic branch (which reads the local _currentAction) still runs.
+	void coopHealing(int actor_id, int type, int part, std::string medkit_state, std::string action_result, int time,
+					 int healer_id = -1, int weapon_id = -1, std::string weapon_type = "", std::string hand = "");
 	void coopActiveGranade(int actor_id, int type, std::string hand, int fusetimer, int item_id);
 	void coopActionClick(int actor_id, std::string hand, int type, bool fuse, int fusetimer, int target_x, int target_y, int target_z, int time, std::string weapon_type, int weapon_id);
 	// This should end the co-op battle.
@@ -136,6 +163,10 @@ class BattlescapeState : public State
 	void melee_attack(std::string str_obj);
 	void shootPlayerTarget(std::string str_obj);
 	void showCoopWarning(const std::string &message);
+	/// coop (PRD-P5): the banner currently on the warning widget ("" = none).
+	std::string getCoopWarningText() const;
+	/// coop: the visible "Please wait..." banner text ("" when hidden), for tests.
+	std::string getCoopWaitText() const;
 	void showCoopLongWarning(const std::string &message);
 	void doAbortPath();
 	/// Selects the next soldier.
diff --git a/src/Battlescape/DebriefingState.cpp b/src/Battlescape/DebriefingState.cpp
index 32e975374..9ace69909 100644
--- a/src/Battlescape/DebriefingState.cpp
+++ b/src/Battlescape/DebriefingState.cpp
@@ -320,7 +320,9 @@ DebriefingState::DebriefingState() : _eventToSpawn(nullptr), _region(0), _countr
 		_game->getCoopMod()->coopInventory = false;
 
 		// fix
-		_game->getCoopMod()->_coop_task_completed = true;
+		// PRD-P6 pre-task: teardown forces the gate open whatever depth it is at -
+		// a BState that never got to deinit() must not jam the queue for good.
+		_game->getCoopMod()->resetCoopTaskDepth();
 		_game->getCoopMod()->playerInsideCoopBase = false;
 		_game->getCoopMod()->_battleWindow = false;
 		_game->getCoopMod()->_isMainCampaignBaseDefense = false;
@@ -329,7 +331,6 @@ DebriefingState::DebriefingState() : _eventToSpawn(nullptr), _region(0), _countr
 		_game->getCoopMod()->_isActiveAISync = false;
 		_game->getCoopMod()->_isActivePlayerSync = false;
 		_game->getCoopMod()->_battleInit = false;
-		_game->getCoopMod()->gamePaused = 0;
 		_game->getCoopMod()->_clientPanicHandle = false;
 		_game->getCoopMod()->_onClickClose = false;
 
@@ -1552,6 +1553,21 @@ void DebriefingState::btnOkClick(Action *)
 	_game->popState();
 	if (_game->getSavedGame()->getMonthsPassed() == -1)
 	{
+		// coop (#162 / 056b500db reconciliation): a skirmish OK-exit is a GRACEFUL
+		// leave, not a drop. Tell the peer BEFORE our own teardown closes the socket
+		// so it can suppress the "<player> has left the server" notice over its own
+		// debriefing (056b500db's intent) while still raising it for an ABRUPT drop
+		// (#162). Sent from here - the one clean chokepoint for the skirmish exit;
+		// GoToMainMenuState carries no coop code. Queued ahead of the teardown, and
+		// TCP in-order delivery lands it before the FIN. Additive: an old peer just
+		// ignores the message (and a new peer then shows the notice on this clean
+		// exit too - acceptable version-mixing degradation, see PROTOCOL.md).
+		if (_game->getCoopMod()->getCoopStatic() == true)
+		{
+			Json::Value leaving;
+			leaving["state"] = "coop_leaving";
+			_game->getCoopMod()->sendTCPPacketData(leaving.toStyledString());
+		}
 		// issue #82: a skirmish ends the world - GoToMainMenuState drops the SavedGame
 		// instead of leaving it live (and leaking) for the rest of the process.
 		_game->setState(new GoToMainMenuState(false));
diff --git a/src/Battlescape/DebriefingState.h b/src/Battlescape/DebriefingState.h
index f78a98833..ace71937d 100644
--- a/src/Battlescape/DebriefingState.h
+++ b/src/Battlescape/DebriefingState.h
@@ -133,6 +133,10 @@ class DebriefingState : public State
 	void decreaseRecoveredItemCount(const RuleItem *rule, int amount);
 	// Hides the SELL and TRANSFER buttons.
 	void hideSellTransferButtons();
+	/// coop harness: the score page's rows exactly as prepareDebriefing() built them.
+	/// Each machine computes these from its OWN save, so this is the readout for
+	/// "did both players see the same mission result".
+	const std::vector<DebriefingStat*> &harnessStats() const { return _stats; }
 };
 
 }
diff --git a/src/Battlescape/ExplosionBState.cpp b/src/Battlescape/ExplosionBState.cpp
index da16ab4c6..38ee800a1 100644
--- a/src/Battlescape/ExplosionBState.cpp
+++ b/src/Battlescape/ExplosionBState.cpp
@@ -31,12 +31,56 @@
 #include "../Mod/RuleItem.h"
 #include "../Mod/Armor.h"
 #include "../Engine/RNG.h"
+#include <atomic>
 
 namespace OpenXcom
 {
 
-// coop
-bool coopTaskCompleted = false;
+// coop (chain-atomicity D.3b): the auto-shot pacing "parked, awaiting the host's flip"
+// flag is now a PER-INSTANCE member (ExplosionBState::_coopTaskCompleted), not a file-scope
+// global. A file-scope global was shared by every live ExplosionBState, so a chained-terrain
+// explosion (checkForTerrainExplosions, _explosionCounter > 0) could park on it or consume
+// the shot's host flip - the D.3b wedge. The member confines the pacing flag to the one shot
+// that parked it.
+
+// coop (chain-atomicity D.3b fixture instrumentation): the chained-terrain pacing race,
+// counted at the bug site. A chained-terrain consequence (checkForTerrainExplosions,
+// _explosionCounter > 0, BA_NONE) must NEVER touch the shot-pacing signal. These monotonic
+// counters make the race observable through parallel_state (TestServer extern-reads them):
+//   g_coopTerrainPacingParks    = a chained-terrain that PARKED on the shot-pacing flag
+//   g_coopTerrainPacingConsumes = a chained-terrain whose think() release CONSUMED the flip
+//   g_coopTerrainPacingDiverted = a chained-terrain that reached the pacing decision while
+//                                 the shot-pacing condition was live and was DIVERTED off
+//                                 the park path by the _explosionCounter == 0 gate (the fix)
+// Parks/consumes are the BUG (non-zero only before the fix); diverted proves the fix engaged
+// on the same opportunity. All three are parallel-client only and inert (0) otherwise.
+std::uint32_t g_coopTerrainPacingParks = 0;
+std::uint32_t g_coopTerrainPacingConsumes = 0;
+std::uint32_t g_coopTerrainPacingDiverted = 0;
+
+// coop (explosion ordered-replay E1): the replay-lever + display-only counters are
+// file-scope in connectionTCP.cpp (alongside the E0 objective-leak counters); extern-
+// declared here so this file can read/increment them without a wide recompile, matching
+// the pattern the D.3b counters above use in reverse (defined here, extern-read by
+// TestServer.cpp). g_explosionReplayDisable is the E0-introduced TEST-ONLY lever
+// (E0 only stored + surfaced it; E1 is what actually wires it to force the legacy
+// racing-sim path). g_explosionsDisplayOnly / g_explodeCallsSuppressed are new this
+// phase: the former counts ExplosionBState instances that took the display-only path
+// (latched once per state, right after _coopReplayDisplay), the latter counts how many
+// times the single explode() call at init() was suppressed by it.
+extern std::atomic<bool> g_explosionReplayDisable;
+extern std::atomic<uint32_t> g_explosionsDisplayOnly;
+extern std::atomic<uint32_t> g_explodeCallsSuppressed;
+
+// coop (explosion ordered-replay E2): the chain_detonation send/apply counters, file-scope
+// in connectionTCP.cpp alongside the E1 counters above; extern-declared here so this file's
+// parallel-host send site can increment the sent side. g_chainDetonationsSent counts every
+// chain_detonation the parallel host ships (its successive checkForTerrainExplosions scan
+// hits); g_chainDetonationsApplied (incremented in connectionTCP.cpp's handler) counts every
+// one the parallel client replays. The two must match at side close - a mismatch means the
+// ordered chain stream dropped or duplicated a secondary.
+extern std::atomic<uint32_t> g_chainDetonationsSent;
+extern std::atomic<uint32_t> g_chainDetonationsApplied;
 
 /**
  * Sets up an ExplosionBState.
@@ -85,6 +129,20 @@ void ExplosionBState::optValue(int& oldValue, int newValue) const
  */
 void ExplosionBState::init()
 {
+	// coop (explosion ordered-replay E1): latch ONCE, near the top, so the value
+	// persists into think()/member explode() for the whole life of this state. True
+	// only on a parallel client whose replay lever has not been forced off - see the
+	// member declaration in ExplosionBState.h. g_explosionReplayDisable is the E0-
+	// introduced lever E1 now actually wires (RED: forces the client back onto the
+	// old racing explode()/checkForCasualties path, same build).
+	_coopReplayDisplay = _parent->getCoopMod()->parallelTurnActive()
+		&& !_parent->getCoopMod()->getHost()
+		&& !OpenXcom::g_explosionReplayDisable.load(std::memory_order_relaxed);
+	if (_coopReplayDisplay)
+	{
+		++OpenXcom::g_explosionsDisplayOnly;
+	}
+
 	BattleType type = BT_NONE;
 	BattleActionType action = _attack.type;
 	const RuleItem* itemRule = 0;
@@ -130,7 +188,29 @@ void ExplosionBState::init()
 		//testing if we hit target
 		if (action == BA_SELF_DESTRUCT)
 		{
-			if (!RNG::percent(itemRule->getSpecialChance()))
+			// coop (PRD-P3 GAP-4b): the host rolled this in BattleUnit::damage, before
+			// the selfDestruct packet went out, and parked the answer here.
+			auto* coopSD = _parent->getCoopMod();
+			bool triggered;
+			// coop (wire-order Increment 3 / A2): prefer the parallel client's display-side
+			// copy (populated at the selfDestruct receiver-park lever-on) so next_turn's
+			// state-half clear cannot starve this replay. Empty lever-off / on the host, so
+			// it falls through to the canonical queue, then the RNG roll, byte-identically.
+			if (coopSD && coopSD->getCoopStatic() && !coopSD->_selfDestructResultsDisplay.empty())
+			{
+				triggered = coopSD->_selfDestructResultsDisplay.front() != 0;
+				coopSD->_selfDestructResultsDisplay.erase(coopSD->_selfDestructResultsDisplay.begin());
+			}
+			else if (coopSD && coopSD->getCoopStatic() && !coopSD->_selfDestructResults.empty())
+			{
+				triggered = coopSD->_selfDestructResults.front() != 0;
+				coopSD->_selfDestructResults.erase(coopSD->_selfDestructResults.begin());
+			}
+			else
+			{
+				triggered = RNG::percent(itemRule->getSpecialChance());
+			}
+			if (!triggered)
 			{
 				_power = 0;
 			}
@@ -190,7 +270,21 @@ void ExplosionBState::init()
 			break;
 		}
 		_power = _tile->getExplosive();
-		_tile->setExplosive(0, 0, true);
+		// coop (chain-atomicity item-2): the tile's explosive-charge CONSUMPTION is
+		// host-authoritative terrain bookkeeping, not display. On the parallel replay
+		// client this zero used to run LOCALLY off the display loop, racing the
+		// destroy_tile ARM carrier - so the charge (a saveBlob/terrain hash term) could
+		// diverge between machines and drive a chained explosion one machine never ran.
+		// The client now applies the host's stamped set_explosive_tile(0) instead (shipped
+		// below), keeping the charge purely packet-driven. Host / classic co-op / PvP /
+		// single-player zero exactly as before; the _power read above still feeds the
+		// animation radius on every machine.
+		const bool coopExplReplayClient =
+			_parent->getCoopMod()->parallelTurnActive() && !_parent->getCoopMod()->getHost();
+		if (!coopExplReplayClient)
+		{
+			_tile->setExplosive(0, 0, true);
+		}
 		_damageType = _parent->getMod()->getDamageType(DT);
 		_radius = _power /10;
 		_areaOfEffect = true;
@@ -205,11 +299,62 @@ void ExplosionBState::init()
 
 	bool range = !(_hit || (_attack.weapon_item && _attack.weapon_item->getRules()->getBattleType() == BT_PSIAMP));
 
+	// coop (PRD-I3 SEAM-3 a): a mid-side explosion running with no open admitted chain
+	// (a shot/grenade whose action already drained, or a spontaneous detonation) owns its
+	// own seq so the destroy_tile/hazard outcome it is about to emit rides the I1 gate
+	// instead of shipping seq-0 always-consume. Boundary-phase explosions are excluded -
+	// their destroys ride the ordered endturn/sidestart boundary compare already.
+	if (!_coopBoundaryExpl)
+	{
+		connectionTCP::coopStampLooseOutcomeChain("expl");
+	}
+
+	// coop (chain-atomicity item-2): ship the host's explosive-charge CONSUMPTION as a
+	// stamped set_explosive_tile carrier so the parallel replay client mirrors the zero
+	// at the bookkeeping clock - ordered behind this tile's destroy_tile ARM and drained
+	// ahead of the chain's action_end (D.1 barrier), exactly like destroy_tile.
+	// coopStampChainSeq tags it with the loose chain opened just above (mid-side) or
+	// leaves it seq-0 for a boundary explosion (applied before the boundary hash, as
+	// boundary destroy_tile already is). Host-only + parallel-PvE-only: classic co-op,
+	// PvP and single-player never ship it and the replay client's suppression above is
+	// likewise parallel-gated, so those paths stay byte-identical. Only a real
+	// consumption (_power > 0) ships; the tile is already zeroed on the host above.
+	if (_tile && _power > 0
+		&& _parent->getCoopMod()->parallelTurnActive() && _parent->getCoopMod()->getHost())
+	{
+		Json::Value root;
+		root["state"] = "set_explosive_tile";
+		connectionTCP::coopStampChainSeq(root);
+		const Position tpos = _tile->getPosition();
+		root["tile_pos_x"] = tpos.x;
+		root["tile_pos_y"] = tpos.y;
+		root["tile_pos_z"] = tpos.z;
+		root["explosive"] = _tile->getExplosive();
+		root["explosive_type"] = _tile->getExplosiveType();
+		connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
+	}
+
 	if (_areaOfEffect)
 	{
 		if (_power > 0)
 		{
-			_parent->getSave()->getTileEngine()->explode(_attack, _center, _power, _damageType, _radius, range);
+			// coop (explosion ordered-replay E1): the authoritative ray-trace. On a
+			// display-only parallel client this is SUPPRESSED - terrain/charge/fire/
+			// smoke/item/FOV outcomes arrive as carriers (destroy_tile, set_explosive_tile,
+			// set_fire_tile, set_smoke_tile, explode_items, calc_explode_fov), unit damage
+			// as hit_unit - and the explode-path gravity/objective/module writes simply
+			// stop happening at the source instead of racing the carriers. The ANIMATION
+			// below is UNCONDITIONAL - only this one call is gated. Host / classic co-op /
+			// PvP / single-player: _coopReplayDisplay is always false, so this call is
+			// unchanged (byte-identical to pre-E1).
+			if (!_coopReplayDisplay)
+			{
+				_parent->getSave()->getTileEngine()->explode(_attack, _center, _power, _damageType, _radius, range);
+			}
+			else
+			{
+				++OpenXcom::g_explodeCallsSuppressed;
+			}
 
 			int powerForAnimation = _power;
 			if (itemRule && itemRule->getPowerForAnimation() > 0)
@@ -383,10 +528,35 @@ void ExplosionBState::init()
 void ExplosionBState::think()
 {
 
+	// coop (Class-A soak wedge fix): this auto-shot pacing wait (below) is the ONE
+	// display state that can hold the receive gate for the rest of the battle - via
+	// the ProjectileFlyBState beneath it - when its flip packet never lands (a
+	// host/client multi-shot count divergence, likeliest on hazard-heavy turns).
+	// updateCoopTask watches _coopPacingWait and, once it has been held past the
+	// stall floor, raises _coopForceDrainReplay so the wait can end instead of
+	// starving the gate forever. Release AS IF the flip had landed: -2 also stops
+	// projectileHitUnit re-arming this wait for the remaining shots (it only arms on
+	// -1), so a wedged multi-shot drains in one pass rather than one escape per shot.
+	if (_coopTaskCompleted && _parent->getCoopMod()->_coopForceDrainReplay)
+	{
+		_parent->getCoopMod()->_coopForceDrainReplay = false;
+		_parent->getCoopMod()->_coopPacingWait = false;
+		_parent->getCoopMod()->_hasHitUnit = -2;
+		_coopTaskCompleted = false;
+		_parent->popState();
+		return;
+	}
+
 	//  coop
-	if (coopTaskCompleted && (_parent->getCoopMod()->_hasHitUnit == -1 || _parent->getCoopMod()->_hasHitUnit == -2))
+	if (_coopTaskCompleted && (_parent->getCoopMod()->_hasHitUnit == -1 || _parent->getCoopMod()->_hasHitUnit == -2))
 	{
-		coopTaskCompleted = false;
+		// D.3b guard: with the per-instance flag a chained-terrain (_explosionCounter > 0)
+		// never has its OWN _coopTaskCompleted set, so it can never reach this release and
+		// consume the shot's flip. Post-fix this stays 0; a non-zero value means a chained-
+		// terrain leaked onto the pacing path again.
+		if (_explosionCounter > 0) ++g_coopTerrainPacingConsumes;
+		_coopTaskCompleted = false;
+		_parent->getCoopMod()->_coopPacingWait = false;
 		_parent->popState();
 		return;
 	}
@@ -464,7 +634,24 @@ void ExplosionBState::explode()
 	}
 
 	// now check for new casualties
-	_parent->checkForCasualties(_attack.damage_item ? _damageType : nullptr, _attack, false, terrainExplosion);
+	// coop (chain-atomicity Strand A): a BOUNDARY explosion (side-close fuse/terrain, run
+	// BEFORE coopArmSyncBoundary arms its marker) is excluded from the loose-chain stamp
+	// above, so it dies with _openChainSeq == 0; without this bracket the UnitDieBState it
+	// pushes would latch _coopBoundaryDeath == false and open a mid-side chain. Flag the
+	// phase so those deaths stay seq-0 (covered by the ordered boundary marker). A mid-side
+	// explosion (opened a loose chain above) passes false, so its deaths ride that chain.
+	_parent->coopSetBoundaryCasualty(_coopBoundaryExpl);
+	// coop (explosion ordered-replay E1): on a display-only parallel client, casualty
+	// resolution is SUPPRESSED here - death/knockout arrive as unit_casualty (atomic-death
+	// Phase 2) instead of being computed locally. The coopSetBoundaryCasualty bracket
+	// above/below keeps running unconditionally (cheap chain bookkeeping, harmless even
+	// when the call it brackets is skipped). Host / classic co-op / PvP / single-player
+	// unchanged.
+	if (!_coopReplayDisplay)
+	{
+		_parent->checkForCasualties(_attack.damage_item ? _damageType : nullptr, _attack, false, terrainExplosion);
+	}
+	_parent->coopSetBoundaryCasualty(false);
 	// revive units if damage could give hp or reduce stun
 	_parent->getSave()->reviveUnconsciousUnits(true);
 	// if any unit get infected turn it to zombie
@@ -478,26 +665,113 @@ void ExplosionBState::explode()
 
 	if (_attack.damage_item && (_attack.damage_item->getRules()->getBattleType() == BT_GRENADE || _attack.damage_item->getRules()->getBattleType() == BT_PROXIMITYGRENADE))
 	{
+		// coop (TRACE A DIAGNOSTIC, RCA lost-removal): the ACTUAL removal of a detonated
+		// grenade is CLIENT-SIM here (runs on BOTH machines, NOT coop-replicated). If this
+		// line runs on the HOST for a STR_STUN_BOMB but NOT on the CLIENT, the client's
+		// detonation ExplosionBState never fired for it => the grenade is never removed =>
+		// the frozen +1. Log both sides, capture-gated, production-inert.
+		if (g_diagCapture.load(std::memory_order_relaxed)
+			&& _attack.damage_item->getRules()->getType() == "STR_STUN_BOMB")
+		{
+			const bool isHost = _parent->getCoopMod() && _parent->getCoopMod()->getHost();
+			coopDiagS(std::string("GREM_REMOVE ") + (isHost ? "HOST" : "CLIENT")
+				+ " id=" + std::to_string(_attack.damage_item->getId())
+				+ " cid=" + std::to_string(_attack.damage_item->getCoopID())
+				+ " replayDisplay=" + std::to_string(_coopReplayDisplay ? 1 : 0));
+		}
 		_parent->getSave()->removeItem(_attack.damage_item);
 	}
 
-	// coop
-	if (_parent->getCoopMod()->getCoopStatic() == true && _parent->getCoopMod()->getHost() == false && _parent->getCoopMod()->_hasHitUnit == 1)
+	// coop (chain-atomicity D.3b): only a SHOT-origin explosion (_explosionCounter == 0)
+	// may park on the auto-shot pacing path. The park flag is per-instance
+	// (_coopTaskCompleted), and the extra _explosionCounter == 0 gate keeps a
+	// chained-terrain consequence (spawned below by checkForTerrainExplosions, with
+	// _explosionCounter > 0 and BA_NONE) off this path entirely: it never parks on the
+	// shared host flip and never clears the shot's _coopPacingWait. Before the fix a
+	// terrain-chain ExplosionBState read the same file-scope flag and could park on or
+	// consume the shot's flip (or, once gated to the else, reset the RX pump's stall floor
+	// mid-chain), starving the shot's pacing wait - the ~10 s client wedge bounded only by
+	// the force-drain watchdog.
+	const bool coopPacingCandidate =
+		_parent->getCoopMod()->getCoopStatic() == true
+		&& _parent->getCoopMod()->getHost() == false
+		&& _parent->getCoopMod()->_hasHitUnit == 1;
+	if (_explosionCounter == 0 && coopPacingCandidate)
 	{
-		coopTaskCompleted = true;
+		_coopTaskCompleted = true;
+		// coop (Class-A soak wedge fix): flag the pacing wait live so the RX pump's
+		// stall floor (updateCoopTask) can force-drain it if the flip never comes.
+		_parent->getCoopMod()->_coopPacingWait = true;
+	}
+	else if (_explosionCounter == 0)
+	{
+		// a shot-origin explosion that is NOT pacing (host side, single shot, or the
+		// flip already landed): clear the wait and finish, exactly as before.
+		_parent->getCoopMod()->_coopPacingWait = false;
+		_parent->popState();
 	}
 	else
 	{
+		// a chained-terrain consequence: it must never touch the shot-pacing signal, so
+		// leave _coopPacingWait owned by whatever shot parked it and just finish. D.3b: it
+		// is DIVERTED off the park path here - count it while a shot's pacing wait is live
+		// (the same race window that PARKED it before the fix), so the regression test can
+		// prove the fix engaged on a real race rather than on a vacuous run. _coopPacingWait
+		// (not _hasHitUnit==1) is the window: it stays set for the whole wait, whereas
+		// _hasHitUnit flips to -2 the moment the now-uncontested flip lands.
+		if (_parent->getCoopMod()->getCoopStatic() == true
+			&& _parent->getCoopMod()->getHost() == false
+			&& _parent->getCoopMod()->_coopPacingWait)
+		{
+			++g_coopTerrainPacingDiverted;
+		}
 		_parent->popState();
 	}
 
-	// check for terrain explosions
-	Tile *t = save->getTileEngine()->checkForTerrainExplosions();
-	if (t)
+	// coop (explosion ordered-replay E2): the whole chained-terrain scan+spawn block is
+	// host/classic/PvP/SP only now. On the parallel client (_coopReplayDisplay) this whole-
+	// map checkForTerrainExplosions scan raced independently on both machines (each machine's
+	// scan order could differ), so a parallel client no longer scans or spawns chained
+	// secondaries locally - it replays them in the host's scan order from the chain_detonation
+	// stream instead (handler in connectionTCP.cpp). This also removes the item-2 "stranded"
+	// tile problem entirely: that hack existed only to converge a parallel CLIENT's own
+	// (independently-ordered) scan hitting its own explosion's tile; a client that never scans
+	// can never strand on it.
+	if (!_coopReplayDisplay)
 	{
-		Position p = t->getPosition().toVoxel();
-		p += Position(8,8,0);
-		_parent->statePushFront(new ExplosionBState(_parent, p, BattleActionAttack{ BA_NONE, _attack.attacker, }, t, false, 0, _explosionCounter + 1));
+		// check for terrain explosions
+		Tile *t = save->getTileEngine()->checkForTerrainExplosions();
+		if (t)
+		{
+			Position p = t->getPosition().toVoxel();
+			p += Position(8,8,0);
+			// coop (explosion ordered-replay E2): the parallel host ships one chain_detonation
+			// per secondary it spawns so the client detonates them in THIS host's scan order
+			// (its successive scans are the order). explosive/type ride the packet - by the time
+			// the client displays this the tile's charge may already be zeroed by a
+			// set_explosive_tile carrier. coopStampChainSeq tags it with the triggering chain
+			// (mid-side) or leaves it seq-0 for a boundary explosion, exactly like the item-2
+			// set_explosive_tile carrier above. Parallel-host-only; classic/PvP/SP ship nothing.
+			if (_parent->getCoopMod()->parallelTurnActive() && _parent->getCoopMod()->getHost())
+			{
+				Json::Value root;
+				root["state"] = "chain_detonation";
+				connectionTCP::coopStampChainSeq(root);
+				const Position tp = t->getPosition();
+				root["tile_pos_x"] = tp.x; root["tile_pos_y"] = tp.y; root["tile_pos_z"] = tp.z;
+				root["explosive"] = t->getExplosive();
+				root["explosive_type"] = t->getExplosiveType();
+				connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
+				++OpenXcom::g_chainDetonationsSent;
+				OpenXcom::chainDetonationListRecord(tp.x, tp.y, tp.z);
+			}
+			// coop (PRD-I3 SEAM-3 a): a terrain-chain consequence inherits this explosion's
+			// origin - a boundary chain stays boundary (excluded from the loose stamp); a
+			// mid-side chain stays inside the seq this explosion opened, so it never re-stamps.
+			ExplosionBState *chained = new ExplosionBState(_parent, p, BattleActionAttack{ BA_NONE, _attack.attacker, }, t, false, 0, _explosionCounter + 1);
+			chained->coopSetBoundaryExpl(_coopBoundaryExpl);
+			_parent->statePushFront(chained);
+		}
 	}
 
 	// Spawn a unit if the item does that
diff --git a/src/Battlescape/ExplosionBState.h b/src/Battlescape/ExplosionBState.h
index c112ccbe8..e0fd6dd72 100644
--- a/src/Battlescape/ExplosionBState.h
+++ b/src/Battlescape/ExplosionBState.h
@@ -47,12 +47,40 @@ class ExplosionBState : public BattleState
 	int _radius;
 	int _range;
 	bool _areaOfEffect, _lowerWeapon, _hit, _psi;
+	// coop (PRD-I3 SEAM-3 a): set on an explosion that ORIGINATES in the endTurn
+	// boundary phase (a fuse detonation or a boundary terrain explosion), and
+	// inherited by any terrain-chain consequence it spawns. A boundary explosion is
+	// deliberately NOT given its own admitted chain - its destroys are applied before
+	// the endturn/sidestart boundary marker's hash on both machines, so the ordered
+	// boundary compare already covers them; opening a mid-phase chain there would
+	// interleave an action_end with the boundary markers.
+	bool _coopBoundaryExpl = false;
+	// coop (chain-atomicity D.3b): the auto-shot pacing "parked, awaiting the host's
+	// flip" flag, now PER-INSTANCE (it was a file-scope global shared by every
+	// ExplosionBState). Only a shot-origin explosion (_explosionCounter == 0) ever
+	// parks on it; a chained-terrain consequence (_explosionCounter > 0) can neither
+	// set nor clear another instance's, so it can never consume this shot's flip nor
+	// starve its wait. The host flip channel (_hasHitUnit, on the CoopMod) stays
+	// shared - the per-instance flag is what routes a release to the parked shot.
+	bool _coopTaskCompleted = false;
+	// coop (explosion ordered-replay E1): latched ONCE near the top of init() so it
+	// persists into think()/member explode(). True only on a parallel client that has
+	// not had the replay lever forced off (parallelTurnActive() && !getHost() &&
+	// !g_explosionReplayDisable) - on that machine this ExplosionBState becomes
+	// DISPLAY-ONLY: the authoritative explode() ray-trace (init, single call) and
+	// checkForCasualties (member explode()) are gated on it. The blast ANIMATION is
+	// unaffected - only those two sim calls. Host / classic co-op / PvP / single-player
+	// always compute this false, so they are byte-identical to pre-E1.
+	bool _coopReplayDisplay = false;
 
 	/// Calculates the effects of the explosion.
 	void explode();
 	/// Set new value to reference if new value is not equal -1.
 	void optValue(int &oldValue, int newValue) const;
 public:
+	/// coop (PRD-I3 SEAM-3 a): flag/read this explosion as a boundary-phase origin.
+	void coopSetBoundaryExpl(bool b) { _coopBoundaryExpl = b; }
+	bool coopBoundaryExpl() const { return _coopBoundaryExpl; }
 	/// Creates a new ExplosionBState class.
 	ExplosionBState(BattlescapeGame *parent, LastPositions center, BattleActionAttack attack, Tile *tile = 0, bool lowerWeapon = false, int range = 0, int explosionCounter = 0, int terrainMeleeTilePart = 0);
 	/// Cleans up the ExplosionBState.
diff --git a/src/Battlescape/InfoboxState.cpp b/src/Battlescape/InfoboxState.cpp
index 1795526f4..103c0ede6 100644
--- a/src/Battlescape/InfoboxState.cpp
+++ b/src/Battlescape/InfoboxState.cpp
@@ -36,8 +36,10 @@ namespace OpenXcom
 InfoboxState::InfoboxState(const std::string &msg)
 {
 
-	// coop
-	_game->getCoopMod()->_coop_task_completed = false;
+	// coop: hold the receive gate for as long as the box is up. PRD-P6 pre-task
+	// made this a depth counter - a modal opening INSIDE a shot no longer releases
+	// the projectile's own hold when it closes.
+	_game->getCoopMod()->setCoopTaskCompleted(false);
 	connectionTCP::isInfoboxClosed = false;
 
 	_screen = false;
@@ -101,7 +103,7 @@ InfoboxState::~InfoboxState()
 {
 
 	// coop
-	_game->getCoopMod()->_coop_task_completed = true;
+	_game->getCoopMod()->setCoopTaskCompleted(true);
 	connectionTCP::isInfoboxClosed = true;
 
 	delete _timer;
diff --git a/src/Battlescape/Map.cpp b/src/Battlescape/Map.cpp
index 02f72ade7..bfa860cbe 100644
--- a/src/Battlescape/Map.cpp
+++ b/src/Battlescape/Map.cpp
@@ -17,6 +17,7 @@
  * along with OpenXcom.  If not, see <http://www.gnu.org/licenses/>.
  */
 #include "Map.h"
+#include "BattlescapeGame.h" // coop (Phase 2c death ghost): CoopDeathGhost + coopActiveGhost()
 #include "Camera.h"
 #include "UnitSprite.h"
 #include "ItemSprite.h"
@@ -488,16 +489,11 @@ int getShadePulseForFrame(int shade, int frame)
  */
 void Map::drawUnit(UnitSprite &unitSprite, Tile *unitTile, Tile *currTile, Position currTileScreenPosition, bool topLayer, BattleUnit* movingUnit)
 {
-	const int tileFoorWidth = 32;
-	const int tileFoorHeight = 16;
-	const int tileHeight = 40;
-
 	if (!unitTile)
 	{
 		return;
 	}
 	BattleUnit* bu = unitTile->getOverlappingUnit(_save, TUO_ALWAYS);
-	Position unitOffset;
 	bool unitFromBelow = false;
 	bool unitFromAbove = false;
 	if (bu)
@@ -521,11 +517,52 @@ void Map::drawUnit(UnitSprite &unitSprite, Tile *unitTile, Tile *currTile, Posit
 		unitFromAbove = true;
 	}
 	else
+	{
+		// coop (Phase 2c death ghost): no live unit occupies this tile - a client-side
+		// death ghost (a unit already tile-unlinked by coopApplyCasualty) may cover it.
+		coopMaybeDrawGhost(unitSprite, unitTile, currTile, currTileScreenPosition, topLayer);
+		return;
+	}
+	drawUnitResolved(unitSprite, bu, unitTile, currTile, currTileScreenPosition, topLayer, unitFromBelow, unitFromAbove, false, false);
+}
+
+/**
+ * coop (Phase 2c death ghost): draw the death-collapse animation for a client-side
+ * ghost whose footprint covers @a unitTile. The ghost's unit was tile-unlinked by
+ * coopApplyCasualty so it never resolves through getOverlappingUnit; draw it here with
+ * its captured apply-time visibility standing in for getVisible(). A fast null-check
+ * no-op when no ghost covers this tile (host / classic / single-player).
+ */
+void Map::coopMaybeDrawGhost(UnitSprite &unitSprite, Tile *unitTile, Tile *currTile, Position currTileScreenPosition, bool topLayer)
+{
+	BattlescapeGame* bg = _save->getBattleGame();
+	if (!bg)
+	{
+		return;
+	}
+	const CoopDeathGhost* g = bg->coopGhostCoveringTile(unitTile->getPosition());
+	if (!g || !g->unit)
 	{
 		return;
 	}
+	drawUnitResolved(unitSprite, g->unit, unitTile, currTile, currTileScreenPosition, topLayer, false, false, true, g->visibleAtApply);
+}
+
+/**
+ * Draws a resolved unit (or a Phase 2c death ghost) at its tile. Factored out of
+ * drawUnit so the ghost path reuses the exact multi-tile offset / mask / shade logic;
+ * @a useVisibleOverride lets the ghost supply its captured apply-time visibility
+ * instead of the (now tile-less) unit's live getVisible().
+ */
+void Map::drawUnitResolved(UnitSprite &unitSprite, BattleUnit* bu, Tile *unitTile, Tile *currTile, Position currTileScreenPosition, bool topLayer, bool unitFromBelow, bool unitFromAbove, bool useVisibleOverride, bool visibleOverride)
+{
+	const int tileFoorWidth = 32;
+	const int tileFoorHeight = 16;
+	const int tileHeight = 40;
 
-	if (!(bu->getVisible() || _save->getDebugMode()))
+	Position unitOffset;
+
+	if (!((useVisibleOverride ? visibleOverride : bu->getVisible()) || _save->getDebugMode()))
 	{
 		return;
 	}
@@ -734,6 +771,55 @@ void Map::drawUnit(UnitSprite &unitSprite, Tile *unitTile, Tile *currTile, Posit
 	unitSprite.draw(bu, part, tileScreenPosition.x + offsets.ScreenOffset.x, tileScreenPosition.y + offsets.ScreenOffset.y, shade, mask, _isAltPressed && !_isCtrlPressed);
 }
 
+/**
+ * coop (Phase 2c death ghost): Tile::getTopItem() but skipping any item id an
+ * active/pending death ghost is hiding (its freshly minted corpse + spilled kit),
+ * so those stay invisible until the collapse animation reveals them. Replicates
+ * Tile::getTopItem's selection (>100 items -> front; any item carrying a unit wins;
+ * else max total weight). A fast passthrough to the stock getter whenever no ghost
+ * is hiding anything (host / classic / single-player, and most parallel frames).
+ */
+BattleItem* Map::coopTopItemExcluding(Tile* tile)
+{
+	BattlescapeGame* bg = _save->getBattleGame();
+	if (!bg || !bg->coopHasHiddenGhostItems())
+	{
+		return tile->getTopItem();
+	}
+	std::vector<BattleItem*>* inv = tile->getInventory();
+	if (inv->size() > 100)
+	{
+		for (auto* bi : *inv)
+		{
+			if (!bg->coopIsGhostHiddenItem(bi->getId()))
+			{
+				return bi;
+			}
+		}
+		return nullptr;
+	}
+	int biggestWeight = -999;
+	BattleItem* biggestItem = nullptr;
+	for (auto* bi : *inv)
+	{
+		if (bg->coopIsGhostHiddenItem(bi->getId()))
+		{
+			continue;
+		}
+		if (bi->getUnit())
+		{
+			return bi;
+		}
+		int temp = bi->getTotalWeight();
+		if (temp > biggestWeight)
+		{
+			biggestWeight = temp;
+			biggestItem = bi;
+		}
+	}
+	return biggestItem;
+}
+
 /**
  * Draw the terrain.
  * Keep this function as optimised as possible. It's big to minimise overhead of function calls.
@@ -1033,7 +1119,7 @@ void Map::drawTerrain(Surface *surface)
 							}
 						}
 						// draw an item on top of the floor (if any)
-						BattleItem* item = tile->getTopItem();
+						BattleItem* item = coopTopItemExcluding(tile); // coop (Phase 2c): hide a death ghost's corpse/kit until its collapse ends
 						if (item)
 						{
 							itemSprite.draw(item,
diff --git a/src/Battlescape/Map.h b/src/Battlescape/Map.h
index 007ecd4ef..df8541ecf 100644
--- a/src/Battlescape/Map.h
+++ b/src/Battlescape/Map.h
@@ -40,6 +40,8 @@ class Timer;
 class Text;
 class Tile;
 class UnitSprite;
+class BattleItem;
+struct CoopDeathGhost;
 
 enum CursorType { CT_NONE, CT_NORMAL, CT_AIM, CT_PSI, CT_WAYPOINT, CT_THROW };
 enum TilePart : int;
@@ -105,6 +107,13 @@ class Map : public InteractiveSurface
 	SurfaceSet *_projectileSet;
 
 	void drawUnit(UnitSprite &unitSprite, Tile *unitTile, Tile *currTile, Position tileScreenPosition, bool topLayer, BattleUnit* movingUnit = nullptr);
+	/// coop (Phase 2c death ghost): the body of drawUnit after the unit is resolved,
+	/// reused by the ghost draw (which supplies its captured apply-time visibility).
+	void drawUnitResolved(UnitSprite &unitSprite, BattleUnit* bu, Tile *unitTile, Tile *currTile, Position currTileScreenPosition, bool topLayer, bool unitFromBelow, bool unitFromAbove, bool useVisibleOverride, bool visibleOverride);
+	/// coop (Phase 2c death ghost): draw a client-side death ghost covering @a unitTile.
+	void coopMaybeDrawGhost(UnitSprite &unitSprite, Tile *unitTile, Tile *currTile, Position currTileScreenPosition, bool topLayer);
+	/// coop (Phase 2c death ghost): getTopItem() skipping a ghost's hidden corpse/kit.
+	BattleItem* coopTopItemExcluding(Tile* tile);
 	void drawTerrain(Surface *surface);
 	int getTerrainLevel(const Position& pos, int size) const;
 	int getWallShade(TilePart part, Tile* tileFrot);
diff --git a/src/Battlescape/MedikitState.cpp b/src/Battlescape/MedikitState.cpp
index 5dea1b636..af0feaf71 100644
--- a/src/Battlescape/MedikitState.cpp
+++ b/src/Battlescape/MedikitState.cpp
@@ -33,10 +33,43 @@
 #include "../Savegame/SavedGame.h"
 #include "../Savegame/SavedBattleGame.h"
 #include "TileEngine.h"
+#include "BattlescapeGame.h"
+#include "../CoopMod/connectionTCP.h"
 
 namespace OpenXcom
 {
 
+/**
+ * coop: adds the healer/medikit identity a classic `medkit` packet never
+ * carried. Without it the receiver has to guess the medikit from its own
+ * _currentAction, which in parallel mode belongs to the other player. Additive -
+ * an older peer ignores these keys and keeps its classic behaviour.
+ */
+static void coopStampMedikitPacket(Json::Value& obj, const BattleAction* action)
+{
+	if (action && action->actor)
+	{
+		obj["healer_id"] = action->actor->getId();
+	}
+	if (action && action->weapon)
+	{
+		obj["weapon_id"] = action->weapon->getId();
+		obj["weapon_type"] = action->weapon->getRules()->getType();
+		obj["hand"] = BattlescapeGame::coopHandOf(action->actor, action->weapon, "right");
+	}
+	if (action && action->actor)
+	{
+		// coop (PRD-P9 soak finding, same shape as rider R2): the ACTOR's cost.
+		// Prime, unprime and medikit mutate synchronously inside a UI handler, so
+		// they push no BattleState and the peer has nothing that would charge them
+		// - it mirrored the EFFECT (fuse, wounds) but never the price, and the two
+		// copies of the soldier drifted apart by the action's TU on every use
+		// (measured: 31 vs 62 after one prime). Additive and presence-gated.
+		obj["tu"] = action->actor->getTimeUnits();
+		obj["energy"] = action->actor->getEnergy();
+	}
+}
+
 /**
  * Helper function that returns a string representation of a type (mainly used for numbers).
  * @param t The value to stringify.
@@ -205,6 +238,27 @@ void MedikitState::handle(Action *action)
 	}
 }
 
+/**
+ * coop (PRD-P6): routes this press through the action-intent door. Returns true
+ * when nothing local may run (a parallel client shipped an intent; a parallel
+ * host was refused admission and flashed busy).
+ */
+bool MedikitState::coopForwardMedikit(int medikitMode, int bodyPart)
+{
+	SavedBattleGame* battle = _game->getSavedGame() ? _game->getSavedGame()->getSavedBattle() : nullptr;
+	BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+	if (!bg)
+	{
+		return false;
+	}
+	if (bg->coopRouteMedikit(_action, _targetUnit, medikitMode, bodyPart))
+	{
+		update();
+		return true;
+	}
+	return false;
+}
+
 void MedikitState::coopHandle(std::string state, int part)
 {
 
@@ -251,6 +305,14 @@ void MedikitState::onHealClick(Action *)
 		return;
 	}
 
+	// coop (PRD-P6): the parallel client asks instead of healing. The panel is
+	// still refreshed - the host's `medkit` broadcast is what actually changes
+	// the numbers it reads.
+	if (coopForwardMedikit(BMA_HEAL, _medikitView->getSelectedPart()))
+	{
+		return;
+	}
+
 	if (_action->spendTU(&_action->result))
 	{
 		bool canContinueHealing = _tileEngine->medikitUse(_action, _targetUnit, BMA_HEAL, (UnitBodyPart)_medikitView->getSelectedPart());
@@ -264,6 +326,7 @@ void MedikitState::onHealClick(Action *)
 			obj["type"] = (int)_action->type;
 			obj["part"] = _medikitView->getSelectedPart();
 			obj["medkit_state"] = "heal";
+			coopStampMedikitPacket(obj, _action);
 			obj["action_result"] = &_action->result;
 			obj["time"] = _action->Time;
 
@@ -295,6 +358,12 @@ void MedikitState::onStimulantClick(Action *)
 		return;
 	}
 
+	// coop (PRD-P6)
+	if (coopForwardMedikit(BMA_STIMULANT, BODYPART_TORSO))
+	{
+		return;
+	}
+
 	if (_action->spendTU(&_action->result))
 	{
 		bool canContinueHealing = _tileEngine->medikitUse(_action, _targetUnit, BMA_STIMULANT, BODYPART_TORSO);
@@ -313,6 +382,7 @@ void MedikitState::onStimulantClick(Action *)
 			obj["type"] = (int)_action->type;
 			obj["part"] = _medikitView->getSelectedPart();
 			obj["medkit_state"] = "stimulant";
+			coopStampMedikitPacket(obj, _action);
 			obj["action_result"] = &_action->result;
 
 			_game->getCoopMod()->sendTCPPacketData(obj.toStyledString());
@@ -336,6 +406,12 @@ void MedikitState::onPainKillerClick(Action *)
 		return;
 	}
 
+	// coop (PRD-P6)
+	if (coopForwardMedikit(BMA_PAINKILLER, BODYPART_TORSO))
+	{
+		return;
+	}
+
 	if (_action->spendTU(&_action->result))
 	{
 		bool canContinueHealing = _tileEngine->medikitUse(_action, _targetUnit, BMA_PAINKILLER, BODYPART_TORSO);
@@ -355,6 +431,7 @@ void MedikitState::onPainKillerClick(Action *)
 			obj["type"] = (int)_action->type;
 			obj["part"] = _medikitView->getSelectedPart();
 			obj["medkit_state"] = "painkiller";
+			coopStampMedikitPacket(obj, _action);
 			obj["action_result"] = &_action->result;
 
 			_game->getCoopMod()->sendTCPPacketData(obj.toStyledString());
diff --git a/src/Battlescape/MedikitState.h b/src/Battlescape/MedikitState.h
index e8e0487de..b023b77f1 100644
--- a/src/Battlescape/MedikitState.h
+++ b/src/Battlescape/MedikitState.h
@@ -59,5 +59,9 @@ class MedikitState : public State
 	/// Handler for right-clicking anything.
 	void handle(Action *action) override;
 	void coopHandle(std::string state, int part);
+	/// coop (PRD-P6): ships this press as an `action_intent` on a parallel
+	/// client (and gates the parallel host on the same admission check).
+	bool coopForwardMedikit(int medikitMode, int bodyPart);
+
 };
 }
diff --git a/src/Battlescape/MeleeAttackBState.cpp b/src/Battlescape/MeleeAttackBState.cpp
index 212e46f23..b45056afb 100644
--- a/src/Battlescape/MeleeAttackBState.cpp
+++ b/src/Battlescape/MeleeAttackBState.cpp
@@ -36,6 +36,20 @@
 namespace OpenXcom
 {
 
+// coop (wire-order report alignment, Increment 2 / A1): the master lever, file-scope in
+// connectionTCP.cpp; extern-declared here (matching TestServer.cpp) to fence the display-
+// replay ammo spend without a connectionTCP.h recompile.
+extern std::atomic<bool> g_wireOrderState;
+// True only when THIS machine is the parallel CLIENT with the wire-order lever on - the one
+// case where a display replay's spendAmmoForAction would clobber the host's SEAM-11 itemAmmo
+// absolute (docs carrier-census A1). Lever-off / host / classic -> false -> ammo is spent
+// exactly as before (byte-identical).
+static bool coopFenceReplayAmmoSpend()
+{
+	return g_wireOrderState.load(std::memory_order_relaxed)
+		&& connectionTCP::parallelTurnActive() && !connectionTCP::getHost();
+}
+
 /**
  * Sets up a MeleeAttackBState.
  */
@@ -59,6 +73,16 @@ void MeleeAttackBState::init()
 	if (_initialized) return;
 	_initialized = true;
 
+	// coop (PRD-P6 pre-task): melee had no receive-gate coverage - the peer could
+	// apply an unrelated packet halfway through a melee chain. Mirrors
+	// UnitTurnBState. Guarded: popState() re-init()s this state when the
+	// ExplosionBState it pushes in front of itself pops.
+	if (!_coopGateHeld)
+	{
+		_coopGateHeld = true;
+		_parent->setCoopTaskCompleted(false);
+	}
+
 	
 	// coop
 	if (_parent->getCoopMod()->_isActivePlayerSync == false && _parent->getCoopMod()->getCoopStatic() == true)
@@ -200,7 +224,11 @@ void MeleeAttackBState::init()
 	}
 
 	//spend TU
-	if (!_action.spendTU(&_action.result) && !coop_action)
+	// coop: spendTU() was the LEFT operand, so a replayed melee spent the TU
+	// AGAIN on top of the authoritative value the packet had just written
+	// (measured 49 vs 29). The guard has to short-circuit, not just suppress the
+	// popState.
+	if (!coop_action && !_action.spendTU(&_action.result))
 	{
 		_parent->popState();
 		return;
@@ -264,6 +292,23 @@ void MeleeAttackBState::init()
 
 	}
 
+	// coop (PRD-P3 GAP-4b): decide hit/miss HERE, before the ExplosionBState this
+	// pushes can roll it, and park the answer for TileEngine::meleeAttack to
+	// replay. The sender is the machine that already owns every other pre-roll
+	// for this action (the aim/trajectory queue), and deciding it now is what
+	// lets the boolean ride the SAME packet - a follow-up would race the peer's
+	// own ExplosionBState, which starts one frame after its MeleeAttackBState.
+	bool coopMeleeHit = false;
+	const bool coopMeleeSender = _parent->getCoopMod()->getCoopStatic() == true
+								 && _parent->getCoopMod()->_isActivePlayerSync == true;
+	if (coopMeleeSender)
+	{
+		coopMeleeHit = (terrainMeleeTilePart > 0) // terrain melee never misses
+					   || (_parent->getTileEngine()->meleeAttackCalculate(
+							   BattleActionAttack::GetAferShoot(_action, _ammo), _target) > 0);
+		_parent->getCoopMod()->_meleeResults.push_back(coopMeleeHit ? 1 : 0);
+	}
+
 	performMeleeAttack();
 
 	// coop
@@ -271,6 +316,11 @@ void MeleeAttackBState::init()
 	{
 		Json::Value obj;
 		obj["state"] = "melee_attack";
+		// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+		// client's action_end apply-barrier accounts for this parked melee hit/miss
+		// result (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(obj);
+		obj["hit"] = coopMeleeHit;
 
 		int index = 0;
 
@@ -326,6 +376,18 @@ void MeleeAttackBState::init()
 
 }
 
+/**
+ * Deinitializes the state - releases the co-op receive gate init() took.
+ */
+void MeleeAttackBState::deinit()
+{
+	if (_coopGateHeld)
+	{
+		_coopGateHeld = false;
+		_parent->setCoopTaskCompleted(true);
+	}
+}
+
 /**
  * Performs all the overall functions of the state, this code runs AFTER the explosion state pops.
  */
@@ -390,7 +452,10 @@ void MeleeAttackBState::performMeleeAttack(int terrainMeleeTilePart)
 	_unit->aim(true);
 
 	// use up ammo if applicable
-	_action.weapon->spendAmmoForAction(BA_HIT, _parent->getSave());
+	// coop (wire-order Increment 2 / A1): fence the parallel client's display-replay ammo
+	// spend lever-on; the host's SEAM-11 itemAmmo absolute authors canonical ammo.
+	if (!coopFenceReplayAmmoSpend())
+		_action.weapon->spendAmmoForAction(BA_HIT, _parent->getSave());
 	_parent->getMap()->setCursorType(CT_NONE);
 
 	// offset the damage voxel ever so slightly so that the target knows which side the attack came from
diff --git a/src/Battlescape/MeleeAttackBState.h b/src/Battlescape/MeleeAttackBState.h
index d305c7755..0170256a0 100644
--- a/src/Battlescape/MeleeAttackBState.h
+++ b/src/Battlescape/MeleeAttackBState.h
@@ -40,6 +40,10 @@ class MeleeAttackBState : public BattleState
 	int _hitNumber;
 	bool _initialized;
 	bool _reaction;
+	/// coop (PRD-P6 pre-task): does this state hold the receive gate? The melee
+	/// chain had NO gate coverage at all before P6 (AUDIT-rng caution 1), so a
+	/// peer packet could interleave into the middle of one.
+	bool _coopGateHeld = false;
 public:
 	/// Creates a new MeleeAttackBState class
 	MeleeAttackBState(BattlescapeGame *parent, BattleAction action);
@@ -47,6 +51,8 @@ class MeleeAttackBState : public BattleState
 	~MeleeAttackBState();
 	/// Initializes the state.
 	void init() override;
+	/// Deinitializes the state.
+	void deinit() override;
 	/// Runs state functionality every cycle.
 	void think() override;
 	/// Performs a melee attack
diff --git a/src/Battlescape/NextTurnState.cpp b/src/Battlescape/NextTurnState.cpp
index c3a4fed4b..4d3e2ab62 100644
--- a/src/Battlescape/NextTurnState.cpp
+++ b/src/Battlescape/NextTurnState.cpp
@@ -48,6 +48,8 @@
 #include "Map.h"
 #include "TileEngine.h"
 #include "Pathfinding.h"
+#include "../CoopMod/SharedEcon.h"
+#include "../CoopMod/connectionTCP.h" // coop (PRD-I0): the side-start boundary marker
 
 namespace OpenXcom
 {
@@ -490,7 +492,13 @@ bool NextTurnState::applyEnvironmentalConditionToFaction(UnitFaction faction, En
 	if (showMessage)
 	{
 		// now check for new casualties
+		// coop (chain-atomicity Strand A): environmental-condition (fire/EMP/etc.) turn-start
+		// casualties are a side-start boundary pass (the sidestart marker is armed later in
+		// NextTurnState::close), so flag the phase to keep these deaths seq-0 instead of
+		// opening a loose mid-side chain during the next-turn screen.
+		_battleGame->getBattleGame()->coopSetBoundaryCasualty(true);
 		_battleGame->getBattleGame()->checkForCasualties(nullptr, BattleActionAttack{ }, true, false);
+		_battleGame->getBattleGame()->coopSetBoundaryCasualty(false);
 		// revive units if damage could give hp or reduce stun
 		//_battleGame->reviveUnconsciousUnits(true);
 	}
@@ -576,6 +584,11 @@ void NextTurnState::close()
 		// we don't care if someone was revived in the meantime, the decision to end the battle was already made!
 		tally.liveAliens = 0;
 
+		// coop (PRD-I3 Option D-lite): the battle is ending here, so DISCARD any pending
+		// deferred turn advance - there is no player side to advance to and the debriefing
+		// is the authoritative replacement (harmless on the host; the flag is client-only).
+		connectionTCP::_turnAdvanceDeferred = 0;
+
 		// mind control anyone who was revived (needed for correct recovery in the debriefing)
 		for (auto* bu : *_battleGame->getUnits())
 		{
@@ -592,8 +605,24 @@ void NextTurnState::close()
 	// not "escort the VIPs" missions, not the final mission and all aliens dead.
 	bool killingAllAliensIsNotEnough = _battleGame->getObjectiveType() == MUST_DESTROY || (_battleGame->getVIPSurvivalPercentage() > 0 && _battleGame->getVIPEscapeType() != ESCAPE_NONE);
 
-	// coop
-	if ((!killingAllAliensIsNotEnough && tally.liveAliens == 0) || tally.liveSoldiers == 0)
+	// coop (SESSION D): battle end is HOST-AUTHORITATIVE in parallel mode. The
+	// parallel client must not decide the battle is over from its OWN tallyUnits()
+	// - its tally can diverge from the host's whenever a battle-end input is
+	// deferred/host-only (e.g. a mod with surrenderMode>=2 reads the panic
+	// wantsToSurrender the client DEFERS at BattleUnit::prepareNewTurn, so a
+	// surrendered alien still counts as a live alien here). Ending on the local
+	// tally would either quiesce the client early (host still fighting -> the
+	// client waits for a debrief that never comes) or make the two machines
+	// disagree on when the battle ends. The host announces the end with the
+	// "DebriefingState" packet (the single trigger in PVE/SHARED; BattlescapeState::
+	// finishBattle already no-ops on the non-host PVE client), so on the parallel
+	// client never take the local-tally end branch - follow the host's turn
+	// machinery and end only on the host's packet. The host and classic co-op keep
+	// their own tally (the guard is false there), so both stay byte-identical.
+	// Abort is a separate, explicitly host-announced vote (finishBattle(true), which
+	// is NOT gated here and still crosses on the client).
+	const bool coopHostAuthoritativeEnd = connectionTCP::parallelTurnActive() && !_game->getCoopMod()->getHost();
+	if (!coopHostAuthoritativeEnd && ((!killingAllAliensIsNotEnough && tally.liveAliens == 0) || tally.liveSoldiers == 0))
 	{
 		_state->finishBattle(false, tally.liveSoldiers);
 	}
@@ -627,6 +656,30 @@ void NextTurnState::close()
 
 					root["end"] = true;
 
+					// coop (PRD-I3 Option D-lite): the authoritative turn/side for the client's
+					// deferred turn-machine advance. Additive - an old peer ignores them and
+					// keeps the legacy free-run, so classic/old-host posture is unchanged.
+					root["turn"] = _battleGame->getTurn();
+					root["side"] = (int)_battleGame->getSide();
+
+					// coop (parallel battlescape Phase 1 - per-unit state watermark): stamp
+					// this next_turn snapshot with the side that just started (BattlescapeGame::
+					// endTurn already incremented connectionTCP::_sideSeq before sending endTurn,
+					// so it is the new side's token by the time we get here). Rank 0 (snapshot).
+					// Additive - an old peer ignores these fields.
+					if (connectionTCP::parallelTurnActive())
+					{
+						root["side_seq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+						root["action_seq"] = 0;
+					}
+
+					// coop (explosion ordered-replay E0): host->client objective-counter
+					// parity. The client no longer self-counts (LEAK-OBJ gate in
+					// SavedBattleGame::addDestroyedObjective), so it converges to this
+					// absolute on next_turn (applied in connectionTCP's next_turn handler).
+					if (connectionTCP::parallelTurnActive())
+						root["objectivesDestroyed"] = static_cast<Json::UInt>(_battleGame->getObjectivesDestroyed());
+
 					for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
 					{
 
@@ -656,6 +709,24 @@ void NextTurnState::close()
 
 						root["units"][index]["fire"] = unit->getFire();
 
+						// coop (PRD-I3 Session F saveBlob close): the unit's ABSOLUTE floating
+						// bit. Real kneel-eligibility reader (BattlescapeGame.cpp:1394 /
+						// UnitTurnBState.cpp:220); a unit_fall coverage gap left it diverging on
+						// the parallel client at SIDESTART (saveBlob `floating`). next_turn is the
+						// boundary carrier for the host's post-turn state, so it ships the absolute
+						// here (faction/fire precedent). Additive/present-gated; client applies
+						// PVE-only via setFloatingCoop.
+						root["units"][index]["floating"] = unit->isFloating();
+
+						// coop (PRD-I3 SEAM-10): the unit's ABSOLUTE faction. A mind-controlled
+						// unit reverts to its original faction at the NEUTRAL->PLAYER boundary in
+						// SavedBattleGame::endTurn's prepareNewTurn loop - which the HOST runs but
+						// the parallel client DEFERS to this packet (connectionTCP side==2), so a
+						// dead/MC-expired victim would otherwise keep the player faction forever.
+						// next_turn is built AFTER that revert, so getFaction() is the post-revert
+						// absolute. Additive/present-gated; the client applies it PVE-only.
+						root["units"][index]["faction"] = (int)unit->getFaction();
+
 						// mind control (host)
 						if (unit->_coop_mindcontrolled == true)
 						{
@@ -706,7 +777,14 @@ void NextTurnState::close()
 
 
 						// coop fix
-						if (!unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+						// coop (parallel Phase 3, Sub-task B): host send-side tile-less
+						// DEAD-status inference - classic only. In parallel the atomic
+						// unit_casualty already carried each casualty's explicit final
+						// status when it died, so re-inferring DEAD from tile-lessness
+						// here (ahead of building this next_turn snapshot's `isTile`
+						// field below, which stays ungated) is unneeded and could
+						// misfire.
+						if (!connectionTCP::parallelTurnActive() && !unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
 						{
 							unit->setCoopStatus(STATUS_DEAD);
 						}
@@ -757,8 +835,55 @@ void NextTurnState::close()
 						++tile_index;
 					}
 
+					// coop (PRD-I3 SEAM-11): every item's ammo absolute. The parallel client
+					// replays shots for DISPLAY and runs its own spendAmmoForAction, which
+					// drifts on a diverging autoshot/abort count (saveBlob ammoqty, e.g. 17 vs
+					// 14); a chain-close absolute is clobbered by the still-running replay's
+					// later spend, so ship it here - next_turn applies AFTER every replay has
+					// drained, and mid-turn drift heals by the SIDESTART where saveBlob compares.
+					// RAW qty (not getAmmoQuantity()'s clipSize==-1 -> 255) so a self-powered
+					// weapon reads -1 on both; only non-zero, matching BattleItem::save's gate.
+					{
+						int ammoIndex = 0;
+						for (BattleItem* bi : *_game->getSavedGame()->getSavedBattle()->getItems())
+						{
+							if (!bi || bi->getAmmoQuantityRaw() == 0) continue;
+							root["itemAmmo"][ammoIndex]["id"] = bi->getId();
+							root["itemAmmo"][ammoIndex]["qty"] = bi->getAmmoQuantityRaw();
+							ammoIndex++;
+						}
+					}
+
+					// PRD-P2 3b: the battle drift tripwire rides the per-turn packet -
+					// the one packet guaranteed to cross once a turn, and already a
+					// full-state stamp. The client compares and REPORTS; it never
+					// repairs (SharedEcon.h explains why).
+					SharedEcon::attachBattleChecksum(_game, root);
+
+					// PRD-P4: the same turn-boundary hygiene the peer does on the
+					// receiving side. A Tier-A record whose carrier packet never went
+					// out - the host replaying a CLIENT-driven death, whose
+					// `after_unit_death` this machine does not send - would otherwise
+					// sit in the store for the rest of the battle.
+					SharedEcon::clearSpawnManifests();
+
 					_game->getCoopMod()->sendTCPPacketData(root.toStyledString());
 
+					// coop (PRD-I0): the SIDE-START boundary pseudo-seq. `next_turn`
+					// is the packet that repairs unit stats and tile hazards from the
+					// host's snapshot, so the state right after it is the common
+					// baseline every action of the new side is measured from - and it
+					// is the only place both machines can be asked "do you agree yet?"
+					// with a defensible answer.
+					//
+					// Armed, so the marker leaves AFTER this packet and the client
+					// consumes it once `next_turn` has been APPLIED. That is the
+					// hash-after-apply half of PRD-I0 §1 - deliberately the opposite
+					// of attachBattleChecksum's compare-before-apply above, which
+					// stays as it is because the tripwire needs the PRE-repair state
+					// or it would be silent by construction.
+					connectionTCP::coopArmSyncBoundary("sidestart");
+
 				}
 
 			}
diff --git a/src/Battlescape/PrimeGrenadeState.cpp b/src/Battlescape/PrimeGrenadeState.cpp
index 5f563d04f..2d68095fb 100644
--- a/src/Battlescape/PrimeGrenadeState.cpp
+++ b/src/Battlescape/PrimeGrenadeState.cpp
@@ -25,6 +25,7 @@
 #include "../Interface/Frame.h"
 #include "../Engine/InteractiveSurface.h"
 #include "../Savegame/BattleItem.h"
+#include "../Savegame/BattleUnit.h"
 #include "../Savegame/SavedGame.h"
 #include "../Savegame/SavedBattleGame.h"
 #include "../Mod/Mod.h"
@@ -176,8 +177,11 @@ void PrimeGrenadeState::btnClick(Action *action)
 	if (btnID != -1)
 	{
 
-		// coop
-		if (_game->getCoopMod()->getCoopStatic() == true && _game->getCoopMod()->getCurrentTurn() != 1)
+		// coop. A parallel CLIENT never sends it: the prime is confirmed in
+		// BattlescapeGame::handleNonTargetAction(), which ships an `action_intent`,
+		// and the host re-broadcasts `active_grenade` once it has actually primed.
+		if (_game->getCoopMod()->getCoopStatic() == true && _game->getCoopMod()->getCurrentTurn() != 1
+			&& !connectionTCP::parallelInputBlocked())
 		{
 
 			Json::Value root;
@@ -198,6 +202,18 @@ void PrimeGrenadeState::btnClick(Action *action)
 	
 			root["actor_id"] = _game->getSavedGame()->getSavedBattle()->getBattleGame()->getCoopActorID();
 
+			if (_action && _action->actor)
+			{
+			// coop (PRD-P9 soak finding, same shape as rider R2): the ACTOR's cost.
+			// Prime, unprime and medikit mutate synchronously inside a UI handler, so
+			// they push no BattleState and the peer has nothing that would charge them
+			// - it mirrored the EFFECT (fuse, wounds) but never the price, and the two
+			// copies of the soldier drifted apart by the action's TU on every use
+			// (measured: 31 vs 62 after one prime). Additive and presence-gated.
+				root["tu"] = _action->actor->getTimeUnits();
+				root["energy"] = _action->actor->getEnergy();
+			}
+
 			if (_grenadeInInventory)
 			{
 				root["item_id"] = _grenadeInInventory->getId();
diff --git a/src/Battlescape/Projectile.cpp b/src/Battlescape/Projectile.cpp
index 9c890477e..d81c69fa9 100644
--- a/src/Battlescape/Projectile.cpp
+++ b/src/Battlescape/Projectile.cpp
@@ -216,6 +216,25 @@ int Projectile::calculateTrajectory(double accuracy, const Position& originVoxel
 			max_shots = conf->shots;
 		}
 
+		// coop (PRD-P3 GAP-5): a shotgun fires ONE queued shot and then traces
+		// getShotgunPellets()-1 extra trajectories per shot. Only the shots were
+		// pre-rolled, so the peer ran dry mid-pellet and started rolling aim points
+		// off its own RNG stream: different pellet endpoints, a different number of
+		// TileEngine::hit() calls, and from there a permanently mis-paired hit
+		// stream. Pre-roll the pellets too, interleaved in the exact order both
+		// machines consume them (shot, its pellets, next shot, its pellets, ...).
+		int pellets = 1;
+		if (_ammo && _ammo->getRules()->getShotgunPellets() != 0 && _ammo->getRules()->getDamageType()->isDirect())
+		{
+			pellets = _ammo->getRules()->getShotgunPellets();
+		}
+		const int shotgunSpread = pellets > 1 ? _ammo->getRules()->getShotgunSpread() : 0;
+		const int shotgunBehavior = pellets > 1 ? _ammo->getRules()->getShotgunBehaviorType() : 0;
+		const int shotgunChoke = pellets > 1 ? _action.weapon->getRules()->getShotgunChoke() : 0;
+		// The pellet rolls must not walk _targetVoxel forward the way the shot rolls
+		// deliberately do, so they run off a saved copy of the original aim.
+		const Position pelletBaseTarget = _targetVoxel;
+
 		bool accuracyLossCoop = false;
 		double accuracyLossCoopValue = 0;
 
@@ -242,6 +261,29 @@ int Projectile::calculateTrajectory(double accuracy, const Position& originVoxel
 			_coopProjectilesClient.append(projectile);
 			_coopProjectilesHost.append(projectile);
 
+			for (int p = 1; p < pellets; ++p)
+			{
+				double pelletAccuracy = shotgunBehavior == 1
+											? std::max(0.0, (1.0 - shotgunSpread / 100.0) * shotgunChoke / 100.0)
+											: std::max(0.0, accuracy - p * 5.0 * shotgunSpread / 100.0);
+
+				Position pelletTarget = pelletBaseTarget;
+				applyAccuracy(originVoxel, &pelletTarget, pelletAccuracy, false, extendLine);
+
+				Json::Value pelletShot(Json::objectValue);
+
+				pelletShot["rng_x"] = pelletTarget.x;
+				pelletShot["rng_y"] = pelletTarget.y;
+				pelletShot["rng_z"] = pelletTarget.z;
+				pelletShot["seed"] = RNG::getSeedCoop();
+				pelletShot["origin_x"] = originVoxel.x;
+				pelletShot["origin_y"] = originVoxel.y;
+				pelletShot["origin_z"] = originVoxel.z;
+
+				_coopProjectilesClient.append(pelletShot);
+				_coopProjectilesHost.append(pelletShot);
+			}
+
 		}
 
 		_save->getBattleGame()->getCoopMod()->_coopAllow = true;
diff --git a/src/Battlescape/ProjectileFlyBState.cpp b/src/Battlescape/ProjectileFlyBState.cpp
index 8bb47dd74..20a3e3a48 100644
--- a/src/Battlescape/ProjectileFlyBState.cpp
+++ b/src/Battlescape/ProjectileFlyBState.cpp
@@ -37,12 +37,27 @@
 #include "Camera.h"
 #include "Explosion.h"
 #include "BattlescapeState.h"
+#include "../CoopMod/connectionTCP.h"
 #include "../Savegame/BattleUnitStatistics.h"
 #include "../fmath.h"
 
 namespace OpenXcom
 {
 
+// coop (wire-order report alignment, Increment 2 / A1): the master lever, file-scope in
+// connectionTCP.cpp; extern-declared here (matching TestServer.cpp) to fence the display-
+// replay ammo spend without a connectionTCP.h recompile.
+extern std::atomic<bool> g_wireOrderState;
+// True only when THIS machine is the parallel CLIENT with the wire-order lever on - the one
+// case where a display replay's spendAmmoForAction would clobber the host's SEAM-11 itemAmmo
+// absolute (docs carrier-census A1). Lever-off / host / classic -> false -> ammo is spent
+// exactly as before (byte-identical).
+static bool coopFenceReplayAmmoSpend()
+{
+	return g_wireOrderState.load(std::memory_order_relaxed)
+		&& connectionTCP::parallelTurnActive() && !connectionTCP::getHost();
+}
+
 /**
  * Sets up an ProjectileFlyBState.
  */
@@ -72,8 +87,11 @@ void ProjectileFlyBState::init()
 	if (_initialized) return;
 	_initialized = true;
 
-	// coop
-	_parent->getCoopMod()->_coop_task_completed = false;
+	// coop: acquire the receive gate for the whole shot. Safe to do unguarded -
+	// init() returns early above when it has already run, which is what keeps this
+	// paired with the single deinit() release even though popState() re-init()s the
+	// state every time an ExplosionBState pushed in front of it pops.
+	_parent->getCoopMod()->setCoopTaskCompleted(false);
 	_parent->getCoopMod()->_coopInitDeath = true;
 	_parent->getCoopMod()->_hasHitUnit = -1;
 
@@ -294,8 +312,37 @@ void ProjectileFlyBState::init()
 		return;
 	}
 
+	// coop (PRD-P3 GAP-4b): the close-quarters check is three independent RNG draws
+	// (the sneak-up percent, the to-hit roll, and the redirect direction) that both
+	// machines used to make for the same shot. The SENDER runs it; the peer applies
+	// the outcome, which mostly rides this packet already - the redirected aim IS
+	// the target the packet carries, because the block below rewrites _action.target
+	// before the send at the end of init().
+	bool coopCqbBlocked = false;
+	int coopCqbDefender = -1;
+	const bool coopCqbReplay = _parent->isCoop() == true && _parent->getCoopMod()->_isActivePlayerSync == false;
+	if (coopCqbReplay)
+	{
+		coopCqbBlocked = _parent->getCoopMod()->_cqbBlocked;
+		coopCqbDefender = _parent->getCoopMod()->_cqbDefenderId;
+		_parent->getCoopMod()->_cqbBlocked = false;
+		_parent->getCoopMod()->_cqbDefenderId = -1;
+		if (coopCqbBlocked && coopCqbDefender != -1)
+		{
+			for (auto* bu : *_parent->getSave()->getUnits())
+			{
+				if (bu->getId() == coopCqbDefender)
+				{
+					bu->spendTimeUnits(_parent->getMod()->getCloseQuartersTuCostGlobal());
+					bu->spendEnergy(_parent->getMod()->getCloseQuartersEnergyCostGlobal());
+					break;
+				}
+			}
+		}
+	}
+
 	// Check for close quarters combat
-	if (_parent->getMod()->getEnableCloseQuartersCombat() && _action.type != BA_THROW && _action.type != BA_LAUNCH && _unit->getTurretType() == -1 && !_unit->getArmor()->getIgnoresMeleeThreat())
+	if (!coopCqbReplay && _parent->getMod()->getEnableCloseQuartersCombat() && _action.type != BA_THROW && _action.type != BA_LAUNCH && _unit->getTurretType() == -1 && !_unit->getArmor()->getIgnoresMeleeThreat())
 	{
 		// Start by finding 'targets' for the check
 		std::vector<BattleUnit*> closeQuartersTargetList;
@@ -406,6 +453,9 @@ void ProjectileFlyBState::init()
 					// We're done, spend TUs and Energy; and don't check remaining CQB candidates anymore
 					bu->spendTimeUnits(_parent->getMod()->getCloseQuartersTuCostGlobal());
 					bu->spendEnergy(_parent->getMod()->getCloseQuartersEnergyCostGlobal());
+					// coop: report the outcome with the shot packet at the end of init()
+					coopCqbBlocked = true;
+					coopCqbDefender = bu->getId();
 					break;
 				}
 			}
@@ -526,6 +576,17 @@ void ProjectileFlyBState::init()
 			// temporarily turn off camera following projectiles to prevent annoying flashing effects (e.g. on minigun-like weapons)
 			_parent->getMap()->setFollowProjectile(false);
 		}
+		// coop (PRD-P5): a teammate's replayed shot must not drag the local camera
+		// during a parallel player side - the local player is aiming their own shot
+		// at the same time. Map::draw()'s projectile follow is the one that would do
+		// it. deinit() turns following back on unconditionally, so this is scoped to
+		// the replayed chain. The AI phase keeps the follow (nobody is acting
+		// locally), and classic co-op is untouched.
+		if (_action.coopReplay && connectionTCP::parallelTurnActive()
+			&& _parent->getCoopMod()->_isActiveAISync == false)
+		{
+			_parent->getMap()->setFollowProjectile(false);
+		}
 		if (_range == 0) _action.spendTU();
 		_parent->getMap()->setCursorType(CT_NONE);
 		_parent->getMap()->getCamera()->stopMouseScrolling();
@@ -573,6 +634,11 @@ void ProjectileFlyBState::init()
 		// fix!
 		obj["weapon_type"] = _action.weapon->getRules()->getType();
 
+		// coop (PRD-P3 GAP-4b): close-quarters outcome. The redirected aim needs no
+		// field of its own - the coords above already carry it.
+		obj["cqb_blocked"] = coopCqbBlocked;
+		obj["cqb_defender"] = coopCqbDefender;
+
 		obj["projectiles"] = _parent->getCoopMod()->_coopProjectilesClient;
 
 		obj["ammo_type"] = "";
@@ -730,7 +796,10 @@ bool ProjectileFlyBState::createNewProjectile()
 			}
 			if (_action.type != BA_LAUNCH)
 			{
-				_action.weapon->spendAmmoForAction(_action.type, _parent->getSave());
+				// coop (wire-order Increment 2 / A1): fence the parallel client's
+				// display-replay ammo spend lever-on; SEAM-11 itemAmmo authors canonical ammo.
+				if (!coopFenceReplayAmmoSpend())
+					_action.weapon->spendAmmoForAction(_action.type, _parent->getSave());
 			}
 		}
 		else
@@ -778,7 +847,10 @@ bool ProjectileFlyBState::createNewProjectile()
 			}
 			if (_action.type != BA_LAUNCH)
 			{
-				_action.weapon->spendAmmoForAction(_action.type, _parent->getSave());
+				// coop (wire-order Increment 2 / A1): fence the parallel client's
+				// display-replay ammo spend lever-on; SEAM-11 itemAmmo authors canonical ammo.
+				if (!coopFenceReplayAmmoSpend())
+					_action.weapon->spendAmmoForAction(_action.type, _parent->getSave());
 			}
 		}
 		else
@@ -819,8 +891,12 @@ void ProjectileFlyBState::deinit()
 {
 
 	// coop
-	_parent->getCoopMod()->_coop_task_completed = true;
+	_parent->getCoopMod()->setCoopTaskCompleted(true);
 	_parent->getCoopMod()->_coopInitDeath = false;
+	// coop (Class-A soak wedge fix): the shot chain is over, so no pacing wait can
+	// still be outstanding on it - clear the flag defensively (a force-drain or a
+	// normal release already cleared it; this guards the paths that popped early).
+	_parent->getCoopMod()->_coopPacingWait = false;
 	// coop fix
 	_parent->getCoopMod()->_trajectoryCoop.clear();
 
@@ -832,6 +908,10 @@ void ProjectileFlyBState::deinit()
 
 		Json::Value obj;
 		obj["state"] = "hasHitUnit";
+		// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+		// holds this outcome for its own chain's opener instead of contaminating
+		// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(obj);
 
 		_parent->getCoopMod()->sendTCPPacketData(obj.toStyledString());
 	}
@@ -873,6 +953,10 @@ void ProjectileFlyBState::think()
 
 				Json::Value obj;
 				obj["state"] = "hasHitUnit";
+				// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+				// holds this outcome for its own chain's opener instead of contaminating
+				// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+				connectionTCP::coopStampChainSeq(obj);
 
 				_parent->getCoopMod()->sendTCPPacketData(obj.toStyledString());
 
@@ -974,7 +1058,10 @@ void ProjectileFlyBState::think()
 				_parent->getMap()->resetCameraSmoothing();
 				if (_action.type == BA_LAUNCH)
 				{
-					_action.weapon->spendAmmoForAction(_action.type, _parent->getSave());
+					// coop (wire-order Increment 2 / A1): fence the parallel client's
+					// display-replay ammo spend lever-on; SEAM-11 itemAmmo authors canonical ammo.
+					if (!coopFenceReplayAmmoSpend())
+						_action.weapon->spendAmmoForAction(_action.type, _parent->getSave());
 				}
 
 				if (_projectileImpact != V_OUTOFBOUNDS)
@@ -1067,6 +1154,10 @@ void ProjectileFlyBState::think()
 										power = _ammo->getRules()->getPowerBonus(attack) - _ammo->getRules()->getPowerRangeReduction(proj->getDistance());
 									}
 									_parent->getMap()->getExplosions()->push_back(explosion);
+									// coop (PRD-I3 SEAM-3 close): a shotgun pellet's direct terrain hit owns a
+									// seq if the shot chain has already drained (loose); in-chain it is a no-op
+									// and the destroy inherits the shot's seq. Shots are mid-side, no boundary.
+									connectionTCP::coopStampLooseOutcomeChain("pellet");
 									_parent->getSave()->getTileEngine()->hit(attack, proj->getPosition(offset), power, _ammo->getRules()->getDamageType());
 
 									//do not work yet
diff --git a/src/Battlescape/PsiAttackBState.cpp b/src/Battlescape/PsiAttackBState.cpp
index 34ccffa07..09d651688 100644
--- a/src/Battlescape/PsiAttackBState.cpp
+++ b/src/Battlescape/PsiAttackBState.cpp
@@ -57,6 +57,16 @@ void PsiAttackBState::init()
 	if (_initialized) return;
 	_initialized = true;
 
+	// coop (PRD-P6 pre-task): psi had no receive-gate coverage - the peer could
+	// apply an unrelated packet halfway through a psi chain. Mirrors
+	// UnitTurnBState. Guarded: popState() re-init()s this state when the
+	// ExplosionBState it pushes in front of itself pops.
+	if (!_coopGateHeld)
+	{
+		_coopGateHeld = true;
+		_parent->setCoopTaskCompleted(false);
+	}
+
 	// coop
 	if (_parent->getCoopMod()->_isActivePlayerSync == false && _parent->getCoopMod()->_psi_target_id != -1)
 	{
@@ -181,6 +191,18 @@ void PsiAttackBState::init()
 
 }
 
+/**
+ * Deinitializes the state - releases the co-op receive gate init() took.
+ */
+void PsiAttackBState::deinit()
+{
+	if (_coopGateHeld)
+	{
+		_coopGateHeld = false;
+		_parent->setCoopTaskCompleted(true);
+	}
+}
+
 /**
  * After the explosion animation is done doing its thing,
  * restore the camera/cursor.
diff --git a/src/Battlescape/PsiAttackBState.h b/src/Battlescape/PsiAttackBState.h
index 1dc733781..8490f71bb 100644
--- a/src/Battlescape/PsiAttackBState.h
+++ b/src/Battlescape/PsiAttackBState.h
@@ -36,6 +36,9 @@ class PsiAttackBState : public BattleState
 	BattleUnit *_unit, *_target;
 	BattleItem *_item;
 	bool _initialized;
+	/// coop (PRD-P6 pre-task): does this state hold the receive gate? Psi had NO
+	/// gate coverage at all before P6 (AUDIT-rng caution 1).
+	bool _coopGateHeld = false;
 public:
 	/// Creates a new PsiAttack state.
 	PsiAttackBState(BattlescapeGame *parent, BattleAction action);
@@ -43,6 +46,8 @@ class PsiAttackBState : public BattleState
 	~PsiAttackBState();
 	/// Initializes the state.
 	void init() override;
+	/// Deinitializes the state.
+	void deinit() override;
 	/// Runs state functionality every cycle.
 	void think() override;
 };
diff --git a/src/Battlescape/TileEngine.cpp b/src/Battlescape/TileEngine.cpp
index af79482b9..2a5b883b1 100644
--- a/src/Battlescape/TileEngine.cpp
+++ b/src/Battlescape/TileEngine.cpp
@@ -17,6 +17,7 @@
  * along with OpenXcom.  If not, see <http://www.gnu.org/licenses/>.
  */
 #include <assert.h>
+#include <atomic>
 #include <set>
 #include "TileEngine.h"
 #include "AIModule.h"
@@ -879,6 +880,16 @@ void iterateTilesLightMaxBound(SavedBattleGame* save, Position position, int eve
 
 } // namespace
 
+// coop (explosion ordered-replay E5a GAP-MODULE): the module_destroyed send/apply
+// counters are file-scope in connectionTCP.cpp (alongside the E1-E4 counters);
+// extern-declared here so this file's parallel-host send site (detonate(), the
+// base-module decrement) can increment the sent side. g_moduleDestroyedSent counts
+// every module_destroyed the parallel host ships; g_moduleDestroyedApplied
+// (incremented in connectionTCP.cpp's handler) counts every one the parallel client
+// replays. The two must match - a mismatch means the carrier dropped or duplicated
+// a base-defense module decrement. Parallel-only, 0 everywhere else.
+extern std::atomic<uint32_t> g_moduleDestroyedSent;
+
 constexpr int TileEngine::heightFromCenter[11];
 
 
@@ -2970,37 +2981,19 @@ int TileEngine::hitTile(Tile* tile, int damage, const RuleDamageType* type)
 		if (tile->getSmoke() < _save->getBattleGame()->getMod()->getTooMuchSmokeThreshold() && tile->getTerrainLevel() > -24)
 		{
 			tile->setFire(0);
+			// coop (PRD-P3 GAP-7): the _smokeRNGs relay is gone. It was unbalanced -
+			// pushed once per hit(), popped only down this smoke branch, and popped
+			// again by explode()'s hitTile with no matching push - and vestigial: the
+			// value it carried only ever reached setSmoke(), which is host-gated and
+			// ships set_smoke_tile. That packet is the single source of the peer's
+			// smoke, so the roll below runs on the host and nowhere else.
 			if (damage >= type->SmokeThreshold * 2)
 			{
-
-				if (_save->getBattleGame()->getCoopMod()->_smokeRNGs.empty())
-				{
-					tile->setSmoke(RNG::generate(7, 15)); // for SmokeThreshold == 0
-				}
-				else
-				{
-
-					int oldest = _save->getBattleGame()->getCoopMod()->_smokeRNGs.front();
-					tile->setSmoke(oldest); // for SmokeThreshold == 0
-					_save->getBattleGame()->getCoopMod()->_smokeRNGs.erase(_save->getBattleGame()->getCoopMod()->_smokeRNGs.begin());
-				}
-
+				tile->setSmoke(RNG::generate(7, 15)); // for SmokeThreshold == 0
 			}
 			else
 			{
-
-				if (_save->getBattleGame()->getCoopMod()->_smokeRNGs.empty())
-				{
-					tile->setSmoke(RNG::generate(7, 15) * (damage - type->SmokeThreshold) / type->SmokeThreshold);
-				}
-				else
-				{
-
-					int oldest2 = _save->getBattleGame()->getCoopMod()->_smokeRNGs.front();
-					tile->setSmoke(oldest2 * (damage - type->SmokeThreshold) / type->SmokeThreshold);
-					_save->getBattleGame()->getCoopMod()->_smokeRNGs.erase(_save->getBattleGame()->getCoopMod()->_smokeRNGs.begin());
-				}
-
+				tile->setSmoke(RNG::generate(7, 15) * (damage - type->SmokeThreshold) / type->SmokeThreshold);
 			}
 
 			return 1;
@@ -3317,9 +3310,26 @@ bool TileEngine::hitUnit(BattleActionAttack attack, BattleUnit *target, const Po
 
 			Json::Value root;
 			root["state"] = "hit_unit";
+			// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+			// client's action_end apply-barrier waits for this damage before sampling the
+			// chain's post-N sync-check hash (no-op off the parallel host, _openChainSeq==0).
+			connectionTCP::coopStampChainSeq(root);
+			// coop (PHASE D.2 / chain-atomicity): the hit_unit "attack_id" was
+			// correlation only (this packet is keyed by unit id and nothing consumed
+			// the field); removed with the attack_id keying it belonged to.
 			root["unit_id"] = target->getId();
 			root["health"] = target->getHealth();
 			root["stunlevel"] = target->getStunlevel();
+			// coop (PRD-I3): the remaining combat stats BattleUnit::damage() writes.
+			// A parallel thin client applies hit_unit WITHOUT replaying the attack, so
+			// without these the victim's morale/energy/mana/tu keep their pre-hit value
+			// until next_turn's bulk apply repairs them - a per-action unitsStats seam
+			// (morale is what a vanilla rifle shot exposes). Additive: an older peer
+			// ignores the fields.
+			root["morale"] = target->getMorale();
+			root["energy"] = target->getEnergy();
+			root["mana"] = target->getMana();
+			root["tu"] = target->getTimeUnits();
 
 			Json::Value fatalArray(Json::arrayValue);
 			for (int i = 0; i < BODYPART_MAX; ++i)
@@ -3329,6 +3339,50 @@ bool TileEngine::hitUnit(BattleActionAttack attack, BattleUnit *target, const Po
 
 			root["fatalWounds"] = fatalArray;
 
+			// coop (PRD-I3 saveBlob close): the victim's post-damage per-side armor.
+			// damage() degrades _currentArmor and NO other packet carries it (next_turn
+			// does not re-ship armor), so a parallel thin client - which does not replay
+			// damage() - keeps full armor forever, a permanent saveBlob divergence.
+			// Additive; classic replays damage() and stays byte-identical.
+			Json::Value armorArray(Json::arrayValue);
+			for (int i = 0; i < SIDE_MAX; ++i)
+			{
+				armorArray.append(target->getArmor((UnitSide)i));
+			}
+			root["armor"] = armorArray;
+
+			// coop (kill-credit fix): murdererId/killedBy can change on the host AFTER a
+			// unit is down (e.g. a later blast catches the downed body's tile, see
+			// setMurdererId above), but the thin client never runs damage() itself - ship
+			// the current attribution on every hit_unit so the client's credit does not
+			// drift from the host's. Additive; classic/PvP/single-player unaffected.
+			root["murdererId"] = target->getMurdererId();
+			root["killedBy"] = (int)target->killedBy();
+
+			// coop (E5a GAP-XP): awardExperience (:3264 above) is dead on the
+			// parallel client - this function's own client early-return
+			// (:3222-3230) means the client never replays the attack, so its
+			// copy of the attacker never trains combat XP and debrief shows no
+			// stat improvement. hit_unit already fires per-hit, stamped +
+			// subject-keyed; ship the ATTACKER's post-award exp absolutes
+			// alongside the victim state (exact field set = every counter
+			// awardExperience/addManaExp mutate, BattleUnit.cpp:4204-4270) so
+			// the client can apply them without re-running awardExperience
+			// itself. Additive/present-gated; classic/PvP/host unaffected (they
+			// compute this locally via their own awardExperience call).
+			if (attack.attacker)
+			{
+				root["attacker_id"] = attack.attacker->getId();
+				root["exp_bravery"] = attack.attacker->getExpStats()->bravery;
+				root["exp_reactions"] = attack.attacker->getExpStats()->reactions;
+				root["exp_firing"] = attack.attacker->getExpStats()->firing;
+				root["exp_throwing"] = attack.attacker->getExpStats()->throwing;
+				root["exp_psi_skill"] = attack.attacker->getExpStats()->psiSkill;
+				root["exp_psi_strength"] = attack.attacker->getExpStats()->psiStrength;
+				root["exp_melee"] = attack.attacker->getExpStats()->melee;
+				root["exp_mana"] = attack.attacker->getExpStats()->mana;
+			}
+
 			_save->getBattleGame()->getCoopMod()->sendTCPPacketData(root.toStyledString());
 		}
 	}
@@ -3466,8 +3520,14 @@ void TileEngine::hit(BattleActionAttack attack, Position center, int power, cons
 		if (_save->getBattleGame()->getCoopMod()->getCoopStatic() == true && _save->getBattleGame()->getCoopMod()->getHost() == false)
 		{
 
-			_save->getBattleGame()->getCoopMod()->_battleActions.push_back(attack);
-
+			// coop (PHASE D.2 / chain-atomicity): the client resolves NO hit locally.
+			// It used to park this BattleActionAttack and wait for the host's
+			// "hit_tile" to pair it by identity (attack_id) - a match that DROPPED the
+			// whole hit whenever the two machines disagreed on shot count (autoshot,
+			// pellet, CQB), a permanent terrain divergence since next_turn never
+			// re-ships map-data destruction. The host now ships the attack's identity
+			// directly on hit_tile and the client's handler reconstructs the call, so
+			// there is nothing to park here.
 			return;
 		}
 
@@ -3480,12 +3540,28 @@ void TileEngine::hit(BattleActionAttack attack, Position center, int power, cons
 			damage = current_damage;
 			tileFinalDamage = current_damage;
 
-			uint64_t _smokeRNG = RNG::generate(7, 15);
-
-			_save->getBattleGame()->getCoopMod()->_smokeRNGs.push_back(_smokeRNG);
-
 			Json::Value root;
 			root["state"] = "hit_tile";
+			// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+			// holds this outcome for its own chain's opener instead of contaminating
+			// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+			connectionTCP::coopStampChainSeq(root);
+
+			// coop (PHASE D.2 / chain-atomicity): ship the attack's identity DIRECTLY
+			// so the peer reconstructs the hitCoop call from the packet, with no
+			// parked-attack FIFO to drift and no drop path. These are exactly the
+			// fields hitCoop consumes: attacker feeds voxelCheck (excludes the shooter
+			// from the raycast that picks the tile part - load-bearing for the terrain
+			// outcome); type/weapon/damage_item rebuild the BattleActionAttack hitCoop
+			// forwards to hitUnit. The chain seq stamped above (coopStampChainSeq / I1)
+			// carries the CHAIN attribution; these carry the ATTACK parameters. Ids are
+			// looked up on the peer, never fabricated (issue #74). Hard cutover: an old
+			// peer sending the pre-D.2 shape is unsupported (both ends ship together on
+			// this pre-merge branch - see PROTOCOL.md).
+			root["attacker_id"] = attack.attacker ? attack.attacker->getId() : -1;
+			root["weapon_item_id"] = attack.weapon_item ? attack.weapon_item->getId() : -1;
+			root["damage_item_id"] = attack.damage_item ? attack.damage_item->getId() : -1;
+			root["ba_type"] = (int)attack.type;
 
 			root["center_x"] = center.x;
 			root["center_y"] = center.y;
@@ -3496,7 +3572,6 @@ void TileEngine::hit(BattleActionAttack attack, Position center, int power, cons
 			root["terrainMeleeTilePart"] = terrainMeleeTilePart;
 
 			root["seed"] = seed;
-			root["smokeRNG"] = _smokeRNG;
 
 			// new!!!
 			root["ArmorEffectiveness"] = type->ArmorEffectiveness;
@@ -3801,6 +3876,12 @@ void TileEngine::explode(BattleActionAttack attack, Position center, int power,
 							e["id"] = bi->getId();
 							e["type"] = bi->getRules()->getType();
 							coopRemoved.append(e);
+							// coop (TRACE A DIAGNOSTIC, RCA lost-removal): the HOST's emission of
+							// the removal for this item - the "was it ever sent" leg. Capture-gated.
+							if (g_diagCapture.load(std::memory_order_relaxed)
+								&& bi->getRules() && bi->getRules()->getType() == "STR_STUN_BOMB")
+								coopDiagS("EXPL_TX id=" + std::to_string(bi->getId())
+									+ " cid=" + std::to_string(bi->getCoopID()) + " t=STR_STUN_BOMB");
 							_save->removeItem(bi);
 						}
 
@@ -3889,6 +3970,10 @@ void TileEngine::explode(BattleActionAttack attack, Position center, int power,
 		{
 			Json::Value root;
 			root["state"] = "explode_items";
+			// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+			// client's action_end apply-barrier waits for these blast item deletions
+			// (no-op off the parallel host, _openChainSeq==0).
+			connectionTCP::coopStampChainSeq(root);
 			root["items"] = coopRemoved;
 			_save->getBattleGame()->getCoopMod()->sendTCPPacketData(root.toStyledString());
 		}
@@ -3913,6 +3998,10 @@ void TileEngine::explode(BattleActionAttack attack, Position center, int power,
 
 		Json::Value root;
 		root["state"] = "calc_explode_fov";
+		// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+		// holds this outcome for its own chain's opener instead of contaminating
+		// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(root);
 
 		root["maxRadius"] = maxRadius;
 		root["coop_is_second_fov"] = coop_is_second_fov;
@@ -4006,6 +4095,27 @@ bool TileEngine::detonate(Tile* tile, int explosive)
 				tiles[i]->getMapData(currentpart)->isBaseModule())
 			{
 				_save->getModuleMap()[tile->getPosition().x/10][tile->getPosition().y/10].second--;
+				// coop (E5a GAP-MODULE): this decrement runs inside detonate(), which
+				// early-returns for every non-host coop client (:4012-4015 above,
+				// classic idiom) - host-only with no carrier. DebriefingState scores
+				// base defense from getModuleMap(), so a parallel client's
+				// base-defense result silently drifts from the host's. The hit-path
+				// decrements (hitCoop / hit()) are already machine-symmetric (same
+				// seeded damage replayed on both machines) - do NOT carrier those,
+				// only this detonate-path one (carriering both double-decrements).
+				// Parallel-host-only send + parallel-client-only apply
+				// (connectionTCP.cpp's module_destroyed handler) so classic/PvP/host
+				// stay byte-identical.
+				if (connectionTCP::parallelTurnActive() && connectionTCP::getHost())
+				{
+					Json::Value root;
+					root["state"] = "module_destroyed";
+					connectionTCP::coopStampChainSeq(root);
+					root["gx"] = tile->getPosition().x / 10;
+					root["gy"] = tile->getPosition().y / 10;
+					connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
+					++OpenXcom::g_moduleDestroyedSent;
+				}
 			}
 			//this trick is to follow transformed object parts (object can become a ground)
 			diemcd = tiles[i]->getMapData(currentpart)->getDieMCD();
@@ -4466,7 +4576,7 @@ int TileEngine::blockage(Tile *tile, const TilePart part, ItemDamageType type, i
  *		  4 not enough TUs
  *		  5 would contravene fire reserve
  */
-int TileEngine::unitOpensDoor(BattleUnit *unit, bool rClick, int dir)
+int TileEngine::unitOpensDoor(BattleUnit *unit, bool rClick, int dir, bool costFree, bool replayNeutral, Position *openedPos, int *openedPart)
 {
 	int door = -1;
 	int TUCost = 0;
@@ -4570,7 +4680,7 @@ int TileEngine::unitOpensDoor(BattleUnit *unit, bool rClick, int dir)
 				tile = _save->getTile(unit->getPosition() + Position(x,y,z) + pair.first);
 				if (tile)
 				{
-					door = tile->openDoor(pair.second, unit, _save->getBattleGame()->getReservedAction(), rClick);
+					door = tile->openDoor(pair.second, unit, _save->getBattleGame()->getReservedAction(), rClick, costFree, replayNeutral);
 					if (door != -1)
 					{
 						part = pair.second;
@@ -4578,12 +4688,21 @@ int TileEngine::unitOpensDoor(BattleUnit *unit, bool rClick, int dir)
 						{
 							++doorsOpened;
 							doorCentre = unit->getPosition() + Position(x, y, z) + pair.first;
+							// coop (SEAM-3 door B): report the hinged door the executor just
+							// opened, so UnitWalkBState can ship it on the walk closer.
+							if (openedPos) *openedPos = unit->getPosition() + Position(x, y, z) + pair.first;
+							if (openedPart) *openedPart = (int)pair.second;
 						}
 						else if (door == 1)
 						{
 							std::pair<int, Position> adjacentDoors = checkAdjacentDoors(unit->getPosition() + Position(x,y,z) + pair.first, pair.second);
 							doorsOpened += adjacentDoors.first + 1;
 							doorCentre = adjacentDoors.second;
+							// coop (UFO-door authority): report the primary UFO-door tile+part so the
+							// executor's UnitWalkBState ships it on the walk closer (doors_opened); the
+							// peer re-derives the adjacent run via checkAdjacentDoors on apply.
+							if (openedPos) *openedPos = unit->getPosition() + Position(x, y, z) + pair.first;
+							if (openedPart) *openedPart = (int)pair.second;
 						}
 					}
 				}
@@ -4609,7 +4728,14 @@ int TileEngine::unitOpensDoor(BattleUnit *unit, bool rClick, int dir)
 
 	if (door == 0 || door == 1)
 	{
-		if (_save->getBattleGame()->checkReservedTU(unit, TUCost, 0))
+		if (costFree)
+		{
+			// coop (SEAM-3 door): a replayed host walk applies the door-open without
+			// charging the peer's TU (host-authoritative); still refresh lighting/FOV.
+			calculateLighting(LL_FIRE, doorCentre, doorsOpened, true);
+			calculateFOV(doorCentre, doorsOpened, true, true);
+		}
+		else if (_save->getBattleGame()->checkReservedTU(unit, TUCost, 0))
 		{
 			if (unit->spendTimeUnits(TUCost))
 			{
@@ -5119,6 +5245,23 @@ bool TileEngine::psiAttack(BattleActionAttack attack, BattleUnit *victim)
 	if (!victim)
 		return false;
 
+	// coop (PRD-P3 GAP-2): psi is host-authoritative in the co-operative modes,
+	// mirroring hitUnit(). Both machines used to roll psiAttackCalculate and apply
+	// the whole outcome - faction flip, panic morale, mind-controller id - and
+	// `psi_result` was only ever sent in PVP, so a PVE mind control that succeeded
+	// on one machine and failed on the other was permanent (next_turn repairs
+	// stats and tiles, never faction).
+	//
+	// PVP/PVP2 keep the old executor-decides mirror below untouched: there the
+	// packet is an INVERTED flip ("mine now" / "yours no more"), not a state copy,
+	// and the executor may be either machine.
+	auto* coopPsi = _save->getBattleGame() ? _save->getBattleGame()->getCoopMod() : nullptr;
+	const bool coopPvp = coopPsi && (connectionTCP::getCoopGamemode() == 2 || connectionTCP::getCoopGamemode() == 3);
+	if (coopPsi && coopPsi->getCoopStatic() && !coopPsi->getHost() && !coopPvp)
+	{
+		return false;
+	}
+
 	// Mana experience - this is a temporary/experimental approach, can be improved later after modder feedback
 	attack.attacker->addManaExp(attack.weapon_item->getRules()->getManaExperience());
 
@@ -5220,6 +5363,7 @@ bool TileEngine::psiAttack(BattleActionAttack attack, BattleUnit *victim)
 				_save->getBattleGame()->autoEndBattle();
 			}
 		}
+		coopShipPsiResult(attack, victim, true);
 		return true;
 	}
 	else
@@ -5228,10 +5372,53 @@ bool TileEngine::psiAttack(BattleActionAttack attack, BattleUnit *victim)
 		{
 			victim->addPsiStrengthExp(); // experience for the victim, not the attacker
 		}
+		coopShipPsiResult(attack, victim, false);
 		return false;
 	}
 }
 
+/**
+ * coop (PRD-P3 GAP-2): host-authoritative psi outcome for the co-operative modes.
+ * Ships the victim's POST-state rather than the inputs, so the peer never re-derives
+ * anything (reduceByBravery, convertToFaction and recoverTimeUnits all read state
+ * this machine has already changed). `pvp: false` tells the handler this is the new
+ * state-copy flavour and not the legacy PVP inverted flip.
+ */
+void TileEngine::coopShipPsiResult(BattleActionAttack attack, BattleUnit* victim, bool success)
+{
+	auto* coop = _save->getBattleGame() ? _save->getBattleGame()->getCoopMod() : nullptr;
+	if (!coop || !coop->getCoopStatic() || !coop->getHost())
+	{
+		return;
+	}
+	if (connectionTCP::getCoopGamemode() == 2 || connectionTCP::getCoopGamemode() == 3)
+	{
+		return; // PVP keeps its own psi_result, sent from psiAttackMessage
+	}
+
+	Json::Value root;
+	root["state"] = "psi_result";
+	// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the client's
+	// action_end apply-barrier waits for this mind-control outcome before sampling the
+	// chain's post-N sync-check hash (no-op off the parallel host, _openChainSeq==0).
+	connectionTCP::coopStampChainSeq(root);
+	root["pvp"] = false;
+	root["unit_id"] = victim->getId();
+	root["success"] = success;
+	root["ba_type"] = (int)attack.type;
+	root["mindControllerId"] = victim->getMindControllerId();
+	root["faction"] = (int)victim->getFaction();
+	root["morale"] = victim->getMorale();
+	root["tu"] = victim->getTimeUnits();
+	// coop: ENERGY too. A successful mind control runs recoverTimeUnits(), which
+	// restores BOTH tu and energy; shipping only tu left the peer's copy of a
+	// mind-controlled victim on whatever energy it had when the attack landed.
+	root["energy"] = victim->getEnergy();
+	root["coop"] = victim->getCoop();
+
+	coop->sendTCPPacketData(root.toStyledString());
+}
+
 /**
  * Calculate success rate of melee attack action.
  */
@@ -5293,6 +5480,29 @@ bool TileEngine::meleeAttack(BattleActionAttack attack, BattleUnit *victim, int
 		{
 			victim->setMeleeAttackedBy(attack.attacker->getId());
 		}
+
+		// coop (PRD-P3 GAP-4b): replay the sender's to-hit decision (parked by
+		// MeleeAttackBState::init locally, or by the melee_attack handler on the
+		// receiver) instead of rolling an independent one. BA_CQB is deliberately
+		// excluded - close-quarters checks are a different stream and must not eat
+		// a real melee's answer; ProjectileFlyBState skips them on the peer instead.
+		auto* coop = _save->getBattleGame() ? _save->getBattleGame()->getCoopMod() : nullptr;
+		// coop (wire-order Increment 3 / A2): the parallel client's display replay reads its
+		// display-side copy first (populated at the melee receiver-park lever-on), so
+		// next_turn's state-half clear of the canonical queue cannot starve it. Empty
+		// lever-off / on the host, so this falls through to the canonical queue below.
+		if (coop && coop->getCoopStatic() && !coop->_meleeResultsDisplay.empty())
+		{
+			bool hit = coop->_meleeResultsDisplay.front() != 0;
+			coop->_meleeResultsDisplay.erase(coop->_meleeResultsDisplay.begin());
+			return hit;
+		}
+		if (coop && coop->getCoopStatic() && !coop->_meleeResults.empty())
+		{
+			bool hit = coop->_meleeResults.front() != 0;
+			coop->_meleeResults.erase(coop->_meleeResults.begin());
+			return hit;
+		}
 	}
 
 	return meleeAttackCalculate(attack, victim) > 0;
@@ -5585,6 +5795,10 @@ void TileEngine::itemDrop(Tile *t, BattleItem *item, bool updateLight)
 
 			Json::Value obj;
 			obj["state"] = "Inventory";
+			// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+			// client's action_end apply-barrier waits for this in-chain item drop/move
+			// (no-op off the parallel host, _openChainSeq==0).
+			connectionTCP::coopStampChainSeq(obj);
 			obj["item_name"] = item->getRules()->getName();
 			obj["inv_id"] = "";
 			obj["inv_x"] = 0;
diff --git a/src/Battlescape/TileEngine.h b/src/Battlescape/TileEngine.h
index 8acf4c7b4..0404cf1f8 100644
--- a/src/Battlescape/TileEngine.h
+++ b/src/Battlescape/TileEngine.h
@@ -202,7 +202,7 @@ class TileEngine
 	/// Checks if a destroyed tile starts an explosion.
 	Tile *checkForTerrainExplosions();
 	/// Unit opens door?
-	int unitOpensDoor(BattleUnit *unit, bool rClick = false, int dir = -1);
+	int unitOpensDoor(BattleUnit *unit, bool rClick = false, int dir = -1, bool costFree = false, bool replayNeutral = false, Position *openedPos = 0, int *openedPart = 0);
 	/// Closes ufo doors.
 	int closeUfoDoors();
 	/// Calculates a line trajectory in tile space.
@@ -228,6 +228,8 @@ class TileEngine
 	int psiAttackCalculate(BattleActionAttack::ReadOnly attack, const BattleUnit *victim);
 	/// Attempts a panic or mind control action.
 	bool psiAttack(BattleActionAttack attack, BattleUnit *victim);
+	/// coop (PRD-P3 GAP-2): ships the host's psi outcome to the peer (PVE modes).
+	void coopShipPsiResult(BattleActionAttack attack, BattleUnit* victim, bool success);
 	/// Calculate success rate of melee attack action.
 	int meleeAttackCalculate(BattleActionAttack::ReadOnly attack, const BattleUnit *victim);
 	/// Attempts a melee attack action.
diff --git a/src/Battlescape/UnitDieBState.cpp b/src/Battlescape/UnitDieBState.cpp
index e242d00d8..546759eb0 100644
--- a/src/Battlescape/UnitDieBState.cpp
+++ b/src/Battlescape/UnitDieBState.cpp
@@ -18,6 +18,7 @@
  */
 
 #include "UnitDieBState.h"
+#include "BattlescapeGame.h" // coop (Phase 2c death ghost): full CoopDeathGhost definition
 #include "TileEngine.h"
 #include "BattlescapeState.h"
 #include "Map.h"
@@ -30,15 +31,26 @@
 #include "../Engine/Sound.h"
 #include "../Engine/RNG.h"
 #include "../Engine/Options.h"
+#include "../Engine/Logger.h" // coop (parallel Phase 3, Sub-task D): defensive Log(LOG_WARNING)
 #include "../Engine/Language.h"
 #include "../Mod/Armor.h"
 #include "InfoboxOKState.h"
 #include "InfoboxState.h"
 #include "../Savegame/Node.h"
+#include "../CoopMod/SharedEcon.h" // coop (PRD-P4): Tier-A corpse id-manifest
 
 namespace OpenXcom
 {
 
+// coop (chain-atomicity Strand A introspection): defined in connectionTCP.cpp. Counts
+// mid-side (non-boundary) host deaths and how many shipped unstamped (the Strand-A bug).
+extern std::atomic<uint32_t> g_coopMidSideDeaths;
+extern std::atomic<uint32_t> g_coopMidSideDeathsUnstamped;
+// coop (parallel battlescape Phase 2b - atomic unit death, TEST-ONLY RED lever):
+// defined in connectionTCP.cpp. ON = fall back to the legacy unit_death/
+// after_unit_death trio instead of `unit_casualty` (see init()/deinit() below).
+extern std::atomic<bool> g_atomicDeathDisable;
+
 /**
  * Sets up an UnitDieBState.
  * @param parent Pointer to the Battlescape.
@@ -50,7 +62,14 @@ UnitDieBState::UnitDieBState(BattlescapeGame* parent, BattleUnit* unit, const Ru
 	_unit(unit), _damageType(damageType), _noSound(noSound), _coop_death(coop_death), _extraFrame(0), _overKill(unit->getOverKillDamage())
 {
 
-	// coop 
+	// coop (chain-atomicity Strand A): capture the boundary-casualty phase NOW, at
+	// construction, while the boundary checkForCasualties bracket is still open on the
+	// parent - init() runs a think() later, after it has closed. A boundary-phase death
+	// keeps its unit_death/after_unit_death seq-0 (covered by the ordered endturn/
+	// sidestart marker) instead of opening a loose mid-side chain. See _coopBoundaryDeath.
+	_coopBoundaryDeath = _parent->coopBoundaryCasualty();
+
+	// coop
 	if (_parent->isCoop() == true && _parent->getCoopMod()->getHost() == false && _coop_death == false)
 	{
 		return;
@@ -112,60 +131,369 @@ UnitDieBState::UnitDieBState(BattlescapeGame* parent, BattleUnit* unit, const Ru
 	}
 }
 
+/**
+ * coop (parallel battlescape Phase 2c - death ghost): the display-only ctor.
+ *
+ * The parallel replay client pushes this AFTER coopApplyCasualty already applied the
+ * death atomically (the unit is dead, tile-unlinked, corpse minted with the host's
+ * ids). This state reproduces the vanilla collapse animation on the victim's
+ * BattleUnit display-OVERRIDE fields (never its real state, which stays final) and
+ * SKIPS every world mutation and every host-only send/notify. The override was seeded
+ * to the pre-death STANDING pose at queue time (so the unit drew standing while this
+ * ghost waited its turn); here we set the animation cadence exactly as the vanilla
+ * ctor did, off the ghost's captured pose.
+ */
+UnitDieBState::UnitDieBState(BattlescapeGame* parent, const CoopDeathGhost* ghost) : BattleState(parent),
+	_unit(ghost->unit), _damageType(nullptr), _noSound(ghost->noSound), _extraFrame(0),
+	_overKill(false), _coop_death(true), _ghost(ghost)
+{
+	_coopBoundaryDeath = false;
+
+	_unit->setCoopDisplayOverride(true);
+	_unit->setCoopDisplayStatus(STATUS_STANDING);
+	_unit->setCoopDisplayDir(ghost->dirBeforeApply);
+	_unit->setCoopDisplayFallPhase(0);
+
+	// don't show the "fall to death" pirouette when the unit was blasted (indirect)
+	// or was already unconscious - jump straight to the final frame (vanilla ctor's
+	// setDirection(3) + instaFalling), rendered on the override fields.
+	if (!ghost->direct || ghost->wasUnconsciousBefore)
+	{
+		_unit->setCoopDisplayDir(3);
+		const int frames = _unit->getArmor()->getDeathFrames();
+		_unit->setCoopDisplayFallPhase(frames > 0 ? frames - 1 : 0);
+		_unit->setCoopDisplayStatus(ghost->finalStatus);
+	}
+	else
+	{
+		if (ghost->faction == FACTION_PLAYER)
+		{
+			_parent->getMap()->setUnitDying(true);
+		}
+		_parent->setStateInterval(BattlescapeState::DEFAULT_ANIM_SPEED);
+		if (ghost->dirBeforeApply != 3)
+		{
+			_parent->setStateInterval(BattlescapeState::DEFAULT_ANIM_SPEED / 3);
+		}
+	}
+}
+
 /**
  * Deletes the UnitDieBState.
  */
 UnitDieBState::~UnitDieBState()
 {
+}
+
+/**
+ * coop: stamps the host's kill ATTRIBUTION on a death packet.
+ *
+ * `killedBy` and `murdererId` are written by BattlescapeGame::checkForCasualties -
+ * on the machine that RESOLVED the death, before it pushes this state - and they
+ * were the one part of a death that never crossed the wire. The peer got away with
+ * that whenever it happened to run its own checkForCasualties over the same victim
+ * (it is displaying the attack, so the murderer is resolvable there too), which is
+ * every death caused by an action the peer replays. It does NOT happen for a death
+ * the peer never replays as a local attack chain - a reaction-fire kill during the
+ * ALIEN side is the everyday one - and there the alien keeps the BattleUnit ctor
+ * default `_killedBy = its own faction`.
+ *
+ * That is a scored, persisted divergence, not a cosmetic one: DebriefingState
+ * counts STR_ALIENS_KILLED as `oldFaction == FACTION_HOSTILE && killedBy() ==
+ * FACTION_PLAYER` over each machine's OWN save (prepareDebriefing runs on both,
+ * ahead of the host's debriefing packet), so the two players saw different kill
+ * counts and different scores for the same battle - and `killedBy` is saved.
+ *
+ * Written on BOTH death packets: `unit_death` so the peer has it while the death
+ * is still being displayed, `after_unit_death` as the definitive re-stamp once the
+ * death has fully resolved. Applying it twice is idempotent.
+ */
+void UnitDieBState::coopWriteKillAttribution(Json::Value& root) const
+{
+	root["killedBy"] = (int)_unit->killedBy();
+	root["murdererId"] = _unit->getMurdererId();
+}
+
+/**
+ * coop (PRD-I3 SEAM-4): every LIVING unit's absolute morale after this casualty.
+ *
+ * BattlescapeGame::checkForCasualties applies a morale change to EVERY living unit
+ * on any death/stun (the losing squad loses morale, the winning squad gains, and a
+ * murderer gets a kill bonus) BEFORE it pushes this state - so by the time this
+ * packet is sent getMorale() is the host's FINAL post-casualty value for all of
+ * them. A PARALLEL thin client never runs checkForCasualties for a kill it only
+ * DISPLAYS (BattlescapeGame::coopDeath just animates the death; a reaction-fire /
+ * alien-side kill is never a local attack chain there), so without this the whole
+ * squad's morale stays at its pre-casualty value until next_turn's bulk re-ship one
+ * side later - a per-action unitsStats(morale) divergence across every living
+ * bystander. `hit_unit` already ships the VICTIM's own post-damage morale; this is
+ * the OTHER units the casualty moved.
+ *
+ * Shipped as an ABSOLUTE {id -> morale} snapshot, so applying it is idempotent: it
+ * cannot double-apply against a chain the client also replays, and it is safe against
+ * next_turn's later bulk re-ship. The receiver applies it ONLY on the parallel
+ * non-host machine (parallelTurnActive() && !getHost()); a classic client replays the
+ * attack and runs its OWN checkForCasualties, so it never reads this and stays
+ * byte-identical. Additive - an older peer ignores the field. Written on BOTH death
+ * packets, mirroring coopWriteKillAttribution: `unit_death` while the death displays,
+ * `after_unit_death` as the freshest re-stamp (a chain-reaction casualty between
+ * init() and deinit() moves morale again).
+ */
+void UnitDieBState::coopWriteBystanderMorale(Json::Value& root) const
+{
+	Json::Value arr(Json::arrayValue);
+	for (auto* bu : *_parent->getSave()->getUnits())
+	{
+		if (bu->isOut())
+			continue;
+		Json::Value entry;
+		entry["id"] = bu->getId();
+		entry["morale"] = bu->getMorale();
+		arr.append(entry);
+	}
+	root["bystander_morale"] = arr;
+}
+
+/**
+ * coop (PRD-P10): `after_unit_death` moved here from the DESTRUCTOR.
+ *
+ * A BattleState is destroyed by cleanupDeleted(), which runs at a turn boundary
+ * and at a couple of UI transitions - NOT when the state finishes. So this
+ * packet, which carries the death's final unit state AND the PRD-P4 corpse
+ * id-manifest, was being sent up to a whole side after the corpse existed
+ * (measured: 82 s on a soak run). For every second of that window the peer's
+ * corpse carried an id off the host's, and any census taken in it disagreed -
+ * including the one after the alien side, because a death DURING that side does
+ * not reach a cleanupDeleted() until the boundary AFTER the census.
+ *
+ * deinit() is called by popState() the instant the state pops, exactly once per
+ * pop, which is what "the death is over" actually means.
+ */
+void UnitDieBState::deinit()
+{
+	// coop (Phase 2c - death ghost): display-only, never a wire sender.
+	if (_ghost)
+	{
+		return;
+	}
 
 	// coop
 	if ((_parent->isCoop() == true && _coop_death == false && _parent->getCoopMod()->getHost() == true))
 	{
+		// coop (Phase 2b unit_casualty): on the PARALLEL host this ships ONE
+		// `unit_casualty` packet instead of the legacy `after_unit_death` - the
+		// client now applies it atomically (BattlescapeGame::coopApplyCasualty).
+		// Classic co-op (parallelTurnActive() == false), a classic/PvP client, a
+		// `_coop_death` animation state (excluded by the outer condition above),
+		// and the TEST-ONLY `atomic_death_disable` RED lever (which stands the
+		// atomic path down so the SAME build can reproduce the pre-atomic
+		// transient straddle) all keep the exact `after_unit_death` send below -
+		// byte-identical.
+		if (connectionTCP::parallelTurnActive() && connectionTCP::getHost()
+			&& !g_atomicDeathDisable.load(std::memory_order_relaxed))
+		{
+			// coop (Phase 2a unit_casualty)
+			Json::Value root;
+
+			root["state"] = "unit_casualty";
+
+			// coop (chain-atomicity): mid-side deaths always have an open chain here
+			// (Strand A guarantees init() opened one), so coopStampChainSeq writes
+			// action_seq+side_seq normally. A BOUNDARY-phase death runs with
+			// _openChainSeq == 0 (intentionally - it rides the ordered endturn/
+			// sidestart marker instead), so the stamp is a no-op there; write bnd:true
+			// and side_seq explicitly in that case and do NOT write action_seq.
+			connectionTCP::coopStampChainSeq(root);
+			const bool coopBoundaryPhase = _coopBoundaryDeath
+				|| connectionTCP::_coopBoundaryDecay
+				|| !connectionTCP::_pendingBoundaries.empty();
+			root["bnd"] = coopBoundaryPhase;
+			if (coopBoundaryPhase)
+			{
+				root["side_seq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+			}
 
-		// coop
-		Json::Value root;
+			root["unit_id"] = _unit->getId();
 
-		root["state"] = "after_unit_death";
+			// coop (Phase 2a unit_casualty): the outcome this casualty resolved to.
+			// Mirrors the think() branch that already ran: convertUnit (respawn) took
+			// priority over convertUnitToCorpse whenever getSpawnUnit() && !_overKill
+			// && !getAlreadyRespawned(); otherwise the unit is either UNCONSCIOUS or
+			// DEAD per its final status.
+			const bool coopConverted = (_unit->getSpawnUnit() != nullptr) && !_overKill && !_unit->getAlreadyRespawned();
+			int coopOutcome;
+			if (coopConverted)
+			{
+				coopOutcome = 2; // CONVERTED (respawn)
+			}
+			else if (_unit->getStatus() == STATUS_UNCONSCIOUS)
+			{
+				coopOutcome = 1; // UNCONSCIOUS
+			}
+			else
+			{
+				coopOutcome = 0; // DEAD
+			}
+			root["outcome"] = coopOutcome;
+
+			root["status"] = _parent->getCoopMod()->unitstatusToInt(_unit->getStatus());
+
+			Json::Value posArray(Json::arrayValue);
+			posArray.append(_unit->getPosition().x);
+			posArray.append(_unit->getPosition().y);
+			posArray.append(_unit->getPosition().z);
+			root["pos"] = posArray;
+
+			root["dir"] = _unit->getDirection();
+			root["faceDir"] = _unit->getFaceDirection();
+
+			root["tu"] = _unit->getTimeUnits();
+			root["health"] = _unit->getHealth();
+			root["energy"] = _unit->getEnergy();
+			root["morale"] = _unit->getMorale();
+			root["mana"] = _unit->getMana();
+			root["stunlevel"] = _unit->getStunlevel();
+
+			// coop (chain-atomicity, fatalWounds gap): mirrors hit_unit / the legacy
+			// after_unit_death wound array - the death carrier is the authoritative
+			// final word on the victim's combat state.
+			Json::Value fatalArray(Json::arrayValue);
+			for (int i = 0; i < BODYPART_MAX; ++i)
+			{
+				fatalArray.append(_unit->getFatalWound((UnitBodyPart)i));
+			}
+			root["fatalWounds"] = fatalArray;
 
-		root["status"] = _parent->getCoopMod()->unitstatusToInt(_unit->getStatus());
+			// coop (PRD-I3 saveBlob close): the victim's post-damage per-side armor -
+			// mirrors the hit_unit armor array (TileEngine.cpp damage()).
+			Json::Value armorArray(Json::arrayValue);
+			for (int i = 0; i < SIDE_MAX; ++i)
+			{
+				armorArray.append(_unit->getArmor((UnitSide)i));
+			}
+			root["armor"] = armorArray;
+
+			root["motionpoints"] = _unit->getMotionPoints();
+			root["respawn"] = _unit->getRespawn();
+
+			// coop (PRESENTATION ONLY): whether the death was a direct hit, for the
+			// client's death animation choice. Never ship _damageType itself.
+			root["direct"] = _damageType ? _damageType->isDirect() : false;
+			root["noSound"] = _noSound;
+
+			// coop: the kill ATTRIBUTION, the host's final word on it.
+			coopWriteKillAttribution(root);
+
+			// coop (PRD-I3 SEAM-4): every living unit's absolute post-casualty morale.
+			coopWriteBystanderMorale(root);
+
+			// coop (PRD-P4): the ids this death's corpses were minted with (root
+			// level - storeSpawnManifest reads root["minted_ids"], not nested).
+			// Writes nothing when the death produced no corpse (an overkill, a
+			// carried body, or a respawn - which ships its own manifest on
+			// `convertUnit`).
+			SharedEcon::flushSpawnRecord(root, "corpse", _unit->getId());
+
+			// coop (Phase 2a unit_casualty): the corpse-mint outcome captured by
+			// coopMintCorpse() / the think() reset - see BattlescapeGame's
+			// _coopCorpseMintMode. mode: 0 = on-tile mint, 1 = carried convert,
+			// 2 = overKill/no corpse, 3 = none (respawn/convert).
+			Json::Value corpseObj;
+			corpseObj["mode"] = _parent->coopGetCorpseMintMode();
+			corpseObj["carrier_item_id"] = _parent->coopGetCorpseMintCarrierId();
+			root["corpse"] = corpseObj;
+
+			// coop (Phase 2a unit_casualty): whether itemDropInventory actually ran
+			// on the host's mint - see BattlescapeGame::coopMintCorpse's coopSpill
+			// capture. Deterministic given the unit's final on-tile/carried state.
+			root["spill"] = _parent->coopGetCorpseMintSpill();
+
+			_parent->sendPacketData(root.toStyledString());
+		}
+		else
+		{
+			// coop
+			Json::Value root;
+
+			root["state"] = "after_unit_death";
+
+			// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+			// client's action_end apply-barrier waits for this death's final state before
+			// sampling the chain's post-N sync-check hash (no-op off the parallel host).
+			connectionTCP::coopStampChainSeq(root);
+
+			root["status"] = _parent->getCoopMod()->unitstatusToInt(_unit->getStatus());
+
+			root["unit_id"] = _unit->getId();
+
+			root["time"] = _unit->getTimeUnits();
+			root["health"] = _unit->getHealth();
+			root["energy"] = _unit->getEnergy();
+			root["morale"] = _unit->getMorale();
+			root["mana"] = _unit->getMana();
+			root["stunlevel"] = _unit->getStunlevel();
+
+			// coop (chain-atomicity, fatalWounds gap): the death carrier is the authoritative
+			// final word on the victim's combat state but shipped only health/stun, never the
+			// fatal wounds. A next_turn bulk snapshot that reorders in AHEAD of this death
+			// (carrying the unit's pre-hit wounds) then survived, because neither death carrier
+			// re-shipped the wounds to correct it - the client's post-death fatalWounds stuck at
+			// the resurrected value. Ship the wounds array exactly like hit_unit; the parallel
+			// client applies it (present- + parallel-gated so classic/PvP stay byte-identical).
+			Json::Value fatalArray(Json::arrayValue);
+			for (int i = 0; i < BODYPART_MAX; ++i)
+			{
+				fatalArray.append(_unit->getFatalWoundsCoop()[i]);
+			}
+			root["fatalWounds"] = fatalArray;
+
+			root["setDirection"] = _unit->getDirection();
+			root["setFaceDirection"] = _unit->getFaceDirection();
 
-		root["unit_id"] = _unit->getId();
+			// motions point
+			root["motionpoints"] = _unit->getMotionPoints();
 
-		root["time"] = _unit->getTimeUnits();
-		root["health"] = _unit->getHealth();
-		root["energy"] = _unit->getEnergy();
-		root["morale"] = _unit->getMorale();
-		root["mana"] = _unit->getMana();
-		root["stunlevel"] = _unit->getStunlevel();
+			// new
+			root["respawn"] = _unit->getRespawn();
 
-		root["setDirection"] = _unit->getDirection();
-		root["setFaceDirection"] = _unit->getFaceDirection();
+			bool isTile = false;
 
-		// motions point
-		root["motionpoints"] = _unit->getMotionPoints();
+			if (_unit->getTile())
+			{
 
-		// new
-		root["respawn"] = _unit->getRespawn();
+				isTile = true;
+			}
 
-		bool isTile = false;
+			root["isTile"] = isTile;
 
-		if (_unit->getTile())
-		{
+			// coop: the kill ATTRIBUTION, the host's final word on it.
+			coopWriteKillAttribution(root);
 
-			isTile = true;
-		}
+			// coop (PRD-I3 SEAM-4): every living unit's absolute post-casualty morale.
+			coopWriteBystanderMorale(root);
 
-		root["isTile"] = isTile;
+			// coop (PRD-P4): the ids this death's corpses were minted with. This is the
+			// FIRST packet after convertUnitToCorpse() has run, so it is where the
+			// manifest belongs; writes nothing when the death produced no corpse (an
+			// overkill, a carried body - convertToCorpse() reuses the body item's id -
+			// or a respawn, which ships its own manifest on `convertUnit`).
+			SharedEcon::flushSpawnRecord(root, "corpse", _unit->getId());
 
-		_parent->sendPacketData(root.toStyledString());
+			_parent->sendPacketData(root.toStyledString());
+		}
 	}
 
 }
 
 void UnitDieBState::init()
 {
+	// coop (Phase 2c - death ghost): display-only, nothing to send/decide/notify.
+	if (_ghost)
+	{
+		return;
+	}
 
-	// coop 
+	// coop
 	if (_parent->isCoop() == true && _parent->getCoopMod()->getHost() == false && _coop_death == false)
 	{
 		return;
@@ -175,48 +503,136 @@ void UnitDieBState::init()
 	if ((_parent->isCoop() == true && _coop_death == false && _parent->getCoopMod()->getHost() == true))
 	{
 
-		// coop
-		Json::Value root;
+		// coop (chain-atomicity Strand A - loose mid-side death, SEAM-3a doctrine): a unit
+		// that dies AFTER its killing chain already drained runs its UnitDieBState with
+		// _openChainSeq == 0, so unit_death/after_unit_death would ship seq-0 unstamped and
+		// bypass the client's I1 seq-gate + D.1 apply barrier (legacy always-consume). The
+		// death then straddles a neighbouring chain's post-N sync-check hash - the residual
+		// items/itemIdCtr/unitsCore drift at ai/expl seqs. Open a loose chain so BOTH death
+		// carriers carry a seq and defer on the ordered gate exactly like an in-chain death.
+		// Boundary-phase deaths are EXCLUDED (already covered by the ordered endturn/
+		// sidestart marker): _coopBoundaryDeath latches the construction-time boundary
+		// bracket (side-close fuse/terrain/environmental + neutral->player bleed-out), and
+		// the live decay / armed-marker flags catch the armed side-closes. coopStampChainSeq
+		// then tags both carriers with the chain opened here. No-op unless the parallel host
+		// is between chains; the chain closes normally when the death drains
+		// (coopCloseActionChain), mid-side deaths in one drain batch sharing the one chain.
+		if (connectionTCP::parallelTurnActive() && connectionTCP::getHost()
+			&& connectionTCP::_openChainSeq == 0
+			&& !_coopBoundaryDeath
+			&& !connectionTCP::_coopBoundaryDecay
+			&& connectionTCP::_pendingBoundaries.empty())
+		{
+			connectionTCP::coopStampLooseOutcomeChain("death");
+		}
 
-		root["state"] = "unit_death";
+		// coop (chain-atomicity Strand A introspection): a mid-side (non-boundary) death that
+		// STILL ships _openChainSeq==0 here is the Strand-A bug (seq-0 legacy consume). Post-
+		// fix the loose stamp above always opens a chain for mid-side deaths, so the unstamped
+		// counter stays 0; boundary deaths are intentionally seq-0 and excluded from the count.
+		if (connectionTCP::parallelTurnActive() && connectionTCP::getHost())
+		{
+			const bool coopBoundaryPhase = _coopBoundaryDeath
+				|| connectionTCP::_coopBoundaryDecay
+				|| !connectionTCP::_pendingBoundaries.empty();
+			if (!coopBoundaryPhase)
+			{
+				++g_coopMidSideDeaths;
+				if (connectionTCP::_openChainSeq == 0)
+					++g_coopMidSideDeathsUnstamped;
+			}
+		}
+
+		// coop (Phase 2b unit_casualty): on the PARALLEL host, `unit_casualty` - built
+		// once from UnitDieBState::deinit() - replaces this legacy `unit_death` send
+		// entirely; the loose-chain-open and midSideDeaths bookkeeping above stay
+		// unconditional (they are about the CHAIN, not this packet). Classic co-op
+		// (parallelTurnActive() == false), a classic/PvP client, and the TEST-ONLY
+		// `atomic_death_disable` RED lever (which sends this legacy carrier again so
+		// the SAME build can reproduce the pre-atomic straddle) keep sending
+		// unit_death exactly as before - byte-identical.
+		if (!(connectionTCP::parallelTurnActive() && connectionTCP::getHost()
+			  && !g_atomicDeathDisable.load(std::memory_order_relaxed)))
+		{
+			// coop
+			Json::Value root;
+
+			root["state"] = "unit_death";
+
+			// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+			// client's action_end apply-barrier waits for this death before sampling the
+			// chain's post-N sync-check hash (no-op off the parallel host).
+			connectionTCP::coopStampChainSeq(root);
+
+			root["status"] = _parent->getCoopMod()->unitstatusToInt(_unit->getStatus());
+
+			root["unit_id"] = _unit->getId();
+			root["pos_x"] = _unit->getPosition().x;
+			root["pos_y"] = _unit->getPosition().y;
+			root["pos_z"] = _unit->getPosition().z;
+
+			root["time"] = _unit->getTimeUnits();
+			root["health"] = _unit->getHealth();
+			root["energy"] = _unit->getEnergy();
+			root["morale"] = _unit->getMorale();
+			root["mana"] = _unit->getMana();
+			root["stunlevel"] = _unit->getStunlevel();
+
+			// coop (chain-atomicity, fatalWounds gap): as in deinit() below - unit_death is the
+			// first authoritative death carrier and must also carry the fatal wounds, so a
+			// next_turn snapshot that reorders in ahead of the death cannot leave the client's
+			// post-death wounds at a resurrected pre-hit value. Mirrors hit_unit's wound array;
+			// applied present- + parallel-gated on the client (classic/PvP byte-identical).
+			Json::Value fatalArray(Json::arrayValue);
+			for (int i = 0; i < BODYPART_MAX; ++i)
+			{
+				fatalArray.append(_unit->getFatalWoundsCoop()[i]);
+			}
+			root["fatalWounds"] = fatalArray;
 
-		root["status"] = _parent->getCoopMod()->unitstatusToInt(_unit->getStatus());
+			root["setDirection"] = _unit->getDirection();
+			root["setFaceDirection"] = _unit->getFaceDirection();
 
-		root["unit_id"] = _unit->getId();
-		root["pos_x"] = _unit->getPosition().x;
-		root["pos_y"] = _unit->getPosition().y;
-		root["pos_z"] = _unit->getPosition().z;
+			// motions points (fix)
+			root["motionpoints"] = _unit->getMotionPoints();
 
-		root["time"] = _unit->getTimeUnits();
-		root["health"] = _unit->getHealth();
-		root["energy"] = _unit->getEnergy();
-		root["morale"] = _unit->getMorale();
-		root["mana"] = _unit->getMana();
-		root["stunlevel"] = _unit->getStunlevel();
+			root["damageType"] = _parent->getCoopMod()->ItemDamageTypeToInt(_damageType->ResistType);
+			root["noSound"] = _noSound;
 
-		root["setDirection"] = _unit->getDirection();
-		root["setFaceDirection"] = _unit->getFaceDirection();
+			// coop (PRD-P9 soak finding): whether the dying unit still stands on a
+			// tile. Only `after_unit_death` used to carry this, and the peer read the
+			// MISSING key here as false - so it unlinked the tile before its own
+			// UnitDieBState ran, and convertUnitToCorpse's `dropItems && getTile()`
+			// test then skipped itemDropInventory. The dead soldier's whole kit
+			// stayed in its inventory on the peer while it lay on the ground on the
+			// executor - a strict-census divergence on every equipped casualty.
+			root["isTile"] = (_unit->getTile() != nullptr);
 
-		// motions points (fix)
-		root["motionpoints"] = _unit->getMotionPoints();
+			// new
+			root["respawn"] = _unit->getRespawn();
 
-		root["damageType"] = _parent->getCoopMod()->ItemDamageTypeToInt(_damageType->ResistType);
-		root["noSound"] = _noSound;
+			bool isTile = false;
 
-		// new
-		root["respawn"] = _unit->getRespawn();
+			if (_unit->getTile())
+			{
 
-		bool isTile = false;
+				isTile = true;
+			}
 
-		if (_unit->getTile())
-		{
+			root["isTile"] = isTile;
 
-			isTile = true;
-		}
+			// coop: the kill ATTRIBUTION - see coopWriteKillAttribution(). Both
+			// killedBy and murdererId are already final here: checkForCasualties
+			// stamps them and only then pushes this state.
+			coopWriteKillAttribution(root);
 
-		root["isTile"] = isTile;
+			// coop (PRD-I3 SEAM-4): every living unit's absolute post-casualty morale -
+			// see coopWriteBystanderMorale(). checkForCasualties applied the bystander
+			// morale change before pushing this state, so getMorale() is final here.
+			coopWriteBystanderMorale(root);
 
-		_parent->sendPacketData(root.toStyledString());
+			_parent->sendPacketData(root.toStyledString());
+		}
 
 	}
 
@@ -251,11 +667,37 @@ void UnitDieBState::init()
  */
 void UnitDieBState::think()
 {
+	// coop (Phase 2c - death ghost): the display-only animation path.
+	if (_ghost)
+	{
+		coopGhostThink();
+		return;
+	}
+
+	// coop (parallel Phase 3, Sub-task D): a non-ghost `_coop_death == true` state
+	// only exists via BattlescapeGame::coopDeath(), itself only reached from the
+	// legacy unit_death packet handler - dead in parallel mode (unit_casualty owns
+	// death there; the trio never arrives). Should be unreachable here; warn
+	// defensively if it is ever entered anyway. Behaviour unchanged.
+	if (_coop_death && connectionTCP::parallelTurnActive() && !_parent->getCoopMod()->getHost())
+	{
+		Log(LOG_WARNING) << "coop: UnitDieBState(_coop_death=true)::think() entered in parallel mode (should be unreachable - unit_casualty path owns death)";
+	}
 
 	// coop
 	if (_parent->isCoop() == true && _parent->getCoopMod()->getHost() == false && _coop_death == false)
 	{
-		_unit->setCoopStatus(STATUS_STANDING);
+		// coop (PRD-P9 soak finding): cancel the LOCAL death - the peer never
+		// decides who dies - but never RESURRECT. The executor's `unit_death` may
+		// already have arrived and set this unit STATUS_DEAD (it is sent from
+		// UnitDieBState::init, ahead of the damage packets the peer's own
+		// checkForCasualties reacts to), and writing STATUS_STANDING over it left
+		// the peer holding a soldier that was dead on the executor and standing
+		// here, on 0 HP, for the rest of the battle.
+		if (!_unit->isOut())
+		{
+			_unit->setCoopStatus(STATUS_STANDING);
+		}
 		_parent->popState();
 		return;
 	}
@@ -367,6 +809,17 @@ void UnitDieBState::think()
 			_unit->instaKill();
 		}
 		_unit->resetTurnsSince();
+
+		// coop (Phase 2a unit_casualty): reset the corpse-mint bookkeeping BEFORE the
+		// mint decision below. The respawn branch (convertUnit) never calls
+		// coopMintCorpse - and neither does the corner case where getSpawnUnit() &&
+		// !_overKill but getAlreadyRespawned() is already true, which takes NEITHER
+		// branch - so without this reset a respawn/no-mint casualty's packet would
+		// read a STALE mode/carrier/spill left over from a previous casualty's mint.
+		// coopMintCorpse() (reached via convertUnitToCorpse() below, host + non-
+		// parallel-client only) overwrites this with the real mode 0/1/2 when it runs.
+		_parent->coopSetCorpseMintResult(3, -1, false);
+
 		if (_unit->getSpawnUnit() && !_overKill)
 		{
 			if (!_unit->getAlreadyRespawned())
@@ -386,82 +839,145 @@ void UnitDieBState::think()
 }
 
 /**
- * Unit falling cannot be cancelled.
+ * coop (parallel battlescape Phase 2c - death ghost): the display-only collapse
+ * animation, a frame-for-frame replay of vanilla think() driven entirely on the
+ * victim's display-OVERRIDE fields. The real unit is ALREADY final (dead,
+ * tile-unlinked, corpse minted) from coopApplyCasualty, so this touches NO world
+ * state, rolls no sim dice (playDeathSound's sound-pick is the only RNG, exactly as
+ * the pre-2b _coop_death path did) and sends nothing. On the last frame it drops the
+ * override so the real dead unit + the now-unhidden corpse/kit draw at the vanilla
+ * instant, then finishes the ghost and pops.
  */
-void UnitDieBState::cancel()
+void UnitDieBState::coopGhostThink()
 {
-}
+	const CoopDeathGhost* g = _ghost;
+	BattleUnit* u = _unit;
+	const int frames = u->getArmor()->getDeathFrames();
 
-/**
- * Converts unit to a corpse (item).
- */
-void UnitDieBState::convertUnitToCorpse()
-{
-	Position lastPosition = _unit->getPosition();
-	int size = _unit->getArmor()->getSize();
-	bool dropItems = (_unit->hasInventory() &&
-		(!Options::weaponSelfDestruction ||
-		(_unit->getOriginalFaction() != FACTION_HOSTILE || _unit->getStatus() == STATUS_UNCONSCIOUS)));
-
-	if (!_noSound)
+	auto ghostKeepFalling = [&]()
 	{
-		_parent->getSave()->getBattleState()->resetUiButton();
-	}
-	// remove the unconscious body item corresponding to this unit, and if it was being carried, keep track of what slot it was in
-	if (lastPosition != TileEngine::invalid)
+		int phase = u->displayFallingPhase() + 1;
+		if (frames > 0 && phase == frames)
+		{
+			phase = frames - 1;
+			u->setCoopDisplayStatus(g->finalStatus);
+		}
+		u->setCoopDisplayFallPhase(phase < 0 ? 0 : phase);
+	};
+	auto ghostIsOut = [&]()
 	{
-		_parent->getSave()->removeUnconsciousBodyItem(_unit);
-	}
+		const UnitStatus s = u->displayStatus();
+		return s == STATUS_DEAD || s == STATUS_UNCONSCIOUS;
+	};
 
-	// move inventory from unit to the ground
-	if (dropItems && _unit->getTile())
+	if (u->displayDirection() != 3 && g->direct)
+	{
+		// the pirouette: turn one step toward direction 3.
+		int dir = u->displayDirection() + 1;
+		if (dir == 8)
+		{
+			dir = 0;
+		}
+		u->setCoopDisplayDir(dir);
+		if (dir == 3)
+		{
+			_parent->setStateInterval(BattlescapeState::DEFAULT_ANIM_SPEED);
+		}
+	}
+	else if (u->displayStatus() == STATUS_COLLAPSING)
 	{
-		_parent->getTileEngine()->itemDropInventory(_unit->getTile(), _unit);
+		ghostKeepFalling();
 	}
-
-	// remove unit-tile link
-	_unit->setTile(nullptr, _parent->getSave());
-
-	if (lastPosition == TileEngine::invalid) // we're being carried
+	else if (!ghostIsOut())
 	{
-		if (_overKill)
+		// startFalling (display): begin the collapse; death sound at this instant.
+		u->setCoopDisplayStatus(STATUS_COLLAPSING);
+		u->setCoopDisplayFallPhase(0);
+		if (!_noSound)
 		{
-			_parent->getSave()->removeUnconsciousBodyItem(_unit);
+			playDeathSound();
 		}
-		else
+		if (u->getRespawn())
 		{
-			// replace the unconscious body item with a corpse in the carrying unit's inventory
-			for (auto* bi : *_parent->getSave()->getItems())
+			while (u->displayStatus() == STATUS_COLLAPSING)
 			{
-				if (bi->getUnit() == _unit)
-				{
-					auto* corpseRules = _unit->getArmor()->getCorpseBattlescape()[0]; // we're in an inventory, so we must be a 1x1 unit
-					bi->convertToCorpse(corpseRules);
-					break;
-				}
+				ghostKeepFalling();
 			}
 		}
 	}
-	else
+
+	if (_extraFrame == 2)
 	{
-		if (!_overKill)
+		if (g->faction == FACTION_PLAYER)
 		{
-			int i = size * size - 1;
-			for (int y = size - 1; y >= 0; --y)
-			{
-				for (int x = size - 1; x >= 0; --x)
-				{
-					BattleItem *corpse = _parent->getSave()->createItemForTile(_unit->getArmor()->getCorpseBattlescape()[i], nullptr, _unit);
-					_parent->dropItem(lastPosition + Position(x,y,0), corpse, false);
-					--i;
-				}
-			}
+			_parent->getMap()->setUnitDying(false);
 		}
-		else
+		// reveal: drop the override so the real dead unit + the now-unhidden corpse
+		// and spilled kit draw, exactly as vanilla mints them at this instant.
+		u->clearCoopDisplayOverride();
+		if (!_noSound)
 		{
-			_parent->getSave()->getTileEngine()->applyGravity(_parent->getSave()->getTile(lastPosition));
+			_parent->getSave()->getBattleState()->resetUiButton();
 		}
+		_parent->getTileEngine()->calculateLighting(LL_ITEMS, g->pos, g->size);
+		_parent->getTileEngine()->calculateFOV(g->pos, g->size, false);
+		_parent->coopFinishActiveGhost();
+		_parent->popState();
 	}
+	else if (_extraFrame == 1)
+	{
+		_extraFrame++;
+	}
+	else if (ghostIsOut())
+	{
+		_extraFrame = 1;
+		// the indirect-death sound plays here (vanilla isOut branch), never for a
+		// unit that went unconscious.
+		if (!_noSound && !g->direct && g->finalStatus != STATUS_UNCONSCIOUS)
+		{
+			playDeathSound();
+		}
+	}
+}
+
+/**
+ * Unit falling cannot be cancelled.
+ */
+void UnitDieBState::cancel()
+{
+}
+
+/**
+ * Converts unit to a corpse (item).
+ */
+void UnitDieBState::convertUnitToCorpse()
+{
+	// presentation (all machines): hide the per-unit action buttons. Kept on the
+	// animation clock even for the parallel replay client below - it is a pure UI
+	// effect, not a world mutation.
+	if (!_noSound)
+	{
+		_parent->getSave()->getBattleState()->resetUiButton();
+	}
+
+	// coop (item 3, mint-at-apply): on the parallel replay client the corpse item
+	// creation, the inventory spill to the ground and the unit-tile unlink are all
+	// performed by the after_unit_death packet apply (connectionTCP.cpp), on the
+	// ordered bookkeeping clock and with the host's manifest ids adopted at create -
+	// NOT here on this machine's animation clock, where the mint bumped the item-id
+	// counter a beat out of step with the host and straddled the chain's action_end
+	// sync-check hash (the alien-side items/itemIdCtr burn-in residual). This branch
+	// leaves the world untouched: display only (the collapse/vanish visual is driven
+	// by think()'s falling animation, not by this function). Gated strictly on the
+	// parallel replay client - the host, a classic co-op client, PvP and single
+	// player all fall through to the shared mint below and stay byte-identical.
+	if (_parent->isCoop() && _parent->getCoopMod()->parallelTurnActive()
+		&& !_parent->getCoopMod()->getHost())
+	{
+		return;
+	}
+
+	_parent->coopMintCorpse(_unit, _overKill);
 }
 
 /**
diff --git a/src/Battlescape/UnitDieBState.h b/src/Battlescape/UnitDieBState.h
index d7046297c..beca50878 100644
--- a/src/Battlescape/UnitDieBState.h
+++ b/src/Battlescape/UnitDieBState.h
@@ -20,11 +20,14 @@
 #include "BattleState.h"
 #include "../Mod/RuleItem.h"
 
+namespace Json { class Value; }
+
 namespace OpenXcom
 {
 
 class BattlescapeGame;
 class BattleUnit;
+struct CoopDeathGhost;
 
 /* Refactoring tip : UnitDieBState */
 /**
@@ -39,17 +42,44 @@ class UnitDieBState : public BattleState
 	int _extraFrame;
 	bool _overKill;
 	bool _coop_death;
+	// coop (chain-atomicity Strand A): latched at CONSTRUCTION - this death was
+	// pushed inside a BOUNDARY-phase checkForCasualties pass (side-close / side-start
+	// fuse+terrain+environmental+bleed-out), so its unit_death/after_unit_death must
+	// stay seq-0 and ride the ordered boundary marker's hash rather than opening a
+	// loose mid-side chain. Mirrors ExplosionBState::_coopBoundaryExpl. init() runs a
+	// think() later - after the synchronous boundary bracket has closed - so the phase
+	// MUST be captured now, not read live at send time.
+	bool _coopBoundaryDeath = false;
+	// coop (parallel battlescape Phase 2c - death ghost): non-null in GHOST MODE only.
+	// A ghost is a display-only UnitDieBState the parallel replay client pushes AFTER
+	// coopApplyCasualty already applied the death atomically (state is final: dead,
+	// tile-unlinked, corpse minted). Ghost mode replays the vanilla collapse animation
+	// on the victim's BattleUnit display-override fields (never its real state) and
+	// SKIPS every world mutation + every host-only send/notify. nullptr in every
+	// existing path - so no existing behaviour changes.
+	const CoopDeathGhost* _ghost = nullptr;
+	/// coop (Phase 2c): the ghost-mode per-tick animation (display overrides only).
+	void coopGhostThink();
   public:
 	/// Creates a new UnitDieBState class
 	UnitDieBState(BattlescapeGame* parent, BattleUnit* unit, const RuleDamageType* damageType, bool noSound, bool coop_death = false);
+	/// coop (Phase 2c - death ghost): the display-only ctor. Drives the collapse
+	/// animation off @a ghost's captured pose while the real unit stays final.
+	UnitDieBState(BattlescapeGame* parent, const CoopDeathGhost* ghost);
 	/// Cleans up the UnitDieBState.
 	~UnitDieBState();
 	/// Initializes the state.
 	void init() override;
+	/// coop (PRD-P10): ships `after_unit_death` the moment the state POPS.
+	void deinit() override;
 	/// Handles a cancels request.
 	void cancel() override;
 	/// Runs state functionality every cycle.
 	void think() override;
+	/// coop: stamps killedBy/murdererId (the host's kill attribution) on a death packet.
+	void coopWriteKillAttribution(Json::Value& root) const;
+	/// coop (PRD-I3 SEAM-4): every living unit's absolute morale after this casualty.
+	void coopWriteBystanderMorale(Json::Value& root) const;
 	/// Converts a unit to a corpse.
 	void convertUnitToCorpse();
 	/// Plays the death sound.
diff --git a/src/Battlescape/UnitFallBState.cpp b/src/Battlescape/UnitFallBState.cpp
index 43691733b..5b986a9ec 100644
--- a/src/Battlescape/UnitFallBState.cpp
+++ b/src/Battlescape/UnitFallBState.cpp
@@ -28,6 +28,7 @@
 #include "../Engine/Options.h"
 #include "../Mod/Armor.h"
 #include "../Mod/Mod.h"
+#include "../CoopMod/connectionTCP.h"
 
 namespace OpenXcom
 {
@@ -59,7 +60,12 @@ UnitFallBState::~UnitFallBState()
 void UnitFallBState::init()
 {
 	_terrain = _parent->getTileEngine();
-	if (_parent->getSave()->getSide() == FACTION_PLAYER)
+	// coop (PRD-P7): fast-forwarded chains run their fall animation at frame rate
+	// too - a fall is locomotion, and the peer is told the landing tile explicitly.
+	// Parallel mode only; classic keeps the original two lines.
+	if (_parent->getCoopFastForward())
+		_parent->setStateInterval(0);
+	else if (_parent->getSave()->getSide() == FACTION_PLAYER)
 		_parent->setStateInterval(Options::battleXcomSpeed);
 	else
 		_parent->setStateInterval(Options::battleAlienSpeed);
@@ -143,6 +149,15 @@ void UnitFallBState::think()
 				{
 					unit->getTile()->ignite(1);
 					Position groundVoxel = (unit->getPosition().toVoxel()) + Position(8,8,-(unit->getTile()->getTerrainLevel()));
+					// coop (PRD-I3 SEAM-3 close): a burn-floor tile destruction that runs
+					// OUTSIDE any admitted chain (the fall is pushed from think() with the
+					// state queue empty) would ship its destroy_tile / set_fire_tile UNSTAMPED
+					// = seq-0 always-consume, and a lagging client can fold that terrain change
+					// into a neighbouring chain's post-N hash (the SEAM-3 residual class the
+					// ExplosionBState "expl" stamp misses). Own a seq so the outcome rides the
+					// I1 apply-before-hash gate. No-op unless the parallel host is between
+					// chains; the chain closes when the fall drains (coopCloseActionChain).
+					connectionTCP::coopStampLooseOutcomeChain("burn");
 					_parent->getTileEngine()->hit(BattleActionAttack{ BA_NONE, unit, }, groundVoxel, unit->getBaseStats()->strength, _parent->getMod()->getDamageType(DT_IN), false);
 
 					if (unit->getStatus() != STATUS_STANDING) // ie: we burned a hole in the floor and fell through it
@@ -157,6 +172,48 @@ void UnitFallBState::think()
 				_terrain->calculateFOV(unit, true, false); //update tiles
 				if (unit->getStatus() == STATUS_STANDING)
 				{
+					// coop (PRD-I3 z-gravity close): the unit finished falling and is
+					// standing on its landed tile. The host's applyGravity re-dropped it
+					// after a mid-side blast destroyed the floor under it, and
+					// UnitFallBState runs only on the EXECUTOR (_isActivePlayerSync-gated in
+					// BattlescapeGame::think) in BOTH modes, so the NON-acting peer never falls
+					// its copy (a classic peer as well as the parallel client) until next_turn: a
+					// unitsCore z-divergence for the whole side (test_coop_outcome_gaps).
+					// Ship the absolute landed tile so the peer applies it AT the fall; a
+					// position, never a decision. gate on the EXECUTOR, not parallelTurnActive() - the fall is pushed on an EMPTY
+					// queue (no action chain) so that is false here; classic crosses too (additive).
+					if (_parent->getCoopMod()->getCoopStatic() && _parent->getCoopMod()->_isActivePlayerSync && !unit->isOut())
+					{
+						Json::Value fallRoot;
+						fallRoot["state"] = "unit_fall";
+						fallRoot["unit_id"] = unit->getId();
+						// E4 (explosion ordered-replay / atomic-death Phase 3): stamp the fall so it orders
+						// in its chain and the parallel client applies it under the rank-1 per-unit watermark.
+						// The stamp helpers no-op outside the parallel host, so classic co-op ships this
+						// UNSTAMPED exactly as before (byte-identical). Boundary-phase falls carry bnd:true+
+						// side_seq (no action_seq); mid-side falls ride the burn chain opened at :160 if any,
+						// else open a "fall" loose chain (coopStampLooseOutcomeChain no-ops if a chain is open).
+						if (_parent->getCoopMod()->parallelTurnActive() && _parent->getCoopMod()->getHost())
+						{
+							const bool coopBoundaryPhase = _parent->coopBoundaryCasualty()
+								|| connectionTCP::_coopBoundaryDecay
+								|| !connectionTCP::_pendingBoundaries.empty();
+							if (coopBoundaryPhase)
+							{
+								fallRoot["bnd"] = true;
+								fallRoot["side_seq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+							}
+							else
+							{
+								connectionTCP::coopStampLooseOutcomeChain("fall");
+								connectionTCP::coopStampChainSeq(fallRoot);
+							}
+						}
+						fallRoot["x"] = unit->getPosition().x;
+						fallRoot["y"] = unit->getPosition().y;
+						fallRoot["z"] = unit->getPosition().z;
+						_parent->sendPacketData(fallRoot.toStyledString());
+					}
 					BattleAction fall;
 					fall.type = BA_WALK;
 					fall.actor = unit;
diff --git a/src/Battlescape/UnitPanicBState.cpp b/src/Battlescape/UnitPanicBState.cpp
index bc37de9a0..16032d59c 100644
--- a/src/Battlescape/UnitPanicBState.cpp
+++ b/src/Battlescape/UnitPanicBState.cpp
@@ -26,6 +26,7 @@
 #include "../Engine/RNG.h"
 #include "BattlescapeGame.h"
 #include "../Mod/Mod.h"
+#include "../CoopMod/connectionTCP.h" // coop (PRD-P10): the panic outcome packet
 
 namespace OpenXcom
 {
@@ -144,6 +145,49 @@ void UnitPanicBState::think()
 		// reset the unit's time units when all panicking is done
 		_unit->clearTimeUnits();
 		_unit->moraleChange(+15);
+
+		// coop (PRD-P10): ship the panic OUTCOME.
+		//
+		// handlePanickingUnit() returns early on the peer in BOTH modes, so the
+		// peer never rolls flee/berserk and never runs this state - but it DOES
+		// adopt STATUS_PANICKING/STATUS_BERSERK, because `next_turn` stamps the
+		// host's per-unit status and is sent from NextTurnState::close(), i.e.
+		// BEFORE the host resolves any of it. The peer was then left holding a
+		// panicking unit with its FULL turn's TU for the rest of the battle,
+		// while the executor's was standing on zero - the "player unit TU
+		// diverges after the alien side" shape (a soak that never loses a
+		// soldier never drops morale far enough to see it).
+		//
+		// Only the three writes above need a packet: the dropped hand weapons
+		// already cross on TileEngine::itemDrop's `Inventory` send, the flee
+		// walk on UnitWalkBState's, and a berserker's shots on
+		// ProjectileFlyBState's.
+		//
+		// Gated on getHost(), not _isActivePlayerSync: the panic RESOLVER is the
+		// host in both modes (BattlescapeGame::think only calls
+		// handlePanickingPlayer there, and handlePanickingUnit early-outs on the
+		// peer), and in classic co-op that resolution can happen while the
+		// host's _isActivePlayerSync is false (it is the client's turn).
+		if (_parent->isCoop() && _parent->getCoopMod()->getHost())
+		{
+			Json::Value root;
+			root["state"] = "panic_action";
+			// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+			// client's action_end apply-barrier waits for this panic outcome before
+			// sampling the chain's post-N sync-check hash (no-op off the parallel host).
+			connectionTCP::coopStampChainSeq(root);
+			root["unit_id"] = _unit->getId();
+			root["status"] = _parent->getCoopMod()->unitstatusToInt(_unit->getStatus());
+			root["time"] = _unit->getTimeUnits();
+			root["energy"] = _unit->getEnergy();
+			root["health"] = _unit->getHealth();
+			root["morale"] = _unit->getMorale();
+			root["mana"] = _unit->getMana();
+			root["stunlevel"] = _unit->getStunlevel();
+			root["setDirection"] = _unit->getDirection();
+			root["setFaceDirection"] = _unit->getFaceDirection();
+			_parent->sendPacketData(root.toStyledString());
+		}
 	}
 	_parent->popState();
 	_parent->setupCursor();
diff --git a/src/Battlescape/UnitSprite.cpp b/src/Battlescape/UnitSprite.cpp
index 8fa87f892..306303cf6 100644
--- a/src/Battlescape/UnitSprite.cpp
+++ b/src/Battlescape/UnitSprite.cpp
@@ -210,11 +210,11 @@ void UnitSprite::draw(const BattleUnit* unit, int part, int x, int y, int shade,
 	{
 		if (overkill > maxHp)
 		{
-			_burn = 16 * (_unit->getFallingPhase() + 1) / armor->getDeathFrames();
+			_burn = 16 * (_unit->displayFallingPhase() + 1) / armor->getDeathFrames();
 		}
 		else
 		{
-			_burn = 16 * overkill * (_unit->getFallingPhase() + 1) / armor->getDeathFrames() / maxHp;
+			_burn = 16 * overkill * (_unit->displayFallingPhase() + 1) / armor->getDeathFrames() / maxHp;
 		}
 	}
 
@@ -368,13 +368,13 @@ void UnitSprite::drawRoutine0()
 	const int offXAiming = 0;
 	const int soldierHeight = 22;
 
-	const int unitDir = _unit->getDirection();
+	const int unitDir = _unit->displayDirection();
 	const int walkPhase = _unit->getWalkingPhase();
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
@@ -404,7 +404,7 @@ void UnitSprite::drawRoutine0()
 
 
 	// when walking, torso(fixed sprite) has to be animated up/down
-	if (_unit->getStatus() == STATUS_WALKING)
+	if (_unit->displayStatus() == STATUS_WALKING)
 	{
 		if (_drawingRoutine == 10)
 			torsoHandsWeaponY = mutonYoffWalk[walkPhase];
@@ -447,7 +447,7 @@ void UnitSprite::drawRoutine0()
 	if (_itemR)
 	{
 		// draw handob item
-		if (_unit->getStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemR, _itemR, dir);
@@ -481,7 +481,7 @@ void UnitSprite::drawRoutine0()
 		if (_itemR->getRules()->isTwoHanded())
 		{
 			selectUnit(leftArm, larm2H, unitDir);
-			if (_unit->getStatus() == STATUS_AIMING)
+			if (_unit->displayStatus() == STATUS_AIMING)
 			{
 				selectUnit(rightArm, rarmShoot, unitDir);
 			}
@@ -500,7 +500,7 @@ void UnitSprite::drawRoutine0()
 
 
 		// the fixed arm(s) have to be animated up/down when walking
-		if (_unit->getStatus() == STATUS_WALKING)
+		if (_unit->displayStatus() == STATUS_WALKING)
 		{
 			itemR.offY = (itemR.offY + torsoHandsWeaponY);
 			rightArm.offY = (torsoHandsWeaponY);
@@ -533,7 +533,7 @@ void UnitSprite::drawRoutine0()
 			selectUnit(rightArm, rarm2H, unitDir);
 		}
 
-		if (_unit->getStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemL, _itemL, dir);
@@ -550,7 +550,7 @@ void UnitSprite::drawRoutine0()
 			selectUnit(rightArm, rarmShoot, unitDir);
 		}
 
-		if (_unit->getStatus() == STATUS_WALKING)
+		if (_unit->displayStatus() == STATUS_WALKING)
 		{
 			itemL.offY = (itemL.offY + torsoHandsWeaponY);
 			leftArm.offY = (torsoHandsWeaponY);
@@ -568,7 +568,7 @@ void UnitSprite::drawRoutine0()
 		itemR.offY = (itemR.offY + offYKneel + offsetTFTD);
 		itemL.offY = (itemL.offY + offYKneel + offsetTFTD);
 	}
-	else if (_unit->getStatus() != STATUS_WALKING)
+	else if (_unit->displayStatus() != STATUS_WALKING)
 	{
 		leftArm.offY = (0);
 		rightArm.offY = (0);
@@ -585,7 +585,7 @@ void UnitSprite::drawRoutine0()
 		itemL.offY = (itemL.offY + (soldierHeight - _unit->getStandHeight()));
 	}
 
-	if (_unit->getStatus() == STATUS_AIMING)
+	if (_unit->displayStatus() == STATUS_AIMING)
 	{
 		torso.offX = (offXAiming);
 		legs.offX = (offXAiming);
@@ -596,7 +596,7 @@ void UnitSprite::drawRoutine0()
 		if (itemL)
 			itemL.offX = (itemL.offX + offXAiming);
 	}
-	else if (!itemR && _drawingRoutine == 10 && _unit->getStatus() == STATUS_WALKING && unitDir == 2)
+	else if (!itemR && _drawingRoutine == 10 && _unit->displayStatus() == STATUS_WALKING && unitDir == 2)
 	{
 		rightArm.offX = (-6);
 	}
@@ -608,7 +608,7 @@ void UnitSprite::drawRoutine0()
 	case 1: blitBody(leftArm); blitBody(legs); blitItem(itemL); blitBody(torso); blitItem(itemR); blitBody(rightArm); break;
 	case 2: blitBody(leftArm); blitBody(legs); blitBody(torso); blitItem(itemL); blitItem(itemR); blitBody(rightArm); break;
 	case 3:
-		if (_unit->getStatus() != STATUS_AIMING  && ((_itemR && _itemR->getRules()->isTwoHanded()) || (_itemL && _itemL->getRules()->isTwoHanded())))
+		if (_unit->displayStatus() != STATUS_AIMING  && ((_itemR && _itemR->getRules()->isTwoHanded()) || (_itemL && _itemL->getRules()->isTwoHanded())))
 		{
 			blitBody(legs); blitBody(torso); blitBody(leftArm); blitItem(itemR); blitItem(itemL); blitBody(rightArm);
 		}
@@ -619,7 +619,7 @@ void UnitSprite::drawRoutine0()
 		break;
 	case 4:	blitBody(legs); blitBody(rightArm); blitBody(torso); blitBody(leftArm); blitItem(itemR); blitItem(itemL);	break;
 	case 5:
-		if (_unit->getStatus() != STATUS_AIMING  && ((_itemR && _itemR->getRules()->isTwoHanded()) || (_itemL && _itemL->getRules()->isTwoHanded())))
+		if (_unit->displayStatus() != STATUS_AIMING  && ((_itemR && _itemR->getRules()->isTwoHanded()) || (_itemL && _itemL->getRules()->isTwoHanded())))
 		{
 			blitBody(rightArm); blitBody(legs); blitBody(torso); blitBody(leftArm); blitItem(itemR); blitItem(itemL);
 		}
@@ -630,7 +630,7 @@ void UnitSprite::drawRoutine0()
 		break;
 	case 6: blitBody(rightArm); blitItem(itemR); blitItem(itemL); blitBody(legs); blitBody(torso); blitBody(leftArm); break;
 	case 7:
-		if (_unit->getStatus() != STATUS_AIMING  && ((_itemR && _itemR->getRules()->isTwoHanded()) || (_itemL && _itemL->getRules()->isTwoHanded())))
+		if (_unit->displayStatus() != STATUS_AIMING  && ((_itemR && _itemR->getRules()->isTwoHanded()) || (_itemL && _itemL->getRules()->isTwoHanded())))
 		{
 			blitBody(rightArm); blitItem(itemR); blitItem(itemL); blitBody(leftArm); blitBody(legs); blitBody(torso);
 		}
@@ -661,21 +661,21 @@ void UnitSprite::drawRoutine1()
 	constexpr static int offY3[8] = { -4, -4, -1, 0, 5, 0, 1, 0 }; // for the left handed rifles
 	constexpr static int offXAiming = 0;
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
 
-	const int unitDir = _unit->getDirection();
+	const int unitDir = _unit->displayDirection();
 	const int walkPhase = _unit->getWalkingPhase();
 
 	selectUnit(leftArm, larm, unitDir);
 	selectUnit(rightArm, rarm, unitDir);
 	// when walking, torso(fixed sprite) has to be animated up/down
-	if (_unit->getStatus() == STATUS_WALKING)
+	if (_unit->displayStatus() == STATUS_WALKING)
 	{
 		selectUnit(torso, walk, (5 * unitDir) + (walkPhase / 1.6)); // floater only has 5 walk animations instead of 8
 		torso.offY = (yoffWalk[walkPhase]);
@@ -691,9 +691,9 @@ void UnitSprite::drawRoutine1()
 	if (_itemR)
 	{
 		// draw handob item
-		if (_unit->getStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
 		{
-			int dir = (_unit->getDirection() + 2)%8;
+			int dir = (_unit->displayDirection() + 2)%8;
 			selectItem(itemR, _itemR, dir);
 			itemR.offX = (offX[unitDir]);
 			itemR.offY = (offY[unitDir]);
@@ -708,7 +708,7 @@ void UnitSprite::drawRoutine1()
 		if (_itemR->getRules()->isTwoHanded())
 		{
 			selectUnit(leftArm, larm2H, unitDir);
-			if (_unit->getStatus() == STATUS_AIMING)
+			if (_unit->displayStatus() == STATUS_AIMING)
 			{
 				selectUnit(rightArm, rarmShoot, unitDir);
 			}
@@ -740,7 +740,7 @@ void UnitSprite::drawRoutine1()
 			selectUnit(rightArm, rarm2H, unitDir);
 		}
 
-		if (_unit->getStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemL, _itemL, dir);
@@ -749,7 +749,7 @@ void UnitSprite::drawRoutine1()
 			selectUnit(rightArm, rarmShoot, unitDir);
 		}
 
-		if (_unit->getStatus() == STATUS_WALKING)
+		if (_unit->displayStatus() == STATUS_WALKING)
 		{
 			leftArm.offY = (yoffWalk[walkPhase]);
 			itemL.offY = (itemL.offY + yoffWalk[walkPhase]);
@@ -758,13 +758,13 @@ void UnitSprite::drawRoutine1()
 		}
 	}
 
-	if (_unit->getStatus() != STATUS_WALKING)
+	if (_unit->displayStatus() != STATUS_WALKING)
 	{
 		leftArm.offY = (0);
 		rightArm.offY = (0);
 		torso.offY = (0);
 	}
-	if (_unit->getStatus() == STATUS_AIMING)
+	if (_unit->displayStatus() == STATUS_AIMING)
 	{
 		torso.offX = (offXAiming);
 		leftArm.offX = (offXAiming);
@@ -820,7 +820,7 @@ void UnitSprite::drawRoutine2()
 	}
 
 	// draw the tank itself
-	selectUnit(s, hoverTank + (_part * 8), _unit->getDirection());
+	selectUnit(s, hoverTank + (_part * 8), _unit->displayDirection());
 	blitBody(s);
 
 	// draw the turret, together with the last part
@@ -832,8 +832,8 @@ void UnitSprite::drawRoutine2()
 		int turretOffsetY = -4;
 		if (hoverTank)
 		{
-			turretOffsetX += offX[_unit->getDirection()];
-			turretOffsetY += offy[_unit->getDirection()];
+			turretOffsetX += offX[_unit->displayDirection()];
+			turretOffsetY += offy[_unit->displayDirection()];
 		}
 		t.offX = (turretOffsetX);
 		t.offY = (turretOffsetY);
@@ -868,7 +868,7 @@ void UnitSprite::drawRoutine3()
 		}
 	}
 
-	selectUnit(s, (_part * 8), _unit->getDirection());
+	selectUnit(s, (_part * 8), _unit->displayDirection());
 
 	blitBody(s);
 
@@ -921,16 +921,16 @@ void UnitSprite::drawRoutine4()
 		die = 148;
 	}
 
-	const int unitDir = _unit->getDirection();
+	const int unitDir = _unit->displayDirection();
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
-	else if (_unit->getStatus() == STATUS_WALKING)
+	else if (_unit->displayStatus() == STATUS_WALKING)
 	{
 		selectUnit(s, walk, (8 * unitDir) + _unit->getWalkingPhase());
 	}
@@ -948,7 +948,7 @@ void UnitSprite::drawRoutine4()
 	if (_itemR && !_itemR->getRules()->isFixed())
 	{
 		// draw handob item
-		if (_unit->getStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemR, _itemR, dir);
@@ -987,7 +987,7 @@ void UnitSprite::drawRoutine4()
 			itemL.offY = (0);
 		}
 
-		if (_unit->getStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemL, _itemL, dir);
@@ -996,7 +996,7 @@ void UnitSprite::drawRoutine4()
 		}
 	}
 
-	if (_unit->getStatus() == STATUS_AIMING)
+	if (_unit->displayStatus() == STATUS_AIMING)
 	{
 		s.offX = (offXAiming);
 		if (itemR)
@@ -1024,13 +1024,13 @@ void UnitSprite::drawRoutine5()
 {
 	Part s{ BODYPART_LARGE_TORSO + _part };
 
-	if (_unit->getStatus() == STATUS_WALKING)
+	if (_unit->displayStatus() == STATUS_WALKING)
 	{
-		selectUnit(s, 32 + (_part * 4), (_unit->getDirection() * 16) + ((_unit->getWalkingPhase() / 2) % 4));
+		selectUnit(s, 32 + (_part * 4), (_unit->displayDirection() * 16) + ((_unit->getWalkingPhase() / 2) % 4));
 	}
 	else
 	{
-		selectUnit(s, 0 + (_part * 8), _unit->getDirection());
+		selectUnit(s, 0 + (_part * 8), _unit->displayDirection());
 	}
 
 	blitBody(s);
@@ -1058,15 +1058,15 @@ void UnitSprite::drawRoutine6()
 	constexpr static int offY3[8] = { -4, -4, -1, 0, 5, 0, 1, 0 }; // for the left handed rifles
 	constexpr static int offXAiming = 0;
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
 
-	const int unitDir = _unit->getDirection();
+	const int unitDir = _unit->displayDirection();
 	const int walkPhase = _unit->getWalkingPhase();
 
 	selectUnit(torso, Torso, unitDir);
@@ -1075,7 +1075,7 @@ void UnitSprite::drawRoutine6()
 
 
 	// when walking, torso(fixed sprite) has to be animated up/down
-	if (_unit->getStatus() == STATUS_WALKING)
+	if (_unit->displayStatus() == STATUS_WALKING)
 	{
 		int xoffWalk = 0;
 		if (unitDir < 3)
@@ -1101,7 +1101,7 @@ void UnitSprite::drawRoutine6()
 	if (_itemR)
 	{
 		// draw handob item
-		if (_unit->getStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemR->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemR, _itemR, dir);
@@ -1124,7 +1124,7 @@ void UnitSprite::drawRoutine6()
 		if (_itemR->getRules()->isTwoHanded())
 		{
 			selectUnit(leftArm, larm2H, unitDir);
-			if (_unit->getStatus() == STATUS_AIMING)
+			if (_unit->displayStatus() == STATUS_AIMING)
 			{
 				selectUnit(rightArm, rarmShoot, unitDir);
 			}
@@ -1140,7 +1140,7 @@ void UnitSprite::drawRoutine6()
 
 
 		// the fixed arm(s) have to be animated up/down when walking
-		if (_unit->getStatus() == STATUS_WALKING)
+		if (_unit->displayStatus() == STATUS_WALKING)
 		{
 			itemR.offY = (yoffWalk[walkPhase]);
 			rightArm.offY = (yoffWalk[walkPhase]);
@@ -1169,7 +1169,7 @@ void UnitSprite::drawRoutine6()
 			selectUnit(rightArm, rarm2H, unitDir);
 		}
 
-		if (_unit->getStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
+		if (_unit->displayStatus() == STATUS_AIMING && _itemL->getRules()->isTwoHanded())
 		{
 			int dir = (unitDir + 2)%8;
 			selectItem(itemL, _itemL, dir);
@@ -1178,7 +1178,7 @@ void UnitSprite::drawRoutine6()
 			selectUnit(rightArm, rarmShoot, unitDir);
 		}
 
-		if (_unit->getStatus() == STATUS_WALKING)
+		if (_unit->displayStatus() == STATUS_WALKING)
 		{
 			leftArm.offY = (yoffWalk[walkPhase]);
 			itemL.offY = (offY2[unitDir] + yoffWalk[walkPhase]);
@@ -1187,13 +1187,13 @@ void UnitSprite::drawRoutine6()
 		}
 	}
 	// offset everything but legs when kneeled
-	if (_unit->getStatus() != STATUS_WALKING)
+	if (_unit->displayStatus() != STATUS_WALKING)
 	{
 		leftArm.offY = (0);
 		rightArm.offY = (0);
 		torso.offY = (0);
 	}
-	if (_unit->getStatus() == STATUS_AIMING)
+	if (_unit->displayStatus() == STATUS_AIMING)
 	{
 		torso.offX = (offXAiming);
 		legs.offX = (offXAiming);
@@ -1233,22 +1233,22 @@ void UnitSprite::drawRoutine7()
 	constexpr static int rarmWalk = 40;
 	constexpr static int yoffWalk[8] = {1, 0, -1, 0, 1, 0, -1, 0}; // bobbing up and down
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
 
-	const int unitDir = _unit->getDirection();
+	const int unitDir = _unit->displayDirection();
 	const int walkPhase = _unit->getWalkingPhase();
 
 	selectUnit(torso, Torso, unitDir);
 
 
 	// when walking, torso(fixed sprite) has to be animated up/down
-	if (_unit->getStatus() == STATUS_WALKING)
+	if (_unit->displayStatus() == STATUS_WALKING)
 	{
 		torso.offY = (yoffWalk[walkPhase]);
 		selectUnit(legs, legsWalk, 24 * unitDir + walkPhase);
@@ -1292,15 +1292,15 @@ void UnitSprite::drawRoutine8()
 
 	selectUnit(legs, Body, Pulsate[_animationFrame % 8]);
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
 
-	if (_unit->getStatus() == STATUS_AIMING)
+	if (_unit->displayStatus() == STATUS_AIMING)
 		selectUnit(legs, aim, 0);
 
 	blitBody(legs);
@@ -1317,10 +1317,10 @@ void UnitSprite::drawRoutine9()
 
 	selectUnit(torso, Body, _animationFrame % 8);
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
@@ -1347,7 +1347,7 @@ void UnitSprite::drawRoutine11()
 	}
 
 	Part s{ BODYPART_LARGE_TORSO + _part };
-	selectUnit(s, body + (_part * 4), 16 * _unit->getDirection() + animFrame);
+	selectUnit(s, body + (_part * 4), 16 * _unit->displayDirection() + animFrame);
 	s.offY = (4);
 	blitBody(s);
 
@@ -1357,11 +1357,11 @@ void UnitSprite::drawRoutine11()
 	{
 		Part t{ BODYPART_LARGE_TURRET };
 		selectUnit(t, 256 + (turret * 8), _unit->getTurretDirection());
-		t.offX = (offTurretX[_unit->getDirection()]);
+		t.offX = (offTurretX[_unit->displayDirection()]);
 		if (_part == 3)
-			t.offY = (offTurretYBelow[_unit->getDirection()]);
+			t.offY = (offTurretYBelow[_unit->displayDirection()]);
 		else
-			t.offY = (offTurretYAbove[_unit->getDirection()]);
+			t.offY = (offTurretYAbove[_unit->displayDirection()]);
 		blitBody(t);
 	}
 
@@ -1390,10 +1390,10 @@ void UnitSprite::drawRoutine16()
 
 	selectUnit(s, 0, _animationFrame % 8);
 
-	if ( (_unit->getStatus() == STATUS_COLLAPSING))
+	if ( (_unit->displayStatus() == STATUS_COLLAPSING))
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
@@ -1410,20 +1410,20 @@ void UnitSprite::drawRoutine19()
 	// magic numbers
 	constexpr static int stand = 0, move = 8, die = 16;
 
-	if (_unit->getStatus() == STATUS_COLLAPSING)
+	if (_unit->displayStatus() == STATUS_COLLAPSING)
 	{
 		Part coll{ BODYPART_COLLAPSING };
-		selectUnit(coll, die, _unit->getFallingPhase());
+		selectUnit(coll, die, _unit->displayFallingPhase());
 		blitBody(coll);
 		return;
 	}
-	else if (_unit->getStatus() == STATUS_WALKING)
+	else if (_unit->displayStatus() == STATUS_WALKING)
 	{
-		selectUnit(s, move, _unit->getDirection());
+		selectUnit(s, move, _unit->displayDirection());
 	}
 	else
 	{
-		selectUnit(s, stand, _unit->getDirection());
+		selectUnit(s, stand, _unit->displayDirection());
 	}
 
 	blitBody(s);
@@ -1436,13 +1436,13 @@ void UnitSprite::drawRoutine20()
 {
 	Part s{ BODYPART_LARGE_TORSO + _part };
 
-	if (_unit->getStatus() == STATUS_WALKING)
+	if (_unit->displayStatus() == STATUS_WALKING)
 	{
-		selectUnit(s, (_part * 5), (_unit->getWalkingPhase()/2%4) + 5 * (4 * _unit->getDirection()));
+		selectUnit(s, (_part * 5), (_unit->getWalkingPhase()/2%4) + 5 * (4 * _unit->displayDirection()));
 	}
 	else
 	{
-		selectUnit(s, (_part * 5), 5 * (4 * _unit->getDirection()));
+		selectUnit(s, (_part * 5), 5 * (4 * _unit->displayDirection()));
 	}
 
 	blitBody(s);
@@ -1455,7 +1455,7 @@ void UnitSprite::drawRoutine21()
 {
 	Part s{ BODYPART_LARGE_TORSO + _part };
 
-	selectUnit(s, (_part * 4), (_unit->getDirection() * 16) + (_animationFrame % 4));
+	selectUnit(s, (_part * 4), (_unit->displayDirection() * 16) + (_animationFrame % 4));
 
 	blitBody(s);
 }
@@ -1472,14 +1472,14 @@ void UnitSprite::sortRifles()
 			_itemR = _unit->getActiveHand(_itemL, _itemR);
 			_itemL = 0;
 		}
-		else if (_unit->getStatus() != STATUS_AIMING)
+		else if (_unit->displayStatus() != STATUS_AIMING)
 		{
 			_itemL = 0;
 		}
 	}
 	else if (_itemL && _itemL->getRules()->isTwoHanded())
 	{
-		if (_unit->getStatus() != STATUS_AIMING)
+		if (_unit->displayStatus() != STATUS_AIMING)
 		{
 			_itemR = 0;
 		}
diff --git a/src/Battlescape/UnitTurnBState.cpp b/src/Battlescape/UnitTurnBState.cpp
index 70938958f..f94587041 100644
--- a/src/Battlescape/UnitTurnBState.cpp
+++ b/src/Battlescape/UnitTurnBState.cpp
@@ -144,7 +144,12 @@ void UnitTurnBState::init()
 	_coopStartTurret = _unit->getTurretDirection();
 
 	_action.clearTU();
-	if (_unit->getFaction() == FACTION_PLAYER)
+	// coop (PRD-P7): while the fast-forward is armed the turn animation is not
+	// being waited for (see UnitWalkBState::setNormalWalkSpeed). Parallel mode
+	// only; classic keeps the original two lines.
+	if (_parent->getCoopFastForward())
+		_parent->setStateInterval(0);
+	else if (_unit->getFaction() == FACTION_PLAYER)
 		_parent->setStateInterval(Options::battleXcomSpeed);
 	else
 		_parent->setStateInterval(Options::battleAlienSpeed);
diff --git a/src/Battlescape/UnitWalkBState.cpp b/src/Battlescape/UnitWalkBState.cpp
index 944afd80f..9279cc3f2 100644
--- a/src/Battlescape/UnitWalkBState.cpp
+++ b/src/Battlescape/UnitWalkBState.cpp
@@ -22,6 +22,7 @@
 #include "TileEngine.h"
 #include "Pathfinding.h"
 #include "BattlescapeState.h"
+#include "../CoopMod/connectionTCP.h"
 #include "Map.h"
 #include "Camera.h"
 #include "../Savegame/BattleUnit.h"
@@ -60,8 +61,14 @@ UnitWalkBState::~UnitWalkBState()
 void UnitWalkBState::init()
 {
 
-	// coop
-	_parent->setCoopTaskCompleted(false);
+	// coop: hold the receive gate for the walk. Guarded because popState()
+	// re-init()s this state after the UnitFallBState it pushes in front of itself
+	// pops, and the gate counts depth (PRD-P6 pre-task).
+	if (!_coopGateHeld)
+	{
+		_coopGateHeld = true;
+		_parent->setCoopTaskCompleted(false);
+	}
 	_parent->getCoopMod()->_coopWalkInit = true;
 
 	_unit = _action.actor;
@@ -152,6 +159,43 @@ void UnitWalkBState::deinit()
 		root["setTurretDirection"] = _unit->getTurretDirection();
 		root["setTurretToDirection"] = _unit->getTurretToDirection();
 
+		// coop (PRD-P9 rider R2): the walk's END STATE. This packet already
+		// teleport-corrects the peer onto the executor's tile and facing; without
+		// the two costs the peer keeps whatever its own (possibly truncated or
+		// fast-forwarded) animation happened to spend, which is a real TU skew
+		// until some later packet or the side boundary overwrites it.
+		root["tu"] = _unit->getTimeUnits();
+		root["energy"] = _unit->getEnergy();
+
+		// coop (PRD-I3): the walk's END KNEEL STATE. UnitWalkBState::init stands a
+		// kneeled unit up on its first step (BattlescapeGame::kneel, :239) - a
+		// kneel-bit mutation that ships on NO packet, because only the explicit
+		// BA_KNEEL path sends coopSendKneelPacket. abortPath is the walk closer, so
+		// it carries the actor's absolute post-walk kneeled bit; the parallel peer
+		// applies it, re-syncing a stand-up its own gated/reserve-refused replay
+		// left kneeled. Additive + presence-gated: an older peer ignores it, and the
+		// receiver applies it on the parallel client only, so classic is byte-identical.
+		root["kneeled"] = _unit->isKneeled();
+
+		// coop (SEAM-3 door B): the hinged doors this walk opened, keyed {x,y,z,part},
+		// so the peer - whose replay walk is door-state-neutral - applies them cost-free
+		// at abortPath receipt. Additive + presence-gated: an older peer ignores the
+		// field (and falls back to fix A's cost-free replay open).
+		if (!_coopWalkDoors.empty())
+		{
+			Json::Value doorsArr(Json::arrayValue);
+			for (const auto& d : _coopWalkDoors)
+			{
+				Json::Value dj;
+				dj["x"] = d.first.x;
+				dj["y"] = d.first.y;
+				dj["z"] = d.first.z;
+				dj["part"] = d.second;
+				doorsArr.append(dj);
+			}
+			root["doors_opened"] = doorsArr;
+		}
+
 		if (_parent->getCoopGamemode() != 2 && _parent->getCoopGamemode() != 3 && _parent->getCoopMod()->_isActiveAISync == false)
 		{
 			int j = 0;
@@ -169,7 +213,11 @@ void UnitWalkBState::deinit()
 	}
 
 	// coop
-	_parent->setCoopTaskCompleted(true);
+	if (_coopGateHeld)
+	{
+		_coopGateHeld = false;
+		_parent->setCoopTaskCompleted(true);
+	}
 
 	_terrain->removeMovingUnit(_unit);
 
@@ -188,7 +236,17 @@ void UnitWalkBState::think()
 
 		_parent->getCoopMod()->AbortCoopWalk = false;
 
-		_unit->setCoopStatus(STATUS_STANDING);
+		// coop (PRD-P9 soak finding): never resurrect. A unit killed DURING the
+		// replayed walk - reaction fire on the executor, whose `unit_death`
+		// arrives before the `abortPath` that closes the walk - is already
+		// STATUS_DEAD by the time this runs, and the unconditional write below
+		// put it back on its feet with 0 HP: dead on the executor, standing on
+		// the peer, for the rest of the battle. Coop-only block (AbortCoopWalk is
+		// a coop flag), so single player is untouched.
+		if (!_unit->isOut())
+		{
+			_unit->setCoopStatus(STATUS_STANDING);
+		}
 		_unit->setwalkPhaseCoop(0);
 
 		_pf->abortPath();
@@ -274,7 +332,7 @@ void UnitWalkBState::think()
 			if (_parent->getCoopMod()->getCoopGamemode() == 2 || _parent->getCoopMod()->getCoopGamemode() == 3)
 			{
 
-				if (_parent->getCurrentAction()->sneak == true)
+				if (_action.sneak == true)
 				{
 					sound = false;
 				}
@@ -332,20 +390,40 @@ void UnitWalkBState::think()
 			if (!_parent->getMap()->getCamera()->isOnScreen(_unit->getPosition(), true, size, false) && _unit->getFaction() != FACTION_PLAYER && _unit->getVisible())
 				_parent->getMap()->getCamera()->centerOnPosition(_unit->getPosition());
 			// if the unit changed level, camera changes level with
-			_parent->getMap()->getCamera()->setViewLevel(_unit->getPosition().z);
+			// coop (PRD-P5): NOT for a teammate's replayed walk during a parallel
+			// player side. Both players are acting at once there, so this per-step
+			// level-follow would drag the local player's view up and down the map
+			// while they are trying to aim. The AI phase (_isActiveAISync) and
+			// classic co-op keep the unconditional follow - in classic the watcher
+			// has no action of their own to protect.
+			if (!(_action.coopReplay && connectionTCP::parallelTurnActive()
+					&& _parent->getCoopMod()->_isActiveAISync == false))
+			{
+				_parent->getMap()->getCamera()->setViewLevel(_unit->getPosition().z);
+			}
 		}
 
 		// is the step finished?
 		if (_unit->getStatus() == STATUS_STANDING)
 		{
 			// update the TU display
-			_parent->getSave()->getBattleState()->updateSoldierInfo();
+			// coop (PRD-P1): only for the unit this player actually has selected -
+			// a replayed teammate walk must not repaint our stat panel.
+			if (_unit == _parent->getSave()->getSelectedUnit())
+			{
+				_parent->getSave()->getBattleState()->updateSoldierInfo();
+			}
 			// if the unit burns floor tiles, burn floor tiles as long as we're not falling
 			if (!_falling && (_unit->getSpecialAbility() == SPECAB_BURNFLOOR || _unit->getSpecialAbility() == SPECAB_BURN_AND_EXPLODE))
 			{
 				_unit->getTile()->ignite(1);
 				Position posHere = _unit->getPosition();
 				Position voxelHere = posHere.toVoxel() + Position(8,8,-(_unit->getTile()->getTerrainLevel()));
+				// coop (PRD-I3 SEAM-3 close): as UnitFallBState - own a seq if the in-walk
+				// burn-floor destruction runs loose. In-chain (the normal admitted walk /
+				// "ai" chain) this is a no-op and the destroy inherits the walk's seq. Walks
+				// are strictly mid-side, so no boundary exclusion applies.
+				connectionTCP::coopStampLooseOutcomeChain("burn");
 				_parent->getTileEngine()->hit(BattleActionAttack{ BA_NONE, _unit, }, voxelHere, _unit->getBaseStats()->strength, _parent->getMod()->getDamageType(DT_IN), false);
 
 				if (_unit->getStatus() != STATUS_STANDING) // ie: we burned a hole in the floor and fell through it
@@ -486,7 +564,27 @@ void UnitWalkBState::think()
 			// now open doors (if any)
 			if (dir < Pathfinding::DIR_UP)
 			{
-				int door = _terrain->unitOpensDoor(_unit, false, dir);
+				// coop (SEAM-3 door B + UFO-door authority): the peer's REPLAY walk is
+			// door-state-neutral for BOTH hinged and UFO doors - it never swaps one. The
+			// EXECUTOR records the doors it opens (hinged door==0, ufo door==1) and ships
+			// them on the abortPath closer (deinit), applied on the peer. So neither a
+			// TU/reserve/re-path shortfall (peer misses a host open) nor a divergent re-path
+			// (peer opens one the host never crossed) can drift door state. UFO doors used to
+			// be exempt (their frame animation ran on the peer's independently re-pathfound
+			// walk), which left a UFO door the host never crossed open until the side boundary
+			// (isUfoDoorOpen divergence, host closed / peer open); recording them here closes
+			// that seam. Their adjacent-tile run is re-derived on apply via checkAdjacentDoors.
+			bool coopReplayDoor = _parent->isCoop() && !_parent->getCoopMod()->_isActivePlayerSync;
+			Position openedPos;
+			int openedPart = -1;
+			int door = _terrain->unitOpensDoor(_unit, false, dir, false, coopReplayDoor,
+											   coopReplayDoor ? 0 : &openedPos,
+											   coopReplayDoor ? 0 : &openedPart);
+			if (!coopReplayDoor && (door == 0 || door == 1) && _parent->isCoop()
+				&& _parent->getCoopMod()->_isActivePlayerSync)
+			{
+				_coopWalkDoors.push_back(std::make_pair(openedPos, openedPart));
+			}
 				if (door == 3)
 				{
 					return; // don't start walking yet, wait for the ufo door to open
@@ -674,6 +772,17 @@ void UnitWalkBState::postPathProcedures()
  */
 void UnitWalkBState::setNormalWalkSpeed()
 {
+	// coop (PRD-P7): the same interval-0 seam an OFF-SCREEN walk already takes
+	// (think(), the `onScreen || debugMode` branch below its caller). While the
+	// fast-forward is armed nobody is waiting for this animation - the arbiter has
+	// another action queued behind it - so it runs at frame rate. The flag can
+	// only be armed during a parallel player side, so classic co-op and single
+	// player keep the original two lines exactly.
+	if (_parent->getCoopFastForward())
+	{
+		_parent->setStateInterval(0);
+		return;
+	}
 	if (_unit->getFaction() == FACTION_PLAYER)
 		_parent->setStateInterval(Options::battleXcomSpeed);
 	else
diff --git a/src/Battlescape/UnitWalkBState.h b/src/Battlescape/UnitWalkBState.h
index ffc41b636..028d76a3b 100644
--- a/src/Battlescape/UnitWalkBState.h
+++ b/src/Battlescape/UnitWalkBState.h
@@ -20,6 +20,8 @@
 #include "BattleState.h"
 #include "BattlescapeGame.h"
 #include "Position.h"
+#include <vector>
+#include <utility>
 
 namespace OpenXcom
 {
@@ -53,6 +55,16 @@ class UnitWalkBState : public BattleState
 	void playMovementSound();
 	std::size_t _numUnitsSpotted;
 	int _preMovementCost;
+	/// coop (PRD-P6 pre-task): does this state hold the receive gate?
+	/// init() is re-entered whenever the UnitFallBState it pushes in front of
+	/// itself pops, and the gate is a DEPTH COUNTER now - a second acquire would
+	/// never be released and would jam the peer's queue for the rest of the
+	/// battle. Acquire once, release once.
+	bool _coopGateHeld = false;
+	/// coop (SEAM-3 door B): hinged doors this EXECUTOR walk opened, shipped on the
+	/// abortPath closer so the peer (whose replay walk is door-state-neutral) can
+	/// apply them cost-free. Each entry is {door tile position, tile part}.
+	std::vector<std::pair<Position, int>> _coopWalkDoors;
 public:
 	/// Creates a new UnitWalkBState class.
 	UnitWalkBState(BattlescapeGame *parent, BattleAction _action);
diff --git a/src/Battlescape/WarningMessage.cpp b/src/Battlescape/WarningMessage.cpp
index 65f6f97b0..cfe7c790e 100644
--- a/src/Battlescape/WarningMessage.cpp
+++ b/src/Battlescape/WarningMessage.cpp
@@ -151,6 +151,14 @@ void WarningMessage::fade()
 /**
  * Draws the warning message.
  */
+/**
+ * coop (PRD-P5): the text currently displayed, or "" when the widget is hidden.
+ */
+std::string WarningMessage::getMessage() const
+{
+	return getVisible() ? _text->getText() : std::string();
+}
+
 void WarningMessage::draw()
 {
 	Surface::draw();
diff --git a/src/Battlescape/WarningMessage.h b/src/Battlescape/WarningMessage.h
index ff6f45207..9d4d51a92 100644
--- a/src/Battlescape/WarningMessage.h
+++ b/src/Battlescape/WarningMessage.h
@@ -51,6 +51,10 @@ class WarningMessage : public Surface
 	void setPalette(const SDL_Color *colors, int firstcolor = 0, int ncolors = 256) override;
 	/// Shows the warning message.
 	void showMessage(const std::string &msg, int time = 2);
+	/// coop (PRD-P5): the message currently on screen, "" when hidden. Read-only
+	/// introspection - the co-op harness asserts WHICH banners a turn mode posts
+	/// (the persistent showCoopWarning(msg, -1) ones squat on this widget).
+	std::string getMessage() const;
 	/// Handles the timers.
 	void think() override;
 	/// Fades the message.
diff --git a/src/CoopMod/CoopState.cpp b/src/CoopMod/CoopState.cpp
index fabf5d144..5e2bd630a 100644
--- a/src/CoopMod/CoopState.cpp
+++ b/src/CoopMod/CoopState.cpp
@@ -35,7 +35,9 @@
 #include "../Menu/OptionsVideoState.h"
 #include "../Menu/PauseState.h"
 #include "../Geoscape/GeoscapeState.h"
+#include "../Engine/CrossPlatform.h"
 #include "CoopState.h"
+#include "SharedEcon.h" // PRD-I5: crash-report bundle handlers
 
 #include "../Basescape/BasescapeState.h"
 
@@ -1878,4 +1880,248 @@ void CoopState::loadCoop(Action *)
 
 }
 
+// ---- CoopDesyncNoticeState ---------------------------------------------------
+
+std::string CoopDesyncNoticeState::s_lastHeadline;
+std::string CoopDesyncNoticeState::s_lastMessage;
+std::string CoopDesyncNoticeState::s_lastReportUrl;
+std::string CoopDesyncNoticeState::s_lastOpenTarget;
+std::string CoopDesyncNoticeState::s_lastZipPath;
+int CoopDesyncNoticeState::s_raiseCount = 0;
+
+CoopDesyncNoticeState::CoopDesyncNoticeState(const std::string &message,
+	const std::string &headline, const std::string &zipPath, const std::string &reportUrl)
+	: _headline(headline), _message(message), _zipPath(zipPath), _reportUrl(reportUrl)
+{
+	// OPEN FOLDER opens the DIRECTORY the zip lives in (the reports folder), reusing
+	// CrossPlatform::openExplorer - the vetted cross-platform helper OXCE already uses
+	// for the mods folder - rather than a Windows-only `explorer /select,<zip>`.
+	size_t slash = zipPath.find_last_of("/\\");
+	_openTarget = (slash == std::string::npos) ? zipPath : zipPath.substr(0, slash);
+
+	// Test hook: record what this notice WOULD open. The modal is dismissed by the
+	// co-op turn cycle within a poll or two, so a harness check made afterwards reads
+	// these statics instead of the live widget (and never launches a browser).
+	s_lastHeadline = _headline;
+	s_lastMessage = _message;
+	s_lastReportUrl = _reportUrl;
+	s_lastOpenTarget = _openTarget;
+	s_lastZipPath = _zipPath;
+	++s_raiseCount;
+
+	buildLayout();
+}
+
+void CoopDesyncNoticeState::buildLayout()
+{
+	_screen = false;
+
+	// Roomier than the notice family's usual 256x88: this one carries a full
+	// filesystem path, an attribution headline AND three buttons.
+	_window = new Window(this, 300, 172, 10, 14, POPUP_BOTH);
+	_txtHeadline = new Text(284, 18, 18, 22);
+	_txtMessage = new Text(284, 104, 18, 42);
+	_btnOk = new TextButton(84, 16, 20, 152);
+	_btnOpenFolder = new TextButton(94, 16, 112, 152);
+	_btnReport = new TextButton(88, 16, 214, 152);
+
+	std::string category = "sackSoldier";
+	std::string textElement = "text";
+	if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+	{
+		// Same combination the co-op lobby uses in battle: geoscape interface with
+		// alterPal, saveMenus colors, under the battle palette (see GiftNoticeState).
+		setInterface("geoscape", true, _game->getSavedGame()->getSavedBattle());
+		category = "saveMenus";
+	}
+	else
+	{
+		// Adopt the palette of whatever screen we are over. Skip sibling notices so the
+		// context is the screen underneath, not another notice stacked on top.
+		State* context = nullptr;
+		for (auto it = _game->getStates().rbegin(); it != _game->getStates().rend(); ++it)
+		{
+			if (dynamic_cast<CoopDesyncNoticeState*>(*it) == nullptr)
+			{
+				context = *it;
+				break;
+			}
+		}
+		if (context)
+		{
+			setStatePalette(context->getPalette());
+			if (dynamic_cast<GeoscapeState*>(context))
+			{
+				category = "geoManufactureComplete"; // standard geoscape popup colors
+				textElement = "text1";
+			}
+		}
+	}
+
+	add(_window, "window", category);
+	add(_txtHeadline, textElement, category);
+	add(_txtMessage, textElement, category);
+	add(_btnOk, "button", category);
+	add(_btnOpenFolder, "button", category);
+	add(_btnReport, "button", category);
+
+	centerAllSurfaces();
+	setWindowBackground(_window, category);
+	if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+	{
+		applyBattlescapeTheme(category);
+	}
+
+	_txtHeadline->setAlign(ALIGN_CENTER);
+	_txtHeadline->setWordWrap(true);
+	_txtHeadline->setText(_headline);
+
+	_txtMessage->setAlign(ALIGN_CENTER);
+	_txtMessage->setWordWrap(true);
+	_txtMessage->setText(_message);
+
+	_btnOk->setText(tr("STR_OK"));
+	_btnOk->onMouseClick((ActionHandler)&CoopDesyncNoticeState::btnOkClick);
+	_btnOk->onKeyboardPress((ActionHandler)&CoopDesyncNoticeState::btnOkClick, Options::keyOk);
+	_btnOk->onKeyboardPress((ActionHandler)&CoopDesyncNoticeState::btnOkClick, Options::keyCancel);
+
+	_btnOpenFolder->setText(tr("STR_COOP_DESYNC_OPEN_FOLDER"));
+	_btnOpenFolder->onMouseClick((ActionHandler)&CoopDesyncNoticeState::btnOpenFolderClick);
+
+	_btnReport->setText(tr("STR_COOP_DESYNC_REPORT_GITHUB"));
+	_btnReport->onMouseClick((ActionHandler)&CoopDesyncNoticeState::btnReportClick);
+}
+
+std::string CoopDesyncNoticeState::getMessageText() const
+{
+	return _txtMessage ? _txtMessage->getText() : std::string();
+}
+
+void CoopDesyncNoticeState::btnOkClick(Action *)
+{
+	_game->popState();
+}
+
+void CoopDesyncNoticeState::btnOpenFolderClick(Action *)
+{
+	// Test hook + real action: record what we WOULD open, then shell out to the OS
+	// file manager. No auto-upload - this only opens the local folder.
+	s_lastOpenTarget = _openTarget;
+	if (!_openTarget.empty())
+	{
+		CrossPlatform::openExplorer(_openTarget);
+	}
+}
+
+void CoopDesyncNoticeState::btnReportClick(Action *)
+{
+	// Test hook + real action: record the prefilled GitHub URL, then open the browser
+	// at it. No auto-upload - the player still attaches the zip by hand.
+	s_lastReportUrl = _reportUrl;
+	if (!_reportUrl.empty())
+	{
+		CrossPlatform::openExplorer(_reportUrl);
+	}
+}
+
+// ---- CoopCrashPromptState (PRD-I5) ------------------------------------------
+
+int CoopCrashPromptState::s_raiseCount = 0;
+std::string CoopCrashPromptState::s_lastChoice;
+
+CoopCrashPromptState::CoopCrashPromptState(const std::string &message,
+	const std::string &headline, const std::string &markerPath,
+	const std::string &dmpPath, const std::string &logPath)
+	: _headline(headline), _message(message), _markerPath(markerPath),
+	  _dmpPath(dmpPath), _logPath(logPath)
+{
+	++s_raiseCount;
+	buildLayout();
+}
+
+void CoopCrashPromptState::buildLayout()
+{
+	_screen = false;
+
+	// Same roomy geometry as CoopDesyncNoticeState (headline + wrapped body + a row
+	// of buttons). This one always sits over the main menu, so it takes the menu's
+	// interface + palette directly rather than adopting whatever is underneath.
+	_window = new Window(this, 300, 172, 10, 14, POPUP_BOTH);
+	_txtHeadline = new Text(284, 18, 18, 22);
+	_txtMessage = new Text(284, 104, 18, 42);
+	_btnBundle = new TextButton(84, 16, 20, 152);
+	_btnNotNow = new TextButton(94, 16, 112, 152);
+	_btnNever = new TextButton(88, 16, 214, 152);
+
+	setInterface("mainMenu");
+
+	add(_window, "window", "mainMenu");
+	add(_txtHeadline, "text", "mainMenu");
+	add(_txtMessage, "text", "mainMenu");
+	add(_btnBundle, "button", "mainMenu");
+	add(_btnNotNow, "button", "mainMenu");
+	add(_btnNever, "button", "mainMenu");
+
+	centerAllSurfaces();
+	setWindowBackground(_window, "mainMenu");
+
+	_txtHeadline->setAlign(ALIGN_CENTER);
+	_txtHeadline->setWordWrap(true);
+	_txtHeadline->setText(_headline);
+
+	_txtMessage->setAlign(ALIGN_CENTER);
+	_txtMessage->setWordWrap(true);
+	_txtMessage->setText(_message);
+
+	_btnBundle->setText(tr("STR_COOP_CRASH_REPORT_BUNDLE"));
+	_btnBundle->onMouseClick((ActionHandler)&CoopCrashPromptState::btnBundleClick);
+	_btnBundle->onKeyboardPress((ActionHandler)&CoopCrashPromptState::btnBundleClick, Options::keyOk);
+
+	_btnNotNow->setText(tr("STR_COOP_CRASH_REPORT_NOT_NOW"));
+	_btnNotNow->onMouseClick((ActionHandler)&CoopCrashPromptState::btnNotNowClick);
+	_btnNotNow->onKeyboardPress((ActionHandler)&CoopCrashPromptState::btnNotNowClick, Options::keyCancel);
+
+	_btnNever->setText(tr("STR_COOP_CRASH_REPORT_NEVER"));
+	_btnNever->onMouseClick((ActionHandler)&CoopCrashPromptState::btnNeverClick);
+}
+
+std::string CoopCrashPromptState::getMessageText() const
+{
+	return _txtMessage ? _txtMessage->getText() : std::string();
+}
+
+void CoopCrashPromptState::btnBundleClick(Action *)
+{
+	// BUNDLE: pop the prompt FIRST so the result notice lands over the menu (not
+	// over a dying prompt), THEN build the zip. Either bundler deletes/marks its
+	// source on success and raises the CoopDesyncNoticeState result dialog.
+	s_lastChoice = "bundle";
+	Game* g = _game;
+	std::string marker = _markerPath, dmp = _dmpPath, log = _logPath;
+	_game->popState();
+	if (!marker.empty())
+		SharedEcon::bundleCrashReportFromMarker(g, marker);
+	else
+		SharedEcon::bundleCrashReportFromCrashlog(g, dmp, log);
+}
+
+void CoopCrashPromptState::btnNotNowClick(Action *)
+{
+	// NOT NOW: leave the source untouched so the next launch asks again.
+	s_lastChoice = "not_now";
+	_game->popState();
+}
+
+void CoopCrashPromptState::btnNeverClick(Action *)
+{
+	// NEVER (this crash): drop the marker (+ dedup its VEH pair), or mark the
+	// crashlog seen - without bundling.
+	s_lastChoice = "never";
+	if (!_markerPath.empty())
+		SharedEcon::declineCrashMarker(_markerPath);
+	else
+		SharedEcon::markCrashlogSeenPath(_dmpPath);
+	_game->popState();
+}
+
 }
diff --git a/src/CoopMod/CoopState.h b/src/CoopMod/CoopState.h
index 0fe729632..80fb77275 100644
--- a/src/CoopMod/CoopState.h
+++ b/src/CoopMod/CoopState.h
@@ -151,4 +151,101 @@ class CoopState : public State
 	void think() override;
 };
 
+/**
+ * Click-to-dismiss notice raised once a battle desync diagnostic bundle has been
+ * written (SharedEcon::captureDesyncReport). Its own class rather than a CoopState
+ * code or an InfoboxOKState because:
+ *  - it is nearly always raised OVER a live battle, where CoopState's geoscape
+ *    window is the documented dialog/dismiss trap;
+ *  - InfoboxOKState's constructor REPLICATES itself to the peer when the local
+ *    machine is the host, and each machine's report names its own local path -
+ *    the peer must never be shown this one;
+ *  - it has to hold a full filesystem path plus a "where to send it" sentence,
+ *    which does not fit InfoboxOKState's 255x61 big-font title.
+ * Palette handling mirrors GiftNoticeState: adopt the screen underneath, and in
+ * battle use the co-op lobby's geoscape/saveMenus combination under the battle
+ * palette. NOTHING is captured here - the bundle is already on disk by the time
+ * this is pushed, so a dialog the player leaves sitting cannot spoil it.
+ */
+class CoopDesyncNoticeState : public State
+{
+  private:
+	Window *_window;
+	Text *_txtHeadline;
+	Text *_txtMessage;
+	TextButton *_btnOk;
+	TextButton *_btnOpenFolder;
+	TextButton *_btnReport;
+	std::string _headline;
+	std::string _message;
+	std::string _zipPath;     ///< the diagnostic bundle zip
+	std::string _openTarget;  ///< the folder OPEN FOLDER opens (the reports dir)
+	std::string _reportUrl;   ///< the prefilled GitHub new-issue URL
+	void buildLayout();
+  public:
+	/// PRD-I4: message + attribution headline + one-click UX (open folder / prefilled
+	/// GitHub issue). No auto-upload; the buttons only shell out to the OS helper.
+	CoopDesyncNoticeState(const std::string &message, const std::string &headline,
+						  const std::string &zipPath, const std::string &reportUrl);
+	/// Harness introspection: what this notice says / would open.
+	std::string getMessageText() const;
+	std::string getHeadlineText() const { return _headline; }
+	std::string getReportUrl() const { return _reportUrl; }
+	std::string getOpenFolderTarget() const { return _openTarget; }
+	std::string getZipPath() const { return _zipPath; }
+	void btnOkClick(Action *);
+	void btnOpenFolderClick(Action *);
+	void btnReportClick(Action *);
+	/// Test hook: the values the LAST-raised notice would open, kept after the modal
+	/// is dismissed so a harness poll made later can still read them.
+	static std::string s_lastHeadline;
+	static std::string s_lastMessage;
+	static std::string s_lastReportUrl;
+	static std::string s_lastOpenTarget;
+	static std::string s_lastZipPath;
+	static int s_raiseCount;
+};
+
+/**
+ * PRD-I5: next-launch crash-report consent dialog. Raised once over the main menu
+ * when crash-pending.json names a dump + log that still exist. Three outcomes:
+ *  - BUNDLE:  zip the crash artifacts (SharedEcon::bundleCrashReportFromMarker),
+ *             which deletes the marker and raises the CoopDesyncNoticeState result;
+ *  - NOT NOW: keep the marker (asks again next launch);
+ *  - NEVER:   delete the marker for this crash without bundling.
+ * Palette handling mirrors CoopDesyncNoticeState: adopt the screen underneath (the
+ * main menu). It only ever fires at the boot main-menu altitude, never in battle.
+ */
+class CoopCrashPromptState : public State
+{
+  private:
+	Window *_window;
+	Text *_txtHeadline;
+	Text *_txtMessage;
+	TextButton *_btnBundle;
+	TextButton *_btnNotNow;
+	TextButton *_btnNever;
+	std::string _headline;
+	std::string _message;
+	std::string _markerPath; ///< classic crashDump marker (source 1); empty for a crashlog
+	std::string _dmpPath;    ///< issue #124 VEH crashlog dump (source 2); empty for a marker
+	std::string _logPath;    ///< the paired VEH crash log
+	void buildLayout();
+  public:
+	/// One of {markerPath} (classic) or {dmpPath,logPath} (VEH crashlog) is set.
+	CoopCrashPromptState(const std::string &message, const std::string &headline,
+						 const std::string &markerPath, const std::string &dmpPath,
+						 const std::string &logPath);
+	/// Harness introspection: what this prompt says.
+	std::string getMessageText() const;
+	std::string getHeadlineText() const { return _headline; }
+	void btnBundleClick(Action *);
+	void btnNotNowClick(Action *);
+	void btnNeverClick(Action *);
+	/// Harness introspection: how many prompts were raised this process, and the
+	/// choice the last-dismissed prompt took ("bundle" / "not_now" / "never").
+	static int s_raiseCount;
+	static std::string s_lastChoice;
+};
+
 }
diff --git a/src/CoopMod/HostMenu.cpp b/src/CoopMod/HostMenu.cpp
index a7473ba76..15f4e726e 100644
--- a/src/CoopMod/HostMenu.cpp
+++ b/src/CoopMod/HostMenu.cpp
@@ -51,7 +51,9 @@ HostMenu::HostMenu() : _craft(0), _selectType(NewBattleSelectType::MISSION), _is
 	int x = 20;
 	
 	// Create objects
-	_window = new Window(this, 260, 160, x, 20, POPUP_BOTH);
+	// coop (PRD-P5): 18px taller than stock - the PARALLEL TURNS toggle takes the
+	// old button row (152) and START HOST / CANCEL move down to 172.
+	_window = new Window(this, 260, 178, x, 20, POPUP_BOTH);
 	_lstSaves = new TextList(224, 18, x + 18, 60);
 
 	_lblServerName = new Text(108, 18, x + 18, 72);
@@ -60,12 +62,13 @@ HostMenu::HostMenu() : _craft(0), _selectType(NewBattleSelectType::MISSION), _is
 
 	_port = new TextEdit(this, 116, 18, x + 126, 92);
 	_serverName = new TextEdit(this, 116, 18, x + 126, 72);
-	_tcpButtonHost = new TextButton(112, 18, x + 18, 152);
+	_tcpButtonHost = new TextButton(112, 18, x + 18, 172);
+	_btnParallelTurns = new TextButton(224, 18, x + 18, 152);
 	_cbxVisibility = new ComboBox(this, 224, 18, x + 18, 50);
 	_cbxRegions = new ComboBox(this, 112, 18, x + 18, 112); 
 	_cbxMaxPlayers = new ComboBox(this, 112, 18, x + 130, 112); 
 	_password = new TextEdit(this, 116, 18, x + 126, 132);
-	_btnCancel = new TextButton(112, 18, x + 130, 152);
+	_btnCancel = new TextButton(112, 18, x + 130, 172);
 	_txtTitle = new Text(250, 17, x + 5, 32);
 
 	int screenWidth = Options::baseXGeoscape;
@@ -84,6 +87,7 @@ HostMenu::HostMenu() : _craft(0), _selectType(NewBattleSelectType::MISSION), _is
 	add(_serverName, "text", "pauseMenu");
 	add(_password, "text", "pauseMenu");
 	add(_tcpButtonHost, "button", "pauseMenu");
+	add(_btnParallelTurns, "button", "pauseMenu");
 	add(_btnCancel, "button", "pauseMenu");
 	add(_cbxVisibility, "button", "pauseMenu");
 	add(_cbxRegions, "button", "pauseMenu");
@@ -156,6 +160,11 @@ HostMenu::HostMenu() : _craft(0), _selectType(NewBattleSelectType::MISSION), _is
 	_tcpButtonHost->onMouseClick((ActionHandler)&HostMenu::hostTCPGame);
 	_tcpButtonHost->setVisible(true);
 
+	// coop (PRD-P5)
+	updateParallelTurnsButton();
+	_btnParallelTurns->onMouseClick((ActionHandler)&HostMenu::btnParallelTurnsClick);
+	_btnParallelTurns->setVisible(true);
+
 	_btnCancel->setText(tr("CANCEL"));
 	_btnCancel->onMouseClick((ActionHandler)&HostMenu::btnCancelClick);
 	_btnCancel->onKeyboardPress((ActionHandler)&HostMenu::btnCancelClick, Options::keyCancel);
@@ -352,6 +361,11 @@ void HostMenu::init()
 		_cbxRegions->setVisible(true);
 
 	}
+
+	// coop (PRD-P5): the toggle lives and dies with the hosting controls - it is a
+	// pre-session switch, and once the session is live the handshake has already
+	// frozen the mode.
+	updateParallelTurnsButton();
 }
 
 void HostMenu::convertUnits()
@@ -552,6 +566,9 @@ void HostMenu::cbxVisibilityChange(Action* action)
 		_isUDPconnection = false;
 	}
 
+	// coop (PRD-P5)
+	updateParallelTurnsButton();
+
 }
 
 void HostMenu::cbxMaxPlayersChange(Action* action)
@@ -792,6 +809,30 @@ bool HostMenu::hostControlsVisible() const
 		|| _cbxVisibility->getVisible();
 }
 
+/**
+ * coop (PRD-P5): PARALLEL TURNS toggle. Flips the HOST's option; the value is
+ * shipped to the client on COOP_READY_HOST, so only the host's setting matters
+ * and only before the session goes live.
+ */
+void HostMenu::btnParallelTurnsClick(Action*)
+{
+	Options::EnableCoopParallelTurns = !Options::EnableCoopParallelTurns;
+	updateParallelTurnsButton();
+}
+
+/**
+ * coop (PRD-P5): keeps the toggle's label in sync with the option and its
+ * visibility in sync with the rest of the hosting controls (hidden in hotseat
+ * mode, which has a single machine, and once a session is live).
+ */
+void HostMenu::updateParallelTurnsButton()
+{
+	_btnParallelTurns->setText(Options::EnableCoopParallelTurns
+		? "PARALLEL TURNS: ON"
+		: "PARALLEL TURNS: OFF");
+	_btnParallelTurns->setVisible(_tcpButtonHost->getVisible());
+}
+
 /**
  * Returns to the previous screen.
  * @param action Pointer to an action.
diff --git a/src/CoopMod/HostMenu.h b/src/CoopMod/HostMenu.h
index 0694d19fd..2e1f1517c 100644
--- a/src/CoopMod/HostMenu.h
+++ b/src/CoopMod/HostMenu.h
@@ -82,6 +82,10 @@ class HostMenu : public State
 {
   private:
 	TextButton *_btnCancel, *_tcpButtonHost;
+	// coop (PRD-P5): session-scoped PARALLEL TURNS toggle, next to the other
+	// pre-session switches. Locks once the session is live (the hosting controls
+	// are hidden then), which matches the COOP_READY_HOST handshake timing.
+	TextButton *_btnParallelTurns;
 	TextList *_lstSaves;
 	TextEdit *_serverName, *_port, *_password;
 	ComboBox *_cbxVisibility, *_cbxMaxPlayers, *_cbxRegions;
@@ -107,6 +111,9 @@ class HostMenu : public State
 	/// Handler for clicking the OK button
 	void btnCancelClick(Action *action);
 	void hostTCPGame(Action *action);
+	void btnParallelTurnsClick(Action* action);
+	/// coop (PRD-P5): label + visibility of the PARALLEL TURNS toggle.
+	void updateParallelTurnsButton();
 	void btnChatClick(Action* action);
 	void cbxVisibilityChange(Action* action);
 	void cbxMaxPlayersChange(Action* action);
diff --git a/src/CoopMod/SharedEcon.cpp b/src/CoopMod/SharedEcon.cpp
index f2966bf9b..6d578cd71 100644
--- a/src/CoopMod/SharedEcon.cpp
+++ b/src/CoopMod/SharedEcon.cpp
@@ -27,7 +27,10 @@
 #include <map>
 #include <mutex>
 #include <set>
+#include <sstream>
+#include <string_view>
 #include <unordered_map>
+#include <tuple>
 #include <utility>
 #include <vector>
 
@@ -71,6 +74,16 @@
 #include "../Savegame/CraftWeapon.h"
 #include "../Savegame/Country.h"
 #include "../Savegame/WeightedOptions.h"
+#include "../Savegame/SavedBattleGame.h"
+#include "../Savegame/BattleItem.h"
+#include "../Savegame/BattleUnit.h"
+// PRD-I0: the sync-check sweep reads tiles (terrain/fire/smoke), inventory slot
+// ids and the TilePart enum directly.
+#include "../Savegame/Tile.h"
+#include "../Mod/MapData.h"
+#include "../Mod/RuleInventory.h"
+#include "../Battlescape/BattlescapeGame.h"
+#include "../Battlescape/BattlescapeState.h"
 #include "../Mod/RuleUfo.h"
 #include "../Mod/RuleCraftWeapon.h"
 #include "../Mod/RuleCountry.h"
@@ -108,6 +121,24 @@
 
 #include "connectionTCP.h"
 #include "CoopState.h"
+#include "CrashHandler.h"
+
+// Desync auto-report bundle. miniz is already vendored (libs/miniz) and already
+// compiled into both build systems for FileMap's zip-mod reader, so the zip
+// WRITER costs nothing new. MINIZ_NO_STDIO matches how CMake compiles miniz.c
+// (src/CMakeLists.txt) - without it this header would offer the file-based
+// writer APIs that exist only in the MSVC object, i.e. a Windows-only feature
+// that fails to LINK on the Linux AppImage. The heap writer is guard-free on
+// both, so everything below builds an archive in memory and writes the bytes
+// out through CrossPlatform's binary writeFile().
+#include "../Engine/CrossPlatform.h"
+#include "../version.h"
+
+#include <cstring>
+#include <ctime>
+
+#define MINIZ_NO_STDIO
+#include "../../libs/miniz/miniz.h"
 
 namespace OpenXcom
 {
@@ -3550,181 +3581,3807 @@ void worldAggregates(SavedGame* save, int64_t& items, int64_t& soldiers,
 }
 } // namespace
 
-void attachWorldChecksum(Game* game, Json::Value& msg)
-{
-	if (!game || !game->getSavedGame()) return;
-	SavedGame* save = game->getSavedGame();
-	msg["chkFunds"] = Json::Value::Int64(save->getFunds());
-	msg["chkBases"] = (int)save->getBases()->size();
-	msg["chkResearch"] = (int)save->getDiscoveredResearch().size();
+// ---- PRD-P2: battlescape drift tripwire (3a stamp + 3b compare) --------------
+namespace {
+bool g_battleDesyncSeen = false;      // harness flag: the tripwire fired here
+bool g_battleMismatchLogged = false;  // one log line per mismatch EPISODE
+int64_t g_lastBattleNotifyMs = -1;    // player notify throttle (RESYNC_DEBOUNCE_MS)
+bool g_desyncReportWritten = false;   // ONE diagnostic bundle per battle per machine
+std::string g_desyncReportPath;       // ... and where it went
+
+// coop (Class-A soak wedge fix, A3): peer-liveness tripwire state. A peer that
+// wedges mid-replay does not DIVERGE - it goes SILENT, so no per-term detector
+// fires. But it stops answering boundary markers while this (host) machine keeps
+// crossing them, so g_syncLastBoundarySeq climbs and g_syncLastComparedBoundarySeq
+// freezes. Latch the SAME shared desync path (one banner, one bundle) so a
+// gone-dark peer is detected in the field instead of the players sitting through a
+// frozen session.
+//
+// Signal = "NO boundary progress while behind", NOT "gap sustained". A peer can fall
+// FAR behind (a soak client dropped 13 boundaries) and then recover slowly - the
+// existing P11 liveness floor / P7 fast-forward / the A1 escape all pull it back.
+// Such a peer is answering boundaries the whole time, just late; the gap stays >= 2
+// for MINUTES while it catches up. Firing on the gap alone flags that recoverable lag
+// as a wedge (measured: soak seed 11100011, a ~175 s stall the P11 floor recovered,
+// zero term drift). So the clock is reset by ANY boundary answer (a change in
+// g_syncLastComparedBoundarySeq): only a peer that answers NOTHING for the whole
+// window is "gone dark". The stall window is set ABOVE the longest legitimate
+// no-progress span - a single slow alien side freezes boundary progress for its whole
+// display (~100 s observed on a loaded soak client) - with margin, so a slow side
+// never trips it while a permanent wedge (the 40-min forensic) does. Overridable by a
+// test lever (setPeerLivenessThresholds) so the red-capability test fires in seconds.
+const std::uint32_t kPeerLivenessBoundaryGap = 2;      // >= this many boundaries behind ...
+const std::int64_t  kPeerLivenessStallMs     = 240000; // ... with ZERO boundary progress for this long (wall ms)
+std::uint32_t g_peerLivenessBoundaryGap = kPeerLivenessBoundaryGap;
+std::int64_t  g_peerLivenessStallMs     = kPeerLivenessStallMs;
+std::int64_t  g_peerLivenessProgressMs  = -1;   // wall time the peer last answered a boundary (-1 = not yet)
+std::uint32_t g_peerLivenessLastCompared = 0;   // last g_syncLastComparedBoundarySeq seen (progress edge)
+std::uint32_t g_peerLivenessLatched     = 0;    // introspection: 1 once it has fired this battle
+
+// FNV-1a. std::hash is implementation-defined and the two machines are not
+// necessarily the same build (Windows .exe vs the Linux AppImage), so the census
+// mix has to be spelled out to be comparable ACROSS the wire.
+uint64_t fnv1a(const std::string& s)
+{
+	uint64_t h = 1469598103934665603ULL;
+	for (char c : s)
+	{
+		h ^= (uint64_t)(unsigned char)c;
+		h *= 1099511628211ULL;
+	}
+	return h;
+}
+} // namespace
 
-	// GAP-4: widen past funds/bases/research so store, roster, transfer and
-	// production drift can no longer hide from the auto-repair (funds is the only
-	// exact-VALUE field; the four below are counts). Stamp and compare MUST stay
-	// in lock-step - both go through worldAggregates().
-	int64_t items, soldiers, transfers, productions;
-	worldAggregates(save, items, soldiers, transfers, productions);
-	msg["chkItems"] = Json::Value::Int64(items);
-	msg["chkSoldiers"] = Json::Value::Int64(soldiers);
-	msg["chkTransfers"] = Json::Value::Int64(transfers);
-	msg["chkProduction"] = Json::Value::Int64(productions);
-	// issue #78: an orphaned replica mission site (a despawn the snapshot missed)
-	// must trip the auto-repair too. Count only - the restream is the repair.
-	msg["chkSites"] = (int)save->getMissionSites()->size();
+// The unit term's status field. NOT the raw UnitStatus: STANDING / WALKING /
+// FLYING / TURNING / AIMING / COLLAPSING / PANICKING / BERSERK are ANIMATION
+// phases, and the two machines are never on the same animation frame - the peer
+// is a display that lags the executor by whatever the packet took to arrive.
+// Hashing the raw enum would fire on every turn where anything was still moving.
+//
+// What must agree is the one classification the protocol really does replicate
+// and that nothing may quietly disagree about: is this unit on its feet, dead, or
+// unconscious. That is exactly BattleUnit::isOut() refined by WHICH of the two
+// out-states it is (dead vs merely stunned is a real difference - a stunned unit
+// can wake up and shoot), and it is the term the PRD-P9 soak asserts.
+int unitLiveness(const BattleUnit* unit)
+{
+	switch (unit->getStatus())
+	{
+	case STATUS_DEAD:        return 1;
+	case STATUS_UNCONSCIOUS: return 2;
+	case STATUS_IGNORE_ME:   return 3;  // isOut() counts this too (isIgnored())
+	default:                 return 0;  // on its feet, however it is animating
+	}
 }
 
-bool requestResync(Game* game, const std::string& why, bool force)
+bool battleChecksumTerms(Game* game, int64_t& itemIdCounter, int64_t& census,
+						 int64_t& units)
 {
-	if (!game || !game->getCoopMod() || !game->getCoopMod()->isSharedReplica()) return false;
-	if (!force && g_resyncPending) return false;
-
-	g_resyncPending = true;
-	g_lastResyncGameMin = gameMinutes(game->getSavedGame());
-	++g_resyncReqN;
-	Log(LOG_WARNING) << "[SHARED] requesting a world resync from the host (" << why
-		<< (force ? ", forced)" : ")");
+	itemIdCounter = -1;
+	census = -1;
+	units = -1;
+	if (!game || !game->getSavedGame()) return false;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return false;
 
-	Json::Value req;
-	req["state"] = "shared_resync_request";
-	game->getCoopMod()->sendTCPPacketData(req.toStyledString());
+	itemIdCounter = battle->getCurrentItemIdValue();
+	uint64_t sum = 0;
+	for (BattleItem* item : *battle->getItems())
+	{
+		if (!item) continue;
+		uint64_t h = fnv1a(item->getRules() ? item->getRules()->getType() : std::string("?"));
+		h = (h ^ (uint64_t)(int64_t)item->getId()) * 1099511628211ULL;
+		h = (h ^ (uint64_t)(int64_t)(item->getOwner() ? item->getOwner()->getId() : -1)) * 1099511628211ULL;
+		// SUM, not a rolling hash: _items order is not replicated, so the term must
+		// not depend on it. Identity (id + type + owner) is what has to agree.
+		sum += h;
+	}
+	// Fold into the non-negative range: a negative wire value is the "the peer did
+	// not stamp this" sentinel and must never be producible by a real battle.
+	census = (int64_t)(sum & 0x3FFFFFFFFFFFFFFFULL);
+
+	// The unit term. FIELDS: id, faction, liveness (see unitLiveness) and position.
+	//
+	// DELIBERATELY EXCLUDED, every one of them because it is known to differ
+	// LEGITIMATELY at the instant this is compared:
+	//   * TU / energy of a NON-player unit. An alien's remaining TU is spent by AI
+	//     that runs on the executor alone and reaction fire leaves it a point or
+	//     two apart here - a pre-existing classic co-op accounting seam the soak
+	//     reports rather than asserts (test_parallel_soak.tu_report).
+	//   * TU / energy at all. Only the walk packet and the two cost packets carry
+	//     energy, and BOTH machines regenerate TU in their own prepareNewTurn -
+	//     which straddles this very stamp.
+	//   * health / stun / fatal wounds / morale / mana. Same reason: prepareNewTurn
+	//     bleeds fatal wounds and recovers stun independently on each machine, so
+	//     whether the stamp was taken before or after that pass is a coin flip.
+	//   * the raw animation status and the facing (see unitLiveness).
+	// What is left is the intersection with the set the PRD-P9 soak ASSERTS after
+	// every side - id, position, isOut - which many clean soaks have shown to be
+	// drift-free at a side boundary, plus faction (mind control replicates through
+	// `psi_result` immediately in PVE, and PVP's deferred flip is not a mode this
+	// term is compared in) and the dead/unconscious split isOut() collapses.
+	uint64_t usum = 0;
+	for (BattleUnit* unit : *battle->getUnits())
+	{
+		if (!unit) continue;
+		const Position p = unit->getPosition();
+		uint64_t h = 1469598103934665603ULL;
+		h = (h ^ (uint64_t)(int64_t)unit->getId()) * 1099511628211ULL;
+		h = (h ^ (uint64_t)(int64_t)(int)unit->getFaction()) * 1099511628211ULL;
+		h = (h ^ (uint64_t)(int64_t)unitLiveness(unit)) * 1099511628211ULL;
+		h = (h ^ (uint64_t)(int64_t)p.x) * 1099511628211ULL;
+		h = (h ^ (uint64_t)(int64_t)p.y) * 1099511628211ULL;
+		h = (h ^ (uint64_t)(int64_t)p.z) * 1099511628211ULL;
+		// SUM again, for the same reason as the item census: _units order is not
+		// something the protocol replicates.
+		usum += h;
+	}
+	units = (int64_t)(usum & 0x3FFFFFFFFFFFFFFFULL);
 	return true;
 }
 
-void notifyWorldAdopted()
+// coop (option 3): boundary persistence helpers - DEFINED just before syncCheckCompare
+// (their bodies touch g_syncBoundaryPending, declared further down), FORWARD-declared here
+// so verifyBattleChecksum (2c) can route through the same store.
+static bool coopWireOn();
+static bool coopBoundaryPersistShouldAlarm(const char* bucket, const std::string& kind, std::uint32_t bseq);
+static void coopBoundaryPersistHeal(const char* bucket, const std::string& kind, std::uint32_t bseq);
+
+void attachBattleChecksum(Game* game, Json::Value& msg)
+{
+	// coop (#151): PvP (gamemodes 2/3) runs a ROLE-AWARE sim where the two machines
+	// diverge BY DESIGN - PvP is outside all parallel + I0 sync machinery, so the
+	// battle drift tripwire must not stamp the battle terms there. An unstamped peer
+	// reads back as the -1 "agree" sentinel in verifyBattleChecksum, so a mixed
+	// old/new-version session stays compatible. The SHARED-economy world checksum
+	// (chkFunds/chkBases/... in attachWorldChecksum) is a DIFFERENT mechanism that
+	// PvP campaigns still use, and is left unconditional.
+	if (connectionTCP::getCoopGamemode() == 2 || connectionTCP::getCoopGamemode() == 3) return;
+	int64_t itemIdCounter, census, units;
+	if (!battleChecksumTerms(game, itemIdCounter, census, units)) return; // no battle
+	msg["chkBattleItemId"] = Json::Value::Int64(itemIdCounter);
+	msg["chkBattleCensus"] = Json::Value::Int64(census);
+	msg["chkBattleUnits"] = Json::Value::Int64(units);
+}
+
+void verifyBattleChecksum(Game* game, const Json::Value& msg, const std::string& context)
+{
+	// coop (#151): symmetric with attachBattleChecksum - PvP (gamemodes 2/3) diverges
+	// by design, so this machine must never compare the battle terms or fire the
+	// desync capture in PvP. Belt-and-braces on the receive side: even a mixed-version
+	// peer that still stamped chkBattle* must not trip the tripwire here. (The I0
+	// per-action sync-check is already inert in PvP via parallelTurnActive() == gm 1/4.)
+	if (connectionTCP::getCoopGamemode() == 2 || connectionTCP::getCoopGamemode() == 3) return;
+	const int64_t peerItemId = msg.get("chkBattleItemId", -1).asInt64();
+	const int64_t peerCensus = msg.get("chkBattleCensus", -1).asInt64();
+	// Additive: a peer that predates the unit term stamps nothing here, which reads
+	// back as the same -1 "agree" sentinel the other two use.
+	const int64_t peerUnits = msg.get("chkBattleUnits", -1).asInt64();
+	if (peerItemId < 0 && peerCensus < 0 && peerUnits < 0) return; // old peer / no battle
+
+	int64_t myItemId, myCensus, myUnits;
+	if (!battleChecksumTerms(game, myItemId, myCensus, myUnits)) return; // no battle here
+
+	// coop (PRD-P10): not comparable mid-death. A death replay that is still
+	// QUEUED here has not minted its corpse yet, so both terms are legitimately
+	// one death behind the stamp - and `next_turn` lands in that window whenever
+	// the alien side's last casualty dies a frame or two before the side closes.
+	// Skipping is right rather than merely quiet: the next stamp compares the
+	// same two machines once this one has caught up.
+	if (corpseReplayPendingAny())
+	{
+		Log(LOG_INFO) << "[COOP] battle checksum on " << context
+					  << " skipped - a death replay here has not converted yet";
+		return;
+	}
+
+	// coop: the unit term is a QUIESCENT-state invariant - where every unit is and
+	// whether it is down. `next_turn` carries no subject, so the in-order receive
+	// pump lets it overtake a per-unit chain it could not consume in the same pass
+	// (PRD-P11's design, and correct: the snapshot is a repair). While it has, this
+	// machine is one walk or one death behind the peer THROUGH THE PROTOCOL WORKING
+	// AS INTENDED - the deferred chain applies a tick later and lands on the same
+	// tile. Comparing there reports a divergence that never existed. Measured in a
+	// PRD-P9 soak: an alien three tiles and 12 TU apart at the stamp, identical
+	// again by the time the side settled.
+	//
+	// The ITEM terms keep comparing unconditionally: an item id minted on one
+	// machine only is not a state a late chain can heal.
+	const bool unitsComparable = !rxPassDeferred();
+	// coop (option 3, 2c lever-on): the ITEM terms also get the behind-at-boundary guard
+	// (a corpse mint / item removal still replaying here is a late chain that heals) - the
+	// same rxPassDeferred() guard `units` already uses. Lever-off keeps the item terms
+	// unconditional (byte-identical: itemsComparable == true).
+	const bool itemsComparable = coopWireOn() ? unitsComparable : true;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	const std::uint32_t turnKey = static_cast<std::uint32_t>(battle->getTurn());
+	const bool dItem   = peerItemId >= 0 && itemsComparable && peerItemId != myItemId;
+	const bool dCensus = peerCensus >= 0 && itemsComparable && peerCensus != myCensus;
+	const bool dUnits  = peerUnits  >= 0 && unitsComparable && peerUnits  != myUnits;
+	if (!dItem && !dCensus && !dUnits)
+	{
+		if (g_battleMismatchLogged)
+		{
+			Log(LOG_INFO) << "[COOP] battle checksum back in agreement with the peer";
+			g_battleMismatchLogged = false;
+		}
+		// coop (option 3, 2c): every comparable term agrees - heal any pending next_turn entries.
+		if (coopWireOn())
+		{
+			coopBoundaryPersistHeal("itemId", "next_turn", turnKey);
+			coopBoundaryPersistHeal("census", "next_turn", turnKey);
+			coopBoundaryPersistHeal("units",  "next_turn", turnKey);
+		}
+		return;
+	}
+
+	// coop (option 3, 2c lever-on): route the divergence through the SAME persistence store
+	// (kind="next_turn", monotonic key = the battle turn number - increments once per
+	// next_turn on both machines). Heal the terms that are clean; pend the ones that
+	// diverge; ALARM only when a diverged term is confirmed again at a LATER turn. The
+	// detection-only contract (report + let the players finish) is unchanged; lever-off
+	// keeps the immediate P2 alarm below (byte-identical).
+	if (coopWireOn())
+	{
+		if (!dItem)   coopBoundaryPersistHeal("itemId", "next_turn", turnKey);
+		if (!dCensus) coopBoundaryPersistHeal("census", "next_turn", turnKey);
+		if (!dUnits)  coopBoundaryPersistHeal("units",  "next_turn", turnKey);
+		bool persist = false;
+		if (dItem   && coopBoundaryPersistShouldAlarm("itemId", "next_turn", turnKey)) persist = true;
+		if (dCensus && coopBoundaryPersistShouldAlarm("census", "next_turn", turnKey)) persist = true;
+		if (dUnits  && coopBoundaryPersistShouldAlarm("units",  "next_turn", turnKey)) persist = true;
+		if (!persist)
+		{
+			Log(LOG_INFO) << "[COOP] BATTLE DESYNC on " << context << " term(s) "
+				<< (dItem ? "itemId " : "") << (dCensus ? "census " : "") << (dUnits ? "units " : "")
+				<< "[pending-1st-boundary turn=" << turnKey << "] - awaiting confirmation next turn";
+			return; // pending, NOT alarmed
+		}
+	}
+
+	// DETECTION ONLY. Whatever diverged, the battle cannot be repaired in place:
+	// sharedResyncStream replaces this machine's entire state stack, which mid-battle
+	// means destroying the running battle. Report and let the players finish.
+	g_battleDesyncSeen = true;
+	if (!g_battleMismatchLogged)
+	{
+		g_battleMismatchLogged = true;
+		BattlescapeGame* bg = battle->getBattleGame();
+		const BattleUnit* sel = battle->getSelectedUnit();
+		// WHICH TERM diverged is the first question a reader has - the three watch
+		// different things (item identity, item-id minting, unit position/liveness)
+		// and point at completely different families of bug.
+		std::string which;
+		if (dItem) which += "itemId ";
+		if (dCensus) which += "census ";
+		if (dUnits) which += "units ";
+		// "Last action context" is what exists pre-PRD-P6: the packet that carried
+		// the stamp, the turn, and this machine's live action/selection. P6's
+		// action_seq replaces the last two once intents are numbered.
+		Log(LOG_ERROR) << "[COOP] BATTLE DESYNC on " << context
+			<< ": term(s) " << which
+			<< "- itemId peer=" << peerItemId << " local=" << myItemId
+			<< ", census peer=" << peerCensus << " local=" << myCensus
+			<< ", units peer=" << peerUnits << " local=" << myUnits
+			<< ", turn=" << battle->getTurn()
+			<< ", side=" << (int)battle->getSide()
+			<< ", items=" << (int)battle->getItems()->size()
+			<< ", localAction=" << (bg ? (int)bg->getCurrentAction()->type : -1)
+			<< ", selected=" << (sel ? sel->getId() : -1);
+
+		// A sum says THAT the unit sets differ, never WHICH unit - and unlike the
+		// item census there is no `battle_items` equivalent a player can be asked
+		// to run. So the unit term dumps its own inputs, once, bounded by the unit
+		// count (a battle has tens): diffing the two machines' log lines then names
+		// the unit in one step. Same fields the term hashes, in the same order.
+		if (dUnits)
+		{
+			std::ostringstream dump;
+			for (BattleUnit* u : *battle->getUnits())
+			{
+				if (!u) continue;
+				const Position p = u->getPosition();
+				dump << " " << u->getId() << ":f" << (int)u->getFaction()
+					 << "/l" << unitLiveness(u) << "/s" << (int)u->getStatus()
+					 << "@" << p.x << "," << p.y << "," << p.z;
+			}
+			Log(LOG_ERROR) << "[COOP] BATTLE DESYNC units here (id:faction/liveness/"
+						   << "rawstatus@x,y,z):" << dump.str();
+		}
+	}
+
+	// Auto-report. AFTER the log line above on purpose - the bundle copies the log
+	// file, and that line is the entry point a developer reads first. Latched
+	// internally to one bundle per battle, so the repeat compares that follow for
+	// the rest of the battle cost nothing.
+	{
+		DesyncTerms report;
+		report.peerItemId = peerItemId;
+		report.localItemId = myItemId;
+		report.peerCensus = peerCensus;
+		report.localCensus = myCensus;
+		report.peerUnits = peerUnits;
+		report.localUnits = myUnits;
+		report.context = context;
+		captureDesyncReport(game, report);
+	}
+
+	// One player-facing notify per debounce window - the same constant the world
+	// checksum debounces on - so a term that stays wrong for the rest of the battle
+	// does not spam the map.
+	const int64_t nowMs = steadyMs();
+	if (g_lastBattleNotifyMs >= 0 && nowMs - g_lastBattleNotifyMs < RESYNC_DEBOUNCE_MS) return;
+	g_lastBattleNotifyMs = nowMs;
+	if (BattlescapeState* bs = battle->getBattleState())
+	{
+		// The in-battle warning banner, NOT a modal: pushing a CoopState over a live
+		// battle is the dialog/dismiss trap, and the tripwire must never disturb the
+		// state stack it is diagnosing. warningLongRaw() self-suppresses while the
+		// peer is acting (isYourTurn == 1); the log line above is unconditional.
+		bs->warningLongRaw("CO-OP DESYNC DETECTED - SEE openxcom.log");
+	}
+}
+
+bool battleDesyncSeen()
 {
-	// A fresh authoritative world just landed: the repair took, so re-arm both the
-	// in-flight guard and the "give up" latch. The cooldown stamp stays, so a
-	// mismatch that reappears within the window is still treated as unrepairable.
-	g_resyncPending = false;
-	g_resyncGaveUp = false;
+	return g_battleDesyncSeen;
 }
 
-void verifyWorldChecksum(Game* game, const Json::Value& msg)
+void resetBattleDesyncSeen()
 {
-	if (!game || !game->getSavedGame()) return;
-	if (!msg.isMember("chkFunds")) return; // older/non-SHARED host
-	SavedGame* save = game->getSavedGame();
-	int64_t hostFunds = msg["chkFunds"].asInt64();
-	int hostBases = msg.get("chkBases", -1).asInt();
-	int hostResearch = msg.get("chkResearch", -1).asInt();
-	// GAP-4 fields. -1 default => a host that predates this change did not stamp
-	// them; since every real aggregate is >= 0, a negative host value can ONLY
-	// mean "not sent" and must read as agreement, never a cross-version false
-	// positive. Absent-or-equal, folded into the condition below.
-	int64_t hostItems = msg.get("chkItems", -1).asInt64();
-	int64_t hostSoldiers = msg.get("chkSoldiers", -1).asInt64();
-	int64_t hostTransfers = msg.get("chkTransfers", -1).asInt64();
-	int64_t hostProductions = msg.get("chkProduction", -1).asInt64();
-	int hostSites = msg.get("chkSites", -1).asInt(); // issue #78; -1 = old host
-	int64_t myFunds = save->getFunds();
-	int myBases = (int)save->getBases()->size();
-	int myResearch = (int)save->getDiscoveredResearch().size();
-	int mySites = (int)save->getMissionSites()->size();
-	int64_t myItems, mySoldiers, myTransfers, myProductions;
-	worldAggregates(save, myItems, mySoldiers, myTransfers, myProductions);
-	if (hostFunds == myFunds && hostBases == myBases && hostResearch == myResearch
-		&& (hostItems < 0 || hostItems == myItems)
-		&& (hostSoldiers < 0 || hostSoldiers == mySoldiers)
-		&& (hostTransfers < 0 || hostTransfers == myTransfers)
-		&& (hostProductions < 0 || hostProductions == myProductions)
-		&& (hostSites < 0 || hostSites == mySites))
+	g_battleDesyncSeen = false;
+	g_battleMismatchLogged = false;
+	g_lastBattleNotifyMs = -1;
+	// The bundle latch lives here: one report per battle per machine, cleared by
+	// the same reset (resetResyncStats / the harness' shared_reset_resync_stats)
+	// that clears the tripwire itself.
+	g_desyncReportWritten = false;
+	g_desyncReportPath.clear();
+	// coop (Class-A soak wedge fix, A3): the peer-liveness clock is battle-scoped, so
+	// clear it on the same "reset the diagnostics" request. Thresholds are left as the
+	// test set them (restored explicitly via setPeerLivenessThresholds(0, -1)).
+	g_peerLivenessProgressMs = -1;
+	g_peerLivenessLastCompared = 0;
+	g_peerLivenessLatched = 0;
+}
+
+// ---- Desync auto-report bundle -----------------------------------------------
+namespace {
+
+// SAFETY / bounded work: the log is the only member that can grow without limit,
+// so only its TAIL travels. 4 MB is many times a whole battle's worth of co-op
+// tracing and keeps the one-shot compress step to a few hundred ms on the single
+// frame this ever runs.
+const size_t DESYNC_LOG_TAIL_BYTES = 4u * 1024u * 1024u;
+// Hand-wrap width for the path in the notice. The dialog's Text is 284 px of
+// small font and OpenXcom's word wrap only breaks at spaces - a filesystem path
+// has none, so an unwrapped one renders clipped and the player cannot find the
+// file we just asked them to send.
+const size_t DESYNC_PATH_WRAP = 44;
+
+/// "20260803-141530". CrossPlatform::now() is dd-MM-yyyy_HH-mm-ss, which does not
+/// sort; a folder of reports wants the sortable form.
+std::string desyncTimeString(const char* format)
+{
+	std::time_t t = std::time(0);
+	std::tm local;
+	std::memset(&local, 0, sizeof(local));
+	if (const std::tm* p = std::localtime(&t)) local = *p;
+	char buf[40];
+	std::memset(buf, 0, sizeof(buf));
+	if (std::strftime(buf, sizeof(buf), format, &local) == 0) return "unknown";
+	return buf;
+}
+
+const char* desyncPlatform()
+{
+#ifdef _WIN64
+	return "Windows 64 bit";
+#elif defined(_WIN32)
+	return "Windows 32 bit";
+#elif defined(__APPLE__)
+	return "OSX";
+#elif defined(__ANDROID_API__)
+	return "Android";
+#elif defined(__linux__)
+	return "Linux";
+#else
+	return "Unix-like";
+#endif
+}
+
+/// Raw byte read, tail-capped, never throwing. CrossPlatform::readFile is wrong
+/// here twice over: it opens in TEXT mode (which mangles a save's bytes on
+/// Windows) and it THROWS on a missing file - a missing member has to degrade to
+/// a smaller bundle, never to an exception raised inside a diagnostic.
+bool readTailBinary(const std::string& path, size_t maxBytes, std::string& out)
+{
+	out.clear();
+	SDL_RWops* rw = SDL_RWFromFile(path.c_str(), "rb");
+	if (!rw) return false;
+	bool ok = false;
+	const int end = SDL_RWseek(rw, 0, SEEK_END);
+	if (end >= 0)
 	{
-		// Back in agreement: whatever drifted is gone. Re-arm the repair so a later,
-		// unrelated drift gets its own auto-resync instead of the give-up popup.
-		if (g_mismatchLogged)
+		const size_t total = (size_t)end;
+		size_t from = 0, want = total;
+		if (maxBytes != 0 && total > maxBytes)
 		{
-			Log(LOG_INFO) << "[SHARED] world checksum back in agreement with the host";
-			g_mismatchLogged = false;
+			from = total - maxBytes;
+			want = maxBytes;
+		}
+		if (SDL_RWseek(rw, (int)from, SEEK_SET) >= 0)
+		{
+			if (want == 0)
+			{
+				ok = true;
+			}
+			else
+			{
+				out.assign(want, '\0');
+				ok = (SDL_RWread(rw, &out[0], 1, (int)want) == (int)want);
+			}
 		}
-		g_mismatchSinceMs = -1;
-		g_resyncGaveUp = false;
-		g_lastResyncGameMin = -1;
-		return;
 	}
+	SDL_RWclose(rw);
+	if (!ok) out.clear();
+	return ok;
+}
 
-	++g_mismatchN;
+/// One zip from in-memory members. Heap writer only - see the include note at the
+/// top of this file for why the file-based writer APIs are off limits.
+bool writeZipArchive(const std::string& path,
+					 const std::vector<std::pair<std::string, std::string> >& members)
+{
+	if (members.empty()) return false;
+	mz_zip_archive zip;
+	std::memset(&zip, 0, sizeof(zip));
+	if (!mz_zip_writer_init_heap(&zip, 0, 256 * 1024)) return false;
 
-	// DEBOUNCE. A single mismatching heartbeat does NOT mean the world diverged:
-	// the checksum and the shared_apply that moves it are separate packets, so any
-	// in-flight mutation shows up here as a brief skew that closes by itself a
-	// frame or two later. Only a mismatch that SURVIVES is worth a multi-megabyte
-	// world restream (which also replaces the replica's whole state stack). At the
-	// heartbeat's ~2 kHz this still detects a real desync in a couple of seconds.
-	const int64_t nowMs = steadyMs();
-	if (g_mismatchSinceMs < 0) g_mismatchSinceMs = nowMs;
-	if (nowMs - g_mismatchSinceMs < RESYNC_DEBOUNCE_MS) return;
+	bool ok = true;
+	for (size_t i = 0; ok && i < members.size(); ++i)
+	{
+		ok = (mz_zip_writer_add_mem(&zip, members[i].first.c_str(),
+									members[i].second.data(), members[i].second.size(),
+									MZ_DEFAULT_COMPRESSION) != MZ_FALSE);
+	}
 
-	if (!g_mismatchLogged)
+	void* buf = 0;
+	size_t size = 0;
+	if (ok) ok = (mz_zip_writer_finalize_heap_archive(&zip, &buf, &size) != MZ_FALSE);
+	if (ok && buf != 0 && size != 0)
 	{
-		// once per episode - see g_mismatchLogged
-		g_mismatchLogged = true;
-		Log(LOG_WARNING) << "[SHARED] world checksum mismatch (persisted "
-			<< RESYNC_DEBOUNCE_MS << "ms): "
-			<< "funds host=" << hostFunds << " replica=" << myFunds
-			<< ", bases host=" << hostBases << " replica=" << myBases
-			<< ", research host=" << hostResearch << " replica=" << myResearch
-			<< ", items host=" << hostItems << " replica=" << myItems
-			<< ", soldiers host=" << hostSoldiers << " replica=" << mySoldiers
-			<< ", transfers host=" << hostTransfers << " replica=" << myTransfers
-			<< ", production host=" << hostProductions << " replica=" << myProductions
-			<< ", sites host=" << hostSites << " replica=" << mySites;
+		// The vector<unsigned char> overload, NOT the std::string one: that opens
+		// the file in TEXT mode, which on Windows rewrites every 0x0A in the
+		// deflate stream and produces a zip nothing can open.
+		const unsigned char* first = (const unsigned char*)buf;
+		std::vector<unsigned char> bytes(first, first + size);
+		ok = CrossPlatform::writeFile(path, bytes);
+	}
+	// finalize_heap_archive HANDS OVER the block (it nulls m_pMem), so it survives
+	// writer_end and this function owns the free.
+	if (buf) mz_free(buf);
+	mz_zip_writer_end(&zip);
+	return ok;
+}
+
+/// The sim-state dump. Goes through the ordinary save path - SavedGame::save, the
+/// same one co-op's autosave, quicksave and deferred host save use - which
+/// resolves its filename inside the master user folder. So: write a temp, read
+/// the bytes back, delete the temp. `.tmp` rather than `.sav`/`.asav` on purpose,
+/// because the LOAD list scans only those two: a delete that somehow fails still
+/// cannot leave a phantom entry in the player's save list.
+bool captureForcedSave(Game* game, std::string& out)
+{
+	out.clear();
+	if (!game || !game->getSavedGame() || !game->getMod()) return false;
+	const std::string tmpName = "_desync_capture_.tmp";
+	const std::string tmpPath = Options::getMasterUserFolder() + tmpName;
+	bool ok = false;
+	try
+	{
+		game->getSavedGame()->save(tmpName, game->getMod());
+		ok = readTailBinary(tmpPath, 0, out);
+	}
+	catch (const std::exception& e)
+	{
+		Log(LOG_ERROR) << "[COOP] desync report: forced save failed: " << e.what();
+	}
+	catch (...)
+	{
+		Log(LOG_ERROR) << "[COOP] desync report: forced save failed";
+	}
+	if (CrossPlatform::fileExists(tmpPath)) CrossPlatform::deleteFile(tmpPath);
+	if (!ok) out.clear();
+	return ok;
+}
+
+/// The context a log line cannot carry: both machines' checksum terms, the battle
+/// and parallel-turn counters, who this seat is, what build and which mods.
+std::string buildDesyncInfo(Game* game, const DesyncTerms& terms,
+							const Json::Value& attribution)
+{
+	Json::Value root;
+	root["schema"] = 1;
+	root["generated"] = desyncTimeString("%Y-%m-%d %H:%M:%S");
+	root["context"] = terms.context.empty() ? std::string("unknown") : terms.context;
+	root["detected"] = terms.viaPeerReport ? "peer_report" : "local_compare";
+
+	Json::Value chk;
+	chk["peer_itemId"] = Json::Value::Int64(terms.peerItemId);
+	chk["local_itemId"] = Json::Value::Int64(terms.localItemId);
+	chk["peer_census"] = Json::Value::Int64(terms.peerCensus);
+	chk["local_census"] = Json::Value::Int64(terms.localCensus);
+	chk["peer_units"] = Json::Value::Int64(terms.peerUnits);
+	chk["local_units"] = Json::Value::Int64(terms.localUnits);
+	root["checksum"] = chk;
+
+	SavedGame* save = game ? game->getSavedGame() : 0;
+	SavedBattleGame* battle = save ? save->getSavedBattle() : 0;
+	Json::Value b;
+	b["live"] = (battle != 0);
+	if (battle)
+	{
+		b["turn"] = battle->getTurn();
+		b["side"] = (int)battle->getSide();
+		b["items"] = (int)battle->getItems()->size();
+		b["units"] = (int)battle->getUnits()->size();
+		const BattleUnit* sel = battle->getSelectedUnit();
+		b["selected_unit"] = sel ? sel->getId() : -1;
+		BattlescapeGame* bg = battle->getBattleGame();
+		b["local_action"] = bg ? (int)bg->getCurrentAction()->type : -1;
+		b["busy"] = bg ? bg->isBusy() : false;
 	}
+	b["coop_turn"] = BattlescapeGame::isYourTurn;
+	root["battle"] = b;
 
-	const int64_t now = gameMinutes(save);
-	const bool cooling = (g_lastResyncGameMin >= 0 && now >= 0
-		&& now - g_lastResyncGameMin < RESYNC_COOLDOWN_MINUTES);
+	Json::Value p;
+	p["parallel_active"] = connectionTCP::parallelTurnActive();
+	p["parallel_enabled"] = connectionTCP::_enable_parallel_turns;
+	p["action_seq"] = (Json::UInt)connectionTCP::_actionSeq;
+	p["side_seq"] = (Json::UInt)connectionTCP::_sideSeq;
+	p["peer_display_acked_seq"] = (Json::UInt)connectionTCP::peerDisplayAckedSeq;
+	p["client_pending_req_id"] = (Json::UInt)connectionTCP::_clientPendingReqId;
+	p["active_sync"] = connectionTCP::_isActivePlayerSync;
+	p["battle_init"] = connectionTCP::_battleInit;
+	if (connectionTCP* coop = game ? game->getCoopMod() : 0)
+	{
+		p["task_depth"] = coop->coopTaskDepth();
+		p["task_completed"] = coop->coopTaskCompleted();
+		p["path_lock"] = coop->_pathLock;
+		p["coop_end"] = coop->_coopEnd;
+	}
+	root["parallel_state"] = p;
+
+	Json::Value s;
+	s["gamemode"] = connectionTCP::getCoopGamemode();
+	s["seat"] = connectionTCP::localSeat();
+	s["host"] = connectionTCP::getHost();
+	s["connected"] = connectionTCP::getCoopStatic();
+	s["shared_campaign"] = connectionTCP::isSharedCampaignStatic();
+	s["save_id"] = Json::Value::Int64((int64_t)connectionTCP::saveID);
+	if (connectionTCP* coop = game ? game->getCoopMod() : 0)
+	{
+		// Machine-relative, not role-relative: getHostName() is THIS player,
+		// getCurrentClientName() is the peer (see the co-op name-getter note).
+		s["local_player"] = coop->getHostName();
+		s["peer_player"] = coop->getCurrentClientName();
+	}
+	root["session"] = s;
+
+	Json::Value v;
+	v["version"] = std::string(OPENXCOM_VERSION_SHORT) + OPENXCOM_VERSION_GIT;
+	v["engine"] = OPENXCOM_VERSION_ENGINE;
+	v["oxce"] = OPENXCOM_VERSION_OXCE;
+	v["save_schema"] = (int)SAVE_SCHEMA_CURRENT;
+	v["platform"] = desyncPlatform();
+	root["build"] = v;
+
+	// No crash-log modlist helper exists in this tree; this is the same
+	// "<id> ver: <version>" line SavedGame::save writes into every save header.
+	Json::Value mods(Json::arrayValue);
+	for (const ModInfo* mi : Options::getActiveMods())
+	{
+		if (mi) mods.append(mi->getId() + " ver: " + mi->getVersion());
+	}
+	root["mods"] = mods;
 
-	if (g_resyncPending)
+	// PRD-I4: the sync-check attribution - the offending seq/kind/bucket, the
+	// per-bucket table and a ring snapshot - so a bundle names WHICH action
+	// diverged, not just that the terms disagree.
+	root["attribution"] = attribution;
+	desyncEmbedSyncState(root);
+
+	return root.toStyledString();
+}
+
+/// Break a path onto dialog-sized lines, cutting after a directory separator
+/// where one is in reach and mid-token where none is.
+std::string wrapPathForDialog(const std::string& path)
+{
+	std::string out;
+	size_t start = 0;
+	while (path.size() - start > DESYNC_PATH_WRAP)
 	{
-		// A restream is already on the wire: every heartbeat until it lands still
-		// mismatches, and re-asking would queue a second serialization of the whole
-		// world on the host. Wait for it - but not forever: if the host dropped the
-		// request (its single-slot streamer was busy) the guard expires with the
-		// cooldown and the next mismatch re-asks.
-		if (cooling) return;
-		g_resyncPending = false;
+		size_t cut = path.find_last_of("/\\", start + DESYNC_PATH_WRAP - 1);
+		if (cut == std::string::npos || cut <= start) cut = start + DESYNC_PATH_WRAP - 1;
+		if (!out.empty()) out += '\n';
+		out.append(path, start, cut - start + 1);
+		start = cut + 1;
+	}
+	if (start < path.size())
+	{
+		if (!out.empty()) out += '\n';
+		out.append(path, start, path.size() - start);
 	}
+	return out.empty() ? path : out;
+}
 
-	if (cooling)
+/// Percent-encode a string for use as a URL query value (RFC 3986 unreserved raw).
+std::string desyncUrlEncode(const std::string& s)
+{
+	static const char* hex = "0123456789ABCDEF";
+	std::string out;
+	out.reserve(s.size() * 3);
+	for (unsigned char c : s)
 	{
-		// A resync DID land and we are diverging again inside the cooldown: the
-		// auto-repair does not stick, so something is drifting faster than a
-		// restream can heal it. Stop looping on multi-megabyte world streams and
-		// hand it to the player.
-		if (!g_resyncGaveUp)
+		if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+			(c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.' || c == '~')
+			out += (char)c;
+		else { out += '%'; out += hex[c >> 4]; out += hex[c & 0xF]; }
+	}
+	return out;
+}
+
+/// The prefilled GitHub issue body: the attribution table plus the "attach the
+/// zip" instruction. Plain text; the caller URL-encodes it. NO auto-upload.
+std::string desyncIssueBody(const DesyncTerms& terms, const Json::Value& attribution,
+							const std::string& path)
+{
+	std::ostringstream b;
+	b << "A co-op battle desync was auto-detected.\n\n";
+	b << "Attribution: " << attribution.get("headline", "unknown").asString() << "\n";
+	b << "  source: " << attribution.get("source", "?").asString()
+	  << "  seq: " << attribution.get("seq", 0).asUInt()
+	  << "  kind: " << attribution.get("kind", "").asString()
+	  << "  bucket: " << attribution.get("bucket", "").asString() << "\n\n";
+	b << "Checksum terms (peer vs local):\n";
+	b << "  itemIdCounter: " << terms.peerItemId << " vs " << terms.localItemId << "\n";
+	b << "  battleCensus:  " << terms.peerCensus << " vs " << terms.localCensus << "\n";
+	b << "  battleUnits:   " << terms.peerUnits << " vs " << terms.localUnits << "\n\n";
+	b << "Please ATTACH the diagnostic zip (do not paste it) to this issue:\n";
+	b << "  " << path << "\n\n";
+	b << "(auto-generated by the co-op desync reporter; log + save + context are in the zip)\n";
+	return b.str();
+}
+
+/// PRD-I5: the crash bundle's system-info json. Mirrors buildDesyncInfo's build +
+/// mods block (the I4 json builder the PRD asks us to reuse), plus the marker echo
+/// (crash timestamp, exception code, the version recorded AT crash time, and the
+/// dump/log the crash wrote). 'build.version' is the version NOW; 'crash.crash_version'
+/// is the version the crash was written under - normally identical, but distinct if
+/// the player updated between the crash and the next launch.
+std::string buildCrashInfo(Game* game, const std::string& source, const std::string& dump,
+						   const std::string& log, const std::string& version,
+						   const std::string& exception, const std::string& timestamp)
+{
+	(void)game;
+	Json::Value root;
+	root["schema"] = 1;
+	root["report"] = "crash";
+	root["source"] = source; // "crashdump-marker" (classic) or "veh-crashlog" (issue #124)
+	root["generated"] = desyncTimeString("%Y-%m-%d %H:%M:%S");
+
+	Json::Value c;
+	c["timestamp"] = timestamp;
+	c["exception"] = exception;
+	c["crash_version"] = version;
+	c["dump"] = dump;
+	c["log"] = log;
+	root["crash"] = c;
+
+	Json::Value v;
+	v["version"] = std::string(OPENXCOM_VERSION_SHORT) + OPENXCOM_VERSION_GIT;
+	v["engine"] = OPENXCOM_VERSION_ENGINE;
+	v["oxce"] = OPENXCOM_VERSION_OXCE;
+	v["platform"] = desyncPlatform();
+	root["build"] = v;
+
+	Json::Value mods(Json::arrayValue);
+	for (const ModInfo* mi : Options::getActiveMods())
+	{
+		if (mi) mods.append(mi->getId() + " ver: " + mi->getVersion());
+	}
+	root["mods"] = mods;
+	return root.toStyledString();
+}
+
+/// PRD-I5: parse + validate the crash marker. Read through readTailBinary (the
+/// UTF-8-safe SDL reader, not std::ifstream) so a user folder with non-ASCII in
+/// the path still opens on Windows. Never throws; a missing/corrupt marker returns
+/// false and the caller deletes it.
+bool parseCrashMarker(const std::string& markerPath, std::string& dump, std::string& log,
+					  std::string& version, std::string& exception, std::string& timestamp)
+{
+	std::string blob;
+	if (!readTailBinary(markerPath, 0, blob) || blob.empty()) return false;
+	std::istringstream ss(blob);
+	Json::CharReaderBuilder b;
+	Json::Value root;
+	std::string errs;
+	if (!Json::parseFromStream(b, ss, &root, &errs) || !root.isObject()) return false;
+	dump      = root.get("dump", "").asString();
+	log       = root.get("log", "").asString();
+	version   = root.get("version", "").asString();
+	exception = root.get("exception", "").asString();
+	timestamp = root.get("timestamp", "").asString();
+	return true;
+}
+
+// ---- PRD-I5 dual-source discovery: crashlogs scan + seen-ledger -------------
+// The crashed process ALREADY writes crash_<ts>_<seq>.{dmp,log} + mod list to
+// <exe>/crashlogs (issue #124 CrashHandler VEH - the robust catch-all that fires
+// even when the fault unwinds through a noexcept frame into std::terminate and so
+// NEVER reaches CrossPlatform::crashDump). The next launch therefore discovers a
+// crash from EITHER the crashDump marker (classic, rich) OR an unseen crashlogs
+// entry (the VEH path). A per-user-folder seen-ledger (crash-seen.json) dedups:
+// BUNDLE and NEVER mark seen, NOT NOW leaves it unseen. First-run rule (least-
+// surprising): the ledger stamps its creation time as a baseline and only entries
+// NEWER than it are ever offered, so pre-existing / pre-feature crashlogs never
+// retro-nag.
+
+std::string crashSeenLedgerPath() { return Options::getUserFolder() + "crash-seen.json"; }
+
+// Load the ledger; CREATE it (baseline = now, empty seen) if absent. Never throws.
+void loadOrCreateSeenLedger(time_t& baseline, std::set<std::string>& seen)
+{
+	baseline = 0; seen.clear();
+	std::string blob;
+	if (readTailBinary(crashSeenLedgerPath(), 0, blob) && !blob.empty())
+	{
+		std::istringstream ss(blob);
+		Json::CharReaderBuilder b; Json::Value root; std::string errs;
+		if (Json::parseFromStream(b, ss, &root, &errs) && root.isObject())
 		{
-			g_resyncGaveUp = true;
-			Log(LOG_ERROR) << "[SHARED] world desync persisted through an auto-resync"
-				<< " (within " << RESYNC_COOLDOWN_MINUTES << " game minutes);"
-				<< " automatic repair disabled - advise the host to save and reload";
-			showFail(game, "Desync repair failed. Ask the host to save and reload the campaign.");
+			baseline = (time_t)root.get("baseline", 0).asInt64();
+			const Json::Value& arr = root["seen"];
+			if (arr.isArray())
+				for (const auto& v : arr) seen.insert(v.asString());
+			return;
 		}
-		return;
 	}
+	baseline = time(nullptr); // fresh: pre-existing crashlogs (older) are never offered
+	Json::Value root;
+	root["baseline"] = Json::Value::Int64((int64_t)baseline);
+	root["seen"] = Json::Value(Json::arrayValue);
+	CrossPlatform::writeFile(crashSeenLedgerPath(), root.toStyledString());
+}
 
-	requestResync(game, "world checksum mismatch");
+void crashlogAddSeen(const std::string& dmpBasename)
+{
+	if (dmpBasename.empty()) return;
+	time_t baseline; std::set<std::string> seen;
+	loadOrCreateSeenLedger(baseline, seen);
+	seen.insert(dmpBasename);
+	Json::Value root;
+	root["baseline"] = Json::Value::Int64((int64_t)baseline);
+	Json::Value arr(Json::arrayValue);
+	for (const auto& s : seen) arr.append(s);
+	root["seen"] = arr;
+	CrossPlatform::writeFile(crashSeenLedgerPath(), root.toStyledString());
 }
 
-ResyncStats resyncStats()
+std::string crashBasename(const std::string& path)
 {
-	ResyncStats s;
-	s.mismatches = g_mismatchN.load();
-	s.requests = g_resyncReqN.load();
-	s.pending = g_resyncPending;
-	s.gaveUp = g_resyncGaveUp;
-	s.lastGameMin = g_lastResyncGameMin;
-	return s;
+	size_t s = path.find_last_of("/\\");
+	return (s == std::string::npos) ? path : path.substr(s + 1);
 }
 
-void resetResyncStats()
+// The shared seq token = the last '_'-delimited field before the extension (the
+// .dmp and its .log share it; they differ only in the ms part of the timestamp).
+std::string crashlogSeq(const std::string& name)
 {
-	g_mismatchN = 0;
-	g_resyncReqN = 0;
-	g_resyncPending = false;
-	g_resyncGaveUp = false;
-	g_mismatchLogged = false;
-	g_mismatchSinceMs = -1;
-	g_lastResyncGameMin = -1;
+	size_t dot = name.find_last_of('.');
+	std::string stem = (dot == std::string::npos) ? name : name.substr(0, dot);
+	size_t us = stem.find_last_of('_');
+	return (us == std::string::npos) ? std::string() : stem.substr(us + 1);
+}
+
+// crash_YYYYMMDD_HHMMSS_mmm_seq.ext -> "YYYYMMDD_HHMMSS" (zip name / info ts).
+std::string crashlogTsToken(const std::string& name)
+{
+	static const std::string pre = "crash_";
+	if (name.compare(0, pre.size(), pre) != 0 || name.size() < pre.size() + 15) return std::string();
+	return name.substr(pre.size(), 15);
+}
+
+// Newest crash_*.dmp basename by mtime (or empty) - used to dedup the marker's pair.
+std::string crashlogNewestDmp()
+{
+	const std::string dir = ::CrashHandler::logDirectory();
+	if (dir.empty()) return std::string();
+	std::string best; time_t bestT = 0;
+	for (const auto& e : CrossPlatform::getFolderContents(dir, "dmp"))
+	{
+		if (std::get<1>(e)) continue;
+		const std::string& nm = std::get<0>(e);
+		if (nm.compare(0, 6, "crash_") != 0) continue;
+		time_t tm = std::get<2>(e);
+		if (best.empty() || tm > bestT) { best = nm; bestT = tm; }
+	}
+	return best;
+}
+
+// Newest crash_*.dmp with mtime > baseline and basename NOT in seen; pair its .log
+// by matching seq + nearest mtime. Fills paths + ts token. Never throws here.
+bool findNewestUnseenCrashlog(std::string& dmpPath, std::string& logPath, std::string& tsToken)
+{
+	dmpPath.clear(); logPath.clear(); tsToken.clear();
+	const std::string dir = ::CrashHandler::logDirectory();
+	if (dir.empty()) return false;
+	time_t baseline; std::set<std::string> seen;
+	loadOrCreateSeenLedger(baseline, seen);
+	std::string bestName; time_t bestT = 0;
+	for (const auto& e : CrossPlatform::getFolderContents(dir, "dmp"))
+	{
+		if (std::get<1>(e)) continue;
+		const std::string& nm = std::get<0>(e);
+		if (nm.compare(0, 6, "crash_") != 0) continue;
+		time_t tm = std::get<2>(e);
+		if (tm <= baseline) continue;   // first-run / pre-feature guard
+		if (seen.count(nm)) continue;   // already handled
+		if (bestName.empty() || tm > bestT) { bestName = nm; bestT = tm; }
+	}
+	if (bestName.empty()) return false;
+	dmpPath = dir + "/" + bestName;
+	tsToken = crashlogTsToken(bestName);
+	const std::string seqWanted = crashlogSeq(bestName);
+	std::string bestLog; time_t bestDiff = 0; bool haveLog = false;
+	for (const auto& e : CrossPlatform::getFolderContents(dir, "log"))
+	{
+		if (std::get<1>(e)) continue;
+		const std::string& nm = std::get<0>(e);
+		if (nm.compare(0, 6, "crash_") != 0) continue;
+		if (crashlogSeq(nm) != seqWanted) continue;
+		time_t tm = std::get<2>(e);
+		time_t diff = (tm > bestT) ? (tm - bestT) : (bestT - tm);
+		if (!haveLog || diff < bestDiff) { bestLog = nm; bestDiff = diff; haveLog = true; }
+	}
+	if (haveLog) logPath = dir + "/" + bestLog;
+	return true;
+}
+
+// Shared tail of both bundle paths: write the zip + raise the I4 result notice.
+bool emitCrashBundle(Game* game, const std::vector<std::pair<std::string, std::string> >& members,
+					 const std::string& tsFile, const std::string& exception,
+					 const std::string& version, const std::string& timestamp)
+{
+	const std::string dir = Options::getUserFolder() + "crash-reports/";
+	if (!CrossPlatform::folderExists(dir)) CrossPlatform::createFolder(dir);
+	if (!CrossPlatform::folderExists(dir))
+	{
+		Log(LOG_ERROR) << "[COOP] crash report: cannot create " << dir;
+		return false;
+	}
+	const std::string tsF = tsFile.empty() ? desyncTimeString("%Y%m%d-%H%M%S") : tsFile;
+	const std::string path = dir + "crash-" + tsF + ".zip";
+	if (!writeZipArchive(path, members))
+	{
+		Log(LOG_ERROR) << "[COOP] crash report: failed to write " << path;
+		return false;
+	}
+	Log(LOG_INFO) << "[COOP] crash report written to " << path
+				  << " (" << (int)members.size() << " members)";
+	if (game && game->getLanguage())
+	{
+		const std::string issueBase =
+			"https://github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues/new";
+		const std::string title = "[coop crash] " + exception + " " + version;
+		std::ostringstream body;
+		body << "OpenXcom crashed and the next launch bundled the details.\n\n";
+		body << "  version:   " << version << "\n";
+		body << "  exception: " << exception << "\n";
+		body << "  timestamp: " << timestamp << "\n\n";
+		body << "Please ATTACH the crash zip (do not paste it) to this issue:\n";
+		body << "  " << path << "\n\n";
+		body << "(auto-generated by the co-op crash reporter; dump, log + system info are in the zip)\n";
+		const std::string reportUrl = issueBase + "?title=" + desyncUrlEncode(title) +
+			"&body=" + desyncUrlEncode(body.str());
+		game->pushState(new CoopDesyncNoticeState(
+			game->getLanguage()->getString("STR_COOP_CRASH_REPORT_SAVED").arg(wrapPathForDialog(path)),
+			game->getLanguage()->getString("STR_COOP_CRASH_REPORT_HEADLINE"),
+			path, reportUrl));
+	}
+	return true;
+}
+
+} // namespace
+
+bool desyncReportWritten()
+{
+	return g_desyncReportWritten;
+}
+
+std::string desyncReportPath()
+{
+	return g_desyncReportPath;
+}
+
+void captureDesyncReport(Game* game, const DesyncTerms& terms)
+{
+	// LATCH FIRST, before anything that can fail. A full disk, a read-only user
+	// folder, a save that throws - none of them may put this back in the firing
+	// line, because the tripwire re-compares on every next_turn for the rest of
+	// the battle and a retry loop writing multi-megabyte bundles is far worse
+	// than the desync it is reporting.
+	if (g_desyncReportWritten) return;
+	g_desyncReportWritten = true;
+
+	// PRD-I4: attribution (offending bucket/seq/kind, or the diverged terms) drives
+	// the desync_report packet, the desync-info.json, the dialog headline and the
+	// prefilled GitHub issue. Computed once, before any (fallible) capture work.
+	const Json::Value attribution = desyncComputeAttribution(game, terms);
+	const std::string headline = attribution.get("headline", "").asString();
+
+	try
+	{
+		// Tell the peer BEFORE doing our own (slow) work: its half of the pair is
+		// only worth having if it is captured at nearly the same instant. A
+		// machine that was itself told never re-sends - that is the ping-pong.
+		if (!terms.viaPeerReport && game && game->getCoopMod() && connectionTCP::getCoopStatic())
+		{
+			SavedGame* sg = game->getSavedGame();
+			SavedBattleGame* battle = sg ? sg->getSavedBattle() : 0;
+			Json::Value root;
+			root["state"] = "desync_report";
+			root["turn"] = battle ? battle->getTurn() : 0;
+			root["side"] = battle ? (int)battle->getSide() : -1;
+			// Named from the RECEIVER's point of view: what it will record as its
+			// peer's terms is what this machine holds locally.
+			root["peer_itemId"] = Json::Value::Int64(terms.localItemId);
+			root["peer_census"] = Json::Value::Int64(terms.localCensus);
+			root["peer_units"] = Json::Value::Int64(terms.localUnits);
+			root["context"] = terms.context;
+			root["attribution"] = attribution;
+			game->getCoopMod()->sendTCPPacketData(root.toStyledString());
+		}
+
+		const std::string dir = Options::getUserFolder() + "desync-reports/";
+		if (!CrossPlatform::folderExists(dir)) CrossPlatform::createFolder(dir);
+		if (!CrossPlatform::folderExists(dir))
+		{
+			Log(LOG_ERROR) << "[COOP] desync report: cannot create " << dir;
+			return;
+		}
+		const std::string path = dir + "desync-" + desyncTimeString("%Y%m%d-%H%M%S") + ".zip";
+
+		std::vector<std::pair<std::string, std::string> > members;
+		// The json first: it is the one member that cannot fail to be produced, so
+		// a bundle always says SOMETHING even if log and save are both unreadable.
+		members.push_back(std::make_pair(std::string("desync-info.json"),
+										 buildDesyncInfo(game, terms, attribution)));
+		std::string blob;
+		// The log already holds the BATTLE DESYNC line - verifyBattleChecksum logs
+		// it before calling here, and Log() appends to the file per message, so the
+		// copy taken now includes it.
+		if (readTailBinary(CrossPlatform::getLogFileName(), DESYNC_LOG_TAIL_BYTES, blob))
+		{
+			members.push_back(std::make_pair(std::string("openxcom.log"), blob));
+		}
+		else
+		{
+			Log(LOG_WARNING) << "[COOP] desync report: could not read "
+							 << CrossPlatform::getLogFileName();
+		}
+		if (captureForcedSave(game, blob))
+		{
+			members.push_back(std::make_pair(std::string("desync-battle.sav"), blob));
+		}
+
+		if (!writeZipArchive(path, members))
+		{
+			Log(LOG_ERROR) << "[COOP] desync report: failed to write " << path;
+			return;
+		}
+		g_desyncReportPath = path;
+		Log(LOG_ERROR) << "[COOP] desync diagnostic report written to " << path
+					   << " (" << (int)members.size() << " members)";
+
+		if (game && game->getLanguage())
+		{
+			// Post-capture UX only: the bundle is already on disk, so a modal the
+			// player leaves sitting cannot spoil the diagnostic it announces.
+			const std::string issueBase =
+				"https://github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues/new";
+			const std::string title = "[coop desync] " +
+				(headline.empty() ? std::string("battle desync") : headline);
+			const std::string reportUrl = issueBase + "?title=" + desyncUrlEncode(title) +
+				"&body=" + desyncUrlEncode(desyncIssueBody(terms, attribution, path));
+			game->pushState(new CoopDesyncNoticeState(
+				game->getLanguage()->getString("STR_COOP_DESYNC_REPORT_SAVED")
+					.arg(wrapPathForDialog(path)),
+				headline, path, reportUrl));
+		}
+	}
+	catch (const std::exception& e)
+	{
+		Log(LOG_ERROR) << "[COOP] desync report failed: " << e.what();
+	}
+	catch (...)
+	{
+		Log(LOG_ERROR) << "[COOP] desync report failed";
+	}
+}
+
+// ---- PRD-I5: next-launch crash reporter (Pattern A) -------------------------
+// The dying process wrote only a marker (CrossPlatform::crashDump). These run at
+// the NEXT launch from the main-menu altitude. Best-effort by contract: every
+// path logs and continues, and only a SUCCESSFUL bundle deletes the marker.
+
+void deleteCrashMarkerFile(const std::string& markerPath)
+{
+	try
+	{
+		if (!markerPath.empty() && CrossPlatform::fileExists(markerPath))
+			CrossPlatform::deleteFile(markerPath);
+	}
+	catch (...) {}
+}
+
+void markCrashlogSeenPath(const std::string& dmpPath)
+{
+	try { crashlogAddSeen(crashBasename(dmpPath)); } catch (...) {}
+}
+
+// NEVER on the classic MARKER: delete it AND mark its paired VEH crashlog (the
+// newest crash_*.dmp, written microseconds earlier by the first-chance handler)
+// seen, so the scan does not re-offer the same crash next launch. Single-crash-
+// since-launch assumption; a rare stale-marker + newer-VEH-crash edge could
+// suppress one prompt - acceptable, documented in prd-i5.
+void declineCrashMarker(const std::string& markerPath)
+{
+	try
+	{
+		deleteCrashMarkerFile(markerPath);
+		crashlogAddSeen(crashlogNewestDmp());
+	}
+	catch (...) {}
+}
+
+bool bundleCrashReportFromMarker(Game* game, const std::string& markerPath)
+{
+	try
+	{
+		std::string dump, log, version, exception, timestamp;
+		if (!parseCrashMarker(markerPath, dump, log, version, exception, timestamp))
+		{
+			Log(LOG_WARNING) << "[COOP] crash report: marker unreadable, ignoring: " << markerPath;
+			deleteCrashMarkerFile(markerPath);
+			return false;
+		}
+		if (dump.empty() || !CrossPlatform::fileExists(dump) ||
+			log.empty()  || !CrossPlatform::fileExists(log))
+		{
+			Log(LOG_WARNING) << "[COOP] crash report: marker names missing files, ignoring";
+			deleteCrashMarkerFile(markerPath);
+			return false;
+		}
+		std::vector<std::pair<std::string, std::string> > members;
+		members.push_back(std::make_pair(std::string("crash-info.json"),
+			buildCrashInfo(game, "crashdump-marker", dump, log, version, exception, timestamp)));
+		std::string blob;
+		if (readTailBinary(dump, 0, blob))
+			members.push_back(std::make_pair(std::string("crash.dmp"), blob));
+		else Log(LOG_WARNING) << "[COOP] crash report: could not read dump " << dump;
+		// One persistent openxcom.log (never truncated) carries the crash's own trace.
+		if (readTailBinary(log, DESYNC_LOG_TAIL_BYTES, blob))
+			members.push_back(std::make_pair(std::string("openxcom.log"), blob));
+		else Log(LOG_WARNING) << "[COOP] crash report: could not read log " << log;
+
+		const std::string tsFile = timestamp.empty() ? std::string() : timestamp;
+		if (!emitCrashBundle(game, members, tsFile, exception, version, timestamp))
+			return false; // keep the marker; retry next launch
+		deleteCrashMarkerFile(markerPath);   // SUCCESS: the marker is spent
+		crashlogAddSeen(crashlogNewestDmp()); // and dedup its paired VEH crashlog
+		return true;
+	}
+	catch (const std::exception& e) { Log(LOG_ERROR) << "[COOP] crash report failed: " << e.what(); }
+	catch (...) { Log(LOG_ERROR) << "[COOP] crash report failed"; }
+	return false;
+}
+
+// BUNDLE on a VEH crashlog (issue #124): the crash artifacts already exist on
+// disk - zip the dump + the #124 crash-log (stack + mod list) + the openxcom.log
+// tail + a system-info json (source=veh-crashlog, ts from the filename; the exact
+// exception code is inside crash-log.txt). Marks the .dmp basename seen on success.
+bool bundleCrashReportFromCrashlog(Game* game, const std::string& dmpPath, const std::string& logPath)
+{
+	try
+	{
+		if (dmpPath.empty() || !CrossPlatform::fileExists(dmpPath))
+		{
+			Log(LOG_WARNING) << "[COOP] crash report: crashlog dump gone, marking seen: " << dmpPath;
+			markCrashlogSeenPath(dmpPath);
+			return false;
+		}
+		const std::string version = std::string(OPENXCOM_VERSION_SHORT) + OPENXCOM_VERSION_GIT;
+		const std::string exception = "(see crash-log.txt)";
+		const std::string tsToken = crashlogTsToken(crashBasename(dmpPath));
+		std::vector<std::pair<std::string, std::string> > members;
+		members.push_back(std::make_pair(std::string("crash-info.json"),
+			buildCrashInfo(game, "veh-crashlog", dmpPath, logPath, version, exception, tsToken)));
+		std::string blob;
+		if (readTailBinary(dmpPath, 0, blob))
+			members.push_back(std::make_pair(std::string("crash.dmp"), blob));
+		else Log(LOG_WARNING) << "[COOP] crash report: could not read dump " << dmpPath;
+		if (!logPath.empty() && readTailBinary(logPath, DESYNC_LOG_TAIL_BYTES, blob))
+			members.push_back(std::make_pair(std::string("crash-log.txt"), blob));
+		if (readTailBinary(CrossPlatform::getLogFileName(), DESYNC_LOG_TAIL_BYTES, blob))
+			members.push_back(std::make_pair(std::string("openxcom.log"), blob));
+
+		if (!emitCrashBundle(game, members, tsToken, exception, version, tsToken))
+			return false; // leave it unseen -> retry next launch
+		markCrashlogSeenPath(dmpPath);
+		return true;
+	}
+	catch (const std::exception& e) { Log(LOG_ERROR) << "[COOP] crash report failed: " << e.what(); }
+	catch (...) { Log(LOG_ERROR) << "[COOP] crash report failed"; }
+	return false;
+}
+
+void maybeReportPreviousCrash(Game* game)
+{
+	try
+	{
+		// Source 1 (preferred, rich): the classic crashDump marker.
+		const std::string markerPath = Options::getUserFolder() + "crash-pending.json";
+		if (CrossPlatform::fileExists(markerPath))
+		{
+			std::string dump, log, version, exception, timestamp;
+			if (!parseCrashMarker(markerPath, dump, log, version, exception, timestamp))
+			{
+				Log(LOG_WARNING) << "[COOP] crash marker unreadable, deleting: " << markerPath;
+				deleteCrashMarkerFile(markerPath); // then fall through to the crashlogs scan
+			}
+			else if (!dump.empty() && CrossPlatform::fileExists(dump) &&
+					 !log.empty()  && CrossPlatform::fileExists(log))
+			{
+				if (!game || !game->getLanguage()) return; // no UI; leave the marker
+				Log(LOG_INFO) << "[COOP] previous crash detected (marker, " << exception << ")";
+				game->pushState(new CoopCrashPromptState(
+					game->getLanguage()->getString("STR_COOP_CRASH_REPORT_PROMPT"),
+					game->getLanguage()->getString("STR_COOP_CRASH_REPORT_HEADLINE"),
+					markerPath, std::string(), std::string()));
+				return;
+			}
+			else
+			{
+				Log(LOG_INFO) << "[COOP] crash marker names missing files, deleting";
+				deleteCrashMarkerFile(markerPath); // fall through to the scan
+			}
+		}
+		// Source 2 (robust catch-all): an unseen issue-#124 VEH crashlog. The
+		// ledger's baseline keeps this O(small) and never retro-nags about old ones.
+		std::string dmpPath, logPath, tsToken;
+		if (findNewestUnseenCrashlog(dmpPath, logPath, tsToken))
+		{
+			if (!game || !game->getLanguage()) return;
+			Log(LOG_INFO) << "[COOP] previous crash detected (crashlog " << dmpPath << ")";
+			game->pushState(new CoopCrashPromptState(
+				game->getLanguage()->getString("STR_COOP_CRASH_REPORT_PROMPT"),
+				game->getLanguage()->getString("STR_COOP_CRASH_REPORT_HEADLINE"),
+				std::string(), dmpPath, logPath));
+		}
+	}
+	catch (const std::exception& e)
+	{
+		Log(LOG_ERROR) << "[COOP] crash reporter startup check failed: " << e.what();
+	}
+	catch (...)
+	{
+		Log(LOG_ERROR) << "[COOP] crash reporter startup check failed";
+	}
+}
+
+
+// ---- PRD-I0: per-action sequenced sync-check --------------------------------
+namespace {
+
+// The PROMOTION TABLE, in BattleHashSet field order. Compile-time constant per
+// build, exactly as PRD-I0 §3 asks for - a runtime option would let a report get
+// written against a policy nobody can reconstruct afterwards.
+//
+// EVERY BUCKET IS REPORT-ONLY AT BIRTH. That is the instrumentation programme's
+// own rule (instrumentation/README.md: "Every bucket onboards REPORT-ONLY,
+// promotes to ALARM after burn-in"), and it is the only honest starting point:
+// I0 ships the DETECTOR, and until each bucket has been through the PRD-I3
+// burn-in nobody knows whether a red is a real divergence or an artefact of
+// where the two machines take the sample. Promoting a bucket early would make
+// `battleDesyncSeen` - which the soak and half a dozen other tests assert on -
+// fire on known-open seams (terrain destruction, fire/smoke decay, per-unit
+// stats), i.e. it would turn a working release gate into noise.
+//
+// PRD-I3 flips these one at a time, each with its burn-in evidence.
+const bool BATTLE_HASH_ALARM[BATTLE_HASH_BUCKETS] = {
+	true,   // terrain      (PRD-I3 PROMOTED 2026-08-14 Session E @e316d716a: side-gated to
+	        //               player-side+sidestart like unitsCore; L3 0/36 incl. incendiary/spawn-blast/casualty)
+	true,   // fire         (PRD-I3 PROMOTED 2026-08-14 @4a15f7bd4: L3 clean incl. incendiary x2)
+	true,   // smoke        (PRD-I3 PROMOTED 2026-08-14 Session E @e316d716a: L3 0/36; twin of fire,
+	        //               endturn hazard-skip + SEAM-3 expl stamp already closed the mid-side class)
+	true,   // items        (PRD-I3 PROMOTED 2026-08-15 Session F @43ec70384: SIDE-GATE (player+sidestart)
+	        //               + corpse-pending window-1/window-2 skips; #74 boundary path proven covered; L3 0)
+	true,   // unitsCore    (PRD-I3 PROMOTED 2026-08-14 Session C: side-gated to player-side+sidestart; L3 clean)
+	true,   // unitsStats   (PRD-I3 PROMOTED 2026-08-14: superseded=0 old-peer fallback, L3 clean)
+	true,   // itemIdCtr    (PRD-I3 PROMOTED 2026-08-15 Session F @43ec70384: same side-gate + corpse-pending
+	        //               skips as items; the id counter re-slaves per the P4 manifest; L3 0 everywhere)
+	true,   // unitsCombat  (PRD-I3 PROMOTED 2026-08-14: CHAIN-authored kneel/mc/w0..w5; fire moved out)
+	true,   // unitsRegen   (PRD-I3 PROMOTED 2026-08-14: DEFERRED set, sidestart-only, L3 clean)
+};
+
+const char* const BATTLE_HASH_NAMES[BATTLE_HASH_BUCKETS] = {
+	"terrain", "fire", "smoke", "items", "unitsCore", "unitsStats", "itemIdCtr",
+	"unitsCombat", "unitsRegen",
+};
+
+const std::uint64_t FNV_OFFSET = 1469598103934665603ULL;
+const std::uint64_t FNV_PRIME = 1099511628211ULL;
+
+inline std::uint64_t mix(std::uint64_t h, std::int64_t v)
+{
+	return (h ^ (std::uint64_t)v) * FNV_PRIME;
+}
+
+std::uint32_t g_lastSweepUs = 0;
+std::uint32_t g_lastSaveBlobUs = 0;   // PRD-I2: cost of the last saveBlob serialize
+
+/// One remembered "state after N" on the executor.
+struct SyncRingEntry
+{
+	bool boundary;            ///< boundary pseudo-seq namespace?
+	std::uint32_t seq;        ///< action_seq (per side) or boundary seq (per battle)
+	std::uint32_t sideSeq;    ///< the side the action seq belongs to (0 for boundary)
+	std::string kind;         ///< "walk" / "shoot" / "ai" / "endturn" / "sidestart" / ...
+	bool compared;            ///< has a peer report been matched against it?
+	BattleHashSet h;
+	// PRD-I2: boundary-only save-derived hash. Left 0 (and never shipped) for
+	// per-action entries; recorded only for boundary entries (see syncCheckRecord).
+	std::uint64_t saveBlob = 0;
+	// PRD-I3 SEAM-7 (opt-in): this machine's full per-unit unitsStats field vector at
+	// hash time, so a unitsStats mismatch on this entry can be diffed field-by-field
+	// against the peer's `uv`. Null (and cheap) unless the capture toggle is armed.
+	Json::Value statVec;
+};
+
+// Size 64 per PRD-I0 §3. The display-backlog cap is 2, so the executor can never
+// be more than a couple of chains ahead of the peer's reports - 64 is two orders
+// of magnitude of headroom, and an overflow of an UNCOMPARED entry is therefore
+// a tripwire in its own right (it means reports stopped coming back), which is
+// why it logs.
+const size_t SYNC_RING_MAX = 64;
+std::deque<SyncRingEntry> g_syncRing;
+
+struct SyncMismatch
+{
+	std::uint32_t seq;
+	bool boundary;
+	std::string kind;
+	std::string bucket;
+};
+// Bounded: a battle that has gone wrong can produce one of these per action, and
+// the introspection block is read by a test on every poll.
+const size_t SYNC_MISMATCH_MAX = 32;
+std::deque<SyncMismatch> g_syncMismatches;
+
+// coop (option 3, boundary persistence alarm): a boundary bucket mismatch is PENDING on
+// first sight and only ALARMS if the SAME (bucket, kind) is still mismatched at a LATER
+// boundary (compare bseq; for verifyBattleChecksum's next_turn-kind entries the monotonic
+// key is the battle turn number). The RCA proved the canonical boundary residuals are
+// display-lane replay lag that heals within one boundary; pending-then-confirm stops crying
+// wolf while keeping fail-loud (persistent divergence still alarms, one-boundary latency).
+// Lever-on (g_wireOrderState) ONLY; per-action compares keep IMMEDIATE alarm. g_strictBurnIn
+// is unaffected by construction: strict mode is report-only CAPTURE; persistence changes ONLY
+// the ALARM latch, never the mismatch RECORDING (g_syncMismatches / counters / LOG lines).
+struct SyncBoundaryPending { std::uint32_t bseq; std::uint32_t seq; bool firstMismatchLogged; };
+std::map<std::pair<std::string, std::string>, SyncBoundaryPending> g_syncBoundaryPending;
+std::uint64_t g_syncBoundaryHealed = 0;
+std::uint64_t g_syncBoundaryPersistAlarms = 0;
+std::uint64_t g_syncBoundaryUnresolved = 0;
+// The pending (first-sight) record behind the most recent PERSISTENT alarm, carried into the
+// desync report attribution so the bundle shows BOTH boundaries (2a).
+bool g_syncPersistPendingSet = false;
+std::string g_syncPersistPendingBucket, g_syncPersistPendingKind;
+std::uint32_t g_syncPersistPendingBseq = 0;
+
+// PRD-I3 SEAM-7: the exact per-unit field(s) behind a unitsStats bucket mismatch,
+// recorded when the opt-in field capture rode both the ring entry and the peer report.
+struct SyncFieldDiff
+{
+	std::uint32_t seq;
+	bool boundary;
+	std::string kind;
+	int unitId;
+	std::string field;
+	std::int64_t host;
+	std::int64_t peer;
+};
+const size_t SYNC_FIELDDIFF_MAX = 64;
+std::deque<SyncFieldDiff> g_syncFieldDiffs;
+
+std::uint64_t g_syncBucketMismatches[BATTLE_HASH_BUCKETS] = { 0 };
+// PRD-I3 SEAM-2 HALF 1: per-bucket COMPARES - times a bucket was actually sampled
+// cross-machine (never incremented for a bucket the compare skipped). "Was it
+// compared" is a different statement from "did it mismatch", and the acceptance
+// test needs the former to prove the endturn hazard exclusion below really fired.
+std::uint64_t g_syncBucketCompares[BATTLE_HASH_BUCKETS] = { 0 };
+// PRD-I3 SEAM-2 HALF 1: the ENDTURN boundary carries no well-defined hazard sample
+// (all decay runs once per cycle at neutral->player, AFTER both endturn boundaries
+// are armed, and the host flushes the endturn boundary racing its own decay), so
+// its smoke/fire buckets are EXCLUDED from the comparison; the SIDESTART boundary
+// (hash-after-apply of next_turn) keeps them. These count the two so a test can
+// assert the split: endturn skipped, sidestart still compared.
+std::uint64_t g_syncEndturnHazardSkips = 0;
+std::uint64_t g_syncSidestartHazardCompares = 0;
+// PRD-I3 SEAM-7: unitsRegen (tu/energy/mana) is turn-machine-authored, so its ai-seq
+// and endturn-boundary samples straddle the transition (host committed toward the next
+// side's regen while the client defers to next_turn). It is EXCLUDED there and compared
+// only where its author makes it well-defined (player action seqs + sidestart). These
+// count the two straddle exclusions so a test can assert exactly where they fired.
+std::uint64_t g_syncRegenAiSkips = 0;
+std::uint64_t g_syncRegenEndturnSkips = 0;
+// PRD-I3 unitsCore side-gate (2026-08-14, Session C): alien-side + endturn skips.
+std::uint64_t g_syncCoreAlienSkips = 0;
+std::uint64_t g_syncCoreEndturnSkips = 0;
+// PRD-I3 terrain side-gate (2026-08-14, Session E): the SEAM-3 residual is a
+// destroy_tile mapDataID that lands one step behind the host during the alien-side
+// AI/explosion replay (ai/expl per-action seqs) and at the alien-side ENDTURN
+// boundary, healing by sidestart. Mirrors unitsCore: skip alien per-action + endturn,
+// keep player-side per-action (strict) + sidestart. These count the two skips.
+std::uint64_t g_syncTerrainAlienSkips = 0;
+std::uint64_t g_syncTerrainEndturnSkips = 0;
+// PRD-I3 Session F items/itemIdCtr side-gate (2026-08-15, manager sign-off after the
+// boundary-death trace): SAME discipline as terrain/unitsCore. The boundary-death corpse
+// mint is COVERED by the after_unit_death P4 manifest and is CLEAN in isolation (proven
+// lockstep across player/alien, single/multi, bleed/fire, and a lagging slow client - the
+// counter and corpse ids match on both machines). The residual items/itemIdCtr drift is an
+// ALIEN-side display window: the D-lite client's gated alien replay mints/re-stamps a corpse
+// one step behind the host's authoritative death resolution (ai/expl per-action seqs) and at
+// the alien-side ENDTURN boundary, healing by sidestart (traced Session F seed 501: fires at
+// alien ai seqs only, transient, count 2, healed before the turn's sidestart). Session E's
+// "boundary sidestart" attribution was a saveBlob firing (seq 10), a conflation. Skip the
+// alien per-action seqs + endturn; KEEP player-side per-action (strict) + sidestart, where a
+// PERSISTENT item drift still surfaces AND the items player-seq negative control
+// (test_sync_check scenario 4) still sees its mint. A skipped bucket is NOT counted as compared.
+std::uint64_t g_syncItemsAlienSkips = 0;
+std::uint64_t g_syncItemsEndturnSkips = 0;
+// PRD-I3 Session F corpse-replay-pending skip (2026-08-15, manager belt-and-suspenders
+// trigger): a report whose hash was sampled while the REPORTING machine's death replay
+// has not minted its corpse yet is legitimately one death behind the executor's ring
+// entry - the corpse exists on the host but not here - so its item terms (items/itemIdCtr)
+// and the saveBlob superset would false-fire even at a SIDESTART (Session F seed 8003 seq
+// 16: items+itemIdCtr fired at sidestart while the P2 tripwire correctly stayed quiet,
+// because verifyBattleChecksum ALREADY skips on corpseReplayPendingAny - the per-action
+// sync-check did not). Mirror that skip here. Transient by construction (the next report,
+// after the replay drains, compares the same two machines caught up); a PERSISTENT item
+// drift has no pending replay and still compares.
+std::uint64_t g_syncItemsCorpsePendingSkips = 0;
+std::uint64_t g_syncSaveBlobCorpsePendingSkips = 0;
+// The two namespaces are tracked apart: `action_seq` restarts at 0 every side, so
+// a shared watermark would be dragged forwards by the battle-monotonic boundary
+// counter and "the deferred loop closed" would read true for ever after.
+std::uint32_t g_syncLastSeq = 0;          ///< newest ACTION seq recorded
+std::uint32_t g_syncLastComparedSeq = 0;  ///< newest ACTION seq a peer report closed
+std::uint32_t g_syncLastBoundarySeq = 0;
+std::uint32_t g_syncLastComparedBoundarySeq = 0;
+std::uint64_t g_syncCompares = 0;         ///< reports matched to a ring entry
+std::uint64_t g_syncStaleReports = 0;     ///< reports with no ring entry left
+std::uint64_t g_syncDropped = 0;          ///< uncompared entries evicted by overflow
+// Compared entries by kind. The only way a test can prove COVERAGE rather than
+// mere silence: "the alien side ran and 7 of its chains were compared" is a
+// different statement from "nothing complained", and PRD-I0's first scenario
+// needs the former (a seq extension that silently stamped nothing would pass a
+// zero-mismatch assertion perfectly).
+std::map<std::string, std::uint64_t> g_syncKindCompares;
+
+// PRD-I2: the save-derived boundary bucket ("saveBlob"). Kept OUT of the seven-
+// bucket BattleHashSet on purpose: computed ONLY at boundaries (a 5-20 ms
+// serialization, never per action), so it must not appear in the raw per-action
+// `battleHashes` sweep the harness polls. Its own report-only flag + counter.
+const bool SAVEBLOB_ALARM = true;    // PRD-I3 PROMOTED 2026-08-15 Session F @43ec70384:
+                                     // the whole-save superset. SEAM-11 shipped ammoqty
+                                     // (next_turn absolute + -1/255) + closed the ufo-door
+                                     // boundary; exp*/tempUnitStatistics/motionPoints
+                                     // excluded, floating shipped. L3 0 everywhere incl.
+                                     // campaign. ALL TEN BUCKETS NOW ALARM.
+std::uint64_t g_syncSaveBlobMismatches = 0;
+// PRD-I3 saveBlob endturn straddle: the saveBlob bucket is computed ONLY at
+// boundaries, and (like the smoke/fire hazard buckets in SEAM-2 HALF 1) the
+// ENDTURN boundary sample is ill-defined - the whole-save hash straddles the
+// deferred turn-machine state the D-lite client only resolves at next_turn. So
+// the host compare EXCLUDES saveBlob at an endturn boundary and keeps it at
+// SIDESTART (hash-after-apply of next_turn = well-defined). Compare-site only;
+// the client still ships saveBlob in every boundary `h`, so the wire is unchanged
+// and old/new peers stay symmetric. These count the two so a test can assert it.
+std::uint64_t g_syncSaveBlobEndturnSkips = 0;
+std::uint64_t g_syncSaveBlobSidestartCompares = 0;
+
+// The nodes stripped BEFORE hashing (exclusion by NODE PATH on the parsed tree,
+// robust to emit formatting). Two scopes, both SHORT and each entry justified.
+//
+// TOP-LEVEL of the battle document only - machine-local display/selection state:
+bool saveBlobExcludedTopKey(std::string_view k)
+{
+	// selectedUnit / undoUnit: the LOCAL player's selected unit and undo pointer.
+	//   Each machine drives its own units (thin-client display), so both diverge by
+	//   design - the same reason the fast sweep never hashes selection.
+	// animFrame: the global battlescape animation phase; the two machines are never
+	//   on the same display frame (identical rationale to the terrain bucket's
+	//   animation-frame skip).
+	return k == "selectedUnit" || k == "undoUnit" || k == "animFrame";
+	// Naturally ABSENT, so deliberately not listed: the RNG seed/state, the camera
+	// and the coop_* session keys are not emitted by SavedBattleGame::save at all -
+	// RNG and coop_* live in SavedGame::save (the geoscape document we do NOT
+	// serialize) and the camera is BattlescapeState runtime state. Serializing the
+	// battle document ONLY excludes all three for free.
+}
+
+// ANY DEPTH - host-authoritative bookkeeping the thin client never derives, plus two
+// vanilla-clean mod-reader keys (exclude-for-vanilla with a caveat). The host save is
+// the single authority (a resume restreams over the client's copy). Every entry was
+// reader-audited (client-side mid-battle readers) for PRD-I3 SEAM-TAIL CLOSE
+// 2026-08-12: a key with a gameplay-relevant CLIENT reader is SHIPPED on a death
+// packet, not excluded here. Categories:
+// (a) AI bookkeeping - PRD-I3 RATIFIED (closes the I2-era "must ratify" note): read
+//     ONLY by the host's handleAI / pathfinding; the client runs no AI
+//     (_isActivePlayerSync-gated), so no client counterpart can agree.
+// (b) FOW / spotting (Option B rider) - presentation, per-machine calculateFOV.
+// (c) casualty kill-bookkeeping (PRD-I3 SEAM-8 consequence): the client no longer
+//     runs checkForCasualties (gate 9dadcb160), so the murderer's kill diary and the
+//     victim's death record never populate there; read ONLY by checkForCasualties and
+//     the host-authoritative debriefing (kills.clear()+refill per PROTOCOL), and
+//     next_turn does not re-ship them, so they persist past the boundary. Zero-disk
+//     client + host-replaced debrief = authority-local, safe to exclude.
+bool saveBlobExcludedAnyKey(std::string_view k)
+{
+	// --- (a) AI bookkeeping (RATIFIED) ---
+	// AI: a BattleUnit's whole AIModule sub-map (fromNode/toNode/AIMode/wasHitBy) -
+	//   host-only; the client's alien units keep the defaults (toNode -1, AIMode 0).
+	// aiMedikitUsed: an AI behaviour flag set only when the host's AI heals a unit.
+	// allocated: a pathfinding Node claimed by the host's AI for a patrol/spawn; the
+	//   client never allocates nodes.
+	// --- (b) per-unit FOV / spotting (PRD-I3 FOW Option B rider) ---
+	// The visibility/spotting fields BattleUnit::save writes. Under the Option B
+	// contract FOW is PRESENTATION - derived locally from replicated positions,
+	// never promised identical between machines - so these are a permanent
+	// carve-out, exactly like the per-tile discovered bits masked out of binTiles.
+	// visible: whether THIS machine currently sees the unit (per-machine FOV).
+	// turnsSinceSpotted* / turnsLeftSpottedForSnipers* (the HOSTILE key plus the
+	//   ByXcom / ByCivilian faction variants): per-faction spotting timers driven
+	//   by each machine's own calculateFOV - FOW-class bookkeeping, not shared state.
+	// --- (c) casualty kill-bookkeeping (PRD-I3 SEAM-TAIL, reader-audited) ---
+	// fatalShotSide / fatalShotBodyPart / murdererWeapon / murdererWeaponAmmo /
+	//   murdererId: the victim's death record (murdererId = attributed killer, set
+	//   host-only in hitUnit/checkForCasualties, both coop-client early-returns; a
+	//   wounded survivor's is never shipped). kills: the murderer's kill counter AND,
+	//   at any depth,
+	//   its tempUnitStatistics.kills diary sub-tree (excluding the map key drops the
+	//   whole list). All read ONLY in checkForCasualties (host) + DebriefingState
+	//   (host debrief) - no mid-battle client gameplay reader.
+	// notificationShown: gates the death-notice popup + death-anim skip/speed; its
+	//   writes are host/classic-gated (UnitDieBState), so on the parallel client it
+	//   stays 0 - a presentation field, not gameplay state.
+	// droppedOnAlienTurn (a BattleItem flag): read ONLY by surveyItems (host AI weapon
+	//   pickup); the client runs no AI, so no client gameplay reader.
+	// turnsSinceStunned: MOVED here from KEEP (was called "a real stun-recovery stat").
+	//   The audit corrects that: recovery is stunlevel-driven; turnsSinceStunned's ONLY
+	//   gameplay reader is handleAI's just-woke check (BattlescapeGame.cpp:1213,
+	//   host-only). startFalling resets it to 0 on a collapse (host), which the gated
+	//   client CFC never mirrors, so it diverges on a casualty. Exclude-for-vanilla; MOD
+	//   CAVEAT: a ruleset script can read it (getTurnsSinceStunned binding) - the shared
+	//   script-reader mod caveat (see the ledger with GAP-10 / wantsToSurrender).
+	// --- (d) two decided vanilla-clean keys ---
+	// exp* (expBravery/expReactions/expFiring/expThrowing/expPsiSkill/expPsiStrength/
+	//   expMana/expMelee): the per-unit combat-EXPERIENCE counters (_exp.*). Accrued on
+	//   the executor as a unit acts (a shot bumps expFiring, etc.), consumed ONLY at
+	//   BattleUnit::postMissionProcedures (host debrief -> improveStat rolls). The parallel
+	//   thin client REPLAYS the action for display without accruing the experience, so
+	//   e.g. expFiring host=1 / client=0 on any firer - the DOMINANT clean-run saveBlob
+	//   residual (Session F seed 8013 named it). No mid-battle client gameplay reader; the
+	//   debrief stat gains are host-authoritative under the whole-world restream, exactly
+	//   like the excluded kills/tempUnitStatistics diary -> exclude the whole family
+	//   (expBravery was already carved out; Session F extends it to all eight).
+	// wantsToSurrender: vanilla NEVER reads it; a MOD reader exists
+	//   (endTurn->tallyUnits->isSurrendering, gated getSurrenderMode()>=2). Exclude-for-
+	//   vanilla; MOD CAVEAT recorded in the ledger next to GAP-10 / turnsSinceStunned.
+	// --- (e) Session F saveBlob dispositions (2026-08-15, manager sign-off) ---
+	// tempUnitStatistics: the per-unit combat diary sub-tree (shotAtCounter / hitCounter /
+	//   shotsFiredCounter / shotsLandedCounter / appliedStimulant + the already-excluded
+	//   kills list). Read ONLY by DebriefingState (host-authoritative coop debrief) and the
+	//   host-only-gated wasUnconcious (BattlescapeGame.cpp:1992, behind !coopThinClientNoReroll
+	//   && getStunningImprovesMorale). No parallel-client mid-battle reader - the SAME class as
+	//   the excluded `kills`. Excluding the parent map key drops the whole diary sub-tree.
+	// motionPoints: the motion-scanner display accumulator (reset in prepareNewTurn:2942,
+	//   accumulated per-machine during movement). next_turn DOES re-ship it
+	//   (NextTurnState.cpp:681 -> setMotionPointsCoop), yet it still diverges at SIDESTART: the
+	//   D-lite client's still-draining gated alien replay legitimately accumulates
+	//   `_motionPoints` AFTER the next_turn overwrite. Serializing replay-before-apply is
+	//   disproportionate for a motion-scanner DISPLAY value with no other reader -> the FOW /
+	//   Option-B presentation carve-out class. PRESENTATION-EXCLUDE (manager sign-off, trace
+	//   in prd-i3 ledger).
+	return k == "AI" || k == "aiMedikitUsed" || k == "allocated"
+		|| k == "visible"
+		|| k == "turnsSinceSpotted"
+		|| k == "turnsSinceSpottedByXcom"
+		|| k == "turnsSinceSpottedByCivilian"
+		|| k == "turnsLeftSpottedForSnipers"
+		|| k == "turnsLeftSpottedForSnipersByXcom"
+		|| k == "turnsLeftSpottedForSnipersByCivilian"
+		|| k == "fatalShotSide"
+		|| k == "fatalShotBodyPart"
+		|| k == "murdererWeapon"
+		|| k == "murdererWeaponAmmo"
+		|| k == "murdererId"
+		|| k == "kills"
+		|| k == "notificationShown"
+		|| k == "droppedOnAlienTurn"
+		|| k == "turnsSinceStunned"
+		|| k == "expBravery"
+		|| k == "expReactions"
+		|| k == "expFiring"
+		|| k == "expThrowing"
+		|| k == "expPsiSkill"
+		|| k == "expPsiStrength"
+		|| k == "expMana"
+		|| k == "expMelee"
+		|| k == "wantsToSurrender"
+		|| k == "tempUnitStatistics"
+		|| k == "motionPoints";
+}
+
+// PRD-I3 FOW contract (Option B, decided 2026-08-09): the per-tile
+// "discovered"/FOW bits are presentation - derived locally from replicated
+// positions, never promised identical between machines - so they are a permanent
+// carve-out from the saveBlob hash, exactly as the fast `terrain` bucket already
+// excludes them. They live packed inside the opaque binTiles base64 blob
+// (Tile::saveBinary boolFields), which cannot be stripped by YAML node path, so
+// decode the blob, zero the three discovered bits in every tile's boolFields byte,
+// and feed the MASKED bytes to the hash (and its canonical-text twin). Everything
+// else in the blob - the four mapDataID/setID pairs, smoke, fire, and the two
+// ufo-door-open bits - is left byte-for-byte intact and still hashed, so real
+// terrain / door / smoke / fire drift still lights the bucket.
+//
+// Layout anchored to Tile::saveBinary + the index prefix serialized in
+// SavedBattleGame::save, sized by Tile::serializationKey (a compile-time constant,
+// NOT versioned): each record is [index][mapDataID x4][mapDataSetID x4][smoke]
+// [fire][boolFields], stride = serializationKey.totalBytes, boolFields last. In
+// that byte (Tile::saveBinary): bit0 = O_WESTWALL.discovered,
+// bit1 = O_NORTHWALL.discovered, bit2 = O_FLOOR.discovered (FOW, mask 0x07);
+// bit3 = ufo-door-open west, bit4 = ufo-door-open north (KEEP).
+bool saveBlobMaskFowBinTiles(const YAML::YamlNodeReader& node, std::vector<char>& out)
+{
+	out.clear();
+	if (node.isMap() || node.isSeq()) return false; // binTiles is a scalar
+	std::vector<char> bytes;
+	try { bytes = node.readValBase64(); }
+	catch (...) { return false; }
+	const size_t stride = Tile::serializationKey.totalBytes;
+	// boolFields sits after index + 4 mapDataID + 4 mapDataSetID + smoke + fire.
+	const size_t boolOff = (size_t)Tile::serializationKey.index
+		+ 4u * (size_t)Tile::serializationKey._mapDataID
+		+ 4u * (size_t)Tile::serializationKey._mapDataSetID
+		+ (size_t)Tile::serializationKey._smoke
+		+ (size_t)Tile::serializationKey._fire;
+	if (stride == 0 || boolOff >= stride) return false; // layout not as anchored
+	const size_t records = bytes.size() / stride;
+	for (size_t r = 0; r < records; ++r)
+	{
+		unsigned char& bf = reinterpret_cast<unsigned char&>(bytes[r * stride + boolOff]);
+		bf = (unsigned char)(bf & (unsigned char)~0x07u); // clear FOW, keep ufo-door bits
+	}
+	out.swap(bytes);
+	return true;
+}
+
+// Deterministic standard base64 (RFC 4648). The human-diffable saveBlob text twin
+// renders the SAME masked binTiles bytes the hash consumes, so a dump diff stays
+// faithful to the hash. Encoder only; decode is the engine's readValBase64.
+std::string saveBlobBase64(const std::vector<char>& in)
+{
+	static const char T[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+	std::string out;
+	out.reserve(((in.size() + 2) / 3) * 4);
+	size_t i = 0;
+	for (; i + 3 <= in.size(); i += 3)
+	{
+		unsigned n = ((unsigned)(unsigned char)in[i] << 16) | ((unsigned)(unsigned char)in[i + 1] << 8) | (unsigned char)in[i + 2];
+		out += T[(n >> 18) & 63]; out += T[(n >> 12) & 63];
+		out += T[(n >> 6) & 63];  out += T[n & 63];
+	}
+	if (i + 1 == in.size())
+	{
+		unsigned n = ((unsigned)(unsigned char)in[i] << 16);
+		out += T[(n >> 18) & 63]; out += T[(n >> 12) & 63]; out += "==";
+	}
+	else if (i + 2 == in.size())
+	{
+		unsigned n = ((unsigned)(unsigned char)in[i] << 16) | ((unsigned)(unsigned char)in[i + 1] << 8);
+		out += T[(n >> 18) & 63]; out += T[(n >> 12) & 63]; out += T[(n >> 6) & 63]; out += "=";
+	}
+	return out;
+}
+
+// Deterministic FNV-1a over the parsed node tree: keys and scalar values in
+// document (= emit) order, recursing maps and sequences. Hashing the STRUCTURE of
+// the re-parsed text (not the raw bytes) normalizes any whitespace/quoting
+// difference between the two builds. @a top marks the battle map's own direct
+// children, where the top-level-only exclusions apply.
+void saveBlobHashTree(const YAML::YamlNodeReader& node, std::uint64_t& h, bool top)
+{
+	if (node.isMap())
+	{
+		for (const auto& child : node.children())
+		{
+			std::string_view key = child.key();
+			if ((top && saveBlobExcludedTopKey(key)) || saveBlobExcludedAnyKey(key))
+				continue;
+			for (char ch : key) { h ^= (std::uint64_t)(unsigned char)ch; h *= FNV_PRIME; }
+			// PRD-I3 FOW: hash the FOW-masked binTiles bytes, not the raw base64 scalar.
+			std::vector<char> maskedTiles;
+			if (key == "binTiles" && saveBlobMaskFowBinTiles(child, maskedTiles))
+			{
+				for (char b : maskedTiles) { h ^= (std::uint64_t)(unsigned char)b; h *= FNV_PRIME; }
+				continue;
+			}
+			saveBlobHashTree(child, h, false);
+		}
+	}
+	else if (node.isSeq())
+	{
+		for (const auto& child : node.children())
+			saveBlobHashTree(child, h, false);
+	}
+	else
+	{
+		std::string_view val = node.val();
+		for (char ch : val) { h ^= (std::uint64_t)(unsigned char)ch; h *= FNV_PRIME; }
+	}
+}
+
+// PRD-I4 (test-only): the human-diffable twin of saveBlobHashTree - the SAME walk,
+// the SAME exclusions, emitted as indented text. So when the saveBlob bucket goes
+// red, a diff of the two machines' dumps names the field. Kept in step with
+// saveBlobHashTree above (same key/seq/scalar order, same node skips).
+void saveBlobCanonicalText(const YAML::YamlNodeReader& node, std::string& out,
+						   int depth, bool top)
+{
+	const std::string pad(depth * 2, ' ');
+	if (node.isMap())
+	{
+		for (const auto& child : node.children())
+		{
+			std::string_view key = child.key();
+			if ((top && saveBlobExcludedTopKey(key)) || saveBlobExcludedAnyKey(key))
+				continue;
+			if (child.isMap() || child.isSeq())
+			{
+				out += pad; out.append(key.data(), key.size()); out += ":\n";
+				saveBlobCanonicalText(child, out, depth + 1, false);
+			}
+			else
+			{
+				// PRD-I3 FOW: emit the SAME FOW-masked binTiles bytes the hash consumes,
+				// so a dump diff stays consistent with the saveBlob hash.
+				std::vector<char> maskedTiles;
+				if (key == "binTiles" && saveBlobMaskFowBinTiles(child, maskedTiles))
+				{
+					out += pad; out.append(key.data(), key.size()); out += ": ";
+					out += saveBlobBase64(maskedTiles); out += "\n";
+				}
+				else
+				{
+					std::string_view val = child.val();
+					out += pad; out.append(key.data(), key.size()); out += ": ";
+					out.append(val.data(), val.size()); out += "\n";
+				}
+			}
+		}
+	}
+	else if (node.isSeq())
+	{
+		for (const auto& child : node.children())
+		{
+			if (child.isMap() || child.isSeq())
+			{
+				out += pad; out += "-\n";
+				saveBlobCanonicalText(child, out, depth + 1, false);
+			}
+			else
+			{
+				std::string_view val = child.val();
+				out += pad; out += "- "; out.append(val.data(), val.size()); out += "\n";
+			}
+		}
+	}
+	else
+	{
+		std::string_view val = node.val();
+		out += pad; out.append(val.data(), val.size()); out += "\n";
+	}
+}
+
+} // namespace
+
+const char* battleHashBucketName(int i)
+{
+	return (i >= 0 && i < BATTLE_HASH_BUCKETS) ? BATTLE_HASH_NAMES[i] : "?";
+}
+
+std::uint64_t battleHashBucketValue(const BattleHashSet& h, int i)
+{
+	switch (i)
+	{
+	case 0: return h.terrain;
+	case 1: return h.fire;
+	case 2: return h.smoke;
+	case 3: return h.items;
+	case 4: return h.unitsCore;
+	case 5: return h.unitsStats;
+	case 6: return h.itemIdCtr;
+	case 7: return h.unitsCombat;
+	case 8: return h.unitsRegen;
+	default: return 0;
+	}
+}
+
+// PRD-I3 Session F: a debug-toggled REPORT-ONLY override. With all ten buckets promoted
+// to ALARM there is no naturally report-only bucket left to carry test_sync_check's
+// negative control (the proof that a report-only mismatch is logged + counted but does
+// NOT latch the desync route). The TestServer `force_report_only` lever sets one of these
+// true, forcing that bucket's alarm gate open for the control scenario. Index
+// BATTLE_HASH_BUCKETS is saveBlob. Test-only; production never sets it, so it is inert.
+bool g_battleHashReportOnlyOverride[BATTLE_HASH_BUCKETS + 1] = { false };
+
+bool saveBlobAlarms()
+{
+	return SAVEBLOB_ALARM && !g_battleHashReportOnlyOverride[BATTLE_HASH_BUCKETS];
+}
+
+bool setBattleHashReportOnlyOverride(const std::string& name, bool on)
+{
+	for (int i = 0; i < BATTLE_HASH_BUCKETS; ++i)
+		if (name == BATTLE_HASH_NAMES[i]) { g_battleHashReportOnlyOverride[i] = on; return true; }
+	if (name == "saveBlob") { g_battleHashReportOnlyOverride[BATTLE_HASH_BUCKETS] = on; return true; }
+	return false;
+}
+
+bool battleHashBucketAlarms(int i)
+{
+	if (i >= 0 && i < BATTLE_HASH_BUCKETS && g_battleHashReportOnlyOverride[i]) return false;
+	return (i >= 0 && i < BATTLE_HASH_BUCKETS) && BATTLE_HASH_ALARM[i];
+}
+
+std::uint32_t battleHashLastSweepUs()
+{
+	return g_lastSweepUs;
+}
+
+/**
+ * ONE sweep, seven buckets.
+ *
+ * Three loops - tiles, items, units - and a counter read. Every term is a SUM of
+ * per-entity FNV-1a mixes rather than a rolling hash, for the reason the PRD-P2
+ * terms already document: neither the tile array, nor `_items`, nor `_units` has
+ * a replicated ORDER, so a term that depended on it would be a permanent red.
+ *
+ * FNV is spelled out rather than delegated to std::hash because the two machines
+ * are not necessarily the same build (Windows .exe vs the Linux AppImage) and
+ * std::hash is implementation-defined.
+ */
+bool computeBattleHashes(Game* game, BattleHashSet& out)
+{
+	out.terrain = out.fire = out.smoke = out.items = 0;
+	out.unitsCore = out.unitsStats = out.itemIdCtr = 0;
+	out.unitsCombat = out.unitsRegen = 0;
+	if (!game || !game->getSavedGame()) return false;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return false;
+
+	const auto t0 = std::chrono::steady_clock::now();
+
+	// --- tiles: terrain, fire, smoke ---------------------------------------
+	//
+	// terrain hashes the four TilePart map-data IDs, which is precisely what the
+	// `destroy_tile` packet mutates on the peer (Tile::destroyCoop swaps the part
+	// for its died-for object or clears it), plus the explosive accumulator that
+	// packet also carries. NOT the animation frame, not the discovered/FOW bits:
+	// the first is a display phase the two machines are never on the same frame
+	// of, and the second is gated on a design decision PRD-I3 owns.
+	//
+	// A VOID tile contributes nothing at all, so the common case (open air above
+	// the map) costs one branch. That is safe rather than merely fast: the skip is
+	// a pure function of the tile's own state, so a tile that went void on ONE
+	// machine is skipped there and mixed here, and the sums differ - which is the
+	// detection we want.
+	const int tileCount = battle->getMapSizeXYZ();
+	for (int i = 0; i < tileCount; ++i)
+	{
+		Tile* tile = battle->getTile(i);
+		if (!tile) continue;
+
+		// NOT Tile::isVoid(): that also answers false for smoke and for a tile that
+		// merely has an item lying on it, which would make `terrain` move whenever
+		// `items` or `smoke` did - and a bucket that is not independent of its
+		// neighbours cannot attribute anything. The skip here is map data only.
+		bool hasPart = false;
+		for (int part = 0; part < O_MAX && !hasPart; ++part)
+		{
+			hasPart = tile->getMapData((TilePart)part) != nullptr;
+		}
+		if (hasPart || tile->getExplosive() != 0)
+		{
+			std::uint64_t h = FNV_OFFSET;
+			h = mix(h, i);
+			for (int part = 0; part < O_MAX; ++part)
+			{
+				int mapDataID = -1, mapDataSetID = -1;
+				tile->getMapData(&mapDataID, &mapDataSetID, (TilePart)part);
+				h = mix(h, mapDataID);
+				h = mix(h, mapDataSetID);
+			}
+			h = mix(h, tile->getExplosive());
+			h = mix(h, tile->getExplosiveType());
+			out.terrain += h;
+		}
+
+		// The soak's `battle_tiles` census fields, which many clean runs have shown
+		// to be equal at a side boundary - so they are a detector, not a red.
+		const int f = tile->getFire();
+		if (f > 0)
+		{
+			std::uint64_t h = FNV_OFFSET;
+			h = mix(h, i);
+			h = mix(h, f);
+			out.fire += h;
+		}
+		const int sm = tile->getSmoke();
+		if (sm > 0)
+		{
+			std::uint64_t h = FNV_OFFSET;
+			h = mix(h, i);
+			h = mix(h, sm);
+			out.smoke += h;
+		}
+	}
+
+	// --- items: the STRICT census ------------------------------------------
+	// Wider than chkBattleCensus (which is id + type + owner): slot, tile
+	// position and fuse are all replicated state, and each of them is a family of
+	// drift the identity triple cannot see - an item in the wrong hand, an item
+	// on the wrong floor tile, a grenade primed on one machine only.
+	for (BattleItem* item : *battle->getItems())
+	{
+		if (!item) continue;
+		std::uint64_t h = FNV_OFFSET;
+		h = mix(h, item->getId());
+		h ^= fnv1a(item->getRules() ? item->getRules()->getType() : std::string("?"));
+		h *= FNV_PRIME;
+		h = mix(h, item->getOwner() ? item->getOwner()->getId() : -1);
+		h ^= fnv1a(item->getSlot() ? item->getSlot()->getId() : std::string("-"));
+		h *= FNV_PRIME;
+		h = mix(h, item->getSlotX());
+		h = mix(h, item->getSlotY());
+		const Tile* t = item->getTile();
+		h = mix(h, t ? t->getPosition().x : -1);
+		h = mix(h, t ? t->getPosition().y : -1);
+		h = mix(h, t ? t->getPosition().z : -1);
+		h = mix(h, item->getFuseTimer());
+		out.items += h;
+	}
+
+	// --- units: core identity/liveness/position, then the full-fidelity stats --
+	for (BattleUnit* unit : *battle->getUnits())
+	{
+		if (!unit) continue;
+		const Position p = unit->getPosition();
+
+		// EXACTLY the chkBattleUnits field set (id, faction, liveness, position),
+		// reusing unitLiveness() so the two detectors can never disagree about what
+		// "down" means.
+		std::uint64_t c = FNV_OFFSET;
+		c = mix(c, unit->getId());
+		c = mix(c, (int)unit->getFaction());
+		c = mix(c, unitLiveness(unit));
+		c = mix(c, p.x);
+		c = mix(c, p.y);
+		c = mix(c, p.z);
+		out.unitsCore += c;
+
+		// The bucket PRD-I0 flags as expected-noisy, and the reason the split
+		// exists: both machines regenerate TU, bleed fatal wounds and recover stun
+		// in their OWN prepareNewTurn, so this term straddles state the protocol
+		// repairs rather than replicates. It is here because it is also the term
+		// that catches a cost charged on one machine only - which is the single
+		// most common parallel-turns bug found so far (PRD-P9's legacy-packet cost
+		// replication was exactly this). Report-only until PRD-I3 burns it in.
+		std::uint64_t s = FNV_OFFSET;
+		s = mix(s, unit->getId());
+		s = mix(s, unit->getTimeUnits());
+		s = mix(s, unit->getEnergy());
+		s = mix(s, unit->getHealth());
+		s = mix(s, unit->getStunlevel());
+		s = mix(s, unit->getMorale());
+		s = mix(s, unit->getMana());
+		s = mix(s, unit->getFire());
+		s = mix(s, unit->isKneeled() ? 1 : 0);
+		s = mix(s, unit->getMindControllerId());
+		const int* wounds = unit->getFatalWoundsCoop();
+		for (int part = 0; part < BODYPART_MAX; ++part)
+		{
+			s = mix(s, wounds ? wounds[part] : 0);
+		}
+		out.unitsStats += s;
+
+		// PRD-I3 SEAM-7/8/9: the SAME field set, SPLIT BY AUTHORSHIP into two independent
+		// FNV sums so the compare can hold each field where its author makes it
+		// well-defined:
+		//   unitsCombat = CHAIN-authored ONLY (kneeled, mind-controller, w0..w5) -
+		//     each written by an absolute the executor ships (kneel packet /
+		//     mind-control / hit_unit's fatal-wound COUNTERS), so it is STRICT at every
+		//     seq incl. ai/expl.
+		//   unitsRegen = TURN-MACHINE / DEFERRED-authored (tu, energy, mana, morale, health,
+		//     stun AND fire) - compared at SIDESTART only (syncCheckCompare).
+		// SEAM-9 (manager sign-off 2026-08-12) moved HEALTH and STUN out of unitsCombat:
+		// both machines bleed fatal wounds and recover stun in their OWN prepareNewTurn
+		// (see the unitsStats note above), so health/stun straddle every per-action + endturn
+		// sample exactly like tu/energy/mana/morale (trace: stun off-by-1 at ai/expl, health
+		// bleed on downed units, all healed by next_turn). The wound COUNTERS stay in
+		// unitsCombat - they are chain-authored (hit/medikit); only their BLEED CONSEQUENCE
+		// on the health VALUE defers, and that value now rides unitsRegen.
+		// FIRE (manager sign-off 2026-08-12) likewise moved to unitsRegen: getFire() is
+		// chain-SET (unit_fire absolute) but turn-DECREMENTED in each machine's own
+		// prepareNewTurn, so it straddles every per-action + endturn sample (incendiary
+		// soak: unitsCombat 31-36 at ai/expl) and is well-defined only at sidestart -
+		// identical dual authorship to health/stun/morale. The combined
+		// unitsStats above is kept verbatim purely for the OLD-peer wire fallback.
+		std::uint64_t comb = FNV_OFFSET;
+		comb = mix(comb, unit->getId());
+		comb = mix(comb, unit->isKneeled() ? 1 : 0);
+		comb = mix(comb, unit->getMindControllerId());
+		for (int part = 0; part < BODYPART_MAX; ++part)
+		{
+			comb = mix(comb, wounds ? wounds[part] : 0);
+		}
+		out.unitsCombat += comb;
+
+		std::uint64_t regen = FNV_OFFSET;
+		regen = mix(regen, unit->getId());
+		regen = mix(regen, unit->getTimeUnits());
+		regen = mix(regen, unit->getEnergy());
+		regen = mix(regen, unit->getMana());
+		regen = mix(regen, unit->getMorale()); // SEAM-8: morale is deferred-authored
+		regen = mix(regen, unit->getHealth());     // SEAM-9: fatal-wound bleed defers
+		regen = mix(regen, unit->getStunlevel());  // SEAM-9: stun recovery defers
+		regen = mix(regen, unit->getFire());       // fire: chain-SET, turn-decremented (deferred)
+		out.unitsRegen += regen;
+	}
+
+	out.itemIdCtr = (std::uint64_t)(std::int64_t)battle->getCurrentItemIdValue();
+
+	g_lastSweepUs = (std::uint32_t)std::chrono::duration_cast<std::chrono::microseconds>(
+		std::chrono::steady_clock::now() - t0).count();
+	return true;
+}
+
+// ---- PRD-I3 SEAM-7: per-seq live unit-field dump + opt-in field-diff capture -------
+//
+// The unitsStats bucket is a SUM of FNV mixes: a mismatch names the bucket but never
+// WHICH field of WHICH unit drifted, and the existing unit_stat_diff harness probe
+// (battle_state.units) samples only tu/energy/health/stun/wounds/morale - NOT fire,
+// kneeling, mana, mind-controller id or the six PER-PART fatal-wound counters, which
+// are precisely the fields the bucket hashes that it cannot see. This builds the FULL
+// bucket field vector per unit so a live dump (unit_stats_full lever) and an opt-in
+// on-mismatch cross-machine diff can NAME the field. Introspection only.
+bool g_syncFieldCapture = false;
+void setSyncFieldCapture(bool on) { g_syncFieldCapture = on; }
+bool syncFieldCapture() { return g_syncFieldCapture; }
+// coop (PHASE D.1 chain-atomicity): the strict-compare burn-in lever (see SharedEcon.h).
+bool g_strictBurnIn = false;
+void setStrictBurnIn(bool on) { g_strictBurnIn = on; }
+bool strictBurnIn() { return g_strictBurnIn; }
+
+void unitStatsFullJson(Game* game, Json::Value& out, int onlyId)
+{
+	out = Json::Value(Json::arrayValue);
+	if (!game || !game->getSavedGame()) return;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return;
+	for (BattleUnit* unit : *battle->getUnits())
+	{
+		if (!unit) continue;
+		if (onlyId >= 0 && unit->getId() != onlyId) continue;
+		Json::Value u(Json::objectValue);
+		u["id"] = unit->getId();
+		// EXACTLY the computeBattleHashes() unitsStats field set, same order, so a
+		// fieldDiffs readout explains a unitsStats bucket mismatch term for term.
+		u["tu"] = unit->getTimeUnits();
+		u["energy"] = unit->getEnergy();
+		u["health"] = unit->getHealth();
+		u["stun"] = unit->getStunlevel();
+		u["morale"] = unit->getMorale();
+		u["mana"] = unit->getMana();
+		u["fire"] = unit->getFire();
+		u["kneeled"] = unit->isKneeled() ? 1 : 0;
+		u["mc"] = unit->getMindControllerId();
+		const int* wounds = unit->getFatalWoundsCoop();
+		for (int part = 0; part < BODYPART_MAX; ++part)
+		{
+			u["w" + std::to_string(part)] = wounds ? wounds[part] : 0;
+		}
+		// coop (parallel battlescape Phase 1 - per-unit state watermark): the unit's
+		// recorded (side_seq, action_seq, rank) watermark, so a fixture can poll for
+		// "this unit has taken a stamped rank>=1 write" without a wire probe.
+		u["coopStateSide"] = static_cast<Json::UInt>(unit->_coopStateSideSeq);
+		u["coopStateSeq"] = static_cast<Json::UInt>(unit->_coopStateActionSeq);
+		u["coopStateRank"] = static_cast<int>(unit->_coopStateRank);
+		out.append(u);
+	}
+}
+
+// ---- PRD-I3 SEAM-3: per-seq terrain vector capture (introspection only) ------------
+//
+// The unit field-diff tooling above ships the client's full unit vector as `uv` on
+// action_done, because a battle has a handful of units. The terrain equivalent cannot:
+// a report would carry every non-void tile (up to 14400), on every action, doubling
+// the action_done payload of a run - and it is armed exactly during the shot/destruction
+// scenarios that already stress the transport (the mass-casualty WinError 10054 class).
+// So this is INTROSPECTION ONLY, no wire change: when armed, BOTH machines stash their
+// own full tile vector at the SAME sample computeBattleHashes() took, into a bounded
+// local ring, and the harness reads BOTH rings for the mismatching seq (which the host
+// already names in syncCheck.mismatches) and diffs them offline. OFF by default = the
+// capture-off path is byte-identical (one bool test at each hash point).
+bool g_syncTerrainCapture = false;
+void setSyncTerrainCapture(bool on) { g_syncTerrainCapture = on; }
+bool syncTerrainCapture() { return g_syncTerrainCapture; }
+
+// One tile's terrain-bucket fields (compact - a Json::Value per tile would be an order
+// of magnitude of memory for a full-map ring). `doorBits` is DIAGNOSTIC only: the bucket
+// does NOT hash UFO-door open state (it lives in Tile::_objectsCache[part].currentFrame,
+// not in the map-data id/set-id the bucket reads - VERIFY-1), so it is captured here to
+// make a door divergence VISIBLE to the offline diff even though it never moves `terrain`.
+struct TerrainTileRec
+{
+	std::int32_t index;
+	std::int32_t m[O_MAX];   ///< mapDataID per part
+	std::int32_t s[O_MAX];   ///< mapDataSetID per part
+	std::int32_t explosive;
+	std::int32_t explosiveType;
+	// DIAGNOSTIC per-part door flags (NONE of these are in the terrain bucket) - 3 bits
+	// per part: isDoor(3p) / isUfoDoor(3p+1) / isUfoDoorOpen(3p+2). Captured at HASH time
+	// so the diff can tell a DOOR straddle (the lagging machine still holds a CLOSED door -
+	// isDoor set - while the other holds the opened leaf) from DESTRUCTION (isDoor clear on
+	// both, only the map-data id moves).
+	std::uint16_t doorBits;
+};
+struct TerrainCaptureEntry
+{
+	bool boundary;
+	std::uint32_t seq;
+	std::uint32_t sideSeq;
+	std::string kind;
+	std::vector<TerrainTileRec> tiles;
+};
+// Bounded like the sync ring: only the last few seqs matter for a live mismatch diff.
+const size_t TERRAIN_CAPTURE_MAX = 48;
+std::deque<TerrainCaptureEntry> g_terrainCaptureRing;
+
+// The INCLUSION TEST here MUST match computeBattleHashes()'s terrain loop exactly (a tile
+// with any map-data part OR a non-zero explosive), so the captured vector reproduces the
+// bucket hash the compare fired on. @a onlyIndex >= 0 narrows to one tile.
+static void buildTerrainVec(SavedBattleGame* battle, std::vector<TerrainTileRec>& out, int onlyIndex)
+{
+	out.clear();
+	if (!battle) return;
+	const int tileCount = battle->getMapSizeXYZ();
+	for (int i = 0; i < tileCount; ++i)
+	{
+		if (onlyIndex >= 0 && i != onlyIndex) continue;
+		Tile* tile = battle->getTile(i);
+		if (!tile) continue;
+		bool hasPart = false;
+		for (int part = 0; part < O_MAX && !hasPart; ++part)
+			hasPart = tile->getMapData((TilePart)part) != nullptr;
+		if (!(hasPart || tile->getExplosive() != 0)) continue;
+		TerrainTileRec r;
+		r.index = i;
+		r.doorBits = 0;
+		for (int part = 0; part < O_MAX; ++part)
+		{
+			int mid = -1, sid = -1;
+			tile->getMapData(&mid, &sid, (TilePart)part);
+			r.m[part] = mid;
+			r.s[part] = sid;
+			if (tile->isDoor((TilePart)part))       r.doorBits |= (std::uint16_t)(1u << (3 * part + 0));
+			if (tile->isUfoDoor((TilePart)part))    r.doorBits |= (std::uint16_t)(1u << (3 * part + 1));
+			if (tile->isUfoDoorOpen((TilePart)part)) r.doorBits |= (std::uint16_t)(1u << (3 * part + 2));
+		}
+		r.explosive = tile->getExplosive();
+		r.explosiveType = tile->getExplosiveType();
+		out.push_back(r);
+		if (onlyIndex >= 0) break;
+	}
+}
+
+static void terrainVecToJson(const std::vector<TerrainTileRec>& v, Json::Value& out)
+{
+	out = Json::Value(Json::arrayValue);
+	for (const auto& r : v)
+	{
+		Json::Value t(Json::objectValue);
+		t["i"] = r.index;
+		for (int p = 0; p < O_MAX; ++p)
+		{
+			t["m" + std::to_string(p)] = r.m[p];
+			t["s" + std::to_string(p)] = r.s[p];
+		}
+		t["expl"] = r.explosive;
+		t["explType"] = r.explosiveType;
+		t["door"] = (int)r.doorBits;
+		out.append(t);
+	}
+}
+
+void tileTerrainFullJson(Game* game, Json::Value& out, int onlyIndex)
+{
+	out = Json::Value(Json::arrayValue);
+	if (!game || !game->getSavedGame()) return;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return;
+	std::vector<TerrainTileRec> v;
+	buildTerrainVec(battle, v, onlyIndex);
+	terrainVecToJson(v, out);
+}
+
+// Capture this machine's full terrain vector for a recorded seq. Called from
+// syncCheckRecord (host ring point) and syncCheckAttach (client emit point) so both
+// sides stash the SAME sample their bucket hash was computed from. No-op unless armed.
+static void terrainCaptureRecord(Game* game, std::uint32_t seq, std::uint32_t sideSeq,
+								 bool boundary, const std::string& kind)
+{
+	if (!g_syncTerrainCapture) return;
+	if (!game || !game->getSavedGame()) return;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return;
+	TerrainCaptureEntry e;
+	e.boundary = boundary;
+	e.seq = seq;
+	e.sideSeq = boundary ? 0 : sideSeq;
+	e.kind = kind;
+	buildTerrainVec(battle, e.tiles, -1);
+	while (g_terrainCaptureRing.size() >= TERRAIN_CAPTURE_MAX)
+		g_terrainCaptureRing.pop_front();
+	g_terrainCaptureRing.push_back(std::move(e));
+}
+
+bool terrainCaptureDumpJson(std::uint32_t seq, bool boundary, int sideSeq, Json::Value& out)
+{
+	// Newest match wins: a per-side action seq recycles every side, and the newest
+	// entry with this seq belongs to the current side (the one a live mismatch is on).
+	for (auto it = g_terrainCaptureRing.rbegin(); it != g_terrainCaptureRing.rend(); ++it)
+	{
+		if (it->boundary != boundary || it->seq != seq) continue;
+		if (sideSeq >= 0 && !boundary && it->sideSeq != (std::uint32_t)sideSeq) continue;
+		out["seq"] = (Json::UInt)it->seq;
+		out["side_seq"] = (Json::UInt)it->sideSeq;
+		out["boundary"] = it->boundary;
+		out["kind"] = it->kind;
+		out["tileCount"] = (Json::UInt)it->tiles.size();
+		terrainVecToJson(it->tiles, out["tiles"]);
+		return true;
+	}
+	return false;
+}
+
+void terrainCaptureSeqsJson(Json::Value& out)
+{
+	out = Json::Value(Json::arrayValue);
+	for (const auto& e : g_terrainCaptureRing)
+	{
+		Json::Value j(Json::objectValue);
+		j["seq"] = (Json::UInt)e.seq;
+		j["side_seq"] = (Json::UInt)e.sideSeq;
+		j["boundary"] = e.boundary;
+		j["kind"] = e.kind;
+		j["tileCount"] = (Json::UInt)e.tiles.size();
+		out.append(j);
+	}
+}
+
+/**
+ * PRD-I2: the save-derived boundary hash - the coverage backstop.
+ *
+ * Serializes the battle EXACTLY as a save would (the self-contained
+ * SavedBattleGame::save writer, into memory, never disk), strips a short
+ * machine-local exclusion list by node path, and FNV-1a hashes the canonical
+ * tree. The seven sweep buckets certify the fields we enumerated; this certifies
+ * the ones we forgot, and tracks the engine automatically as `save` evolves.
+ *
+ * Cost is the serialization (est. 5-20 ms), which is why it runs ONLY at the two
+ * side boundaries and never per action. Measured into g_lastSaveBlobUs.
+ */
+bool computeSaveBlobHash(Game* game, std::uint64_t& out)
+{
+	out = 0;
+	if (!game || !game->getSavedGame()) return false;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return false;
+
+	const auto t0 = std::chrono::steady_clock::now();
+
+	// Battle document ONLY (separable: SavedBattleGame::save is self-contained), so
+	// none of the geoscape / session / RNG state a full SavedGame::save would drag
+	// in is ever hashed - it is authority-local or role-relative by construction.
+	YAML::YamlRootNodeWriter writer;
+	writer.setAsMap();
+	battle->save(writer["battle"]);
+	YAML::YamlString text = writer.emit();
+
+	// Re-parse and hash the STRUCTURE, so the exclusion list applies on the node
+	// tree (PRD-I2 2) and emit-formatting differences between the two builds cannot
+	// register as a divergence.
+	YAML::YamlRootNodeReader reader(text, "saveBlob");
+	std::uint64_t h = FNV_OFFSET;
+	saveBlobHashTree(reader["battle"], h, true);
+	out = h;
+
+	g_lastSaveBlobUs = (std::uint32_t)std::chrono::duration_cast<std::chrono::microseconds>(
+		std::chrono::steady_clock::now() - t0).count();
+	return true;
+}
+
+bool computeSaveBlobText(Game* game, std::string& out)
+{
+	out.clear();
+	if (!game || !game->getSavedGame()) return false;
+	SavedBattleGame* battle = game->getSavedGame()->getSavedBattle();
+	if (!battle) return false;
+
+	// The same serialization computeSaveBlobHash hashes: the self-contained battle
+	// document, in memory, re-parsed so emit formatting cannot register as content.
+	YAML::YamlRootNodeWriter writer;
+	writer.setAsMap();
+	battle->save(writer["battle"]);
+	YAML::YamlString text = writer.emit();
+	YAML::YamlRootNodeReader reader(text, "saveBlob");
+	saveBlobCanonicalText(reader["battle"], out, 0, true);
+	return true;
+}
+
+std::uint32_t battleHashLastSaveBlobUs()
+{
+	return g_lastSaveBlobUs;
+}
+
+void syncCheckRecord(Game* game, std::uint32_t seq, std::uint32_t sideSeq,
+					 bool boundary, const std::string& kind)
+{
+	SyncRingEntry e;
+	e.boundary = boundary;
+	e.seq = seq;
+	e.sideSeq = boundary ? 0 : sideSeq;
+	e.kind = kind;
+	e.compared = false;
+	if (!computeBattleHashes(game, e.h)) return; // no battle: nothing to remember
+	// PRD-I2: the save-derived hash is boundary-only. Per-action entries keep
+	// e.saveBlob at 0 and never ship the field, so it is compared only at
+	// boundaries; recorded here so the peer's boundary report has a match.
+	if (boundary) computeSaveBlobHash(game, e.saveBlob);
+	// PRD-I3 SEAM-7: stash this machine's full unitsStats field vector (opt-in), the
+	// SAME sample e.h was computed from, for a field-by-field mismatch diff later.
+	if (g_syncFieldCapture) unitStatsFullJson(game, e.statVec, -1);
+	// PRD-I3 SEAM-3: HOST-side terrain vector capture (opt-in), same sample as e.h.
+	terrainCaptureRecord(game, seq, sideSeq, boundary, kind);
+
+	while (g_syncRing.size() >= SYNC_RING_MAX)
+	{
+		// PRD-I0 §3: overflow drops the OLDEST, with a log. Only an entry that was
+		// never answered is worth a line - evicting a compared one is the ring
+		// doing its job.
+		if (!g_syncRing.front().compared)
+		{
+			++g_syncDropped;
+			Log(LOG_WARNING) << "[COOP] SYNC-CHECK ring overflow: dropping uncompared seq "
+							 << g_syncRing.front().seq
+							 << (g_syncRing.front().boundary ? " (boundary)" : "")
+							 << " kind=" << g_syncRing.front().kind
+							 << " - the peer has stopped reporting hashes";
+		}
+		g_syncRing.pop_front();
+	}
+	g_syncRing.push_back(e);
+	if (boundary) g_syncLastBoundarySeq = seq;
+	else g_syncLastSeq = seq;
+}
+
+void syncCheckAttach(Game* game, Json::Value& msg)
+{
+	BattleHashSet h;
+	if (!computeBattleHashes(game, h)) return;
+	Json::Value node(Json::objectValue);
+	for (int i = 0; i < BATTLE_HASH_BUCKETS; ++i)
+	{
+		node[BATTLE_HASH_NAMES[i]] = static_cast<Json::UInt64>(battleHashBucketValue(h, i));
+	}
+	msg["h"] = node;
+	// PRD-I3 Session F: flag a report whose hash was sampled while THIS machine's death
+	// replay has not converted its corpse yet. The item terms + saveBlob are then one
+	// death behind the executor's ring entry (the corpse exists on the host, not here),
+	// so the host skips those buckets for this report - the SAME rule verifyBattleChecksum
+	// applies to the P2 tripwire (corpseReplayPendingAny). Additive; an old host ignores it.
+	// PRD-I3 SEAM-11: a projectile replay in flight (_coopInitDeath) means this machine's
+	// DISPLAY replay is still running spendAmmoForAction, so a fired clip's ammoqty is
+	// transiently below the next_turn absolute (the display animation lags past the turn
+	// boundary on a backlogged client) - the SAME display-lag class as a pending corpse.
+	// Reuse the flag: the host skips items/itemIdCtr (harmless - a plain shot mints nothing)
+	// and, the point here, saveBlob, for this report; the next boundary compares them
+	// settled once the replay drains and next_turn re-ships the ammo absolute.
+	const bool coopDisplayReplay = game->getCoopMod() && game->getCoopMod()->_coopInitDeath;
+	if (corpseReplayPendingAny() || corpseRemapPendingAny() || coopDisplayReplay) msg["corpsePending"] = true;
+	// PRD-I3 SEAM-7 (opt-in): the full per-unit field vector, sampled in the SAME pass
+	// as `h`, so the host can diff a unitsStats mismatch field-by-field. Absent unless
+	// the capture toggle is armed (zero wire delta by default; an old/normal peer never
+	// sends it, and the host presence-gates on it).
+	if (g_syncFieldCapture) unitStatsFullJson(game, msg["uv"], -1);
+	// PRD-I3 SEAM-3: CLIENT-side terrain vector capture (opt-in, introspection only - NOT
+	// shipped in msg). Same sample as `h`, stashed in this machine's local ring keyed by
+	// the seq the outgoing action_done carries, so the harness can pull it back and diff
+	// it against the host's ring entry for the same seq. Boundary reports carry `bseq`.
+	if (g_syncTerrainCapture)
+	{
+		const bool boundary = msg.get("boundary", false).asBool();
+		const std::uint32_t seq = boundary
+			? static_cast<std::uint32_t>(msg.get("bseq", 0).asUInt())
+			: static_cast<std::uint32_t>(msg.get("seq", 0).asUInt());
+		const std::uint32_t sideSeq = static_cast<std::uint32_t>(msg.get("side_seq", 0).asUInt());
+		terrainCaptureRecord(game, seq, sideSeq, boundary, std::string());
+	}
+}
+
+void syncCheckAttachBoundary(Game* game, Json::Value& msg)
+{
+	// The seven fast sweep buckets first (identical to a per-action report)...
+	syncCheckAttach(game, msg);
+	if (!msg.isMember("h")) return; // no live battle
+	// ...then the boundary-only save-derived bucket. Its PRESENCE in the "h" map is
+	// what gates the host compare: a per-action report never carries it and an old
+	// peer never carries it, so both are skipped without any policy flag.
+	std::uint64_t blob = 0;
+	if (computeSaveBlobHash(game, blob))
+		msg["h"]["saveBlob"] = static_cast<Json::UInt64>(blob);
+}
+
+// PRD-I3 SEAM-7: diff the two machines' full unit-field vectors (host ring entry vs
+// peer `uv`) and record/log each disagreeing (unit, field, host, peer). Called only
+// when a unitsStats bucket term mismatched AND both vectors are present (capture on).
+static void recordSeam7FieldDiffs(const Json::Value& hostUv, const Json::Value& peerUv,
+	std::uint32_t seq, bool boundary, const std::string& kind)
+{
+	std::map<int, Json::Value> peerById;
+	for (Json::ArrayIndex i = 0; i < peerUv.size(); ++i)
+	{
+		const Json::Value& pu = peerUv[i];
+		if (pu.isObject() && pu.isMember("id")) peerById[pu["id"].asInt()] = pu;
+	}
+	for (Json::ArrayIndex i = 0; i < hostUv.size(); ++i)
+	{
+		const Json::Value& hu = hostUv[i];
+		if (!hu.isObject() || !hu.isMember("id")) continue;
+		int id = hu["id"].asInt();
+		auto it = peerById.find(id);
+		if (it == peerById.end()) continue;
+		const Json::Value& pu = it->second;
+		for (const auto& key : hu.getMemberNames())
+		{
+			if (key == "id") continue;
+			if (!pu.isMember(key)) continue;
+			const std::int64_t hv = hu[key].asInt64();
+			const std::int64_t pv = pu[key].asInt64();
+			if (hv == pv) continue;
+			if (g_syncFieldDiffs.size() >= SYNC_FIELDDIFF_MAX) g_syncFieldDiffs.pop_front();
+			SyncFieldDiff d;
+			d.seq = seq; d.boundary = boundary; d.kind = kind;
+			d.unitId = id; d.field = key; d.host = hv; d.peer = pv;
+			g_syncFieldDiffs.push_back(d);
+			Log(LOG_WARNING) << "[COOP][SEAM7] unitsStats field diff seq=" << seq
+				<< (boundary ? " (boundary)" : "") << " kind=" << (kind.empty() ? "?" : kind)
+				<< " unit=" << id << " field=" << key << " host=" << hv << " peer=" << pv;
+		}
+	}
+}
+
+// coop (option 3): the wire-order master lever, exposed from connectionTCP.cpp.
+static bool coopWireOn() { return g_wireOrderState.load(std::memory_order_relaxed); }
+// coop (RCA TRACE B): the capture-gate, exposed from connectionTCP.cpp - so the boundary
+// compare can log its decisions capture-gated (production-inert).
+static bool coopDiagCap() { return g_diagCapture.load(std::memory_order_relaxed); }
+
+// coop (option 3): record/refresh a boundary (bucket,kind) mismatch as PENDING, or return
+// true (=> ALARM NOW) if the same (bucket,kind) was already pending at an EARLIER bseq -
+// a persistent divergence confirmed at a later boundary. On alarm, stash the pending
+// (first-sight) record for the desync attribution (both records).
+static bool coopBoundaryPersistShouldAlarm(const char* bucket, const std::string& kind,
+										   std::uint32_t bseq)
+{
+	auto key = std::make_pair(std::string(bucket), kind);
+	auto it = g_syncBoundaryPending.find(key);
+	if (it == g_syncBoundaryPending.end())
+	{
+		g_syncBoundaryPending[key] = SyncBoundaryPending{ bseq, bseq, true };
+		if (coopDiagCap()) coopDiagS(std::string("TRACEB pending CREATED bucket=") + bucket
+			+ " kind=" + kind + " bseq=" + std::to_string(bseq));
+		return false; // first sight -> pending, do NOT alarm
+	}
+	if (bseq > it->second.bseq)
+	{
+		++g_syncBoundaryPersistAlarms;
+		g_syncPersistPendingSet = true;
+		g_syncPersistPendingBucket = key.first;
+		g_syncPersistPendingKind = key.second;
+		g_syncPersistPendingBseq = it->second.bseq;
+		if (coopDiagCap()) coopDiagS(std::string("TRACEB pending PROMOTE->ALARM bucket=") + bucket
+			+ " kind=" + kind + " firstBseq=" + std::to_string(it->second.bseq)
+			+ " confirmBseq=" + std::to_string(bseq));
+		return true; // still mismatched at a LATER boundary -> persistent -> alarm
+	}
+	if (coopDiagCap()) coopDiagS(std::string("TRACEB pending REFRESH-same-bseq bucket=") + bucket
+		+ " kind=" + kind + " bseq=" + std::to_string(bseq));
+	return false; // same bseq re-seen (a compare runs once per boundary) -> stay pending
+}
+
+// coop (option 3): a boundary (bucket,kind) that just compared CLEAN heals its pending
+// entry, if one exists. Logs the heal for the owner's fail-loud visibility.
+static void coopBoundaryPersistHeal(const char* bucket, const std::string& kind,
+									std::uint32_t bseq)
+{
+	auto key = std::make_pair(std::string(bucket), kind);
+	auto it = g_syncBoundaryPending.find(key);
+	if (it == g_syncBoundaryPending.end()) return;
+	Log(LOG_INFO) << "[COOP] SYNC-CHECK HEALED bucket=" << bucket << " kind=" << kind
+				  << " bseq=" << it->second.bseq << "->" << bseq;
+	if (coopDiagCap()) coopDiagS(std::string("TRACEB pending HEALED bucket=") + bucket
+		+ " kind=" + kind + " firstBseq=" + std::to_string(it->second.bseq)
+		+ " cleanBseq=" + std::to_string(bseq));
+	g_syncBoundaryPending.erase(it);
+	++g_syncBoundaryHealed;
+}
+
+void syncCheckCompare(Game* game, const Json::Value& msg)
+{
+	if (!msg.isMember("h")) return; // older peer: additive field absent = skip
+	const Json::Value& node = msg["h"];
+	if (!node.isObject()) return;
+
+	const bool boundary = msg.get("boundary", false).asBool();
+	const std::uint32_t seq = boundary
+		? static_cast<std::uint32_t>(msg.get("bseq", 0).asUInt())
+		: static_cast<std::uint32_t>(msg.get("seq", 0).asUInt());
+	const std::uint32_t sideSeq = static_cast<std::uint32_t>(msg.get("side_seq", 0).asUInt());
+	if (seq == 0) return;
+	// PRD-I3 Session F: the reporting machine's death replay had not minted its corpse when
+	// it sampled this hash, so the item terms + saveBlob are one death behind here. Mirrors
+	// verifyBattleChecksum's corpseReplayPendingAny skip. Present-gated (old peer never sets it).
+	const bool corpsePending = msg.get("corpsePending", false).asBool();
+
+	SyncRingEntry* entry = nullptr;
+	for (auto& e : g_syncRing)
+	{
+		// SUBSUMPTION. The client's report carries `_clientDisplaySeq`, which is
+		// allowed to JUMP (a parked report released by the test hold lever, or two
+		// markers consumed before an emit) - and when it does, its hash is the state
+		// after ALL of the chains it skipped, so those entries can never get an
+		// answer of their own. Closing them out here is not a fudge: it is what
+		// stops the ring's overflow warning - "the peer has stopped reporting" -
+		// from firing on chains the peer answered collectively.
+		if (e.boundary == boundary && !e.compared && e.seq < seq
+			&& (boundary || e.sideSeq == sideSeq))
+		{
+			e.compared = true;
+		}
+		// `action_seq` restarts at 0 every side, so the ACTION namespace is keyed
+		// on (side_seq, seq); the boundary namespace is monotonic per battle and
+		// needs no side. Without the side term a report that crossed a boundary in
+		// flight would be compared against a brand-new chain that happens to carry
+		// the same low seq - i.e. a guaranteed false red once a side.
+		if (e.boundary == boundary && e.seq == seq
+			&& (boundary || e.sideSeq == sideSeq))
+		{
+			entry = &e;
+			break;
+		}
+	}
+	if (!entry)
+	{
+		++g_syncStaleReports;
+		return;
+	}
+	entry->compared = true;
+	++g_syncCompares;
+	++g_syncKindCompares[entry->kind.empty() ? std::string("?") : entry->kind];
+	// FOLLOW rather than max: the action namespace restarts at 0 every side, so a
+	// max would leave the watermark stuck on the previous side's highest seq and
+	// "the loop has closed" would never be false again.
+	if (boundary) g_syncLastComparedBoundarySeq = seq;
+	else g_syncLastComparedSeq = seq;
+
+	// PRD-I3 SEAM-7: a peer that shipped the SPLIT buckets supersedes the combined
+	// unitsStats - compare the split, skip the combined (which still carries the
+	// straddle the split legitimately excludes). Absent split = OLD peer = fall back
+	// to the combined below (presence-gated, bidirectional).
+	const bool hasSplit = node.isMember("unitsCombat") || node.isMember("unitsRegen");
+	bool seam7Recorded = false;
+	bool alarm = false;
+	for (int i = 0; i < BATTLE_HASH_BUCKETS; ++i)
+	{
+		const char* name = BATTLE_HASH_NAMES[i];
+		if (!node.isMember(name)) continue; // a peer that predates this bucket
+		if (std::strcmp(name, "unitsStats") == 0 && hasSplit)
+			continue; // superseded by unitsCombat/unitsRegen (this peer shipped the split)
+		// PRD-I3 SEAM-2 HALF 1: EXCLUDE the smoke/fire hazard buckets from an ENDTURN
+		// boundary comparison - the endturn hazard sample is ill-defined (all decay
+		// runs once per cycle at neutral->player, AFTER both endturn boundaries are
+		// armed, and the host flushes the endturn boundary racing its own decay). The
+		// SIDESTART boundary keeps them (hash-after-apply of next_turn = well-defined).
+		// The client still ships every bucket in `h`; only this host-side compare skips
+		// them, so the wire is unchanged and old/new peers stay symmetric. A skipped
+		// bucket is NOT counted as compared.
+		const bool hazardBucket =
+			std::strcmp(name, "smoke") == 0 || std::strcmp(name, "fire") == 0;
+		if (boundary && hazardBucket && entry->kind == "endturn")
+		{
+			++g_syncEndturnHazardSkips;
+			continue;
+		}
+		// PRD-I3 SEAM-9 (manager sign-off 2026-08-12): the unitsRegen (turn-machine/
+		// DEFERRED-authored) bucket - tu/energy/mana/morale AND health/stun - is well-defined
+		// ONLY at SIDESTART (hash-after-apply of next_turn). During a side both machines
+		// advance it in their own prepareNewTurn / defer it under D-lite, so EVERY per-action
+		// seq (ai, expl, player) AND the endturn boundary straddle it (traced: stun off-by-1
+		// at ai/expl, morale at player seqs, downed-unit health bleed - all healed by
+		// sidestart, none ever firing at sidestart). Compare at sidestart ONLY; skip
+		// elsewhere. saveBlob (whole-save superset) and the strict chain-authored unitsCombat
+		// keep the per-action coverage. A skipped bucket is NOT counted as compared.
+		if (std::strcmp(name, "unitsRegen") == 0)
+		{
+			if (!(boundary && entry->kind == "sidestart"))
+			{
+				if (boundary && entry->kind == "endturn") ++g_syncRegenEndturnSkips;
+				else ++g_syncRegenAiSkips; // per-action (ai/expl/player) + neutral deferred skip
+				continue;
+			}
+		}
+		// PRD-I3 unitsCore side-gate (2026-08-14, Session C, manager sign-off after the
+		// field-level trace): the core bucket (id/faction/liveness/position) is well-
+		// defined at PLAYER-side per-action seqs and at SIDESTART, but NOT during the
+		// ALIEN side. There the D-lite client replays the host's alien turn one step
+		// behind its authoritative resolution, so a unit mid death/knockback/stun-
+		// collapse (ai/expl per-action seqs) and at the alien-side ENDTURN boundary
+		// transiently diverges in liveness/position - traced 2026-08-14: a full multi-
+		// packet explosion/casualty resolution differs (e.g. host health 33 / peer 0,
+		// direction varying, several units at once), always healing by sidestart/
+		// next_turn. Skip the alien per-action seqs AND the endturn boundary; keep
+		// player-side per-action (strict) + sidestart, where a PERSISTENT alien-side
+		// desync still surfaces. Mirrors the SEAM-9 unitsRegen sidestart discipline but
+		// keeps the player-side coverage that is the point of a strict liveness/position
+		// bucket. A skipped bucket is NOT counted as compared.
+		if (std::strcmp(name, "unitsCore") == 0 && !g_strictBurnIn) // PHASE D.1 lever: strict when ON
+		{
+			const bool alienSeq = !boundary && (entry->kind == "ai" || entry->kind == "expl");
+			const bool endturnBnd = boundary && entry->kind == "endturn";
+			if (alienSeq || endturnBnd)
+			{
+				if (endturnBnd) ++g_syncCoreEndturnSkips;
+				else ++g_syncCoreAlienSkips;
+				continue;
+			}
+		}
+		// PRD-I3 terrain side-gate (2026-08-14, Session E): SAME discipline as unitsCore.
+		// The SEAM-3 loose-destroy chokepoint closed the in-chain leak, but a residual
+		// destroy_tile mapDataID still lands one step behind the host's authoritative
+		// destruction during the alien-side AI/explosion replay (kind ai/expl) and at the
+		// alien-side ENDTURN boundary, healing by sidestart (traced Session E: terrain
+		// ai/endturn only, never a player seq, never sidestart). Skip the alien per-action
+		// seqs + endturn; keep player-side per-action (strict) + sidestart, where a
+		// PERSISTENT terrain divergence still surfaces. A skipped bucket is NOT compared.
+		if (std::strcmp(name, "terrain") == 0 && !g_strictBurnIn) // PHASE D.1 lever: strict when ON
+		{
+			const bool alienSeq = !boundary && (entry->kind == "ai" || entry->kind == "expl");
+			const bool endturnBnd = boundary && entry->kind == "endturn";
+			if (alienSeq || endturnBnd)
+			{
+				if (endturnBnd) ++g_syncTerrainEndturnSkips;
+				else ++g_syncTerrainAlienSkips;
+				continue;
+			}
+		}
+		// PRD-I3 Session F items/itemIdCtr side-gate (2026-08-15, manager sign-off): SAME
+		// discipline as terrain/unitsCore (see the note by g_syncItemsAlienSkips). The residual
+		// drift is the ALIEN-side display window - the D-lite client's gated alien replay lags
+		// the host's authoritative corpse resolution (ai/expl seqs + alien-side endturn),
+		// healing by sidestart. The BOUNDARY-death corpse mint is covered by the P4
+		// after_unit_death manifest (proven lockstep). Skip alien per-action + endturn; keep
+		// player-side per-action (strict) + sidestart, where a persistent drift still surfaces
+		// AND the items player-seq negative control still sees its mint. NOT counted as compared.
+		if ((std::strcmp(name, "items") == 0 || std::strcmp(name, "itemIdCtr") == 0) && !g_strictBurnIn) // PHASE D.1 lever
+		{
+			const bool alienSeq = !boundary && (entry->kind == "ai" || entry->kind == "expl");
+			const bool endturnBnd = boundary && entry->kind == "endturn";
+			// coop (TRACE B DIAGNOSTIC, RCA silent-alarm): log the per-boundary items-bucket
+			// gate decision - the reason a frozen items mismatch is never even COMPARED
+			// (and thus never pends/promotes). corpsePending :6212 is the prime suspect.
+			// Capture-gated, production-inert.
+			if (coopDiagCap() && boundary && std::strcmp(name, "items") == 0)
+			{
+				const char* decision = endturnBnd ? "SKIP-endturn"
+					: corpsePending ? (coopWireOn() && boundary ? "PEND-corpsePending" : "SKIP-corpsePending")
+					: "COMPARE";
+				coopDiagS("TRACEB items bseq=" + std::to_string(seq)
+					+ " kind=" + entry->kind + " corpsePending=" + std::to_string(corpsePending ? 1 : 0)
+					+ " -> " + decision);
+			}
+			if (alienSeq || endturnBnd)
+			{
+				if (endturnBnd) ++g_syncItemsEndturnSkips;
+				else ++g_syncItemsAlienSkips;
+				continue;
+			}
+			// The reporting machine's corpse mint was still in flight (mirrors the P2
+			// tripwire): the item terms are one death behind, heal on the next report.
+			if (corpsePending)
+			{
+				++g_syncItemsCorpsePendingSkips; // pend-instead-of-skip lever-on (renamed semantics)
+				// coop (alarm-unmask, owner ruling 2026-08-29): the Increment-8 persistence latch
+				// SUPERSEDES this corpse-pending skip's rationale AT A SIDESTART BOUNDARY. The skip
+				// predates the latch; its job was to hide a one-death-behind straddle that heals
+				// next boundary. The latch does that better: a straddle pends on first sight and
+				// HEALS on the next boundary (no alarm), while a PERSISTENT item divergence inside
+				// the corpse-mint window now correctly promotes. TRACE B (2026-08-29 RCA, docs
+				// parallel/boundary-residual-investigation-2026-08-26.md): EVERY live-drift sidestart
+				// in the heavy-death repro carried corpsePending=1, so the frozen weapon-tile drift
+				// was never even COMPARED. Lever-on + boundary: fall through to compare (the mismatch
+				// enters the latch, report-only 1st boundary). Lever-off, OR a per-action
+				// (non-boundary) report: skip byte-identically (per-action keeps immediate alarm).
+				if (!(coopWireOn() && boundary))
+					continue;
+			}
+		}
+		++g_syncBucketCompares[i];
+		if (boundary && hazardBucket && entry->kind == "sidestart")
+			++g_syncSidestartHazardCompares;
+		const std::uint64_t peer = static_cast<std::uint64_t>(node[name].asUInt64());
+		const std::uint64_t mine = battleHashBucketValue(entry->h, i);
+		if (peer == mine)
+		{
+			// coop (option 3): a boundary (bucket,kind) that was pending and now compares
+			// clean has HEALED (lever-on). Nothing else changes on a clean compare.
+			if (coopWireOn() && boundary) coopBoundaryPersistHeal(name, entry->kind, seq);
+			continue;
+		}
+
+		++g_syncBucketMismatches[i];
+		if (g_syncMismatches.size() >= SYNC_MISMATCH_MAX) g_syncMismatches.pop_front();
+		SyncMismatch m;
+		m.seq = seq;
+		m.boundary = boundary;
+		m.kind = entry->kind;
+		m.bucket = name;
+		g_syncMismatches.push_back(m);
+
+		// coop (option 3): a BOUNDARY mismatch that would alarm becomes PENDING on first
+		// sight and alarms only on persistence at a later boundary (lever-on). Per-action
+		// mismatches and the lever-off path keep IMMEDIATE alarm. Mismatch RECORDING above
+		// is untouched; only the ALARM latch + the log SUFFIX change.
+		const bool bucketAlarms = battleHashBucketAlarms(i);
+		const char* suffix;
+		if (bucketAlarms && coopWireOn() && boundary)
+		{
+			if (coopBoundaryPersistShouldAlarm(name, entry->kind, seq))
+			{ alarm = true; suffix = " [ALARM persistent]"; }
+			else suffix = " [pending-1st-boundary]";
+		}
+		else
+		{
+			if (bucketAlarms) alarm = true;
+			suffix = bucketAlarms ? " [ALARM]" : " [report-only]";
+		}
+		Log(LOG_ERROR) << "[COOP] SYNC-CHECK MISMATCH seq=" << seq
+					   << (boundary ? " (boundary)" : "")
+					   << " kind=" << (entry->kind.empty() ? "?" : entry->kind)
+					   << " bucket=" << name
+					   << " host=" << mine << " peer=" << peer
+					   << suffix;
+
+		// PRD-I3 SEAM-7: name the exact field(s) behind a unit-stats mismatch (combined
+		// OR either split bucket), once per compare, when the opt-in capture rode both
+		// this report (`uv`) and this ring entry.
+		const bool unitFamily = std::strcmp(name, "unitsStats") == 0
+			|| std::strcmp(name, "unitsCombat") == 0
+			|| std::strcmp(name, "unitsRegen") == 0;
+		if (unitFamily && !seam7Recorded && entry->statVec.isArray()
+			&& msg.isMember("uv") && msg["uv"].isArray())
+		{
+			recordSeam7FieldDiffs(entry->statVec, msg["uv"], seq, boundary, entry->kind);
+			seam7Recorded = true;
+		}
+	}
+
+	// PRD-I2: the boundary-only save-derived bucket. Presence-gated exactly like
+	// the seven above - only a boundary report from a current-build peer carries
+	// `saveBlob`, and the host recorded entry->saveBlob only for boundary entries.
+	if (node.isMember("saveBlob"))
+	{
+		// PRD-I3 saveBlob endturn straddle: SIDESTART-only compare. At an endturn
+		// boundary the whole-save hash straddles the deferred turn-machine state the
+		// D-lite client resolves only at next_turn, so the endturn saveBlob sample is
+		// ill-defined; SIDESTART (hash-after-apply of next_turn) is the well-defined
+		// point. Mirrors the SEAM-2 HALF-1 smoke/fire endturn skip - compare-site only.
+		const bool saveBlobEndturn = boundary && entry->kind == "endturn";
+		// PRD-I3 Session F: the whole-save superset includes the item census, so a corpse
+		// mint still in flight on the reporting machine straddles saveBlob too - skip it the
+		// same way (mirrors verifyBattleChecksum). Heals on the next boundary.
+		if (saveBlobEndturn) ++g_syncSaveBlobEndturnSkips;
+		else if (corpsePending && !g_strictBurnIn) ++g_syncSaveBlobCorpsePendingSkips; // PHASE D.1 lever
+		else if (boundary && entry->kind == "sidestart") ++g_syncSaveBlobSidestartCompares;
+		const std::uint64_t peer = static_cast<std::uint64_t>(node["saveBlob"].asUInt64());
+		const std::uint64_t mine = entry->saveBlob;
+		// coop (alarm-unmask, owner ruling 2026-08-29): lever-on at a SIDESTART boundary the
+		// corpse-pending straddle is handled by the persistence latch (pend-then-heal), not by
+		// hiding the compare - so compare here too. Lever-off / endturn / strict-burnin
+		// unchanged; the corpsePending SKIP counter above still counts (pend-instead-of-skip).
+		const bool saveBlobCompared = !saveBlobEndturn
+			&& (!corpsePending || g_strictBurnIn || (coopWireOn() && boundary)); // PHASE D.1 lever + alarm-unmask
+		// coop (TRACE B DIAGNOSTIC, RCA silent-alarm): the saveBlob (whole-save superset,
+		// includes the item census) per-boundary gate decision.
+		if (coopDiagCap() && boundary)
+			coopDiagS("TRACEB saveBlob bseq=" + std::to_string(seq) + " kind=" + entry->kind
+				+ " corpsePending=" + std::to_string(corpsePending ? 1 : 0)
+				+ " -> " + (saveBlobEndturn ? "SKIP-endturn"
+					: (!saveBlobCompared ? "SKIP-corpsePending"
+						: (peer == mine ? "COMPARE-clean" : "COMPARE-mismatch"))));
+		if (saveBlobCompared && peer == mine)
+		{
+			// coop (option 3): a boundary saveBlob that was pending and now compares clean has HEALED.
+			if (coopWireOn() && boundary) coopBoundaryPersistHeal("saveBlob", entry->kind, seq);
+		}
+		else if (saveBlobCompared && peer != mine)
+		{
+			++g_syncSaveBlobMismatches;
+			if (g_syncMismatches.size() >= SYNC_MISMATCH_MAX) g_syncMismatches.pop_front();
+			SyncMismatch m;
+			m.seq = seq;
+			m.boundary = boundary;
+			m.kind = entry->kind;
+			m.bucket = "saveBlob";
+			g_syncMismatches.push_back(m);
+			// coop (option 3): boundary saveBlob mismatch -> pending-then-persist (lever-on).
+			const bool sbAlarms = saveBlobAlarms();
+			const char* suffix;
+			if (sbAlarms && coopWireOn() && boundary)
+			{
+				if (coopBoundaryPersistShouldAlarm("saveBlob", entry->kind, seq))
+				{ alarm = true; suffix = " [ALARM persistent]"; }
+				else suffix = " [pending-1st-boundary]";
+			}
+			else
+			{
+				if (sbAlarms) alarm = true;
+				suffix = sbAlarms ? " [ALARM]" : " [report-only]";
+			}
+			Log(LOG_ERROR) << "[COOP] SYNC-CHECK MISMATCH seq=" << seq
+						   << (boundary ? " (boundary)" : "")
+						   << " kind=" << (entry->kind.empty() ? "?" : entry->kind)
+						   << " bucket=saveBlob host=" << mine << " peer=" << peer
+						   << suffix;
+		}
+	}
+
+	if (!alarm) return;
+
+	// ALARM route: the SAME path the PRD-P2 tripwire takes, deliberately - one
+	// latch, one banner, one bundle, whichever detector spoke.
+	g_battleDesyncSeen = true;
+	// PRD-I4: an ALARM-promoted bucket triggers the diagnostic bundle here, the
+	// same as the P2 tripwire (latched to one per battle). Today every bucket is
+	// REPORT-ONLY (BATTLE_HASH_ALARM all false), so promotion alone arms this - no
+	// further code change. The attribution comes from the sync-check's own last
+	// mismatch (buildDesyncInfo -> desyncComputeAttribution reads g_syncMismatches).
+	{
+		DesyncTerms report;
+		battleChecksumTerms(game, report.localItemId, report.localCensus, report.localUnits);
+		report.context = "sync_check";
+		captureDesyncReport(game, report);
+	}
+	SavedBattleGame* battle = game && game->getSavedGame()
+		? game->getSavedGame()->getSavedBattle() : nullptr;
+	const std::int64_t nowMs = steadyMs();
+	if (g_lastBattleNotifyMs >= 0 && nowMs - g_lastBattleNotifyMs < RESYNC_DEBOUNCE_MS) return;
+	g_lastBattleNotifyMs = nowMs;
+	if (battle)
+	{
+		if (BattlescapeState* bs = battle->getBattleState())
+		{
+			bs->warningLongRaw("CO-OP DESYNC DETECTED - SEE openxcom.log");
+		}
+	}
+}
+
+// coop (Class-A soak wedge fix, A3): the peer-liveness tripwire. Runs every tick on
+// the parallel host. A peer wedged mid-replay stops answering boundary markers, so
+// the host's boundary count (g_syncLastBoundarySeq) climbs while the last boundary
+// the peer answered (g_syncLastComparedBoundarySeq) freezes. When that gap has been
+// >= the bar continuously for the stall window, latch the SAME shared desync path the
+// drift tripwire uses (banner + one bundle) - the wedge is otherwise invisible to
+// every per-term detector, because a gone-dark peer never diverges, it just stops.
+//
+// False-fire discipline: the gap opens transiently during normal alien-side lead and
+// under speed-skew (the host runs hostile/neutral sides while a slow peer is still
+// answering), but the peer keeps answering, so the gap re-closes and the clock resets
+// every time it drops below the bar. Only a peer that genuinely stops answering holds
+// the gap for the whole window. A single slow chain cannot trip it: one chain does not
+// cross a boundary, so a slow display never grows the boundary gap (unlike a raw
+// action-backlog clock, which this deliberately is not).
+void checkPeerLiveness(Game* game)
+{
+	if (!game || !game->getSavedGame()) return;
+	connectionTCP* coop = game->getCoopMod();
+	if (!coop || !coop->getHost()) return;
+	// Parallel PVE only - the scope the wedge lives in and the scope the boundary
+	// sync-check is active in. PvP (gm 2/3) diverges by design and has no ring.
+	if (!connectionTCP::parallelTurnActive()) return;
+	if (connectionTCP::getCoopGamemode() == 2 || connectionTCP::getCoopGamemode() == 3) return;
+	if (!game->getSavedGame()->getSavedBattle()) return;
+	// This machine's one bundle per battle is already spent (the drift tripwire or an
+	// earlier liveness latch fired): nothing more to add.
+	if (g_battleDesyncSeen) return;
+
+	const std::uint32_t hostB = g_syncLastBoundarySeq;
+	const std::uint32_t peerB = g_syncLastComparedBoundarySeq;
+	const std::uint32_t gap = hostB > peerB ? hostB - peerB : 0;
+	const std::int64_t nowMs = steadyMs();
+
+	// The peer answered a NEW boundary since last tick: it is making progress (even a
+	// far-behind peer that is slowly catching up), so reset the stall clock. Only a
+	// peer that answers NOTHING for the whole window is "gone dark".
+	if (peerB != g_peerLivenessLastCompared || g_peerLivenessProgressMs < 0)
+	{
+		g_peerLivenessLastCompared = peerB;
+		g_peerLivenessProgressMs = nowMs;
+	}
+
+	if (gap < g_peerLivenessBoundaryGap)
+	{
+		g_peerLivenessProgressMs = nowMs;   // caught up - not behind, keep the clock fresh
+		return;
+	}
+	if (nowMs - g_peerLivenessProgressMs < g_peerLivenessStallMs)
+	{
+		return;   // behind, but the peer has answered a boundary within the window
+	}
+
+	// The peer is >= the bar behind AND has answered NO boundary for the whole stall
+	// window: it has gone dark (a permanent wedge, not a recoverable lag).
+	g_battleDesyncSeen = true;
+	g_peerLivenessLatched = 1;
+	Log(LOG_ERROR) << "[COOP] PEER LIVENESS LOST: the peer is " << gap
+		<< " boundaries behind (host boundary " << hostB << ", peer answered "
+		<< peerB << ") and has answered NO boundary for over "
+		<< (g_peerLivenessStallMs / 1000)
+		<< " s - it has stopped answering boundary markers (wedged mid-replay?). "
+		<< "Auto-report bundle written.";
+	{
+		DesyncTerms report;
+		battleChecksumTerms(game, report.localItemId, report.localCensus, report.localUnits);
+		report.context = "peer_liveness";
+		captureDesyncReport(game, report);
+	}
+	if (g_lastBattleNotifyMs >= 0 && nowMs - g_lastBattleNotifyMs < RESYNC_DEBOUNCE_MS) return;
+	g_lastBattleNotifyMs = nowMs;
+	if (SavedBattleGame* battle = game->getSavedGame()->getSavedBattle())
+	{
+		if (BattlescapeState* bs = battle->getBattleState())
+		{
+			bs->warningLongRaw("CO-OP PEER NOT RESPONDING - SEE openxcom.log");
+		}
+	}
+}
+
+// coop (Class-A soak wedge fix, A3 test lever): override the peer-liveness thresholds
+// so the red-capability test fires in ~seconds. boundaryGap 0 / stallMs < 0 restore
+// the shipped defaults (test teardown). Always resets the running clock.
+void setPeerLivenessThresholds(std::uint32_t boundaryGap, std::int64_t stallMs)
+{
+	g_peerLivenessBoundaryGap = boundaryGap > 0 ? boundaryGap : kPeerLivenessBoundaryGap;
+	g_peerLivenessStallMs = stallMs >= 0 ? stallMs : kPeerLivenessStallMs;
+	g_peerLivenessProgressMs = -1;
+	g_peerLivenessLastCompared = 0;
+}
+
+void syncCheckReport(Json::Value& out)
+{
+	Json::Value node(Json::objectValue);
+	node["lastSeq"] = static_cast<Json::UInt>(g_syncLastSeq);
+	node["lastComparedSeq"] = static_cast<Json::UInt>(g_syncLastComparedSeq);
+	node["lastBoundarySeq"] = static_cast<Json::UInt>(g_syncLastBoundarySeq);
+	node["lastComparedBoundarySeq"] = static_cast<Json::UInt>(g_syncLastComparedBoundarySeq);
+	// coop (Class-A soak wedge fix, A3): the peer-liveness tripwire readout. `gap` is
+	// the live boundary-answer gap the host watches; `latched` is 1 once it fired this
+	// battle; the two thresholds echo the (possibly test-overridden) firing bar.
+	node["peerLivenessGap"] = static_cast<Json::UInt>(
+		g_syncLastBoundarySeq > g_syncLastComparedBoundarySeq
+			? g_syncLastBoundarySeq - g_syncLastComparedBoundarySeq : 0);
+	node["peerLivenessLatched"] = static_cast<Json::UInt>(g_peerLivenessLatched);
+	node["peerLivenessBoundaryGap"] = static_cast<Json::UInt>(g_peerLivenessBoundaryGap);
+	node["peerLivenessStallMs"] = static_cast<Json::Int64>(g_peerLivenessStallMs);
+	node["ringDepth"] = static_cast<Json::UInt>(g_syncRing.size());
+	node["compares"] = static_cast<Json::UInt64>(g_syncCompares);
+	node["staleReports"] = static_cast<Json::UInt64>(g_syncStaleReports);
+	node["dropped"] = static_cast<Json::UInt64>(g_syncDropped);
+	node["sweepUs"] = static_cast<Json::UInt>(g_lastSweepUs);
+	Json::Value kinds(Json::objectValue);
+	for (const auto& kv : g_syncKindCompares)
+	{
+		kinds[kv.first] = static_cast<Json::UInt64>(kv.second);
+	}
+	node["comparedKinds"] = kinds;
+	// PRD-I3 SEAM-2 HALF 1: the endturn hazard exclusion + the sidestart hazard
+	// compares, so a test can assert smoke/fire are UNCOMPARED at endturn but still
+	// compared (and equal) at sidestart.
+	node["endturnHazardSkips"] = static_cast<Json::UInt64>(g_syncEndturnHazardSkips);
+	node["sidestartHazardCompares"] = static_cast<Json::UInt64>(g_syncSidestartHazardCompares);
+	// PRD-I3 SEAM-7: unitsRegen straddle exclusions (ai-seq + endturn boundary), so a
+	// test can assert unitsRegen was skipped exactly at the straddle window.
+	node["unitsRegenAiSkips"] = static_cast<Json::UInt64>(g_syncRegenAiSkips);
+	node["unitsRegenEndturnSkips"] = static_cast<Json::UInt64>(g_syncRegenEndturnSkips);
+	node["unitsCoreAlienSkips"] = static_cast<Json::UInt64>(g_syncCoreAlienSkips);
+	node["unitsCoreEndturnSkips"] = static_cast<Json::UInt64>(g_syncCoreEndturnSkips);
+	// PRD-I3 Session E: terrain alien/endturn skips (unitsCore discipline), so a test
+	// can assert exactly where the promoted terrain bucket was skipped.
+	node["terrainAlienSkips"] = static_cast<Json::UInt64>(g_syncTerrainAlienSkips);
+	node["terrainEndturnSkips"] = static_cast<Json::UInt64>(g_syncTerrainEndturnSkips);
+	// PRD-I3 Session F: items/itemIdCtr alien/endturn skips (terrain/unitsCore discipline),
+	// so a test can assert exactly where the promoted item buckets were skipped.
+	node["itemsAlienSkips"] = static_cast<Json::UInt64>(g_syncItemsAlienSkips);
+	node["itemsEndturnSkips"] = static_cast<Json::UInt64>(g_syncItemsEndturnSkips);
+	// PRD-I3 Session F: corpse-replay-pending skips (items/itemIdCtr + saveBlob), so a test
+	// can assert the sidestart straddle was a mid-flight corpse, not a persistent drift.
+	node["itemsCorpsePendingSkips"] = static_cast<Json::UInt64>(g_syncItemsCorpsePendingSkips);
+	node["saveBlobCorpsePendingSkips"] = static_cast<Json::UInt64>(g_syncSaveBlobCorpsePendingSkips);
+	// PRD-I3 saveBlob endturn straddle: the endturn saveBlob exclusion + the sidestart
+	// saveBlob compares (mirrors the hazard split above), so a test can assert saveBlob
+	// rides SIDESTART only - endturn skipped, sidestart compared.
+	node["saveBlobEndturnSkips"] = static_cast<Json::UInt64>(g_syncSaveBlobEndturnSkips);
+	node["saveBlobSidestartCompares"] = static_cast<Json::UInt64>(g_syncSaveBlobSidestartCompares);
+
+	Json::Value buckets(Json::objectValue);
+	std::uint64_t total = 0;
+	for (int i = 0; i < BATTLE_HASH_BUCKETS; ++i)
+	{
+		Json::Value b(Json::objectValue);
+		b["alarm"] = battleHashBucketAlarms(i); // EFFECTIVE (report-only override applies)
+		b["mismatchCount"] = static_cast<Json::UInt64>(g_syncBucketMismatches[i]);
+		b["compares"] = static_cast<Json::UInt64>(g_syncBucketCompares[i]);
+		buckets[BATTLE_HASH_NAMES[i]] = b;
+		total += g_syncBucketMismatches[i];
+	}
+	// PRD-I2: the eighth, boundary-only bucket. Kept out of the raw `battleHashes`
+	// sweep (harness `sync_buckets` still sees the seven) but reported here so the
+	// harness can read its report-only counter and the cost of the last serialize.
+	{
+		Json::Value sb(Json::objectValue);
+		sb["alarm"] = saveBlobAlarms(); // EFFECTIVE (report-only override applies)
+		sb["mismatchCount"] = static_cast<Json::UInt64>(g_syncSaveBlobMismatches);
+		sb["compares"] = static_cast<Json::UInt64>(g_syncSaveBlobSidestartCompares);
+		buckets["saveBlob"] = sb;
+		total += g_syncSaveBlobMismatches;
+	}
+	node["saveBlobUs"] = static_cast<Json::UInt>(g_lastSaveBlobUs);
+	node["buckets"] = buckets;
+	node["mismatchCount"] = static_cast<Json::UInt64>(total);
+
+	Json::Value list(Json::arrayValue);
+	for (const auto& m : g_syncMismatches)
+	{
+		Json::Value j(Json::objectValue);
+		j["seq"] = static_cast<Json::UInt>(m.seq);
+		j["boundary"] = m.boundary;
+		j["kind"] = m.kind;
+		j["bucket"] = m.bucket;
+		list.append(j);
+	}
+	node["mismatches"] = list;
+
+	// PRD-I3 SEAM-7: the exact per-unit field disagreements behind a unitsStats
+	// mismatch, populated only when the opt-in field capture was armed on both machines.
+	Json::Value fdiffs(Json::arrayValue);
+	for (const auto& d : g_syncFieldDiffs)
+	{
+		Json::Value j(Json::objectValue);
+		j["seq"] = static_cast<Json::UInt>(d.seq);
+		j["boundary"] = d.boundary;
+		j["kind"] = d.kind;
+		j["unit"] = d.unitId;
+		j["field"] = d.field;
+		j["host"] = static_cast<Json::Int64>(d.host);
+		j["peer"] = static_cast<Json::Int64>(d.peer);
+		fdiffs.append(j);
+	}
+	node["fieldDiffs"] = fdiffs;
+	node["fieldCapture"] = g_syncFieldCapture;
+	node["strictBurnIn"] = g_strictBurnIn; // PHASE D.1 chain-atomicity burn-in lever
+
+	out["syncCheck"] = node;
+}
+
+Json::Value desyncComputeAttribution(Game* game, const DesyncTerms& terms)
+{
+	// A peer told us: reuse the detector's attribution verbatim so both bundles agree.
+	if (terms.attribution.isObject() && !terms.attribution.empty())
+		return terms.attribution;
+
+	Json::Value a(Json::objectValue);
+	Language* lang = game ? game->getLanguage() : nullptr;
+
+	// Prefer the sync-check's own verdict: the most recent mismatch (an ALARM one if
+	// any), which names the exact seq / action kind / bucket. In classic co-op the
+	// sync-check is inert (parallelTurnActive() false) and this list is empty, so the
+	// P2 term fallback below runs instead.
+	const SyncMismatch* lastAny = nullptr;
+	const SyncMismatch* lastAlarm = nullptr;
+	for (const auto& m : g_syncMismatches)
+	{
+		lastAny = &m;
+		bool isAlarm = false;
+		for (int i = 0; i < BATTLE_HASH_BUCKETS; ++i)
+			if (m.bucket == BATTLE_HASH_NAMES[i]) isAlarm = battleHashBucketAlarms(i);
+		if (m.bucket == "saveBlob") isAlarm = saveBlobAlarms();
+		if (isAlarm) lastAlarm = &m;
+	}
+	const SyncMismatch* pick = lastAlarm ? lastAlarm : lastAny;
+	if (pick)
+	{
+		a["source"] = "sync_check";
+		a["seq"] = (Json::UInt)pick->seq;
+		a["boundary"] = pick->boundary;
+		a["kind"] = pick->kind;
+		a["bucket"] = pick->bucket;
+		// coop (option 3, 2a): if this alarm was a PERSISTENT boundary confirmation, carry the
+		// first-sight (pending) record too, so the bundle names BOTH boundaries.
+		if (g_syncPersistPendingSet)
+		{
+			Json::Value pend(Json::objectValue);
+			pend["bucket"] = g_syncPersistPendingBucket;
+			pend["kind"] = g_syncPersistPendingKind;
+			pend["bseq"] = (Json::UInt)g_syncPersistPendingBseq;
+			a["pending"] = pend;
+		}
+		std::string headline;
+		if (lang)
+			headline = lang->getString("STR_COOP_DESYNC_HEADLINE_ACTION")
+				.arg(pick->bucket).arg((int)pick->seq)
+				.arg(pick->kind.empty() ? std::string("?") : pick->kind);
+		a["headline"] = headline;
+		return a;
+	}
+
+	// Fallback: name which P2 checksum family diverged.
+	std::string which;
+	if (terms.peerItemId >= 0 && terms.peerItemId != terms.localItemId) which += "itemId ";
+	if (terms.peerCensus >= 0 && terms.peerCensus != terms.localCensus) which += "census ";
+	if (terms.peerUnits >= 0 && terms.peerUnits != terms.localUnits) which += "units ";
+	if (which.empty()) which = "unknown";
+	while (!which.empty() && which.back() == ' ') which.pop_back();
+	a["source"] = "terms";
+	a["seq"] = 0;
+	a["boundary"] = false;
+	a["kind"] = terms.context;
+	a["bucket"] = which;
+	std::string headline;
+	if (lang)
+		headline = lang->getString("STR_COOP_DESYNC_HEADLINE_TERM").arg(which);
+	a["headline"] = headline;
+	return a;
+}
+
+void desyncEmbedSyncState(Json::Value& out)
+{
+	Json::Value sc(Json::objectValue);
+	syncCheckReport(sc);              // sc["syncCheck"] = {buckets, mismatches, ...}
+	out["sync_check"] = sc["syncCheck"];
+
+	// Ring snapshot: the last ~16 recorded seqs (compared or not), oldest first.
+	Json::Value ring(Json::arrayValue);
+	const size_t maxN = 16;
+	const size_t start = g_syncRing.size() > maxN ? g_syncRing.size() - maxN : 0;
+	for (size_t i = start; i < g_syncRing.size(); ++i)
+	{
+		const SyncRingEntry& e = g_syncRing[i];
+		Json::Value j(Json::objectValue);
+		j["seq"] = (Json::UInt)e.seq;
+		j["side_seq"] = (Json::UInt)e.sideSeq;
+		j["kind"] = e.kind;
+		j["boundary"] = e.boundary;
+		j["compared"] = e.compared;
+		ring.append(j);
+	}
+	out["sync_ring"] = ring;
+}
+
+// coop (option 3, 2d): boundary-persistence introspection accessors for parallel_state.
+size_t syncBoundaryPendingSize() { return g_syncBoundaryPending.size(); }
+std::uint64_t syncBoundaryHealed() { return g_syncBoundaryHealed; }
+std::uint64_t syncBoundaryPersistAlarms() { return g_syncBoundaryPersistAlarms; }
+std::uint64_t syncBoundaryUnresolved() { return g_syncBoundaryUnresolved; }
+
+void resetSyncCheck()
+{
+	// coop (option 3, 2b): battle teardown. Any pending boundary mismatch that never got
+	// its confirmation boundary (the battle ended first) is logged ONCE and counted, but
+	// NOT alarmed - a final-boundary divergence that matters materializes in post-battle
+	// WORLD state (recovered items, soldier stats), which the geoscape world checksum still
+	// covers; one that does not materialize is discarded with the battle. This keeps the
+	// residual fail-loud-visible without inventing a new battle-end wire exchange.
+	for (const auto& kv : g_syncBoundaryPending)
+	{
+		Log(LOG_INFO) << "[COOP] SYNC-CHECK UNRESOLVED-AT-END bucket=" << kv.first.first
+					  << " kind=" << kv.first.second << " bseq=" << kv.second.bseq
+					  << " (battle ended before confirmation boundary)";
+		++g_syncBoundaryUnresolved;
+	}
+	g_syncBoundaryPending.clear();
+	g_syncBoundaryHealed = 0;
+	g_syncBoundaryPersistAlarms = 0;
+	g_syncPersistPendingSet = false;
+	g_syncPersistPendingBucket.clear();
+	g_syncPersistPendingKind.clear();
+	g_syncPersistPendingBseq = 0;
+	// g_syncBoundaryUnresolved is session-cumulative (visibility counter); not reset here.
+	g_syncRing.clear();
+	g_syncMismatches.clear();
+	for (int i = 0; i < BATTLE_HASH_BUCKETS; ++i) { g_syncBucketMismatches[i] = 0; g_syncBucketCompares[i] = 0; }
+	g_syncEndturnHazardSkips = 0;
+	g_syncSidestartHazardCompares = 0;
+	g_syncRegenAiSkips = 0;
+	g_syncRegenEndturnSkips = 0;
+	g_syncCoreAlienSkips = 0;
+	g_syncCoreEndturnSkips = 0;
+	g_syncTerrainAlienSkips = 0;
+	g_syncTerrainEndturnSkips = 0;
+	g_syncSaveBlobMismatches = 0;
+	g_syncSaveBlobEndturnSkips = 0;
+	g_syncSaveBlobSidestartCompares = 0;
+	g_syncLastSeq = 0;
+	g_syncLastComparedSeq = 0;
+	g_syncLastBoundarySeq = 0;
+	g_syncLastComparedBoundarySeq = 0;
+	// coop (Class-A soak wedge fix, A3): clear the running peer-liveness clock and its
+	// latch, and restore the shipped thresholds so a prior test's override cannot leak.
+	g_peerLivenessProgressMs = -1;
+	g_peerLivenessLastCompared = 0;
+	g_peerLivenessLatched = 0;
+	g_peerLivenessBoundaryGap = kPeerLivenessBoundaryGap;
+	g_peerLivenessStallMs = kPeerLivenessStallMs;
+	g_syncCompares = 0;
+	g_syncStaleReports = 0;
+	g_syncDropped = 0;
+	g_syncKindCompares.clear();
+	// PRD-I3 SEAM-7: per-episode field-diff diagnostics reset with the ring; the
+	// capture TOGGLE is deliberately NOT reset here (the harness arms it once per run).
+	g_syncFieldDiffs.clear();
+	// PRD-I3 SEAM-3: per-episode terrain capture ring resets with the sync ring; the
+	// terrain capture TOGGLE, like the SEAM-7 one, is armed once per run and kept.
+	g_terrainCaptureRing.clear();
+}
+
+void attachWorldChecksum(Game* game, Json::Value& msg)
+{
+	if (!game || !game->getSavedGame()) return;
+	SavedGame* save = game->getSavedGame();
+	msg["chkFunds"] = Json::Value::Int64(save->getFunds());
+	msg["chkBases"] = (int)save->getBases()->size();
+	msg["chkResearch"] = (int)save->getDiscoveredResearch().size();
+
+	// GAP-4: widen past funds/bases/research so store, roster, transfer and
+	// production drift can no longer hide from the auto-repair (funds is the only
+	// exact-VALUE field; the four below are counts). Stamp and compare MUST stay
+	// in lock-step - both go through worldAggregates().
+	int64_t items, soldiers, transfers, productions;
+	worldAggregates(save, items, soldiers, transfers, productions);
+	msg["chkItems"] = Json::Value::Int64(items);
+	msg["chkSoldiers"] = Json::Value::Int64(soldiers);
+	msg["chkTransfers"] = Json::Value::Int64(transfers);
+	msg["chkProduction"] = Json::Value::Int64(productions);
+	// issue #78: an orphaned replica mission site (a despawn the snapshot missed)
+	// must trip the auto-repair too. Count only - the restream is the repair.
+	msg["chkSites"] = (int)save->getMissionSites()->size();
+
+	// PRD-P2 3a: the battle terms ride along whenever a battle is live, so the
+	// harness' shared_checksum hook exposes them without a second command. No-op on
+	// the geoscape heartbeat, where there is no battle to stamp.
+	attachBattleChecksum(game, msg);
+}
+
+bool requestResync(Game* game, const std::string& why, bool force)
+{
+	if (!game || !game->getCoopMod() || !game->getCoopMod()->isSharedReplica()) return false;
+	if (!force && g_resyncPending) return false;
+
+	g_resyncPending = true;
+	g_lastResyncGameMin = gameMinutes(game->getSavedGame());
+	++g_resyncReqN;
+	Log(LOG_WARNING) << "[SHARED] requesting a world resync from the host (" << why
+		<< (force ? ", forced)" : ")");
+
+	Json::Value req;
+	req["state"] = "shared_resync_request";
+	game->getCoopMod()->sendTCPPacketData(req.toStyledString());
+	return true;
+}
+
+void notifyWorldAdopted()
+{
+	// A fresh authoritative world just landed: the repair took, so re-arm both the
+	// in-flight guard and the "give up" latch. The cooldown stamp stays, so a
+	// mismatch that reappears within the window is still treated as unrepairable.
+	g_resyncPending = false;
+	g_resyncGaveUp = false;
+}
+
+void verifyWorldChecksum(Game* game, const Json::Value& msg)
+{
+	if (!game || !game->getSavedGame()) return;
+	if (!msg.isMember("chkFunds")) return; // older/non-SHARED host
+	// PRD-P2 3a: the battle terms are compared on their OWN path and are deliberately
+	// NOT folded into the world condition below - that condition's repair is
+	// sharedResyncStream, and a mid-battle world restream tears down the live battle.
+	verifyBattleChecksum(game, msg, "world checksum");
+	SavedGame* save = game->getSavedGame();
+	int64_t hostFunds = msg["chkFunds"].asInt64();
+	int hostBases = msg.get("chkBases", -1).asInt();
+	int hostResearch = msg.get("chkResearch", -1).asInt();
+	// GAP-4 fields. -1 default => a host that predates this change did not stamp
+	// them; since every real aggregate is >= 0, a negative host value can ONLY
+	// mean "not sent" and must read as agreement, never a cross-version false
+	// positive. Absent-or-equal, folded into the condition below.
+	int64_t hostItems = msg.get("chkItems", -1).asInt64();
+	int64_t hostSoldiers = msg.get("chkSoldiers", -1).asInt64();
+	int64_t hostTransfers = msg.get("chkTransfers", -1).asInt64();
+	int64_t hostProductions = msg.get("chkProduction", -1).asInt64();
+	int hostSites = msg.get("chkSites", -1).asInt(); // issue #78; -1 = old host
+	int64_t myFunds = save->getFunds();
+	int myBases = (int)save->getBases()->size();
+	int myResearch = (int)save->getDiscoveredResearch().size();
+	int mySites = (int)save->getMissionSites()->size();
+	int64_t myItems, mySoldiers, myTransfers, myProductions;
+	worldAggregates(save, myItems, mySoldiers, myTransfers, myProductions);
+	if (hostFunds == myFunds && hostBases == myBases && hostResearch == myResearch
+		&& (hostItems < 0 || hostItems == myItems)
+		&& (hostSoldiers < 0 || hostSoldiers == mySoldiers)
+		&& (hostTransfers < 0 || hostTransfers == myTransfers)
+		&& (hostProductions < 0 || hostProductions == myProductions)
+		&& (hostSites < 0 || hostSites == mySites))
+	{
+		// Back in agreement: whatever drifted is gone. Re-arm the repair so a later,
+		// unrelated drift gets its own auto-resync instead of the give-up popup.
+		if (g_mismatchLogged)
+		{
+			Log(LOG_INFO) << "[SHARED] world checksum back in agreement with the host";
+			g_mismatchLogged = false;
+		}
+		g_mismatchSinceMs = -1;
+		g_resyncGaveUp = false;
+		g_lastResyncGameMin = -1;
+		return;
+	}
+
+	++g_mismatchN;
+
+	// DEBOUNCE. A single mismatching heartbeat does NOT mean the world diverged:
+	// the checksum and the shared_apply that moves it are separate packets, so any
+	// in-flight mutation shows up here as a brief skew that closes by itself a
+	// frame or two later. Only a mismatch that SURVIVES is worth a multi-megabyte
+	// world restream (which also replaces the replica's whole state stack). At the
+	// heartbeat's ~2 kHz this still detects a real desync in a couple of seconds.
+	const int64_t nowMs = steadyMs();
+	if (g_mismatchSinceMs < 0) g_mismatchSinceMs = nowMs;
+	if (nowMs - g_mismatchSinceMs < RESYNC_DEBOUNCE_MS) return;
+
+	if (!g_mismatchLogged)
+	{
+		// once per episode - see g_mismatchLogged
+		g_mismatchLogged = true;
+		Log(LOG_WARNING) << "[SHARED] world checksum mismatch (persisted "
+			<< RESYNC_DEBOUNCE_MS << "ms): "
+			<< "funds host=" << hostFunds << " replica=" << myFunds
+			<< ", bases host=" << hostBases << " replica=" << myBases
+			<< ", research host=" << hostResearch << " replica=" << myResearch
+			<< ", items host=" << hostItems << " replica=" << myItems
+			<< ", soldiers host=" << hostSoldiers << " replica=" << mySoldiers
+			<< ", transfers host=" << hostTransfers << " replica=" << myTransfers
+			<< ", production host=" << hostProductions << " replica=" << myProductions
+			<< ", sites host=" << hostSites << " replica=" << mySites;
+	}
+
+	const int64_t now = gameMinutes(save);
+	const bool cooling = (g_lastResyncGameMin >= 0 && now >= 0
+		&& now - g_lastResyncGameMin < RESYNC_COOLDOWN_MINUTES);
+
+	if (g_resyncPending)
+	{
+		// A restream is already on the wire: every heartbeat until it lands still
+		// mismatches, and re-asking would queue a second serialization of the whole
+		// world on the host. Wait for it - but not forever: if the host dropped the
+		// request (its single-slot streamer was busy) the guard expires with the
+		// cooldown and the next mismatch re-asks.
+		if (cooling) return;
+		g_resyncPending = false;
+	}
+
+	if (cooling)
+	{
+		// A resync DID land and we are diverging again inside the cooldown: the
+		// auto-repair does not stick, so something is drifting faster than a
+		// restream can heal it. Stop looping on multi-megabyte world streams and
+		// hand it to the player.
+		if (!g_resyncGaveUp)
+		{
+			g_resyncGaveUp = true;
+			Log(LOG_ERROR) << "[SHARED] world desync persisted through an auto-resync"
+				<< " (within " << RESYNC_COOLDOWN_MINUTES << " game minutes);"
+				<< " automatic repair disabled - advise the host to save and reload";
+			showFail(game, "Desync repair failed. Ask the host to save and reload the campaign.");
+		}
+		return;
+	}
+
+	requestResync(game, "world checksum mismatch");
+}
+
+ResyncStats resyncStats()
+{
+	ResyncStats s;
+	s.mismatches = g_mismatchN.load();
+	s.requests = g_resyncReqN.load();
+	s.pending = g_resyncPending;
+	s.gaveUp = g_resyncGaveUp;
+	s.lastGameMin = g_lastResyncGameMin;
+	return s;
+}
+
+void resetResyncStats()
+{
+	g_mismatchN = 0;
+	g_resyncReqN = 0;
+	g_resyncPending = false;
+	g_resyncGaveUp = false;
+	g_mismatchLogged = false;
+	g_mismatchSinceMs = -1;
+	g_lastResyncGameMin = -1;
+	resetBattleDesyncSeen(); // PRD-P2: same "clear the diagnostics" request
+	resetSyncCheck();        // PRD-I0: and the per-action detector's ring + latches
+}
+
+// ---- PRD-P4: Tier-A spawn id-manifest ----------------------------------------
+// See SharedEcon.h for what a Tier-A spawn is and why the ids have to be shipped.
+namespace {
+
+struct CoopSpawnKey
+{
+	std::string action;
+	int subject;
+	bool operator<(const CoopSpawnKey& o) const
+	{
+		if (action != o.action) return action < o.action;
+		return subject < o.subject;
+	}
+};
+
+struct CoopSpawnEntry
+{
+	std::deque<int> ids;   // not yet consumed, in creation order
+	int maxHostId = -1;    // highest id the manifest EVER held (survives popping)
+};
+
+/// Parked id lists. TRANSIENT - nothing here is ever serialised, and every entry
+/// is dropped at the latest by the next turn boundary (clearSpawnManifests).
+std::map<CoopSpawnKey, CoopSpawnEntry> g_spawnManifest;
+
+/// Counter re-slave, applied AFTER a manifest has been consumed - never before.
+/// Order matters: the peer's factories still mint a local id first and only then
+/// adopt the host's, so bumping the counter up front would push that local mint
+/// one past where the host's went and leave the counters permanently one apart.
+/// Same rule SavedBattleGame's loader applies to a save's item ids. Only ever
+/// moves FORWARD, so it can only close a gap, never open one.
+void reslaveItemCounter(SavedBattleGame* battle, int maxHostId,
+						const std::string& action, int subject)
+{
+	if (!battle || maxHostId < 0) return;
+	int* counter = battle->getCurrentItemId();
+	if (!counter || *counter >= maxHostId + 1) return;
+	Log(LOG_INFO) << "[COOP] id-manifest: item-id counter re-slaved " << *counter << " -> "
+				  << (maxHostId + 1) << " (" << action << " subject " << subject << ")";
+	*counter = maxHostId + 1;
+}
+
+/// A frame is one OPEN record (host, appending) or guard (peer, consuming). A
+/// STACK, not a single "active subject": the guards are per call by design, and a
+/// nested spawn must not silently steal the outer one's ids (hole H2).
+struct CoopSpawnFrame
+{
+	CoopSpawnKey key;
+	bool consuming; // false = host record, true = peer guard
+	int adopted = 0; // peer: how many host ids this scope has taken
+	// PRD-P10: the peer's battle, so noteMintedItem can hand back the local id an
+	// adoption just wasted (see there).
+	SavedBattleGame* battle = nullptr;
+};
+std::vector<CoopSpawnFrame> g_spawnFrames;
+
+/// A runaway store would be a slow leak, not a desync - but a bound makes that
+/// impossible to miss instead of impossible to see.
+const size_t kMaxParkedManifests = 64;
+
+/// PRD-P10: units whose corpse replay is pushed but has not converted yet. See
+/// SharedEcon.h's noteCorpseReplayPending for the double-death shape.
+std::set<int> g_corpseReplayPending;
+
+/// PRD-I3 Session F: units whose corpse this CLIENT minted with LOCAL ids (no host
+/// manifest was available at mint, so path a could not adopt) and whose host ids have
+/// not yet arrived on `after_unit_death`. The corpse id/counter is drifted in this
+/// window (when the counter was already off), so the per-action sync-check would fire
+/// items/itemIdCtr at a PLAYER-side casualty seq (window 2, complementing the
+/// corpseReplayPending window 1 which is cleared just BEFORE the mint). Cleared when
+/// `after_unit_death` reconciles the unit (remapCorpseIds) or at the turn boundary.
+std::set<int> g_corpseRemapPending;
+
+/// coop (item 3, mint-at-apply introspection): how many times each window armed this
+/// battle. See SharedEcon.h corpseReplayArmedCount/corpseRemapArmedCount. Reset with
+/// the pending sets at battle teardown (clearSpawnManifests does NOT touch them - they
+/// are cumulative evidence, cleared only when a fresh battle re-zeroes statics).
+std::uint32_t g_corpseReplayArmed = 0;
+std::uint32_t g_corpseRemapArmed = 0;
+
+} // namespace
+
+CoopSpawnRecord::CoopSpawnRecord(const char* action, int subject) : _open(false)
+{
+	if (!connectionTCP::getCoopStatic() || !connectionTCP::getHost()) return;
+
+	CoopSpawnKey key{action ? action : "", subject};
+	// A record OWNS its key for the duration: start from empty, so a repeat of the
+	// same action on the same subject never appends onto an unflushed tail.
+	g_spawnManifest[key] = CoopSpawnEntry();
+	g_spawnFrames.push_back(CoopSpawnFrame{key, false, 0});
+	_open = true;
+}
+
+CoopSpawnRecord::~CoopSpawnRecord()
+{
+	if (!_open) return;
+	if (!g_spawnFrames.empty()) g_spawnFrames.pop_back();
+	// The ids stay parked: flushSpawnRecord() is what ships and drops them.
+}
+
+CoopSubjectGuard::CoopSubjectGuard(SavedBattleGame* battle, const char* action, int subject)
+	: _open(false), _battle(battle), _action(action ? action : ""), _subject(subject)
+{
+	if (!connectionTCP::getCoopStatic() || connectionTCP::getHost()) return;
+
+	g_spawnFrames.push_back(CoopSpawnFrame{CoopSpawnKey{_action, _subject}, true, 0, battle});
+	_open = true;
+}
+
+CoopSubjectGuard::~CoopSubjectGuard()
+{
+	if (!_open) return;
+	int adopted = 0;
+	if (!g_spawnFrames.empty())
+	{
+		adopted = g_spawnFrames.back().adopted;
+		g_spawnFrames.pop_back();
+	}
+	if (adopted > 0)
+	{
+		// One line per applied manifest, mirroring remapCorpseIds - positive
+		// evidence that the consume-on-create path RAN, which "the ids happened to
+		// agree anyway" cannot give on its own.
+		Log(LOG_INFO) << "[COOP] id-manifest: " << _action << " manifest for subject "
+					  << _subject << " applied - " << adopted << " id(s) adopted on create";
+	}
+
+	CoopSpawnKey key{_action, _subject};
+	auto it = g_spawnManifest.find(key);
+	if (it != g_spawnManifest.end())
+	{
+		if (!it->second.ids.empty())
+		{
+			Log(LOG_INFO) << "[COOP] id-manifest: " << it->second.ids.size() << " host id(s) left over "
+						  << "after replaying " << _action << " for subject " << _subject
+						  << " - this machine created fewer items than the host did";
+		}
+		reslaveItemCounter(_battle, it->second.maxHostId, _action, _subject);
+		g_spawnManifest.erase(it);
+	}
+
+	// PRD-I3 Session F window 2: a corpse this replay minted with NO host manifest in
+	// hand (adopted == 0) carries LOCAL ids until `after_unit_death` remaps them - so a
+	// per-action items/itemIdCtr compare in that window would false-fire on a PLAYER-side
+	// casualty. Mark the unit; the after_unit_death handler clears it. (adopted > 0 means
+	// path a already stamped the host's ids at mint, so there is no drift and no mark.)
+	if (_action == "corpse" && adopted == 0)
+	{
+		// coop (item 3, mint-at-apply introspection): window 2 armed - this peer minted
+		// the corpse with LOCAL ids (no host manifest at create). On the parallel replay
+		// client the mint-at-apply path parks the manifest before this guard runs, so
+		// adopted>0 and this branch is never taken; a non-zero count is the OLD animation-
+		// clock mint (a classic client, or a pre-item-3 build).
+		if (g_corpseRemapPending.insert(_subject).second) ++g_corpseRemapArmed;
+	}
+}
+
+void noteMintedItem(BattleItem* item)
+{
+	// The overwhelmingly common case, and the only one on the hot path: no Tier-A
+	// spawn is in progress (and in a single-player game there never is one).
+	if (g_spawnFrames.empty() || !item) return;
+
+	CoopSpawnFrame& frame = g_spawnFrames.back();
+	auto it = g_spawnManifest.find(frame.key);
+	if (!frame.consuming)
+	{
+		if (it == g_spawnManifest.end())
+		{
+			it = g_spawnManifest.emplace(frame.key, CoopSpawnEntry()).first;
+		}
+		it->second.ids.push_back(item->getId());
+		return;
+	}
+
+	// Peer: adopt the host's id for this position in the creation order. Running
+	// dry is not an error worth shouting about - it is exactly what an older host
+	// (no manifest at all) looks like.
+	if (it == g_spawnManifest.end() || it->second.ids.empty()) return;
+	const int hostId = it->second.ids.front();
+	it->second.ids.pop_front();
+	++frame.adopted;
+	const int localId = item->getId();
+	if (hostId != localId)
+	{
+		Log(LOG_INFO) << "[COOP] id-manifest: " << frame.key.action << " subject "
+					  << frame.key.subject << " - re-stamping local item " << localId
+					  << " as host item " << hostId;
+	}
+	item->setIdCoop(hostId);
+
+	// PRD-P10: hand the wasted local id BACK.
+	//
+	// The factory minted `localId` and bumped the counter past it; adopting the
+	// host's id leaves that number unused here and used nowhere on the host, so
+	// keeping the counter past it puts the peer permanently one ahead. It only
+	// shows when the adopted id is LOWER than the local one - i.e. when the two
+	// machines created this Tier-A batch in a different ORDER, which is exactly
+	// what a peer whose death replays are queued behind an animation does. The
+	// counter is only rolled back when `localId` is provably the last id minted;
+	// reslaveItemCounter still pushes it forward afterwards, so this can only
+	// close a gap the peer opened, never hand out an id twice.
+	if (hostId != localId && frame.battle)
+	{
+		int* counter = frame.battle->getCurrentItemId();
+		if (counter && *counter == localId + 1)
+		{
+			*counter = localId;
+		}
+	}
+}
+
+void flushSpawnRecord(Json::Value& root, const char* action, int subject)
+{
+	CoopSpawnKey key{action ? action : "", subject};
+	auto it = g_spawnManifest.find(key);
+	if (it == g_spawnManifest.end()) return;
+	if (!it->second.ids.empty())
+	{
+		Json::Value ids(Json::arrayValue);
+		for (int id : it->second.ids) ids.append(id);
+		root["minted_ids"] = ids;
+		Log(LOG_INFO) << "[COOP] id-manifest: shipping " << it->second.ids.size() << " "
+					  << key.action << " id(s) for subject " << subject;
+	}
+	g_spawnManifest.erase(it);
+}
+
+bool storeSpawnManifest(SavedBattleGame* battle, const char* action, int subject,
+						const Json::Value& root)
+{
+	if (!root.isMember("minted_ids")) return false; // older host: nothing to adopt
+	const Json::Value& ids = root["minted_ids"];
+	if (!ids.isArray() || ids.empty()) return false;
+
+	if (g_spawnManifest.size() > kMaxParkedManifests)
+	{
+		Log(LOG_ERROR) << "[COOP] id-manifest: " << g_spawnManifest.size()
+					   << " manifests parked and never consumed - dropping them all";
+		g_spawnManifest.clear();
+	}
+
+	CoopSpawnEntry parked;
+	for (Json::ArrayIndex i = 0; i < ids.size(); ++i)
+	{
+		const int id = ids[i].asInt();
+		parked.ids.push_back(id);
+		if (id > parked.maxHostId) parked.maxHostId = id;
+	}
+	g_spawnManifest[CoopSpawnKey{action ? action : "", subject}] = parked;
+	// NOTE: the counter is NOT re-slaved here. It is re-slaved once the manifest has
+	// been APPLIED (the guard's destructor, or the end of remapCorpseIds) - see
+	// reslaveItemCounter for why doing it up front is off by one.
+	(void)battle;
+	return true;
+}
+
+void noteCorpseReplayPending(int unitId)
+{
+	if (!connectionTCP::getCoopStatic() || connectionTCP::getHost()) return;
+	if (g_corpseReplayPending.insert(unitId).second) ++g_corpseReplayArmed;
+}
+
+void clearCorpseReplayPending(int unitId)
+{
+	g_corpseReplayPending.erase(unitId);
+}
+
+bool corpseReplayPending(int unitId)
+{
+	return g_corpseReplayPending.count(unitId) != 0;
+}
+
+bool corpseReplayPendingAny()
+{
+	return !g_corpseReplayPending.empty();
+}
+
+void clearCorpseRemapPending(int unitId)
+{
+	g_corpseRemapPending.erase(unitId);
+}
+
+bool corpseRemapPendingAny()
+{
+	return !g_corpseRemapPending.empty();
+}
+
+std::uint32_t corpseReplayArmedCount()
+{
+	return g_corpseReplayArmed;
+}
+
+std::uint32_t corpseRemapArmedCount()
+{
+	return g_corpseRemapArmed;
+}
+
+int remapCorpseIds(SavedBattleGame* battle, int unitId)
+{
+	if (!battle) return 0;
+	CoopSpawnKey key{"corpse", unitId};
+	auto it = g_spawnManifest.find(key);
+	if (it == g_spawnManifest.end() || it->second.ids.empty()) return 0;
+
+	// PRD-P10: the replay is still queued, so every BT_CORPSE item this unit owns
+	// right now pre-dates this death (the body item of an earlier knockout). Leave
+	// the manifest parked - the CoopSubjectGuard inside the replay's
+	// convertUnitToCorpse (path a) is the one that must consume it.
+	if (g_corpseReplayPending.count(unitId))
+	{
+		Log(LOG_INFO) << "[COOP] id-manifest: corpse manifest for unit " << unitId
+					  << " parked - this machine's death replay has not converted yet";
+		return 0;
+	}
+
+	// _items is append-ordered, so this walk yields the corpses in the order
+	// UnitDieBState created them - which is the order the host recorded them in.
+	std::vector<BattleItem*> corpses;
+	for (BattleItem* item : *battle->getItems())
+	{
+		if (!item || !item->getRules()) continue;
+		if (item->getRules()->getBattleType() != BT_CORPSE) continue;
+		const BattleUnit* owner = item->getUnit();
+		if (owner && owner->getId() == unitId) corpses.push_back(item);
+	}
+	if (corpses.empty())
+	{
+		// Not an error: the replay has not created them yet, so the guard around
+		// that creation (path a) is the one that will consume this manifest.
+		return 0;
+	}
+
+	if (corpses.size() != it->second.ids.size())
+	{
+		Log(LOG_ERROR) << "[COOP] id-manifest: unit " << unitId << " has " << corpses.size()
+					   << " corpse item(s) here but the host minted " << it->second.ids.size()
+					   << " - re-stamping the common prefix only";
+	}
+	int n = 0, changed = 0;
+	for (BattleItem* corpse : corpses)
+	{
+		if (it->second.ids.empty()) break;
+		const int hostId = it->second.ids.front();
+		it->second.ids.pop_front();
+		if (hostId != corpse->getId())
+		{
+			Log(LOG_INFO) << "[COOP] id-manifest: corpse of unit " << unitId
+						  << " re-stamped " << corpse->getId() << " -> " << hostId;
+			++changed;
+		}
+		corpse->setIdCoop(hostId);
+		++n;
+	}
+	// One line per applied manifest, always: "0 re-stamped" is the healthy answer
+	// and is the only positive evidence that the pilot ran at all.
+	Log(LOG_INFO) << "[COOP] id-manifest: corpse manifest for unit " << unitId << " applied - "
+				  << n << " corpse(s), " << changed << " re-stamped";
+	reslaveItemCounter(battle, it->second.maxHostId, key.action, unitId);
+	g_spawnManifest.erase(it);
+	return n;
+}
+
+void clearSpawnManifests()
+{
+	// PRD-P10: a corpse manifest whose death replay is still QUEUED on this
+	// machine is not stale - it is the id list that replay is about to adopt
+	// (path a). The turn boundary crosses in the middle of a death routinely (the
+	// alien side's last casualty dies a frame or two before the side closes), and
+	// dropping it there left the peer minting its own corpse ids off a counter
+	// the host had already moved past.
+	size_t kept = 0, dropped = 0;
+	for (auto it = g_spawnManifest.begin(); it != g_spawnManifest.end(); )
+	{
+		if (it->first.action == "corpse" && g_corpseReplayPending.count(it->first.subject))
+		{
+			++kept;
+			++it;
+			continue;
+		}
+		it = g_spawnManifest.erase(it);
+		++dropped;
+	}
+	if (dropped)
+	{
+		Log(LOG_INFO) << "[COOP] id-manifest: dropping " << dropped
+					  << " manifest(s) that were never consumed";
+	}
+	if (kept)
+	{
+		Log(LOG_INFO) << "[COOP] id-manifest: keeping " << kept
+					  << " manifest(s) whose death replay has not converted yet";
+	}
+	// Hygiene for the pending flags themselves: one with nothing parked behind it
+	// can no longer be waiting for a manifest (a respawn took convertUnit instead,
+	// a chain was torn down), so it would only keep exempting this unit from the
+	// tile repair forever.
+	for (auto it = g_corpseReplayPending.begin(); it != g_corpseReplayPending.end(); )
+	{
+		if (g_spawnManifest.count(CoopSpawnKey{"corpse", *it}))
+		{
+			++it;
+		}
+		else
+		{
+			it = g_corpseReplayPending.erase(it);
+		}
+	}
+	// PRD-I3 Session F window 2 (safety): by a turn boundary every death's
+	// `after_unit_death` has crossed (it is sent at the death's deinit, within the side),
+	// so any lingering remap-pending mark is stale - clear it so items/itemIdCtr are never
+	// skipped past the death that set it.
+	g_corpseRemapPending.clear();
 }
 
 } // namespace SharedEcon
diff --git a/src/CoopMod/SharedEcon.h b/src/CoopMod/SharedEcon.h
index a9108d2e4..14a3e66c6 100644
--- a/src/CoopMod/SharedEcon.h
+++ b/src/CoopMod/SharedEcon.h
@@ -35,6 +35,8 @@ class Ufo;
 class Target;
 class Soldier;
 class AlienBase;
+class BattleItem;
+class SavedBattleGame;
 
 /**
  * PRD-J03: the generic SHARED economy command protocol.
@@ -366,6 +368,311 @@ void submitLandReply(Game* game, Craft* craft, bool yes, bool patrol);
 void attachWorldChecksum(Game* game, Json::Value& msg);
 void verifyWorldChecksum(Game* game, const Json::Value& msg);
 
+// ---- PRD-P2: battlescape drift tripwire --------------------------------------
+// INV: after every replicated action the two machines hold identical
+// (id -> BattleItem) maps AND equal SavedBattleGame::_itemId counters. It holds at
+// generation (both machines generate the same map deterministically) and is the
+// first thing to drift once they simulate independently - a peer-side
+// `new BattleItem`, an un-scoped transient mint or a lost item moves one of the two
+// terms below.
+//
+// Three terms, all cheap:
+//   chkBattleItemId = SavedBattleGame::_itemId, the next id this machine will mint.
+//   chkBattleCensus = SUM over getItems() of FNV-1a(type) mixed with the item id and
+//                     its owner unit id. A sum, not a rolling hash, so the vector
+//                     ORDER - which is not replicated - cannot matter.
+//   chkBattleUnits  = the same shape over getUnits(): id, faction, WHERE the unit is
+//                     and WHETHER IT IS DOWN. See battleChecksumTerms() for the field
+//                     selection and, more importantly, for what is deliberately left
+//                     out - a term that hashes something the protocol does not
+//                     replicate is a permanent red, not a detector.
+// Negative = "not stamped" = agree, the same convention the world checksum uses for
+// its GAP-4 fields, so a peer that predates this can never raise a false positive.
+// The three are independent: the item terms cannot see a unit that died on one
+// machine only until it drops a corpse, and the unit term cannot see an item at all.
+//
+// DETECTION ONLY. A mid-battle sharedResyncStream is impossible (the world restream
+// replaces the whole state stack, live battle included), so a mismatch logs,
+// notifies at most once per RESYNC_DEBOUNCE_MS through the in-battle warning banner
+// and raises battleDesyncSeen() for the harness. Prevention is PRD-P3/P4's job.
+
+/// Computes this machine's three battle terms. Returns false (and sets all three to
+/// -1) when no battle is live - which is what makes every caller geoscape-safe.
+bool battleChecksumTerms(Game* game, int64_t& itemIdCounter, int64_t& census,
+						 int64_t& units);
+/// Stamps chkBattleItemId / chkBattleCensus / chkBattleUnits onto @a msg. No-op
+/// without a battle.
+void attachBattleChecksum(Game* game, Json::Value& msg);
+/// Compares a peer's stamped terms against this machine's battle and reports a
+/// mismatch. @a context names the packet that carried them (for the log line).
+/// Never triggers a resync - see the note above.
+void verifyBattleChecksum(Game* game, const Json::Value& msg, const std::string& context);
+/// Harness: has the battle tripwire fired on this machine? A LATCH - once a battle
+/// has been seen to drift, the report stands for the rest of the session; nothing
+/// in a battle clears it (co-op re-arms _battleInit every turn, so that is NOT a
+/// battle-start hook). resetBattleDesyncSeen(), and therefore resetResyncStats() /
+/// the harness' shared_reset_resync_stats, is the only way to clear it.
+bool battleDesyncSeen();
+void resetBattleDesyncSeen();
+
+/// coop (Class-A soak wedge fix, A3): the peer-liveness tripwire. Called every tick
+/// from the host's updateCoopTask; latches the shared desync path when the peer stops
+/// answering boundary markers for a sustained window (a wedged-mid-replay peer goes
+/// silent, so no per-term detector fires). Host-only / PVE-only / self-guarded.
+void checkPeerLiveness(Game* game);
+/// Test lever: override the peer-liveness firing bar (boundaryGap 0 / stallMs < 0
+/// restore the shipped defaults). Set from the TestServer so the red-capability test
+/// fires in seconds rather than the shipped tens of seconds.
+void setPeerLivenessThresholds(std::uint32_t boundaryGap, std::int64_t stallMs);
+
+// ---- PRD-I0: per-action sequenced sync-check ---------------------------------
+//
+// The tripwire above is a TURN-grained detector: three terms, stamped once per
+// `next_turn`, compared before the bulk apply. It answers "did the two battles
+// drift?" and nothing more - by the time it speaks, a whole side of actions is
+// the suspect list.
+//
+// I0 makes the same question per-ACTION. Every admitted chain already carries a
+// host-owned `action_seq` (PRD-P6/P7) and already has ONE well-defined drain
+// point per machine: the executor's `coopCloseActionChain()` and the client's
+// `coopEmitActionDone()`. "The state after action N" is therefore well-defined
+// on both machines - at different wall-clock times, which is exactly why the
+// comparison is DEFERRED rather than a barrier:
+//
+//   host   : at its drain, computeBattleHashes() -> push {seq, kind, hashes}
+//            into a 64-deep ring.
+//   client : at its drain, computeBattleHashes() -> attach the set to the
+//            `action_done {seq, seat}` it was going to send anyway (field "h").
+//   host   : on receipt, look the seq up in the ring and compare PER BUCKET.
+//
+// No new packets, no admission coupling, no barrier. A missing "h" is an older
+// peer and the host simply skips the compare.
+//
+// BUCKETS, not one number: a single hash says only THAT something moved. Seven
+// independent sums say which FAMILY moved, which is the difference between a
+// bug report and a bisect. Each bucket is either ALARM (a mismatch fires the
+// existing battleDesyncSeen() path) or REPORT-ONLY (logged and counted). The
+// promotion table is a compile-time constant - see BATTLE_HASH_ALARM.
+//
+// SEMANTICS OF THE TWO HASH FAMILIES, which are deliberately different:
+//   * per-action seqs are hash-AFTER-drain on both machines. Both are "the state
+//     once this chain finished", which is the only moment they can agree.
+//   * boundary pseudo-seqs (the side-close phase group and the side-start /
+//     prepareNewTurn group) are hash-AFTER-APPLY on the client - it hashes once
+//     it has consumed the marker that follows `fuse_events` / `next_turn`, i.e.
+//     with the host's boundary state already in place. That is the OPPOSITE of
+//     the legacy tripwire above, which compares BEFORE `next_turn`'s bulk apply
+//     precisely so the apply cannot silence it. Both are correct for what they
+//     watch: the tripwire wants the pre-repair divergence, the sync-check wants
+//     a post-boundary state both machines can agree on so the NEXT action's
+//     comparison starts from a common baseline. The tripwire is untouched.
+
+/// The bucket registry. One sweep of the battle fills all seven; every term is an
+/// order-independent SUM of FNV-1a mixes, for the same reason the tripwire's terms
+/// are (neither `_items` nor `_units` nor the tile array order is replicated).
+struct BattleHashSet
+{
+	std::uint64_t terrain;     ///< per tile: the four TilePart map-data ids + explosive
+	std::uint64_t fire;        ///< per tile: turns of fire remaining
+	std::uint64_t smoke;       ///< per tile: turns of smoke remaining (+ overlaps)
+	std::uint64_t items;       ///< id, type, owner, slot, tile pos, fuse - the strict census
+	std::uint64_t unitsCore;   ///< id, faction, liveness, position (the chkBattleUnits set)
+	std::uint64_t unitsStats;  ///< legacy COMBINED unit stats (old-peer wire compat)
+	std::uint64_t unitsCombat; ///< PRD-I3 SEAM-7: chain-authored: health,stun,w0-5,morale,fire,kneel,mc
+	std::uint64_t unitsRegen;  ///< PRD-I3 SEAM-7: turn-machine-authored: tu,energy,mana
+	std::uint64_t itemIdCtr;   ///< SavedBattleGame::getCurrentItemIdValue()
+};
+
+/// How many buckets a BattleHashSet holds.
+const int BATTLE_HASH_BUCKETS = 9;
+/// Wire/introspection name of bucket @a i (0..BATTLE_HASH_BUCKETS-1).
+const char* battleHashBucketName(int i);
+/// Value of bucket @a i.
+std::uint64_t battleHashBucketValue(const BattleHashSet& h, int i);
+/// PROMOTION TABLE. true = a mismatch in this bucket fires battleDesyncSeen()
+/// (banner + the I4 bundle); false = REPORT-ONLY, logged and counted.
+bool battleHashBucketAlarms(int i);
+/// PRD-I3 Session F: the effective saveBlob alarm (SAVEBLOB_ALARM minus the override).
+bool saveBlobAlarms();
+/// PRD-I3 Session F (test-only): force a named bucket ("terrain".."unitsRegen" or
+/// "saveBlob") back to REPORT-ONLY (true) or restore it (false), so the all-promoted
+/// build still has a discriminating negative control. Returns true if the name matched.
+bool setBattleHashReportOnlyOverride(const std::string& name, bool on);
+
+/// ONE sweep of the live battle filling every bucket. Returns false (and zeroes
+/// @a out) when no battle is live, which is what makes every caller geoscape-safe.
+bool computeBattleHashes(Game* game, BattleHashSet& out);
+/// Microseconds the last computeBattleHashes() sweep took (harness cost report).
+std::uint32_t battleHashLastSweepUs();
+/// PRD-I2: FNV-1a hash of the canonical battle-document serialization, minus a
+/// SHORT machine-local exclusion list. Boundary-only (est. 5-20 ms) - the coverage
+/// backstop for state the per-action sweep does not enumerate. Returns false and
+/// zeroes @a out when no battle is live.
+bool computeSaveBlobHash(Game* game, std::uint64_t& out);
+/// PRD-I4 (test-only lever): the canonical, exclusion-stripped battle-document text
+/// that computeSaveBlobHash() hashes - so a saveBlob mismatch diagnosis is a diff of
+/// the two machines' dumps. Returns false when no battle is live.
+bool computeSaveBlobText(Game* game, std::string& out);
+/// Microseconds the last computeSaveBlobHash() serialization took (harness cost).
+std::uint32_t battleHashLastSaveBlobUs();
+
+/// HOST: remember "the state after this chain" so a peer report can be compared
+/// against it later. @a boundary selects the boundary pseudo-seq namespace (which
+/// is monotonic per battle) instead of the per-side `action_seq` one.
+void syncCheckRecord(Game* game, std::uint32_t seq, std::uint32_t sideSeq,
+					 bool boundary, const std::string& kind);
+/// CLIENT: compute this machine's buckets and attach them to @a msg as "h".
+/// No-op without a live battle (the caller then ships the bare `action_done`).
+void syncCheckAttach(Game* game, Json::Value& msg);
+/// CLIENT (PRD-I2): syncCheckAttach plus the boundary-only `saveBlob` bucket in
+/// the "h" map. Called only from the boundary `action_done` emit; a per-action
+/// report never carries `saveBlob`, which is what presence-gates the host compare.
+void syncCheckAttachBoundary(Game* game, Json::Value& msg);
+/// HOST: compare a peer's attached buckets against the ring entry for its seq.
+/// Silently ignores a message with no "h" (older peer) and one whose seq is not
+/// in the ring (a report that crossed a side boundary, or a 64-deep overflow).
+void syncCheckCompare(Game* game, const Json::Value& msg);
+/// Harness: the `syncCheck` introspection block (see PRD-I0 §4).
+void syncCheckReport(Json::Value& out);
+/// coop (option 3): boundary-persistence-alarm introspection (2d). Pending-store size,
+/// heals, persistent alarms, and unresolved-at-end - exposed in `parallel_state`.
+size_t syncBoundaryPendingSize();
+std::uint64_t syncBoundaryHealed();
+std::uint64_t syncBoundaryPersistAlarms();
+std::uint64_t syncBoundaryUnresolved();
+/// Clears the ring, the latches and the mismatch log. Called from
+/// resetResyncStats() (harness `shared_reset_resync_stats`) and at battle teardown.
+void resetSyncCheck();
+/// PRD-I3 SEAM-7 (test/burn-in probe): arm/disarm the opt-in per-mismatch field
+/// capture. When on, the client attaches its full per-unit unitsStats field vector
+/// to every action_done ("uv") and the host stashes its own into the sync ring, so a
+/// unitsStats mismatch is diffed field-by-field into syncCheck.fieldDiffs. Off by
+/// default = zero wire delta.
+void setSyncFieldCapture(bool on);
+bool syncFieldCapture();
+// coop (PHASE D.1 chain-atomicity, test-only): strict-compare BURN-IN lever. When ON,
+// syncCheckCompare disables the terrain/unitsCore/items/itemIdCtr alien+endturn side-gates
+// and the items/saveBlob corpsePending skips, so those buckets compare at EVERY seq. Set
+// via TestServer `sync_capture {strict:bool}`. Not cleared by resetSyncCheck (a manual lever).
+void setStrictBurnIn(bool on);
+bool strictBurnIn();
+/// PRD-I3 SEAM-7: the FULL unitsStats bucket field vector per battle unit - EXACTLY
+/// the fields computeBattleHashes() mixes into the unitsStats sum (tu, energy, health,
+/// stun, morale, mana, fire, kneeled, mind-controller id, the six per-part fatal-wound
+/// counters w0..w5). @a onlyId >= 0 narrows to one unit. Empty array with no battle.
+void unitStatsFullJson(Game* game, Json::Value& out, int onlyId);
+
+// ---- PRD-I3 SEAM-3 (terrain/door): per-seq terrain vector capture ------------
+/// The `terrain` bucket is a SUM of per-tile FNV mixes: a mismatch names the bucket
+/// but never WHICH tile/part/field drifted. This is the terrain analogue of the
+/// SEAM-7 unit field-diff tooling, but the full tile vector (up to 60x60x4 = 14400
+/// tiles) is far too large to ship on every action_done, so it is INTROSPECTION
+/// ONLY (no wire change): when armed, BOTH machines stash their full non-void tile
+/// vector at each hash point into a bounded local ring, and the harness reads both
+/// rings for the mismatching seq and diffs them OFFLINE via the two TestServers.
+void setSyncTerrainCapture(bool on);
+bool syncTerrainCapture();
+/// LIVE probe: the full non-void tile vector right now - per tile: index, the four
+/// TilePart map-data id + set-id pairs and getExplosive()/getExplosiveType() (EXACTLY
+/// the `terrain` bucket field set), plus a diagnostic per-part `door` bitmask
+/// (isUfoDoorOpen, which the bucket is BLIND to - see VERIFY-1). @a onlyIndex >= 0
+/// narrows to one tile. Empty array with no battle.
+void tileTerrainFullJson(Game* game, Json::Value& out, int onlyIndex);
+/// Dump the CAPTURED tile vector for a recorded seq from the local ring (armed
+/// capture only). @a sideSeq < 0 = match on (seq, boundary) taking the newest;
+/// otherwise also filter on side_seq. Returns false if no such entry is held.
+bool terrainCaptureDumpJson(std::uint32_t seq, bool boundary, int sideSeq, Json::Value& out);
+/// Enumerate the seqs currently held in the terrain capture ring, oldest first
+/// ({seq, side_seq, boundary, kind, tileCount}), so a test can pick one to diff.
+void terrainCaptureSeqsJson(Json::Value& out);
+
+// ---- Desync auto-report bundle -----------------------------------------------
+// A logic desync leaves no stack to trace: by the time the two machines disagree
+// the cause is minutes of divergent simulation behind them. So the tripwire
+// captures the two artefacts that DO reproduce it - this machine's `openxcom.log`
+// (which already carries the BATTLE DESYNC line and everything that led up to it)
+// and a forced mid-battle SAVE, i.e. the sim-state dump. Deliberately NOT a
+// process minidump: huge, and it says nothing about a rules-level divergence.
+//
+// BOTH machines write one. The detector also ships `desync_report` so its peer
+// captures the OTHER half of the pair at (nearly) the same instant - one side of
+// a disagreement on its own proves nothing.
+//
+// ONE BUNDLE PER BATTLE PER MACHINE. The latch lives next to g_battleDesyncSeen
+// and clears in resetBattleDesyncSeen() - the same reset the harness drives
+// through shared_reset_resync_stats. The RESYNC_DEBOUNCE_MS notify throttle is a
+// separate thing and still governs the in-battle banner.
+
+/// The checksum terms and packet context one bundle records. The detector fills
+/// all four; a machine told by `desync_report` fills the peer pair from the wire
+/// and its own pair from battleChecksumTerms().
+struct DesyncTerms
+{
+	int64_t peerItemId = -1;
+	int64_t localItemId = -1;
+	int64_t peerCensus = -1;
+	int64_t localCensus = -1;
+	int64_t peerUnits = -1;   // PRD-I4: the P2 unit-census term (added after the bundle branch)
+	int64_t localUnits = -1;
+	std::string context;         // the packet that carried the peer's stamp
+	bool viaPeerReport = false;  // told by the peer rather than by a local compare
+	// PRD-I4: compact seq/kind/bucket/headline attribution. The detector fills it
+	// from its own sync-check (or the diverged terms); a peer told by desync_report
+	// carries the detector's copy so both bundles are equally attributed. Null when
+	// none was received (an older peer, or a local detector before it computes one).
+	Json::Value attribution;
+};
+
+/// Writes the bundle (log + forced save + desync-info.json) to
+/// <user folder>/desync-reports/desync-YYYYMMDD-HHMMSS.zip, raises the notice
+/// dialog, and - unless this machine was ITSELF told by a peer - sends
+/// `desync_report` so the other machine captures its half too.
+///
+/// Best-effort by contract: latched before any work so a failed write can never
+/// re-fire, every step guarded, and any failure logs and returns. Capturing a
+/// diagnostic must never be able to crash or stall the game it is diagnosing.
+void captureDesyncReport(Game* game, const DesyncTerms& terms);
+/// Harness/diagnostics: has this machine written its one bundle, and where to.
+bool desyncReportWritten();
+std::string desyncReportPath();
+/// PRD-I4: the compact primary attribution {source, seq, boundary, kind, bucket,
+/// headline} - from a peer's copy (terms.attribution) if present, else the local
+/// sync-check's last mismatch, else the diverged P2 checksum terms. The headline
+/// is localized via @a game's language.
+Json::Value desyncComputeAttribution(Game* game, const DesyncTerms& terms);
+/// PRD-I4: embeds THIS machine's sync-check state - the per-bucket mismatch table
+/// (out["sync_check"]) and a snapshot of the last ~16 ring seqs (out["sync_ring"]).
+void desyncEmbedSyncState(Json::Value& out);
+
+/// PRD-I5: next-launch crash reporter (Pattern A). The dying process only writes a
+/// marker (CrossPlatform::crashDump drops crash-pending.json next to the dump);
+/// these run at the NEXT launch, from the main-menu altitude, to offer a one-click
+/// bundle of the previous crash. All best-effort: a broken reporter must never
+/// block startup, so every failure logs and continues. Reuses the I4 bundle
+/// plumbing (miniz heap zip writer, log tail reader, CoopDesyncNoticeState).
+///
+/// Reads <user folder>/crash-pending.json and, if it names a dump + log that both
+/// still exist, pushes the consent dialog over the main menu. A missing, corrupt,
+/// or stale marker (its files gone) is deleted and ignored. Never throws.
+void maybeReportPreviousCrash(Game* game);
+/// BUNDLE handler: re-reads + validates the marker at @a markerPath, zips the dump,
+/// the openxcom.log tail and a system-info json into <user folder>/crash-reports/
+/// crash-<ts>.zip, deletes the marker, and raises the result notice (path + OPEN
+/// FOLDER + REPORT ON GITHUB). Returns false and KEEPS the marker on any failure.
+bool bundleCrashReportFromMarker(Game* game, const std::string& markerPath);
+/// NEVER (this crash) handler: delete the marker so this crash is never raised again.
+void deleteCrashMarkerFile(const std::string& markerPath);
+/// Option (b) dual-source discovery: the crashed process already writes
+/// crash_<ts>_<seq>.{dmp,log} to <exe>/crashlogs (issue #124 VEH, the robust
+/// catch-all crashDump misses). maybeReportPreviousCrash also scans that dir for
+/// an unseen entry (per-user crash-seen.json ledger dedups). These are the
+/// crashlog-source handlers the consent dialog dispatches to.
+bool bundleCrashReportFromCrashlog(Game* game, const std::string& dmpPath, const std::string& logPath);
+/// NEVER on the classic marker: delete it + mark its paired VEH crashlog seen.
+void declineCrashMarker(const std::string& markerPath);
+/// NEVER on a crashlog: record its .dmp basename in the seen ledger (no zip).
+void markCrashlogSeenPath(const std::string& dmpPath);
+
 /// Game-minute cooldown between automatic resyncs (see verifyWorldChecksum).
 extern const int RESYNC_COOLDOWN_MINUTES;
 /// Wall-clock ms a checksum mismatch must SURVIVE before it counts as a desync.
@@ -408,6 +715,166 @@ Stats stats();
 std::string lastFailReason();
 void resetStats();
 
+// ---- PRD-P4: Tier-A spawn id-manifest ----------------------------------------
+// Every BattleItem id comes from the LOCAL counter SavedBattleGame::_itemId, and
+// battle resolution keys on it (moveCoopInventory, coopResolveWeapon, the ammo
+// matches in the Melee/ProjectileFly states). A "Tier-A" spawn is a DETERMINISTIC
+// set that both machines create for themselves - corpses (armor corpse list, one
+// per size^2 tile), death-trap grenades (STR_DEATH_TRAP_<floorSpecialType>, pure
+// map data), convertUnit built-ins (fixed getSpawnUnit() type). No RNG picks the
+// set, so both machines create the SAME items; only the ids can drift, and when
+// they do the drift is a TRANSPOSITION - id N denotes a different instance on the
+// two machines and every later id-keyed packet lands on the wrong item.
+//
+// The fix is the host naming the ids it minted and the peer adopting them. A
+// manifest is a `minted_ids` array on the action's own carrier packet, keyed by
+// {action, subject} - transient, per action, NEVER persisted and never spanning a
+// save. Old-peer compatible by construction: absent `minted_ids` = no manifest =
+// the peer keeps its local ids, exactly today's behaviour.
+//
+// Tier-B (RNG-DIVERGENT) spawns are a different mechanism entirely and are already
+// handled by PRD-P3's seed-replay manifest (`spawn_units`): there the host has to
+// ship the DECISION, not just the ids. Do not merge the two.
+//
+// Deviation from the PRD sketch: the guards take no `coopMod` argument.
+// connectionTCP::getCoopStatic() / ::getHost() are static, so a pointer would
+// carry no information - and SavedBattleGame::convertUnit, one of the three
+// sites, has no coopMod handy.
+
+/// HOST-side RAII recorder. While one is open, every BattleItem the SavedBattleGame
+/// factories mint appends its id to the {action, subject} list, in creation order.
+/// Opening CLEARS whatever was under that key, so a repeatable action (the same
+/// unit stepping onto a second death trap) can never ship a previous run's tail.
+/// Inert unless this machine is a co-op HOST. Closing ends the recording window
+/// only - the recorded ids live on until flushSpawnRecord() ships them.
+class CoopSpawnRecord
+{
+public:
+	CoopSpawnRecord(const char* action, int subject);
+	~CoopSpawnRecord();
+	CoopSpawnRecord(const CoopSpawnRecord&) = delete;
+	CoopSpawnRecord& operator=(const CoopSpawnRecord&) = delete;
+private:
+	bool _open;
+};
+
+/// PEER-side RAII consumer, bound to THIS call's subject. While one is open the
+/// factories dequeue the host's ids (creation order) and setIdCoop() them onto the
+/// items being created. Deliberately PER CALL and stacked, never a global "active
+/// subject": two deaths in flight at once would clobber a single global (hole H2).
+/// Closing DROPS whatever the manifest still held for that key - a replay that
+/// created fewer items than the host did must not leave ids parked for the next one.
+/// Inert unless this machine is a co-op peer (non-host).
+class CoopSubjectGuard
+{
+public:
+	CoopSubjectGuard(SavedBattleGame* battle, const char* action, int subject);
+	~CoopSubjectGuard();
+	CoopSubjectGuard(const CoopSubjectGuard&) = delete;
+	CoopSubjectGuard& operator=(const CoopSubjectGuard&) = delete;
+private:
+	bool _open;
+	SavedBattleGame* _battle; // for the counter re-slave when the guard closes
+	std::string _action;
+	int _subject;
+};
+
+/// HOST: move the ids recorded for {action, subject} onto @a root as "minted_ids"
+/// and drop the record. Writes NO field when nothing was recorded, which is what
+/// keeps an older peer (and every non-spawning pass through the same send site)
+/// on exactly today's behaviour.
+void flushSpawnRecord(Json::Value& root, const char* action, int subject);
+
+/// PEER: park the host's `minted_ids` (if @a root carries any) for {action,
+/// subject}. Returns true if a manifest was stored. Call it BEFORE the replay path
+/// that creates the items.
+///
+/// The counter re-slave (`_itemId = max(_itemId, maxHostId + 1)`, the same rule
+/// SavedBattleGame's loader applies to a save's item ids, so an adopted id can
+/// never be minted twice) happens once the manifest has been APPLIED - in the
+/// guard's destructor or at the end of remapCorpseIds. Doing it HERE is off by
+/// one: the factories still mint a local id and only then adopt the host's, so an
+/// up-front bump pushes that local mint one past the host's and the two counters
+/// end up permanently one apart.
+bool storeSpawnManifest(SavedBattleGame* battle, const char* action, int subject,
+						const Json::Value& root);
+
+/// PEER, path (b) "remap on load": re-stamp corpses that ALREADY exist. The corpse
+/// manifest rides `after_unit_death`, which post-dates the peer's own corpse
+/// creation (that was triggered by the earlier `unit_death`), so consume-on-create
+/// alone would never fire for it (hole H3). Matches BT_CORPSE items whose getUnit()
+/// is @a unitId, in _items order = creation order = the order the host recorded -
+/// all size^2 of them for a big unit. No-op (and the manifest is LEFT parked for
+/// the guard) when the corpses do not exist yet. Returns how many were re-stamped.
+///
+/// PRD-P10: also a no-op while noteCorpseReplayPending() says this unit's replay
+/// has not run yet - see there for the double-death shape that made "a BT_CORPSE
+/// item of this unit already exists" the wrong test.
+int remapCorpseIds(SavedBattleGame* battle, int unitId);
+
+/// PEER (PRD-P10): the corpse replay for @a unitId has been PUSHED (coopDeath)
+/// but has not converted yet.
+///
+/// remapCorpseIds' "do the corpses exist here already?" test is a BT_CORPSE scan
+/// keyed on getUnit(), and an UNCONSCIOUS unit is ALREADY represented by such an
+/// item - the body item convertUnitToCorpse removes on its way to minting the
+/// real corpse. So a unit that is knocked out and later bleeds out ships TWO
+/// deaths, and the second one's manifest, arriving before the peer's die state
+/// had a frame to run (both death packets are exempt from the receive gate while
+/// `_coopInitDeath` is up), re-stamped the OLD body item with the NEW corpse's
+/// id. The peer then removed that body and minted its corpse one id further on -
+/// the two machines' corpses one apart, for the rest of the battle.
+void noteCorpseReplayPending(int unitId);
+/// PEER: the corpse replay for @a unitId has run (or can no longer run).
+void clearCorpseReplayPending(int unitId);
+/// PEER: is a pushed death replay for @a unitId still waiting to convert?
+///
+/// Also the guard on `after_unit_death`'s tile unlink. That packet is sent AFTER
+/// the executor's convertUnitToCorpse, so it always says "no tile" - and it is
+/// exempt from the receive gate (`_coopInitDeath`), so it routinely lands while
+/// the peer's own UnitDieBState is still queued behind an animation. Unlinking
+/// there costs the replay everything that reads getTile():
+/// convertUnitToCorpse's `dropItems && getTile()` skips itemDropInventory (the
+/// dead unit's whole kit stays on the body here and lies on the floor there),
+/// and UnitDieBState::init()'s `!getTile()` pops the state outright for any
+/// non-PLAYER unit - no corpse and no drop at all. The replay unlinks the tile
+/// itself one line after the drop, so the repair is redundant until then.
+bool corpseReplayPending(int unitId);
+/// PEER: is ANY death replay still waiting to convert? The drift tripwire's two
+/// terms (item-id counter, item census) are both one corpse short while one is,
+/// so a stamp that lands in that window is not comparable.
+bool corpseReplayPendingAny();
+
+/// PRD-I3 Session F: the COMPLEMENTARY window - a corpse this peer already minted with
+/// LOCAL ids (no host manifest in hand) whose host ids have not yet arrived on
+/// `after_unit_death`. corpseReplayPending covers push->mint; this covers
+/// mint->reconcile. Cleared by the after_unit_death handler and at the turn boundary.
+void clearCorpseRemapPending(int unitId);
+bool corpseRemapPendingAny();
+
+/// coop (item 3, mint-at-apply introspection): cumulative count of how many times
+/// each corpse drift window has ARMED this battle. Window 1 (corpseReplayPending)
+/// arms once per death push (noteCorpseReplayPending) and is expected to keep arming
+/// on any path - it just marks "a death replay is queued". Window 2
+/// (corpseRemapPending) is the one mint-at-apply STRUCTURALLY EMPTIES: it arms only
+/// when this peer minted a corpse with LOCAL ids because no host manifest was in hand
+/// at create (CoopSubjectGuard adopted==0). On the parallel replay client the mint
+/// now runs at the after_unit_death apply with the manifest already parked, so the
+/// guard always adopts at create and this counter must stay 0 through every death.
+/// Additive, read-only; introspection for the harness, no effect on any compare.
+std::uint32_t corpseReplayArmedCount();
+std::uint32_t corpseRemapArmedCount();
+
+/// Factory hook: a BattleItem was just minted. Appends to an open host record or
+/// consumes an id from an open peer guard; does nothing at all when neither is
+/// open, which is every mint outside a Tier-A spawn (and every non-co-op game).
+void noteMintedItem(BattleItem* item);
+
+/// Hygiene: drop every parked manifest. Called at each turn boundary - a manifest
+/// whose replay never happened (the peer created no corpse for that death) must not
+/// outlive the turn it belonged to.
+void clearSpawnManifests();
+
 } // namespace SharedEcon
 
 } // namespace OpenXcom
diff --git a/src/CoopMod/TestServer.cpp b/src/CoopMod/TestServer.cpp
index 11caae04e..df67ec046 100644
--- a/src/CoopMod/TestServer.cpp
+++ b/src/CoopMod/TestServer.cpp
@@ -17,9 +17,35 @@
  * You should have received a copy of the GNU General Public License
  * along with OpenXcom.  If not, see <http://www.gnu.org/licenses/>.
  */
+// Ephemeral-port probe (bring-up plumbing, test-only): bind an OS-assigned port
+// on loopback and read it back via getsockname, so the harness never hardcodes a
+// coop/control port. Winsock must precede any windows.h that SDL later pulls in,
+// so these come first, before every other include. NOMINMAX keeps windows.h from
+// defining the min/max macros that would clobber std::numeric_limits<>::min() in
+// the Engine/Mod headers below; WIN32_LEAN_AND_MEAN keeps it from dragging in the
+// legacy winsock.h that conflicts with winsock2.h.
+#ifdef _WIN32
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#pragma comment(lib, "ws2_32.lib")
+#else
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#endif
+#include <cstdio>
+#include <cstring>
 #include "TestServer.h"
 
 #include <algorithm>
+#include <array>
 #include <cstdlib>
 #include <fstream>
 #include <set>
@@ -57,8 +83,11 @@
 #include "../Battlescape/UnitWalkBState.h"
 #include "../Battlescape/UnitTurnBState.h"
 #include "../Battlescape/ProjectileFlyBState.h"
+#include "../Battlescape/MeleeAttackBState.h"
 #include "../Battlescape/PsiAttackBState.h"
 #include "../Battlescape/Position.h"
+#include "../Battlescape/Map.h"
+#include "../Battlescape/Camera.h"
 #include "../Savegame/BattleItem.h"
 #include "../Mod/RuleItem.h"
 #include "../Mod/RuleInventory.h"
@@ -82,6 +111,7 @@
 #include "../Savegame/EquipmentLayoutItem.h"
 #include "../Savegame/ItemContainer.h"
 #include "../Savegame/Tile.h"
+#include "../Mod/MapData.h"
 #include "../Savegame/Ufo.h"
 #include "../Savegame/CraftWeapon.h"
 #include "../Savegame/Target.h"
@@ -164,6 +194,78 @@
 namespace OpenXcom
 {
 
+// coop (chain-atomicity D.3b fixture): the chained-terrain pacing race counters,
+// defined as file-scope globals in ExplosionBState.cpp. Extern-declared here so
+// parallel_state can surface them without a connectionTCP.h class-layout change (a
+// wide recompile).
+extern std::uint32_t g_coopTerrainPacingParks;
+extern std::uint32_t g_coopTerrainPacingConsumes;
+extern std::uint32_t g_coopTerrainPacingDiverted;
+// coop (chain-atomicity Strand B): the side-barrier counters, file-scope in
+// connectionTCP.cpp. Extern-declared here (not in connectionTCP.h) so parallel_state can
+// surface them without a wide recompile, matching the terrain-pacing counters above.
+extern std::atomic<uint32_t> g_sideBarrierHolds;
+extern std::atomic<uint32_t> g_sideBarrierReleases;
+extern std::atomic<uint32_t> g_sideBarrierHardReleases;
+// coop (chain-atomicity Strand A): mid-side host deaths and how many shipped unstamped.
+extern std::atomic<uint32_t> g_coopMidSideDeaths;
+extern std::atomic<uint32_t> g_coopMidSideDeathsUnstamped;
+// coop (chain-atomicity Strand B, TEST-ONLY lever): disable just the side barrier.
+extern std::atomic<bool> g_rxSideBarrierDisable;
+// coop (wire-order report alignment, Phase 2): master lever, file-scope in
+// connectionTCP.cpp; extern-declared here so the TestServer command handler and
+// parallel_state can reach it without a connectionTCP.h class-layout recompile.
+extern std::atomic<bool> g_wireOrderState;
+// coop DIAGNOSTIC (reject-set audit): next_turn rank-0 watermark rejections captured in
+// BattleUnit.cpp; surfaced here for the harness. Empty unless SEAM-7 capture was armed.
+extern const std::vector<std::array<std::uint32_t, 6> >& coopWmDbgRejects();
+// coop (parallel battlescape Phase 1 - per-unit state watermark): reject counters
+// (total + per-rank) and the TEST-ONLY lever that disables the watermark check.
+// File-scope in connectionTCP.cpp; extern-declared here to avoid a wide recompile.
+extern std::atomic<uint32_t> g_stateWatermarkRejects;
+extern std::atomic<uint32_t> g_stateWatermarkRejectsRank0;
+extern std::atomic<uint32_t> g_stateWatermarkRejectsRank1;
+extern std::atomic<uint32_t> g_stateWatermarkRejectsRank2;
+extern std::atomic<bool> g_deathWatermarkDisable;
+// coop (parallel battlescape Phase 2b - atomic unit death): the `unit_casualty`
+// apply counters + the TEST-ONLY RED lever that falls back to the legacy unit_
+// death/after_unit_death trio. File-scope in connectionTCP.cpp; extern-declared
+// here to avoid a wide recompile, matching the Phase 1 watermark counters above.
+extern std::atomic<uint32_t> g_casualtiesApplied;
+extern std::atomic<uint32_t> g_casualtiesRejected;
+extern std::atomic<bool> g_atomicDeathDisable;
+// coop (parallel battlescape Phase 2c - death ghost, TEST-ONLY RED lever).
+extern std::atomic<bool> g_deathGhostDisable;
+// coop (explosion ordered-replay E0 - LEAK-OBJ): the objective-counter leak
+// block counter + its TEST-ONLY RED lever, and the E0 introspection-only lever
+// for the (E1-enforcing) explosion-replay path. File-scope in connectionTCP.cpp;
+// extern-declared here to avoid a wide recompile, matching the counters above.
+extern std::atomic<uint32_t> g_objectiveLeakBlocked;
+extern std::atomic<bool> g_objectiveGateDisable;
+extern std::atomic<bool> g_explosionReplayDisable;
+// coop (explosion ordered-replay E1): the display-only-path counters. File-scope in
+// connectionTCP.cpp, incremented from ExplosionBState.cpp; extern-declared here to
+// avoid a wide recompile, matching the counters above.
+extern std::atomic<uint32_t> g_explosionsDisplayOnly;
+extern std::atomic<uint32_t> g_explodeCallsSuppressed;
+// coop (explosion ordered-replay E2): the chain_detonation send/apply counters. File-scope
+// in connectionTCP.cpp, incremented from ExplosionBState.cpp (sent) and connectionTCP.cpp's
+// handler (applied); extern-declared here to avoid a wide recompile, matching the counters
+// above.
+extern std::atomic<uint32_t> g_chainDetonationsSent;
+extern std::atomic<uint32_t> g_chainDetonationsApplied;
+// coop (explosion ordered-replay E4, TEST-ONLY RED lever): disables the LEAK-GRAV
+// derive so the SAME build measures the pre-derive hover (red) against the gated
+// (green) behavior. File-scope in connectionTCP.cpp; extern-declared here to avoid
+// a wide recompile, matching the counters above.
+extern std::atomic<bool> g_gravityDeriveDisable;
+// coop (explosion ordered-replay E5a GAP-MODULE): the module_destroyed send/apply
+// counters. File-scope in connectionTCP.cpp, incremented from TileEngine.cpp (sent)
+// and connectionTCP.cpp's handler (applied); extern-declared here to avoid a wide
+// recompile, matching the counters above.
+extern std::atomic<uint32_t> g_moduleDestroyedSent;
+extern std::atomic<uint32_t> g_moduleDestroyedApplied;
+
 namespace {
 // PRD-13 S6: the state-stack scan `for (auto* s : game->getStates()) if (auto*
 // t = dynamic_cast<T*>(s)) found = t;` was pasted ~20x. These file-local helpers
@@ -193,6 +295,60 @@ TestServer& TestServer::instance()
 	return s;
 }
 
+// Bind an OS-assigned ephemeral port on loopback (sockType = SOCK_STREAM or
+// SOCK_DGRAM), read the assigned port back, and release the socket. Returns the
+// port (1..65535) or 0 on failure. This is how both socket kinds go ephemeral
+// without the harness guessing: the game asks the OS for a free port and reports
+// what it got. There is a tiny bind->close->reopen window before the real
+// listener/host binds the same number, but the OS does not immediately recycle a
+// just-released loopback ephemeral port, so a same-port collision is not observed
+// in practice - and this categorically removes the fixed-port linger/collision
+// class (a prior scenario's instance still holding :NNNNN) that motivated the
+// change. Requires winsock to be up (SDLNet_Init / SDL have already done
+// WSAStartup by every call site here).
+static int probeEphemeralPort(int sockType)
+{
+#ifdef _WIN32
+	SOCKET s = socket(AF_INET, sockType, 0);
+	if (s == INVALID_SOCKET) return 0;
+#else
+	int s = socket(AF_INET, sockType, 0);
+	if (s < 0) return 0;
+#endif
+	sockaddr_in addr;
+	std::memset(&addr, 0, sizeof(addr));
+	addr.sin_family = AF_INET;
+	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+	addr.sin_port = 0; // OS assigns
+	int port = 0;
+	if (bind(s, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) == 0)
+	{
+		sockaddr_in bound;
+		std::memset(&bound, 0, sizeof(bound));
+#ifdef _WIN32
+		int len = sizeof(bound);
+#else
+		socklen_t len = sizeof(bound);
+#endif
+		if (getsockname(s, reinterpret_cast<sockaddr*>(&bound), &len) == 0)
+			port = ntohs(bound.sin_port);
+	}
+#ifdef _WIN32
+	closesocket(s);
+#else
+	close(s);
+#endif
+	return port;
+}
+
+// The per-instance file the harness polls to learn the TestServer control port
+// when it was bound ephemeral (OXC_TEST_PORT=0). Lives in the instance's own
+// -user folder, which the harness owns and creates per instance.
+static std::string testServerPortFilePath()
+{
+	return Options::getUserFolder() + "testserver_port.txt";
+}
+
 void TestServer::startFromEnvironment(Game* game)
 {
 	if (_running.load())
@@ -205,14 +361,18 @@ void TestServer::startFromEnvironment(Game* game)
 		return;
 	}
 	int port = std::atoi(portStr);
-	if (port <= 0 || port > 65535)
+	// OXC_TEST_PORT=0 means "OS-assigned ephemeral": ioThread probes a free port
+	// and reports it to the harness via <userfolder>/testserver_port.txt. A fixed
+	// port still works (manual debugging). Reject only out-of-range values.
+	if (port < 0 || port > 65535)
 	{
 		return;
 	}
 	_game = game;
 	_running.store(true);
 	_thread = std::thread(&TestServer::ioThread, this, port);
-	Log(LOG_INFO) << "[testserver] listening on 127.0.0.1:" << port;
+	Log(LOG_INFO) << "[testserver] starting (requested port "
+		<< (port == 0 ? "0 = ephemeral" : std::to_string(port)) << ")";
 }
 
 void TestServer::stop()
@@ -226,11 +386,27 @@ void TestServer::stop()
 
 void TestServer::ioThread(int port)
 {
+	// Clear any stale port file before binding, so the harness never reads a port
+	// left over from a previous run in a reused -user folder.
+	std::remove(testServerPortFilePath().c_str());
+
 	if (SDLNet_Init() != 0)
 	{
 		Log(LOG_ERROR) << "[testserver] SDLNet_Init failed: " << SDLNet_GetError();
 		return;
 	}
+	// Ephemeral control socket (OXC_TEST_PORT=0): ask the OS for a free port now
+	// that winsock is up, then bind SDL_net on that concrete port so we know it.
+	if (port == 0)
+	{
+		port = probeEphemeralPort(SOCK_STREAM);
+		if (port <= 0)
+		{
+			Log(LOG_ERROR) << "[testserver] could not probe an ephemeral port";
+			SDLNet_Quit();
+			return;
+		}
+	}
 	IPaddress ip;
 	// NULL host = listen (SDL_net semantics; a concrete address would mean
 	// an outbound connect). Test-only server, gated by OXC_TEST_PORT.
@@ -248,6 +424,22 @@ void TestServer::ioThread(int port)
 	SDLNet_SocketSet set = SDLNet_AllocSocketSet(2);
 	SDLNet_TCP_AddSocket(set, listening);
 
+	// The listener is up on `port`. Report it to the harness atomically: write a
+	// temp file then rename over the final name, so a poller never reads a
+	// half-written value. The log line below is the stdout/log fallback report.
+	{
+		const std::string finalPath = testServerPortFilePath();
+		const std::string tmpPath = finalPath + ".tmp";
+		std::ofstream pf(tmpPath.c_str(), std::ios::out | std::ios::trunc);
+		if (pf)
+		{
+			pf << port << "\n";
+			pf.close();
+			std::rename(tmpPath.c_str(), finalPath.c_str());
+		}
+	}
+	Log(LOG_INFO) << "[testserver] listening on 127.0.0.1:" << port;
+
 	TCPsocket client = nullptr;
 	std::string recvBuf;
 
@@ -334,12 +526,35 @@ void TestServer::ioThread(int port)
 	SDLNet_FreeSocketSet(set);
 }
 
+// PRD-P11 (test-only): packets armed by `rx_inject {awaitGate: true}`, held
+// until a tick where the receive gate is SHUT. Flushed from pump(), which runs
+// immediately before updateCoopTask() in Game::run, so "the gate was shut when
+// they landed" is exact rather than a round-trip race the test has to win.
+static std::vector<std::string> g_rxArmed;
+static bool g_rxArmedFired = false;
+static int g_rxArmedCount = 0;
+
 void TestServer::pump()
 {
 	if (!_running.load())
 	{
 		return;
 	}
+
+	if (!g_rxArmed.empty())
+	{
+		connectionTCP* armCoop = _game->getCoopMod();
+		if (armCoop && !armCoop->coopTaskCompleted())
+		{
+			for (auto& payload : g_rxArmed)
+			{
+				rxInjectForTest(std::string(payload));
+			}
+			g_rxArmedCount = static_cast<int>(g_rxArmed.size());
+			g_rxArmed.clear();
+			g_rxArmedFired = true;
+		}
+	}
 	// While StartState is on the stack the mod is still being loaded on its
 	// worker thread; executing commands now races it (e.g. GeoscapeState
 	// needs surfaces that modResources() synthesizes at the very end of the
@@ -2588,6 +2803,43 @@ bool TestServer::executeShared11(const std::string& cmd, const Json::Value& req,
 			Options::battleInstantGrenade = req.get("value", false).asBool();
 			resp["ok"] = true;
 		}
+		else if (name == "battleXcomSpeed")
+		{
+			// Per-unit walk animation delay in ms (lower = faster). Tests use it to
+			// make one machine walk slowly while the other races ahead.
+			// battleXcomSpeedOrig is the saved value of the ctrl-s "quick mode"
+			// speed swap (BattlescapeState::handle): while a swap is armed the
+			// next toggle restores that OLD speed over the one set here, so
+			// disarm it too.
+			Options::battleXcomSpeed = req.get("value", 30).asInt();
+			Options::battleXcomSpeedOrig = -1;
+			resp["value"] = Options::battleXcomSpeed;
+			resp["ok"] = true;
+		}
+		else if (name == "battleFireSpeed")
+		{
+			// Projectile animation delay in ms. PRD-P9 needs it: battleXcomSpeed
+			// only slows walk/turn animation, and PRD-P7 fast-forwards exactly
+			// those on a lagging client - so a SHOT is the only chain that can
+			// build the display backlog `canAdmitAction()` caps at 2.
+			Options::battleFireSpeed = req.get("value", 6).asInt();
+			resp["value"] = Options::battleFireSpeed;
+			resp["ok"] = true;
+		}
+		else if (name == "battleAlienSpeed")
+		{
+			Options::battleAlienSpeed = req.get("value", 30).asInt();
+			resp["value"] = Options::battleAlienSpeed;
+			resp["ok"] = true;
+		}
+		else if (name == "EnableCoopParallelTurns")
+		{
+			// PRD-P5's option, declared inert by P0 (Options.inc.h) so the harness
+			// can set it before anything reads it.
+			Options::EnableCoopParallelTurns = req.get("value", false).asBool();
+			resp["value"] = Options::EnableCoopParallelTurns;
+			resp["ok"] = true;
+		}
 		else
 		{
 			resp["error"] = "unknown option: " + name;
@@ -3405,16 +3657,44 @@ bool TestServer::executeBattle12(const std::string& cmd, const Json::Value& req,
 	// arm an arbitrary unit and make it fire a specific weapon (incl. BA_LAUNCH,
 	// which the generic battle_action shoot cannot express). Kept in its own
 	// dispatcher so execute()'s if/else chain does not grow (MSVC C1061).
-	if (cmd != "battle_items" && cmd != "battle_give" && cmd != "battle_fire"
+	if (cmd != "battle_items" && cmd != "battle_tiles"
+		&& cmd != "battle_give" && cmd != "battle_fire"
 		&& cmd != "battle_teleport" && cmd != "battle_open_inventory"
 		&& cmd != "battle_close_inventory" && cmd != "battle_drop"
-		&& cmd != "battle_prox" && cmd != "tile_info")
+		&& cmd != "battle_prox" && cmd != "tile_info" && cmd != "battle_intent"
+		&& cmd != "battle_camera"
+		&& cmd != "battle_reserve"
+		&& cmd != "rx_inject"
+		&& cmd != "hold_action_done"
+		&& cmd != "unit_stats_full"
+		&& cmd != "sync_capture"
+		&& cmd != "terrain_capture"
+		&& cmd != "tile_terrain_full"
+		&& cmd != "find_explosive_parts"
+		&& cmd != "parallel_state"
+		&& cmd != "save_blob")
 	{
 		return false;
 	}
 
 	SavedGame* sg = _game->getSavedGame();
 	SavedBattleGame* sbg = sg ? sg->getSavedBattle() : nullptr;
+	// coop (wire-order report alignment): the wire_order_state lever is a global
+	// atomic, NOT battle-scoped. The harness engages it on every booted instance in
+	// connect() (at the main menu, before any battle), so a parallel_state set/read of
+	// JUST this lever must be serviceable ahead of the battle gate below. Scoped
+	// narrowly - only parallel_state, only when there is no battle: every OTHER field
+	// stays battle-scoped exactly as today (a pre-battle caller gets only the lever
+	// readback, never the battle state).
+	if (cmd == "parallel_state" && !sbg)
+	{
+		if (req.isMember("wire_order_state"))
+			g_wireOrderState.store(req.get("wire_order_state", false).asBool(),
+				std::memory_order_relaxed);
+		resp["wireOrderState"] = g_wireOrderState.load(std::memory_order_relaxed);
+		resp["ok"] = true;
+		return true;
+	}
 	if (!sbg)
 	{
 		resp["error"] = "not in battlescape";
@@ -3430,6 +3710,60 @@ bool TestServer::executeBattle12(const std::string& cmd, const Json::Value& req,
 		return nullptr;
 	};
 
+	if (cmd == "rx_inject")
+	{
+		// PRD-P11 (test-only): put packets straight into the receive hold queue,
+		// in order, and report the state of the receive gate AT THAT MOMENT. The
+		// pump's ordering guarantee is about what happens to a packet that lands
+		// while the gate is shut and an earlier packet about the same unit is
+		// still queued; waiting for that window from the game side is a race, and
+		// `gateClosed` here is what lets a test know it actually hit it.
+		const Json::Value& packets = req["packets"];
+		Json::StreamWriterBuilder wb;
+		wb["indentation"] = "";
+		connectionTCP* rxCoop = _game->getCoopMod();
+		resp["gateClosed"] = rxCoop ? !rxCoop->coopTaskCompleted() : false;
+		resp["taskDepth"] = rxCoop ? rxCoop->coopTaskDepth() : 0;
+		resp["walkInit"] = rxCoop ? rxCoop->_coopWalkInit : false;
+		resp["armedPending"] = static_cast<Json::UInt>(g_rxArmed.size());
+		resp["fired"] = g_rxArmedFired;
+		resp["firedCount"] = g_rxArmedCount;
+		if (req.get("status", false).asBool())
+		{
+			// read-only: how the armed batch got on
+			resp["rxHold"] = static_cast<Json::UInt>(rxHoldSize());
+			resp["ok"] = true;
+		}
+		else if (req.get("awaitGate", false).asBool())
+		{
+			// Arm, do not inject. pump() lands them on the first tick whose gate
+			// is shut - the window this PRD's ordering rule is about.
+			g_rxArmed.clear();
+			g_rxArmedFired = false;
+			g_rxArmedCount = 0;
+			for (Json::ArrayIndex i = 0; i < packets.size(); ++i)
+			{
+				g_rxArmed.push_back(Json::writeString(wb, packets[i]));
+			}
+			resp["armed"] = static_cast<Json::UInt>(g_rxArmed.size());
+			resp["fired"] = false;
+			resp["rxHold"] = static_cast<Json::UInt>(rxHoldSize());
+			resp["ok"] = true;
+		}
+		else
+		{
+			int injected = 0;
+			for (Json::ArrayIndex i = 0; i < packets.size(); ++i)
+			{
+				rxInjectForTest(Json::writeString(wb, packets[i]));
+				++injected;
+			}
+			resp["injected"] = injected;
+			resp["rxHold"] = static_cast<Json::UInt>(rxHoldSize());
+			resp["ok"] = true;
+		}
+	}
+
 	if (cmd == "battle_items")
 	{
 		// EVERY BattleItem instance this machine knows about, with the identity
@@ -3476,6 +3810,114 @@ bool TestServer::executeBattle12(const std::string& cmd, const Json::Value& req,
 		resp["total"] = (int)sbg->getItems()->size();
 		resp["ok"] = true;
 	}
+	else if (cmd == "battle_tiles")
+	{
+		// coop (chain-atomicity D.3b fixture lever): pre-set a tile's explosive so the next
+		// HE blast's ExplosionBState::explode -> checkForTerrainExplosions spawns a chained-
+		// terrain explosion deterministically, arming the shot-pacing race on any map (the
+		// default skirmish carries no explosive terrain). Test-only; call on the client before
+		// firing so its shot replay spawns a local chained-terrain ExplosionBState.
+		if (req.isMember("set_explosive"))
+		{
+			Tile* et = sbg->getTile(Position(req.get("x", 0).asInt(),
+				req.get("y", 0).asInt(), req.get("z", 0).asInt()));
+			if (et)
+			{
+				et->setExplosive(req.get("set_explosive", 0).asInt(),
+					req.get("explosiveType", 0).asInt(), true);
+				resp["explosiveSet"] = et->getExplosive();
+			}
+		}
+		// PRD-P9 soak: the per-tile HAZARD census. Fire and smoke are the two
+		// pieces of battle state that can drift without touching a unit or an
+		// item (they arrive on their own `set_fire_tile` / `set_smoke_tile`
+		// packets and decay on their own schedule), so the drift tripwire's two
+		// item terms cannot see them. Order-independent sums, so the comparison
+		// is one cheap equality per side.
+		long long fireHash = 0, smokeHash = 0;
+		int fireTiles = 0, smokeTiles = 0, fireSum = 0, smokeSum = 0;
+		// coop (chain-atomicity item-2 fixture lever): per-tile EXPLOSIVE-charge census,
+		// the term the host-authoritative set_explosive_tile carrier keeps in sync. Order-
+		// independent sum+hash over value AND type, so the fixture can diff the two
+		// machines' armed-tile state after an HE shot into explosive terrain.
+		long long explosiveHash = 0;
+		int explosiveTiles = 0, explosiveSum = 0;
+		const int tileCount = sbg->getMapSizeXYZ();
+		for (int i = 0; i < tileCount; ++i)
+		{
+			Tile* tl = sbg->getTile(i);
+			if (!tl) continue;
+			const int f = tl->getFire();
+			const int sm = tl->getSmoke();
+			if (f > 0)
+			{
+				++fireTiles;
+				fireSum += f;
+				fireHash += (long long)(i + 1) * 1000003LL + f;
+			}
+			if (sm > 0)
+			{
+				++smokeTiles;
+				smokeSum += sm;
+				smokeHash += (long long)(i + 1) * 1000003LL + sm;
+			}
+			const int ex = tl->getExplosive();
+			if (ex != 0)
+			{
+				++explosiveTiles;
+				explosiveSum += ex;
+				explosiveHash += (long long)(i + 1) * 1000003LL + (long long)ex * 31 + tl->getExplosiveType();
+			}
+		}
+		resp["fireTiles"] = fireTiles;
+		resp["smokeTiles"] = smokeTiles;
+		resp["fireSum"] = fireSum;
+		resp["smokeSum"] = smokeSum;
+		resp["fireHash"] = Json::Value::Int64(fireHash);
+		resp["smokeHash"] = Json::Value::Int64(smokeHash);
+		resp["explosiveTiles"] = explosiveTiles;
+		resp["explosiveSum"] = explosiveSum;
+		resp["explosiveHash"] = Json::Value::Int64(explosiveHash);
+		resp["tileCount"] = tileCount;
+		resp["ok"] = true;
+	}
+	else if (cmd == "save_blob")
+	{
+		// PRD-I2 determinism self-test + cost probe: the save-derived boundary hash
+		// computed on demand (the same machinery the boundary ring uses), so a test
+		// can hash the same quiescent battle twice and prove the emitter is
+		// deterministic, and read the serialization cost.
+		std::uint64_t blob = 0;
+		bool okBlob = SharedEcon::computeSaveBlobHash(_game, blob);
+		// coop (PRD-I3 Session F test levers, carried on save_blob because a fresh top-level
+		// cmd branch did not dispatch in this toolchain): (a) force a named hash bucket back
+		// to REPORT-ONLY for the all-promoted negative control; (b) read/align
+		// SavedBattleGame::_itemId so give-based levers inject no id-counter offset. Test-only.
+		if (req.isMember("report_only_bucket"))
+			resp["report_only_matched"] = SharedEcon::setBattleHashReportOnlyOverride(
+				req["report_only_bucket"].asString(), req.get("report_only_on", true).asBool());
+		if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+		{
+			int* ctr = _game->getSavedGame()->getSavedBattle()->getCurrentItemId();
+			if (ctr)
+			{
+				if (req.isMember("set_item_counter")) *ctr = req["set_item_counter"].asInt();
+				resp["itemCounter"] = *ctr;
+			}
+		}
+		resp["hash"] = static_cast<Json::UInt64>(blob);
+		resp["us"] = static_cast<Json::UInt>(SharedEcon::battleHashLastSaveBlobUs());
+		resp["ok"] = okBlob;
+		// PRD-I4 authorized extra: the canonical, exclusion-stripped battle-document
+		// text the hash is taken over, so a saveBlob mismatch diagnosis = a diff of the
+		// two machines' dumps. Test-only; no wire change beyond this command.
+		if (req.get("text", false).asBool())
+		{
+			std::string dump;
+			resp["textOk"] = SharedEcon::computeSaveBlobText(_game, dump);
+			resp["text"] = dump;
+		}
+	}
 	else if (cmd == "battle_give")
 	{
 		// Arm <unit> with <item> (+ an optional <ammo> loaded into slot 0).
@@ -3712,13 +4154,67 @@ bool TestServer::executeBattle12(const std::string& cmd, const Json::Value& req,
 				part["mapDataSetID"] = dsid;
 				resp["parts"][partNames[p]] = part;
 			}
+			// coop (PRD-I1 test): per-tile hazard read, so the seq-gate red/green
+			// can assert whether an injected set_fire_tile applied to THIS tile.
+			resp["fire"] = t->getFire();
+			resp["smoke"] = t->getSmoke();
+			resp["ok"] = true;
+		}
+	}
+	else if (cmd == "battle_camera")
+	{
+		// Point the map camera at <unit> (or an explicit x/y/z) and report whether
+		// it is on screen afterwards.
+		//
+		// PRD-P7 needs this: UnitWalkBState ALREADY runs an off-screen walk at
+		// interval 0 (nobody can see it), so a test that means to observe a slow
+		// walk - the fast-forward contention scenarios, and the client display lag
+		// the flow-control cap bounds - has to put the walker in view first.
+		// Nothing in the game replicates the camera, so each machine is aimed
+		// independently, which is exactly what a test of two players watching
+		// different things wants.
+		BattlescapeState* pbs = bstate;
+		Map* map = pbs ? pbs->getMap() : nullptr;
+		Camera* cam = map ? map->getCamera() : nullptr;
+		BattleUnit* unit = findUnit(req.get("unit", -1).asInt());
+		if (!cam)
+		{
+			resp["error"] = "no battlescape map";
+		}
+		else
+		{
+			Position at = unit ? unit->getPosition()
+							   : Position(req.get("x", 0).asInt(), req.get("y", 0).asInt(),
+										  req.get("z", 0).asInt());
+			cam->centerOnPosition(at);
+			cam->setViewLevel(at.z);
+			// "visible": UnitWalkBState's on-screen test is
+			// `getVisible() && isOnScreen(...)`, and BattleUnit::_visible is only
+			// raised for a PLAYER unit that some player unit can actually SEE
+			// (TileEngine.cpp:1493). A driver the fixture teleported away from the
+			// squad is therefore invisible on the machine that does not own it,
+			// which silently puts its walk back on the interval-0 seam. The flag is
+			// display-only (Map drawing and the UI panels) and TileEngine raises it
+			// on its own the moment anybody sees the unit.
+			if (unit && req.get("visible", false).asBool())
+			{
+				unit->setVisible(true);
+			}
+			const int size = unit ? unit->getArmor()->getSize() - 1 : 0;
+			resp["x"] = at.x; resp["y"] = at.y; resp["z"] = at.z;
+			resp["visible"] = unit ? unit->getVisible() : false;
+			resp["onScreen"] = cam->isOnScreen(at, true, size, false);
 			resp["ok"] = true;
 		}
 	}
 	else if (cmd == "battle_fire")
 	{
 		// Fire <weapon_id> (or the main hand weapon) from <unit>. mode =
-		// snap|aimed|auto|launch. launch takes <waypoints> (a list of x/y/z) -
+		// snap|aimed|auto|launch|throw|hit|psi|panic. `hit` runs MeleeAttackBState
+		// and `psi`/`panic` run PsiAttackBState, so a test can drive the melee and
+		// psi coop packets (the only other producers of the replay handlers) -
+		// both need a unit standing ON the target tile. launch takes <waypoints>
+		// (a list of x/y/z) -
 		// exactly what a blaster launcher does. <hand> stamps
 		// BattlescapeState::_hand, which is what the coop packet reports as the
 		// firing hand. <tu> tops the actor's TU up first so the shot is never
@@ -3771,13 +4267,16 @@ bool TestServer::executeBattle12(const std::string& cmd, const Json::Value& req,
 		else if (mode == "auto") bt = BA_AUTOSHOT;
 		else if (mode == "launch") bt = BA_LAUNCH;
 		else if (mode == "throw") bt = BA_THROW;
+		else if (mode == "hit") bt = BA_HIT;
+		else if (mode == "psi") bt = BA_MINDCONTROL;
+		else if (mode == "panic") bt = BA_PANIC;
 
 		sbg->setSelectedUnit(unit);
 		BattleAction* a = bg->getCurrentAction();
 		a->actor = unit;
 		a->weapon = w;
 		a->type = bt;
-		a->targeting = true;
+		a->targeting = (bt != BA_HIT);
 		a->waypoints.clear();
 		Position target(req.get("x", 0).asInt(), req.get("y", 0).asInt(), req.get("z", 0).asInt());
 		int tid = req.get("target", -1).asInt();
@@ -3810,8 +4309,955 @@ bool TestServer::executeBattle12(const std::string& cmd, const Json::Value& req,
 		resp["tuHave"] = unit->getTimeUnits();
 		resp["weaponId"] = w->getId();
 		resp["ammoId"] = w->getAmmoForAction(bt) ? w->getAmmoForAction(bt)->getId() : -1;
-		bg->statePushBack(new UnitTurnBState(bg, *a));
-		bg->statePushBack(new ProjectileFlyBState(bg, *a));
+		if (bt == BA_HIT)
+		{
+			// MeleeAttackBState dereferences the unit standing on the target tile;
+			// refuse rather than throw when there is nobody there.
+			Tile* tt = sbg->getTile(a->target);
+			if (!tt || !tt->getUnit())
+			{
+				resp["error"] = "melee target tile holds no unit";
+				return true;
+			}
+			bg->statePushBack(new UnitTurnBState(bg, *a));
+			bg->statePushBack(new MeleeAttackBState(bg, *a));
+		}
+		else if (bt == BA_MINDCONTROL || bt == BA_PANIC)
+		{
+			Tile* tt = sbg->getTile(a->target);
+			if (!tt || !tt->getUnit())
+			{
+				resp["error"] = "psi target tile holds no unit";
+				return true;
+			}
+			bg->statePushBack(new PsiAttackBState(bg, *a));
+		}
+		else
+		{
+			bg->statePushBack(new UnitTurnBState(bg, *a));
+			bg->statePushBack(new ProjectileFlyBState(bg, *a));
+		}
+		resp["ok"] = true;
+	}
+	else if (cmd == "battle_intent")
+	{
+		// PRD-P6: drive an action through the SAME door a UI confirm site uses -
+		// BattlescapeGame::coopRouteAction, then executeAction when it is not
+		// routed. On a parallel client that ships an `action_intent`; on the
+		// parallel host it runs the admission check and executes; in classic it
+		// just executes. `battle_action`/`battle_fire` deliberately still push
+		// BattleStates directly - they are the raw local-execution lever, which
+		// is what test_parallel_sharedturn's no-replication assertion needs.
+		BattleUnit* unit = findUnit(req.get("unit", -1).asInt());
+		if (!unit || !bg)
+		{
+			resp["error"] = "no unit id / no battle game";
+			return true;
+		}
+		const std::string what = req.get("action", "move").asString();
+		if (req.isMember("tu"))
+		{
+			unit->setTimeUnits(req["tu"].asInt());
+		}
+		// PRD-P9: energy too. A soak drives hundreds of walks, and a soldier out
+		// of ENERGY refuses to move just as surely as one out of TU - which made a
+		// scenario that meant to time a long walk quietly measure a walk that
+		// never happened.
+		if (req.isMember("energy"))
+		{
+			unit->setCoopEnergy(req["energy"].asInt());
+		}
+		// PRD-P2 (unit term): a TEST-ONLY one-sided status write, in the wire
+		// encoding (connectionTCP::unitstatusToInt). Nothing in the co-op protocol
+		// replicates a bare status assignment, so setting it on ONE machine moves
+		// that machine's `chkBattleUnits` and NOTHING else - which is precisely the
+		// bug shape the unit term exists to catch (a peer holding a unit on its
+		// feet that the executor has already killed). Pairs with `dry`.
+		if (req.isMember("status") && _game->getCoopMod())
+		{
+			unit->setCoopStatus(_game->getCoopMod()->intToUnitstatus(req["status"].asInt()));
+			resp["status"] = _game->getCoopMod()->unitstatusToInt(unit->getStatus());
+		}
+		if (bstate && req.isMember("hand"))
+		{
+			bstate->_hand = req["hand"].asString();
+		}
+
+		if (what == "probe_step")
+		{
+			// One RPC for "where can this unit actually walk?". The skirmish
+			// fixture packs the squad into the Skyranger, so a driver has to be
+			// found by trial - and probing tile by tile over the wire was slow
+			// enough to look like a hang.
+			//
+			// Refused while a chain is running: Pathfinding is a SINGLETON that
+			// the running UnitWalkBState dequeues from, so calculating a probe
+			// path mid-walk re-routes the unit that is already walking. The real
+			// capture site cannot hit this - mapClick returns early on isBusy().
+			if (bg->isBusy())
+			{
+				resp["error"] = "busy - probing would re-route the running walk";
+				return true;
+			}
+			const Position from = unit->getPosition();
+			const int radius = req.get("radius", 1).asInt();
+			Json::Value found(Json::arrayValue);
+			for (int r = 1; r <= radius; ++r)
+			{
+				for (int dx = -r; dx <= r; ++dx)
+				{
+					for (int dy = -r; dy <= r; ++dy)
+					{
+						if (std::max(std::abs(dx), std::abs(dy)) != r)
+							continue;
+						Position want(from.x + dx, from.y + dy, from.z);
+						bg->getPathfinding()->calculate(unit, want, BAM_NORMAL);
+						if (bg->getPathfinding()->getStartDirection() == -1)
+							continue;
+						Json::Value entry;
+						entry["x"] = want.x;
+						entry["y"] = want.y;
+						entry["z"] = want.z;
+						// De-flake additive fields (existing consumers ignore
+						// them): the RESOLVED path length from the unit's current
+						// tile to this candidate, and whether the candidate tile
+						// has a floor under it. A Chebyshev-adjacent tile whose
+						// DIRECT step is terrain-blocked resolves to a multi-step
+						// DETOUR (pathLen > 1); a TU-clamped unit then stops
+						// partway or falls a z-level at the detour's end, which
+						// the walk/race position asserts misread as a double
+						// execution. `pathLen == 1 && floorSafe` selects the
+						// clean single steps those asserts assume.
+						entry["pathLen"] = (int)bg->getPathfinding()->getPath().size();
+						const Tile* dt = sbg->getTile(want);
+						entry["floorSafe"] = (dt != nullptr) && !dt->hasNoFloor(sbg);
+						found.append(entry);
+						if (found.size() >= (Json::ArrayIndex)req.get("max", 1).asUInt())
+						{
+							resp["steps"] = found;
+							resp["ok"] = true;
+							return true;
+						}
+					}
+				}
+			}
+			resp["steps"] = found;
+			resp["ok"] = !found.empty();
+			if (found.empty())
+			{
+				resp["error"] = "unit can path nowhere";
+			}
+			return true;
+		}
+
+		BattleAction a;
+		a.actor = unit;
+		a.targeting = false;
+		a.target = Position(req.get("x", 0).asInt(), req.get("y", 0).asInt(), req.get("z", 0).asInt());
+		int tid = req.get("target", -1).asInt();
+		if (tid != -1)
+		{
+			BattleUnit* tgt = findUnit(tid);
+			if (!tgt)
+			{
+				resp["error"] = "no target id";
+				return true;
+			}
+			a.target = tgt->getPosition();
+		}
+
+		BattleItem* w = nullptr;
+		int wid = req.get("weapon_id", -1).asInt();
+		if (wid != -1)
+		{
+			for (auto* bi : *sbg->getItems())
+				if (bi->getId() == wid) w = bi;
+		}
+		else
+		{
+			w = unit->getMainHandWeapon(false);
+			if (!w)
+			{
+				for (auto* bi : *unit->getInventory())
+				{
+					if (bi->getSlot() && (bi->getSlot()->getId() == "STR_RIGHT_HAND"
+						|| bi->getSlot()->getId() == "STR_LEFT_HAND"))
+					{
+						w = bi;
+						break;
+					}
+				}
+			}
+		}
+		a.weapon = w;
+
+		std::string kind = "other";
+		if (what == "move")
+		{
+			a.type = BA_WALK;
+			kind = "walk";
+			a.run = req.get("run", false).asBool();
+			a.strafe = req.get("strafe", false).asBool();
+			a.sneak = req.get("sneak", false).asBool();
+		}
+		else if (what == "turn")
+		{
+			a.type = BA_TURN;
+			kind = "turn";
+		}
+		else if (what == "kneel")
+		{
+			a.type = BA_KNEEL;
+			kind = "kneel";
+			a.weapon = nullptr;
+		}
+		else if (what == "throw")
+		{
+			a.type = BA_THROW;
+			kind = "throw";
+		}
+		else if (what == "melee")
+		{
+			a.type = BA_HIT;
+			kind = "melee";
+		}
+		else if (what == "psi")
+		{
+			a.type = req.get("mode", "").asString() == "panic" ? BA_PANIC : BA_MINDCONTROL;
+			kind = "psi";
+		}
+		else if (what == "prime")
+		{
+			a.type = req.get("unprime", false).asBool() ? BA_UNPRIME : BA_PRIME;
+			a.value = req.get("fuse", 0).asInt();
+			kind = "prime";
+		}
+		else if (what == "medikit")
+		{
+			a.type = BA_USE;
+			kind = "medikit";
+		}
+		else
+		{
+			const std::string mode = req.get("mode", "snap").asString();
+			a.type = mode == "aimed" ? BA_AIMEDSHOT : mode == "auto" ? BA_AUTOSHOT
+					 : mode == "launch" ? BA_LAUNCH : BA_SNAPSHOT;
+			kind = "shoot";
+			if (a.type == BA_LAUNCH)
+			{
+				a.waypoints.push_back(a.target);
+			}
+		}
+
+		if (kind != "walk" && kind != "turn" && kind != "kneel")
+		{
+			a.updateTU();
+		}
+		resp["tuCost"] = a.Time;
+		resp["tuHave"] = unit->getTimeUnits();
+		resp["weaponId"] = a.weapon ? a.weapon->getId() : -1;
+
+		if (kind == "walk" && !bg->isBusy())
+		{
+			// mapClick only reaches its capture site when a path exists, so this
+			// lever refuses the same way rather than shipping an unwalkable intent.
+			// Skipped while a chain runs, for the same singleton-Pathfinding reason
+			// probe_step refuses outright: mapClick cannot reach this code while
+			// busy either (it returns early on isBusy()), and the intent that
+			// follows is about to be denied `busy` by the arbiter anyway.
+			bg->getPathfinding()->calculate(a.actor, a.target, a.getMoveType());
+			if (bg->getPathfinding()->getStartDirection() == -1)
+			{
+				resp["error"] = "no path to target";
+				return true;
+			}
+		}
+
+		// dry: set the state up (notably <tu>) and report, route nothing. The only
+		// way a test can put the EXECUTOR's copy of a unit out of time units.
+		if (req.get("dry", false).asBool())
+		{
+			resp["routed"] = false;
+			resp["dry"] = true;
+			resp["ok"] = true;
+			return true;
+		}
+
+		bool routed = false;
+		if (kind == "medikit")
+		{
+			BattleUnit* patient = findUnit(req.get("patient", req.get("unit", -1).asInt()).asInt());
+			if (!patient)
+			{
+				resp["error"] = "no patient id";
+				return true;
+			}
+			const std::string mode = req.get("medikit", "heal").asString();
+			const int mmode = mode == "stim" ? BMA_STIMULANT
+							: mode == "pain" ? BMA_PAINKILLER : BMA_HEAL;
+			routed = bg->coopRouteMedikit(&a, patient, mmode, req.get("part", 0).asInt());
+			if (!routed)
+			{
+				a.coopTargetUnit = patient->getId();
+				a.coopMedikitMode = mmode;
+				a.coopBodyPart = req.get("part", 0).asInt();
+				bg->executeAction(a);
+			}
+		}
+		else
+		{
+			routed = bg->coopRouteAction(a, kind);
+			if (!routed)
+			{
+				bg->executeAction(a);
+			}
+		}
+		// true  = shipped as an intent (client) or refused admission (host)
+		// false = executed right here
+		resp["routed"] = routed;
+		resp["pendingReqId"] = static_cast<Json::UInt>(connectionTCP::_clientPendingReqId);
+		resp["ok"] = true;
+	}
+	else if (cmd == "parallel_state")
+	{
+		// PRD-P0 skeleton: the receive-gate readout plus the parallel-turns mode
+		// flag in one cheap query (battle_state also carries them, but it dumps
+		// every unit as well, which a per-frame poll should not pay for).
+		// Later PRDs append their own fields here: P6 actionSeq/pendingIntent/
+		// admitBlocked/pendingReqId, P7 fastForward/peerDisplayAckedSeq,
+		// P8 readySeats/autoSeats/sideSeq.
+		connectionTCP* pcoop = _game->getCoopMod();
+		// PRD-P5: the real predicate. `parallelEnabled` is the handshake mirror
+		// (connectionTCP::_enable_parallel_turns) and `clientInputBlocked` the
+		// temporary §4 input gate, so a test can tell "the mode is on" from "the
+		// mode is on AND this machine is the one that may not act".
+		resp["parallelActive"] = connectionTCP::parallelTurnActive();
+		resp["parallelEnabled"] = connectionTCP::_enable_parallel_turns;
+		resp["clientInputBlocked"] = connectionTCP::parallelInputBlocked();
+		{
+			std::string warn;
+			std::string waitBanner;
+			if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle()
+				&& _game->getSavedGame()->getSavedBattle()->getBattleState())
+			{
+				BattlescapeState* pbs = _game->getSavedGame()->getSavedBattle()->getBattleState();
+				warn = pbs->getCoopWarningText();
+				// coop (parallel turns): the persistent "Please wait for <player>'s
+				// action" banner text ("" when hidden). Separate field from `warning`
+				// because it lives on its own widget, not the fading _warning one.
+				waitBanner = pbs->getCoopWaitText();
+			}
+			resp["warning"] = warn;
+			resp["coopWaitBanner"] = waitBanner;
+			resp["lastDenyWarning"] = pcoop ? pcoop->_clientLastDenyWarning : std::string();
+		}
+		resp["taskCompleted"] = pcoop ? pcoop->coopTaskCompleted() : true;
+		// PRD-P6 pre-task: the gate is a depth counter now. A chain that leaks a
+		// hold shows up here as a depth that never returns to 0.
+		resp["taskDepth"] = pcoop ? pcoop->coopTaskDepth() : 0;
+		resp["pathLock"] = pcoop ? pcoop->_pathLock : -1;
+		resp["coopWalkInit"] = pcoop ? pcoop->_coopWalkInit : false;
+		resp["coopInitDeath"] = pcoop ? pcoop->_coopInitDeath : false;
+		// coop (Class-A soak wedge fix, A1): the auto-shot pacing wait + its liveness
+		// escape. `coopPacingWait` is 1 while a multi-shot replay is parked on the
+		// host's flip packet (the state that, unrescued, holds the receive gate for the
+		// whole rest of the battle); `forceDrainCount` is the monotonic number of times
+		// the RX pump's stall floor had to force that wait to end - 0 across a clean
+		// run, non-zero only when a real wedge was broken.
+		resp["coopPacingWait"] = pcoop ? pcoop->_coopPacingWait : false;
+		resp["forceDrainReplay"] = pcoop ? pcoop->_coopForceDrainReplay : false;
+		resp["forceDrainCount"] = static_cast<Json::UInt>(pcoop ? pcoop->_coopForceDrainCount : 0);
+		resp["coopEnd"] = pcoop ? pcoop->_coopEnd : 0;
+		// coop (PRD-I3 Option D-lite): the pending deferred turn-machine advance
+		// (1 while a neutral->player advance waits for its next_turn, else 0).
+		resp["turnAdvanceDeferred"] = connectionTCP::_turnAdvanceDeferred;
+		// coop (PRD-I3 rider): monotonic arm count - poll-timing-robust (the bool above
+		// can arm and clear inside one next_turn window a test poll misses).
+		resp["turnAdvanceDeferredCount"] = connectionTCP::_turnAdvanceDeferredCount;
+		resp["rxHold"] = static_cast<Json::UInt>(rxHoldSize());
+		// PRD-P9 R7: packets set aside by a permanent exclusion instead of being
+		// rotated forever. Nothing is lost - they re-enter g_rxHold at the front.
+		resp["rxPark"] = static_cast<Json::UInt>(rxParkSize());
+		// coop (option 3B): the remaining LIVE pending-to-apply depths, so the repro
+		// settle can prove "nothing left to apply" (NOT the cumulative counters).
+		// rxQDepth = already-parsed messages waiting for the game thread; snapPending =
+		// conflation slots still holding an un-applied last-write-wins snapshot.
+		resp["rxQDepth"] = static_cast<Json::UInt>(g_rxQ.size());
+		resp["snapPending"] = static_cast<Json::UInt>(snapshotPendingCount());
+		resp["rxRotates"] = static_cast<Json::UInt>(g_rxRotateCount.load());
+		resp["rxHoldMax"] = static_cast<Json::UInt>(g_rxHoldMaxSeen.load());
+		// PRD-P11: the in-order pump. `rxSkippedBlocked` counts packets the gate
+		// would have let through but that waited for an earlier packet about the
+		// same unit; `rxLegacyPasses` counts liveness-floor engagements and is
+		// expected to stay 0. `trace: true` returns the applied-packet ring, which
+		// is the only way to assert ORDER rather than end state.
+		resp["rxSkippedBlocked"] = static_cast<Json::UInt>(g_rxSkipBlocked.load());
+		resp["rxLegacyPasses"] = static_cast<Json::UInt>(g_rxLegacyPasses.load());
+		// coop (LIVENESS FLOOR ordering-preserving drain): stage-2 hard-floor engagements
+		// (the legacy full-disable backstop). 0 with rxLegacyPasses > 0 AND zero four-bucket
+		// mismatch = the ordering-preserving drain carried the whole load = the fix working.
+		resp["rxHardFloorPasses"] = static_cast<Json::UInt>(g_rxHardFloorPasses.load());
+		// coop (wire-order Increment 7, SHAPE A diagnostic): host regen-carry elements
+		// emitted vs client elements applied. On a firing run, emitted>0 & applied>0 =>
+		// mechanism runs (residual is timing); applied==0 => not reaching the sampler.
+		resp["regenEmitted"] = static_cast<Json::UInt>(g_regenEmitted.load());
+		resp["regenApplied"] = static_cast<Json::UInt>(g_regenApplied.load());
+		resp["diagCapture"] = g_diagCapture.load(std::memory_order_relaxed);
+		{
+			Json::Value dt(Json::arrayValue);
+			std::lock_guard<std::mutex> lk(g_diagTraceMutex);
+			for (const auto& s : g_diagTrace) dt.append(s);
+			resp["diagTrace"] = dt;
+		}
+		resp["rxTestHold"] = g_rxTestHold.load();
+		resp["rxDrainDisable"] = g_rxDrainDisable.load();
+		resp["rxForceFloor"] = g_rxForceFloor.load();
+		resp["rxSideBarrierDisable"] = g_rxSideBarrierDisable.load();
+		// coop (wire-order report alignment, Phase 2): the master lever readback.
+		resp["wireOrderState"] = g_wireOrderState.load();
+		// coop (option 3, 2d): boundary-persistence-alarm introspection.
+		resp["syncBoundaryPending"] = static_cast<Json::UInt64>(SharedEcon::syncBoundaryPendingSize());
+		resp["syncBoundaryHealed"] = static_cast<Json::UInt64>(SharedEcon::syncBoundaryHealed());
+		resp["syncBoundaryPersistAlarms"] = static_cast<Json::UInt64>(SharedEcon::syncBoundaryPersistAlarms());
+		resp["syncBoundaryUnresolved"] = static_cast<Json::UInt64>(SharedEcon::syncBoundaryUnresolved());
+		// coop DIAGNOSTIC (reject-set audit): [unitId, inSide, inSeq, recSide, recSeq, recRank] per rejected next_turn write.
+		{
+			Json::Value ntr(Json::arrayValue);
+			for (const auto& r : coopWmDbgRejects())
+			{
+				Json::Value row(Json::arrayValue);
+				for (int k = 0; k < 6; ++k) row.append(static_cast<Json::UInt>(r[k]));
+				ntr.append(row);
+			}
+			resp["nextTurnRejects"] = ntr;
+		}
+		// coop (parallel battlescape Phase 1 - per-unit state watermark): stamped
+		// per-unit writes dropped because their stamp was < the unit's recorded
+		// watermark. Total + per-rank (0=snapshot/next_turn, 1=chain carrier,
+		// 2=casualty, unused until Phase 2). `deathWatermarkDisable` is the
+		// TEST-ONLY lever that skips the check entirely (writes always apply).
+		resp["stateWatermarkRejects"] = static_cast<Json::UInt>(g_stateWatermarkRejects.load());
+		resp["stateWatermarkRejectsRank0"] = static_cast<Json::UInt>(g_stateWatermarkRejectsRank0.load());
+		resp["stateWatermarkRejectsRank1"] = static_cast<Json::UInt>(g_stateWatermarkRejectsRank1.load());
+		resp["stateWatermarkRejectsRank2"] = static_cast<Json::UInt>(g_stateWatermarkRejectsRank2.load());
+		resp["deathWatermarkDisable"] = g_deathWatermarkDisable.load();
+		// coop (parallel battlescape Phase 2b - atomic unit death): `unit_casualty`
+		// apply/reject counts (the reject path is the SAME rank-2 watermark as
+		// above, just its own counter) and the TEST-ONLY RED lever that falls back
+		// to the legacy unit_death/after_unit_death trio (corpseReplayArmed/
+		// corpseRemapArmed, emitted elsewhere in this response, MUST stay at their
+		// pre-battle value on the atomic path - it never arms those windows).
+		resp["casualtiesApplied"] = static_cast<Json::UInt>(g_casualtiesApplied.load());
+		resp["casualtiesRejected"] = static_cast<Json::UInt>(g_casualtiesRejected.load());
+		resp["atomicDeathDisable"] = g_atomicDeathDisable.load();
+		resp["deathGhostDisable"] = g_deathGhostDisable.load();
+		// coop (explosion ordered-replay E0 - LEAK-OBJ): objectiveLeakBlocked counts
+		// addDestroyedObjective() calls the client's coop gate refused (see
+		// SavedBattleGame.cpp); objectiveGateDisable is the TEST-ONLY RED lever that
+		// reverts the gate; explosionReplayDisable is the E0 introspection-only lever
+		// for the (E1-enforcing) ordered-explosion-sim path.
+		resp["objectiveLeakBlocked"] = static_cast<Json::UInt>(g_objectiveLeakBlocked.load());
+		resp["objectiveGateDisable"] = g_objectiveGateDisable.load();
+		resp["explosionReplayDisable"] = g_explosionReplayDisable.load();
+		// coop (explosion ordered-replay E1): explosionsDisplayOnly counts ExplosionBState
+		// instances that ran display-only on the parallel client; explodeCallsSuppressed
+		// counts how many of those suppressed the single explode() ray-trace call (init()).
+		// Both climb only while explosionReplayDisable is off.
+		resp["explosionsDisplayOnly"] = static_cast<Json::UInt>(g_explosionsDisplayOnly.load());
+		resp["explodeCallsSuppressed"] = static_cast<Json::UInt>(g_explodeCallsSuppressed.load());
+		// coop (explosion ordered-replay E2): chainDetonationsSent/Applied are process-local
+		// counters - a parallel host counts the chain_detonation packets it SHIPPED (its own
+		// checkForTerrainExplosions scan order), a parallel client counts the ones it APPLIED.
+		// They should match at side close on the sending/receiving pair. chainDetonationList
+		// is the same data as [x,y,z] tuples (host = send order, client = apply order) so a
+		// fixture can assert ORDER, not just count.
+		resp["chainDetonationsSent"] = static_cast<Json::UInt>(g_chainDetonationsSent.load());
+		resp["chainDetonationsApplied"] = static_cast<Json::UInt>(g_chainDetonationsApplied.load());
+		resp["chainDetonationList"] = chainDetonationListDump(0);
+		// coop (explosion ordered-replay E4): TEST-ONLY RED lever for the LEAK-GRAV
+		// derive (parallel_state.gravityDeriveDisable).
+		resp["gravityDeriveDisable"] = g_gravityDeriveDisable.load();
+		// coop (explosion ordered-replay E5a GAP-MODULE): moduleDestroyedSent/Applied
+		// are process-local counters, same shape as chainDetonationsSent/Applied above -
+		// a parallel host counts the module_destroyed packets it SHIPPED (one per
+		// detonate-path base-module decrement), a parallel client counts the ones it
+		// APPLIED. Should match at side close.
+		resp["moduleDestroyedSent"] = static_cast<Json::UInt>(g_moduleDestroyedSent.load());
+		resp["moduleDestroyedApplied"] = static_cast<Json::UInt>(g_moduleDestroyedApplied.load());
+		// coop (chain-atomicity D.3b): the chained-terrain pacing race counters. Parks +
+		// consumes are the bug (0 after the _explosionCounter==0 gate + per-instance flag);
+		// diverted proves the fix engaged on a real opportunity.
+		resp["terrainPacingParks"] = static_cast<Json::UInt>(g_coopTerrainPacingParks);
+		resp["terrainPacingConsumes"] = static_cast<Json::UInt>(g_coopTerrainPacingConsumes);
+		resp["terrainPacingDiverted"] = static_cast<Json::UInt>(g_coopTerrainPacingDiverted);
+		// PRD-I1: whitelisted outcome packets held for their own chain's opener
+		// (chain isolation). Expected > 0 on a lagging client, 0 on the executor.
+		resp["rxSeqDeferred"] = static_cast<Json::UInt>(g_rxSeqDeferred.load());
+		resp["barrierBlocks"] = static_cast<Json::UInt>(g_barrierBlocks.load()); // PHASE D.1
+		// coop (chain-atomicity Strand B): side-barrier introspection. holds = passes the
+		// whitelisted endTurn was held for a still-deferred current-side stamped packet;
+		// releases = held endTurns that consumed once side S drained (liveness proof);
+		// hardReleases = held endTurns forced through by the kRxDrainHardFloorMs escape
+		// (0 = the ordered drain always released the token in time).
+		resp["sideBarrierHolds"] = static_cast<Json::UInt>(g_sideBarrierHolds.load());
+		resp["sideBarrierReleases"] = static_cast<Json::UInt>(g_sideBarrierReleases.load());
+		resp["sideBarrierHardReleases"] = static_cast<Json::UInt>(g_sideBarrierHardReleases.load());
+		// coop (chain-atomicity Strand A): midSideDeaths = mid-side (non-boundary) host
+		// deaths seen; midSideDeathsUnstamped = how many shipped _openChainSeq==0 (the
+		// Strand-A bug; must be 0 post-fix, boundary deaths excluded).
+		resp["midSideDeaths"] = static_cast<Json::UInt>(g_coopMidSideDeaths.load());
+		resp["midSideDeathsUnstamped"] = static_cast<Json::UInt>(g_coopMidSideDeathsUnstamped.load());
+		if (req.get("trace", false).asBool())
+		{
+			resp["rxTrace"] = rxAppliedTrace(
+				static_cast<size_t>(req.get("traceLimit", 64).asUInt()));
+		}
+		if (req.get("dump_hold", false).asBool())
+		{
+			resp["holdDump"] = rxHoldDump(
+				static_cast<size_t>(req.get("dumpLimit", 40).asUInt()));
+		}
+		// PRD-P6: the action-intent arbiter. `actionSeq`/`sideSeq` are the host's
+		// counters (the client mirrors what it is told), `admitBlocked` names the
+		// first canAdmitAction() term that said no ("" = it said yes), and the two
+		// pending readouts are the host's admitted slot and the client's
+		// outstanding request.
+		resp["actionSeq"] = static_cast<Json::UInt>(connectionTCP::_actionSeq);
+		resp["sideSeq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+		resp["peerDisplayAckedSeq"] = static_cast<Json::UInt>(connectionTCP::peerDisplayAckedSeq);
+		resp["sideCommit"] = connectionTCP::_sideCommitInProgress;
+		resp["canAdmit"] = connectionTCP::canAdmitAction();
+		resp["admitBlocked"] = connectionTCP::_admitBlocked;
+		resp["pendingIntent"]["reqId"] = static_cast<Json::UInt>(connectionTCP::_intentSlotReqId);
+		resp["pendingIntent"]["seat"] = connectionTCP::_intentSlotSeat;
+		resp["pendingIntent"]["kind"] = connectionTCP::_intentSlotKind;
+		resp["pendingReqId"] = static_cast<Json::UInt>(connectionTCP::_clientPendingReqId);
+		resp["pendingKind"] = connectionTCP::_clientPendingKind;
+		// CLIENT: why its last intent was refused. The flash fades (and is
+		// swallowed outright off the player side), so this is the only stable
+		// readout of a deny REASON. `clear_deny` resets it.
+		resp["lastDenyReason"] = connectionTCP::_clientLastDenyReason;
+		resp["lastDenyWarning"] = connectionTCP::_clientLastDenyWarning;
+		if (req.get("clear_deny", false).asBool())
+		{
+			connectionTCP::clearClientLastDeny();
+		}
+		// coop (Class-A soak wedge fix, A3 test lever): override the peer-liveness
+		// firing bar so the red-capability test fires in seconds rather than the shipped
+		// tens of seconds. setLivenessGap 0 / setLivenessStallMs < 0 restore the defaults.
+		if (req.isMember("setLivenessGap") || req.isMember("setLivenessStallMs"))
+		{
+			SharedEcon::setPeerLivenessThresholds(
+				static_cast<std::uint32_t>(req.get("setLivenessGap", 0).asUInt()),
+				static_cast<std::int64_t>(req.get("setLivenessStallMs", -1).asInt64()));
+		}
+		// coop (Class-A soak wedge fix, A1 test lever): arm the auto-shot pacing wait
+		// directly on this (client) machine so the RX pump's force-drain floor can be
+		// exercised deterministically - a real ExplosionBState wait requires a shot that
+		// hits a unit mid-multi-shot with the host's flip withheld, which no fixture can
+		// stage reliably. `false` clears the wait AND any raised drain flag, so a stale
+		// escape can never leak onto a subsequent real shot.
+		if (req.isMember("armPacingWait") && pcoop)
+		{
+			pcoop->_coopPacingWait = req.get("armPacingWait", false).asBool();
+			if (!pcoop->_coopPacingWait) pcoop->_coopForceDrainReplay = false;
+		}
+		// coop (LIVENESS FLOOR ordering-preserving drain, TEST-ONLY levers): park the
+		// receive pump's consumption by emulating a permanently-busy display for the gate
+		// only (whitelisted carriers keep flowing, action_end markers hold), so the
+		// 600-tick liveness floor can be tripped ON DEMAND mid-alien-side with a backlog of
+		// death/terrain carriers queued. `rx_drain_disable` forces the floor back to its
+		// legacy full-disable path so the SAME build measures the pre-fix out-of-order burst
+		// (red) against the ordering-preserving drain (green).
+		if (req.isMember("rx_hold"))
+		{
+			g_rxTestHold.store(req.get("rx_hold", false).asBool(), std::memory_order_relaxed);
+		}
+		if (req.isMember("rx_drain_disable"))
+		{
+			g_rxDrainDisable.store(req.get("rx_drain_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		if (req.isMember("rx_force_floor"))
+		{
+			g_rxForceFloor.store(req.get("rx_force_floor", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (chain-atomicity Strand B, TEST-ONLY): disable just the side barrier so the
+		// same build measures the pre-fix stale-side straddle (red) vs barrier-held (green).
+		if (req.isMember("rx_side_barrier_disable"))
+		{
+			g_rxSideBarrierDisable.store(req.get("rx_side_barrier_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (wire-order report alignment, Phase 2): flip the wire-order state-apply lever.
+		if (req.isMember("wire_order_state"))
+		{
+			g_wireOrderState.store(req.get("wire_order_state", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (parallel battlescape Phase 1, TEST-ONLY): disable the per-unit state
+		// watermark check so the SAME build measures the pre-fix stale-snapshot
+		// overwrite (red) against the watermark-held ordering (green).
+		if (req.isMember("death_watermark_disable"))
+		{
+			g_deathWatermarkDisable.store(req.get("death_watermark_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (parallel battlescape Phase 2b, TEST-ONLY): disable the atomic
+		// `unit_casualty` path so the SAME build measures the pre-atomic legacy
+		// unit_death/after_unit_death transient straddle (red) against the atomic
+		// apply (green). HOST: falls back to sending the legacy trio. CLIENT: the
+		// legacy handlers' early-returns stand down, so it processes the trio again.
+		if (req.isMember("atomic_death_disable"))
+		{
+			g_atomicDeathDisable.store(req.get("atomic_death_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (explosion ordered-replay E0, TEST-ONLY RED lever): reverts the
+		// LEAK-OBJ gate so the SAME build measures the pre-fix client-side
+		// objective-counter inflation (red) against the gated behavior (green).
+		// coop (parallel battlescape Phase 2c, TEST-ONLY RED lever): disable the
+		// death-ghost animation so coopQueueDeathGhost reverts to the Phase-2b stub
+		// (instant complete, corpse visible at apply) - the SAME build reproduces the
+		// pre-ghost "corpse just appears" behaviour (red) against the collapse (green).
+		if (req.isMember("death_ghost_disable"))
+		{
+			g_deathGhostDisable.store(req.get("death_ghost_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (three-class RCA DIAGNOSTIC): arm/disarm the capture-gated tagged write log.
+		if (req.isMember("diag_capture"))
+		{
+			g_diagCapture.store(req.get("diag_capture", false).asBool(),
+				std::memory_order_relaxed);
+			if (!g_diagCapture.load(std::memory_order_relaxed))
+			{
+				std::lock_guard<std::mutex> lk(g_diagTraceMutex);
+				g_diagTrace.clear();
+			}
+		}
+		if (req.isMember("diag_heavy"))
+			g_diagHeavy.store(req.get("diag_heavy", false).asBool(), std::memory_order_relaxed);
+		if (req.isMember("objective_gate_disable"))
+		{
+			g_objectiveGateDisable.store(req.get("objective_gate_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (explosion ordered-replay E0, TEST-ONLY): E0 only stores + surfaces
+		// this lever (parallel_state.explosionReplayDisable); it is wired to force
+		// the legacy (non-ordered) explosion sim path in E1.
+		if (req.isMember("explosion_replay_disable"))
+		{
+			g_explosionReplayDisable.store(req.get("explosion_replay_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (explosion ordered-replay E4, TEST-ONLY RED lever): disables the
+		// LEAK-GRAV derive so the SAME build measures the pre-derive hover (red)
+		// against the gated (green) behavior.
+		if (req.isMember("gravity_derive_disable"))
+		{
+			g_gravityDeriveDisable.store(req.get("gravity_derive_disable", false).asBool(),
+				std::memory_order_relaxed);
+		}
+		// coop (parallel battlescape Phase 1, TEST-ONLY SYNTHETIC RED lever): re-run
+		// the last applied next_turn snapshot's per-unit loop once, immediately. With
+		// the watermark ON, every unit that has since taken a stamped hit is rejected
+		// (stateWatermarkRejects > 0, state unchanged). With death_watermark_disable
+		// ON, the stale snapshot overwrites - the divergence this whole phase exists
+		// to prevent. Never reachable outside this command.
+		if (req.get("replay_last_next_turn", false).asBool() && pcoop)
+		{
+			pcoop->coopDebugReplayLastNextTurn();
+		}
+		// PRD-P7: walk fast-forward + display flow control.
+		//   fastForward     - is the walk/turn/fall interval pinned to 0 right now
+		//   chainSkippable  - would a new input be DEFERRED rather than refused
+		//   openChainSeq    - HOST: the admitted chain still owing an `action_end`
+		//   displaySeq      - CLIENT: the chain it has finished displaying
+		//   displayBacklog  - HOST: admitted-but-undisplayed chains; the arbiter
+		//                     refuses at 2, so this is the bound the skew test reads
+		//   pendingAdmits   - the deferred inputs, one slot per seat
+		{
+			SavedBattleGame* pbattle = _game->getSavedGame() ? _game->getSavedGame()->getSavedBattle() : nullptr;
+			BattlescapeGame* pbg = pbattle ? pbattle->getBattleGame() : nullptr;
+			resp["fastForward"] = pbg ? pbg->getCoopFastForward() : false;
+			resp["chainSkippable"] = pbg ? pbg->chainIsSkippable() : false;
+			// coop (parallel battlescape Phase 2c - death ghost): the client-side death
+			// animation queue. deathGhosts = per-ghost DISPLAY state (active first, then
+			// pending) so a fixture can assert the collapse sequence against the armor's
+			// getDeathFrames(); deathGhostsPending = still-animating count; completed =
+			// finished so far (== kills once the battle's animations drain).
+			resp["deathGhosts"] = pbg ? pbg->coopDeathGhostsJson() : Json::Value(Json::arrayValue);
+			resp["deathGhostsPending"] = static_cast<Json::UInt>(pbg ? pbg->coopDeathGhostsPending() : 0);
+			resp["deathGhostsCompleted"] = static_cast<Json::UInt>(pbg ? pbg->coopDeathGhostsCompleted() : 0);
+		}
+		resp["pendBlocked"] = connectionTCP::_pendBlocked;
+		resp["openChainSeq"] = static_cast<Json::UInt>(connectionTCP::_openChainSeq);
+		resp["displaySeq"] = static_cast<Json::UInt>(connectionTCP::_clientDisplaySeq);
+		resp["displayBacklog"] = static_cast<Json::UInt>(
+			connectionTCP::_actionSeq > connectionTCP::peerDisplayAckedSeq
+				? connectionTCP::_actionSeq - connectionTCP::peerDisplayAckedSeq : 0);
+		// TEST-ONLY `hold_action_done` lever: is this machine parking its
+		// `action_done` reports, and how many it has parked since the hold was
+		// engaged. A held count of 0 means nothing finished displaying, so a
+		// drain-barrier assertion resting on it would be vacuous.
+		resp["holdActionDone"] = connectionTCP::_testHoldActionDone;
+		resp["heldActionDones"] = static_cast<Json::UInt>(connectionTCP::_heldActionDones);
+		Json::Value pend(Json::arrayValue);
+		for (const auto& slot : connectionTCP::_pendingAdmits)
+		{
+			Json::Value js;
+			js["reqId"] = static_cast<Json::UInt>(slot.reqId);
+			js["seat"] = slot.seat;
+			js["kind"] = slot.kind;
+			js["local"] = slot.local;
+			pend.append(js);
+		}
+		resp["pendingAdmits"] = pend;
+		// PRD-P8: the end-turn readiness tally.
+		//   readySeats / autoSeats - the two seat-indexed bits, as seat lists
+		//   readyCount / seatCount - the tally the UI renders ("END TURN r/n")
+		//   commitBlocked          - why coopCheckSideCommit() last refused
+		//                            ("" = it did not, or it committed)
+		//   reserve / kneelReserve - this machine's OWN reserve, which parallel
+		//                            mode stops mirroring across the wire
+		//   chainReserve*          - the reserve override the running client
+		//                            intent installed (-1 = none)
+		connectionTCP::ensureEndTurnSeats();
+		{
+			const int seats = std::max(1, connectionTCP::seatCount());
+			Json::Value ready(Json::arrayValue), autos(Json::arrayValue);
+			for (int s = 0; s < seats; ++s)
+			{
+				if (connectionTCP::_endTurnReady[(size_t)s]) ready.append(s);
+				if (connectionTCP::_endTurnAuto[(size_t)s]) autos.append(s);
+			}
+			resp["readySeats"] = ready;
+			resp["autoSeats"] = autos;
+			resp["readyCount"] = connectionTCP::endTurnReadyCount();
+			resp["seatCount"] = seats;
+			resp["allReady"] = connectionTCP::endTurnAllReady();
+			resp["localSeat"] = connectionTCP::localSeat();
+			resp["localReady"] = connectionTCP::endTurnSeatReady(connectionTCP::localSeat());
+		}
+		resp["commitBlocked"] = connectionTCP::_commitBlocked;
+		// PRD-I0: the per-action sync-check.
+		//   lastSeq / lastComparedSeq - the deferred loop. On the HOST these close
+		//                     on each other as the peer's `action_done` reports come
+		//                     back; a lastComparedSeq that stops chasing lastSeq
+		//                     means the reports stopped.
+		//   ringDepth       - remembered "state after N" entries (max 64)
+		//   buckets         - {alarm, mismatchCount} per bucket; `alarm` is the
+		//                     compile-time promotion table (all false at I0 birth)
+		//   mismatches      - the last 32, each naming seq + kind + bucket
+		//   sweepUs         - cost of the last computeBattleHashes() sweep
+		SharedEcon::syncCheckReport(resp);
+		resp["boundarySeq"] = static_cast<Json::UInt>(connectionTCP::_boundarySeq);
+		resp["reserve"] = (int)sbg->getTUReserved();
+		resp["kneelReserve"] = sbg->getKneelReserved();
+		resp["chainReserve"] = bg ? bg->coopChainReserveMode() : -1;
+		resp["chainReserveUnit"] = bg ? bg->coopChainReserveUnit() : -1;
+		resp["ok"] = true;
+	}
+	else if (cmd == "unit_stats_full")
+	{
+		// PRD-I3 SEAM-7 probe: the FULL unitsStats bucket field vector per unit
+		// (tu/energy/health/stun/morale/mana/fire/kneeled/mind-controller id + the
+		// six per-part fatal-wound counters w0..w5) - every field
+		// computeBattleHashes() mixes into the unitsStats sum, so a live cross-machine
+		// diff at a settle point names the field the bucket hash only counts. The
+		// existing battle_state.units probe omits fire/kneeled/mana/MC/per-part wounds.
+		// Introspection only; `{"id": N}` narrows to one unit.
+		int onlyId = req.get("id", -1).asInt();
+		Json::Value units;
+		SharedEcon::unitStatsFullJson(_game, units, onlyId);
+		resp["units"] = units;
+		resp["ok"] = true;
+	}
+	else if (cmd == "sync_capture")
+	{
+		// PRD-I3 SEAM-7: arm/disarm the opt-in per-mismatch field capture. When ON
+		// (set on BOTH machines), the client attaches its full unit-field vector to
+		// each action_done (`uv`) and the host stashes its own into the sync ring, so a
+		// unitsStats mismatch is diffed field-by-field into syncCheck.fieldDiffs. OFF
+		// by default = zero wire delta. `{"on": bool}` (omitted = true).
+		// coop (PHASE D.1, block-edit into an existing command - NO new top-level branch):
+		// {"strict": bool} toggles the strict-compare BURN-IN lever, disabling the
+		// terrain/unitsCore/items/itemIdCtr alien+endturn side-gates AND the items/saveBlob
+		// corpsePending skips so those buckets compare STRICTLY at every seq. Independent of
+		// the SEAM-7 field-capture toggle; a request may carry either key or both. The legacy
+		// shapes (`sync_capture` / `{on:...}`) keep their exact behaviour.
+		if (req.isMember("strict"))
+		{
+			SharedEcon::setStrictBurnIn(req["strict"].asBool());
+		}
+		if (req.isMember("on") || !req.isMember("strict"))
+		{
+			SharedEcon::setSyncFieldCapture(req.get("on", true).asBool());
+		}
+		resp["fieldCapture"] = SharedEcon::syncFieldCapture();
+		resp["strictBurnIn"] = SharedEcon::strictBurnIn();
+		resp["ok"] = true;
+	}
+	else if (cmd == "terrain_capture")
+	{
+		// PRD-I3 SEAM-3: arm/disarm the opt-in terrain vector capture. When ON (set on
+		// BOTH machines) each machine stashes its FULL non-void tile vector at every
+		// hash point (host ring entry + client emit) into a bounded local ring. Unlike
+		// sync_capture there is NO wire delta - the vector is too big to ship, so the
+		// harness pulls BOTH machines' vectors back via tile_terrain_full {seq} and
+		// diffs them offline. OFF by default. `{"on": bool}` (omitted = true).
+		bool on = req.get("on", true).asBool();
+		SharedEcon::setSyncTerrainCapture(on);
+		resp["terrainCapture"] = SharedEcon::syncTerrainCapture();
+		resp["ok"] = true;
+	}
+	else if (cmd == "tile_terrain_full")
+	{
+		// PRD-I3 SEAM-3 probe/dump. Three modes:
+		//   {}                     -> LIVE full non-void tile vector (the current terrain
+		//                             bucket field set per tile + a diagnostic UFO-door
+		//                             bitmask the bucket is blind to - answers VERIFY-1).
+		//   {"index": N}           -> LIVE, narrowed to one tile.
+		//   {"seq": N[, "boundary": b][, "side_seq": s]}
+		//                          -> the CAPTURED vector for that recorded seq from the
+		//                             local ring (armed capture only), for the offline diff.
+		//   {"list": true}         -> the seqs currently held in the capture ring.
+		if (req.get("list", false).asBool())
+		{
+			Json::Value seqs;
+			SharedEcon::terrainCaptureSeqsJson(seqs);
+			resp["captured"] = seqs;
+			resp["ok"] = true;
+		}
+		else if (req.isMember("seq"))
+		{
+			std::uint32_t seq = static_cast<std::uint32_t>(req["seq"].asUInt());
+			bool boundary = req.get("boundary", false).asBool();
+			int sideSeq = req.get("side_seq", -1).asInt();
+			Json::Value dump;
+			if (SharedEcon::terrainCaptureDumpJson(seq, boundary, sideSeq, dump))
+			{
+				resp["dump"] = dump;
+				resp["ok"] = true;
+			}
+			else
+			{
+				resp["error"] = "no captured terrain vector for that seq";
+				resp["ok"] = false;
+			}
+		}
+		else
+		{
+			int onlyIndex = req.get("index", -1).asInt();
+			Json::Value tiles;
+			SharedEcon::tileTerrainFullJson(_game, tiles, onlyIndex);
+			resp["tiles"] = tiles;
+			resp["tileCount"] = static_cast<Json::UInt>(tiles.size());
+			resp["ok"] = true;
+		}
+	}
+	else if (cmd == "find_explosive_parts")
+	{
+		// SEAM-3 (b) locator: every tile whose MCD part carries a non-zero explosive
+		// property (UFO power sources et al.) - the terrain parts whose destruction
+		// exercises the destroy_tile explosive path. Read-only.
+		Json::Value hits(Json::arrayValue);
+		const int tileCount = sbg->getMapSizeXYZ();
+		for (int i = 0; i < tileCount; ++i)
+		{
+			Tile* tl = sbg->getTile(i);
+			if (!tl) continue;
+			for (int p = 0; p <= O_OBJECT; ++p)
+			{
+				MapData* md = tl->getMapData((TilePart)p);
+				if (md && md->getExplosive() > 0)
+				{
+					Json::Value h;
+					h["x"] = tl->getPosition().x;
+					h["y"] = tl->getPosition().y;
+					h["z"] = tl->getPosition().z;
+					h["index"] = i;
+					h["part"] = p;
+					h["explosive"] = md->getExplosive();
+					h["explosiveType"] = md->getExplosiveType();
+					hits.append(h);
+				}
+			}
+		}
+		resp["hits"] = hits;
+		resp["count"] = static_cast<Json::UInt>(hits.size());
+		resp["ok"] = true;
+	}
+	else if (cmd == "hold_action_done")
+	{
+		// TEST-ONLY observability lever for PRD-P8's end-turn drain barrier.
+		//
+		// The barrier holds the side commit until the peer reports every admitted
+		// chain DISPLAYED (`action_done`). Producing an undisplayed backlog by
+		// making the client slow does not work: battleXcomSpeed paces only
+		// UnitWalk/UnitTurn/UnitFall, which PRD-P7's client fast-forward pins to
+		// interval 0 anyway, and ProjectileFlyBState uses its own fixed interval
+		// and never reads the option - so the real window is one network round
+		// trip (~200 ms) and no fixture can widen it. This holds the report
+		// instead: `{hold:true}` parks it, `{hold:false}` ships the newest parked
+		// seq immediately (main thread, same emit point as the live path).
+		const bool want = req.get("hold", true).asBool();
+		// coop (Class-A soak wedge fix, A3): `{boundary:true}` parks ONLY the boundary
+		// answer (coopEmitBoundaryDone), leaving the per-chain report flowing - so the
+		// host keeps committing and crossing boundaries while its
+		// g_syncLastComparedBoundarySeq freezes, the exact peer-went-dark-on-boundaries
+		// condition the liveness tripwire detects, forced deterministically.
+		const bool boundaryOnly = req.get("boundary", false).asBool();
+		connectionTCP* hcoop = _game->getCoopMod();
+		if (boundaryOnly)
+		{
+			connectionTCP::_testHoldBoundaryDone = want;
+		}
+		else if (want)
+		{
+			connectionTCP::_heldActionDones = 0;
+			connectionTCP::_testHoldActionDone = true;
+		}
+		else
+		{
+			connectionTCP::_testHoldActionDone = false;
+			if (hcoop) hcoop->coopEmitActionDone();
+		}
+		resp["hold"] = connectionTCP::_testHoldActionDone;
+		resp["holdBoundary"] = connectionTCP::_testHoldBoundaryDone;
+		resp["heldActionDones"] = static_cast<Json::UInt>(connectionTCP::_heldActionDones);
+		resp["displaySeq"] = static_cast<Json::UInt>(connectionTCP::_clientDisplaySeq);
+		resp["peerDisplayAckedSeq"] = static_cast<Json::UInt>(connectionTCP::peerDisplayAckedSeq);
+		resp["ok"] = true;
+	}
+	else if (cmd == "battle_reserve")
+	{
+		// PRD-P8 §5: read / set THIS machine's reserve mode, through the very
+		// send path the reserve buttons use (BattlescapeState::coopSendReserveState)
+		// - so a test proves the SUPPRESSION, not just the local setting.
+		if (!bg)
+		{
+			resp["error"] = "no battle game";
+			return true;
+		}
+		if (req.isMember("mode"))
+		{
+			const std::string m = req["mode"].asString();
+			const BattleActionType bt = m == "snap" ? BA_SNAPSHOT
+									  : m == "aimed" ? BA_AIMEDSHOT
+									  : m == "auto" ? BA_AUTOSHOT : BA_NONE;
+			bg->setTUReserved(bt);
+			if (bstate) bstate->coopSendReserveState(false);
+		}
+		if (req.isMember("kneel"))
+		{
+			bg->setKneelReserved(req["kneel"].asBool());
+			if (bstate) bstate->coopSendReserveState(true);
+		}
+		resp["reserve"] = (int)sbg->getTUReserved();
+		resp["kneelReserve"] = sbg->getKneelReserved();
 		resp["ok"] = true;
 	}
 	return true;
@@ -4598,6 +6044,11 @@ std::string TestServer::execute(const std::string& line)
 				resp["turn"] = bg->getTurn();
 				resp["side"] = (int)bg->getSide();
 				resp["missionType"] = bg->getMissionType();
+				// coop (explosion ordered-replay E0 - LEAK-OBJ): the objective-counter
+				// parity readout. host==client on a fixed build; a red run
+				// (objective_gate_disable on the client) shows client > host.
+				resp["objectivesDestroyed"] = bg->getObjectivesDestroyed();
+				resp["objectivesNeeded"] = bg->getObjectivesNeeded();
 				// Map fingerprint: a cheap content hash + object-tile count so a test can
 				// tell whether host and client loaded the SAME battle map (e.g. whether the
 				// player's craft mapblock actually spawned on both).
@@ -4657,12 +6108,160 @@ std::string TestServer::execute(const std::string& line)
 				// test can see exactly which one blocks _battleInit from ever being set.
 				resp["isBusy"] = bg->getBattleGame() ? bg->getBattleGame()->isBusy() : false;
 				resp["panicHandled"] = bg->getBattleGame() ? bg->getBattleGame()->getPanicHandled() : false;
+				// coop (parallel battlescape Phase 2c - death ghost): the corpse/kit item
+				// ids currently hidden from the map (a death ghost's minted items stay
+				// invisible until its collapse ends). Empty except during a client ghost.
+				resp["hiddenItemIds"] = bg->getBattleGame() ? bg->getBattleGame()->coopHiddenItemIdsJson() : Json::Value(Json::arrayValue);
 				resp["isPreview"] = bg->isPreview();
 				resp["clientPanicHandle"] = _game->getCoopMod()->_clientPanicHandle;
 				resp["serverOwner"] = connectionTCP::getServerOwner();
 				resp["saveOwnerId"] = connectionTCP::coop_save_owner_player_id;
+				// PRD-P0: the receive gate. updateCoopTask() will only hand a packet to
+				// onTCPMessage() once _coop_task_completed (or one of the per-action
+				// exemptions) says this machine is idle; everything else is parked in the
+				// hold queue and rotated. Without these a test can only see that the peer
+				// did not react, not WHY.
+				resp["taskCompleted"] = coop->coopTaskCompleted();
+				resp["taskDepth"] = coop->coopTaskDepth();
+				resp["pathLock"] = coop->_pathLock;
+				resp["coopWalkInit"] = coop->_coopWalkInit;
+				resp["coopInitDeath"] = coop->_coopInitDeath;
+				// coop (Class-A soak wedge fix, A1): the auto-shot pacing wait + its
+				// force-drain escape (see parallel_state for the full note). The forensic
+				// wedge showed coopInitDeath=true + taskDepth stuck; coopPacingWait names
+				// the exact display state holding the gate, forceDrainCount the rescues.
+				resp["coopPacingWait"] = coop->_coopPacingWait;
+				resp["forceDrainReplay"] = coop->_coopForceDrainReplay;
+				resp["forceDrainCount"] = static_cast<Json::UInt>(coop->_coopForceDrainCount);
+				// PRD-I3 Session F straddle: this machine's death-replay windows folded
+				// into one gate - the SAME predicate the in-game sync-check reports on at
+				// SharedEcon.cpp:5817 (corpseReplayPendingAny window-1 + corpseRemapPendingAny
+				// window-2 + this machine's _coopInitDeath display replay). A strict
+				// cross-machine item census (test_parallel_soak) sampled while this is true
+				// straddles a boundary death: the executor already minted the corpse and
+				// spilled its kit to the floor, this peer has not converted yet - kit still
+				// on the body here. The soak fixture waits for it to drain before comparing.
+				// Additive read only; no effect on the compare/tripwire semantics.
+				resp["corpsePending"] = SharedEcon::corpseReplayPendingAny()
+					|| SharedEcon::corpseRemapPendingAny() || coop->_coopInitDeath;
+				// coop (item 3, mint-at-apply introspection): the two corpse drift windows split
+				// out of the folded corpsePending flag above. corpseRemapArmed is the window
+				// mint-at-apply structurally empties (must stay 0 on the parallel replay client
+				// through every death); the live *Now bools show whether a window is armed right
+				// at this sample. Additive read-only.
+				resp["corpseReplayPendingNow"] = SharedEcon::corpseReplayPendingAny();
+				resp["corpseRemapPendingNow"] = SharedEcon::corpseRemapPendingAny();
+				resp["corpseReplayArmed"] = static_cast<Json::UInt>(SharedEcon::corpseReplayArmedCount());
+				resp["corpseRemapArmed"] = static_cast<Json::UInt>(SharedEcon::corpseRemapArmedCount());
+				resp["coopEnd"] = coop->_coopEnd;
+				resp["rxHold"] = static_cast<Json::UInt>(rxHoldSize());
+				resp["rxPark"] = static_cast<Json::UInt>(rxParkSize());
+				resp["rxRotates"] = static_cast<Json::UInt>(g_rxRotateCount.load());
+				resp["rxHoldMax"] = static_cast<Json::UInt>(g_rxHoldMaxSeen.load());
+				// PRD-P11: see the parallel_state readout for what these mean.
+				resp["rxSkippedBlocked"] = static_cast<Json::UInt>(g_rxSkipBlocked.load());
+				resp["rxLegacyPasses"] = static_cast<Json::UInt>(g_rxLegacyPasses.load());
+				// PRD-I1: see the parallel_state readout.
+				resp["rxSeqDeferred"] = static_cast<Json::UInt>(g_rxSeqDeferred.load());
+				resp["barrierBlocks"] = static_cast<Json::UInt>(g_barrierBlocks.load()); // PHASE D.1
+				// Parallel-turns mode (PRD-P5), carried on battle_state (as well as
+				// parallel_state) so the harness' session.can_drive() decides from a
+				// single query.
+				resp["parallelActive"] = connectionTCP::parallelTurnActive();
+				resp["parallelEnabled"] = connectionTCP::_enable_parallel_turns;
+				resp["clientInputBlocked"] = connectionTCP::parallelInputBlocked();
+				// PRD-P6 arbiter, on battle_state too so a driver needs one query
+				resp["actionSeq"] = static_cast<Json::UInt>(connectionTCP::_actionSeq);
+				resp["sideSeq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+				resp["canAdmit"] = connectionTCP::canAdmitAction();
+				resp["admitBlocked"] = connectionTCP::_admitBlocked;
+				resp["pendingReqId"] = static_cast<Json::UInt>(connectionTCP::_clientPendingReqId);
+				// PRD-P5: the banner currently squatting on the in-battle warning widget
+				// ("" = none). The persistent off-turn banners have no meaning in
+				// parallel mode and would block P6/P8's deny/ready flashes, so a test
+				// has to be able to see them.
+				resp["warning"] = bg->getBattleState() ? bg->getBattleState()->getCoopWarningText() : std::string();
+				// PRD-P2: the three battle drift terms this machine would stamp onto
+				// the next_turn packet, plus whether the tripwire has fired here.
+				// Comparing the triple across the two machines is
+				// session.assert_battle_synced(); `desyncSeen` is the 3b flag (set by
+				// SharedEcon::verifyBattleChecksum, cleared at co-op battle init).
+				{
+					int64_t chkBattleItemId = -1, chkBattleCensus = -1, chkBattleUnits = -1;
+					SharedEcon::battleChecksumTerms(_game, chkBattleItemId, chkBattleCensus,
+													chkBattleUnits);
+					resp["itemIdCounter"] = Json::Value::Int64(chkBattleItemId);
+					resp["battleCensus"] = Json::Value::Int64(chkBattleCensus);
+					// The unit term (id + faction + liveness + position) on its own
+					// key rather than widening a pair, so a harness failure names
+					// WHICH of the three families moved.
+					resp["battleUnitsChecksum"] = Json::Value::Int64(chkBattleUnits);
+					resp["desyncSeen"] = SharedEcon::battleDesyncSeen();
+					// The auto-report bundle: latched to one per battle per machine,
+					// so a test can assert both that it appeared and that a SECOND
+					// divergence produced no second file.
+					resp["desyncReportWritten"] = SharedEcon::desyncReportWritten();
+					resp["desyncReportPath"] = SharedEcon::desyncReportPath();
+				}
+				// PRD-I0, OPT-IN (`{"cmd":"battle_state","sync":true}`). Deliberately
+				// not unconditional: `battle_state` is the harness' hot poll - every
+				// wait_until in every test hits it several times a second - and
+				// hanging a full-map hash sweep plus a nested report off it would
+				// change the size and cost of a response 130 tests already depend on.
+				// The sync-check readout has exactly two callers (session.sync_check
+				// and session.sync_buckets), so they ask for it; everything else sees
+				// the response byte-for-byte as before.
+				if (req.get("sync", false).asBool())
+				{
+					// The raw bucket values THIS machine would report right now: a
+					// test proving a lever moved a specific bucket cannot wait a round
+					// trip for a deferred compare that may never come. The sweep also
+					// refreshes `syncCheck.sweepUs`, which is the cost measurement.
+					SharedEcon::BattleHashSet hs;
+					if (SharedEcon::computeBattleHashes(_game, hs))
+					{
+						Json::Value h(Json::objectValue);
+						for (int i = 0; i < SharedEcon::BATTLE_HASH_BUCKETS; ++i)
+						{
+							h[SharedEcon::battleHashBucketName(i)] =
+								static_cast<Json::UInt64>(SharedEcon::battleHashBucketValue(hs, i));
+						}
+						resp["battleHashes"] = h;
+						resp["battleHashSweepUs"] =
+							static_cast<Json::UInt>(SharedEcon::battleHashLastSweepUs());
+					}
+					SharedEcon::syncCheckReport(resp);
+					resp["boundarySeq"] = static_cast<Json::UInt>(connectionTCP::_boundarySeq);
+				}
 				const BattleUnit* sel = bg->getSelectedUnit();
 				resp["selectedId"] = sel ? sel->getId() : -1;
+				// PRD-P1: the two other things a replayed peer action used to steal
+				// from the local player - the camera and the singleton
+				// BattlescapeGame::_currentAction. Read-only; a decoupling test
+				// cannot see either of them from selectedId alone.
+				if (BattlescapeState* pbs = bg->getBattleState())
+				{
+					if (Camera* cam = pbs->getMap() ? pbs->getMap()->getCamera() : nullptr)
+					{
+						Position off = cam->getMapOffset();
+						resp["cameraX"] = off.x;
+						resp["cameraY"] = off.y;
+						resp["cameraZ"] = off.z;
+						resp["viewLevel"] = cam->getViewLevel();
+					}
+				}
+				if (BattlescapeGame* pbg = bg->getBattleGame())
+				{
+					BattleAction* ca = pbg->getCurrentAction();
+					resp["actionType"] = (int)ca->type;
+					resp["actionActorId"] = ca->actor ? ca->actor->getId() : -1;
+					resp["actionWeaponId"] = ca->weapon ? ca->weapon->getId() : -1;
+					resp["actionTargeting"] = ca->targeting;
+					resp["actionTargetX"] = ca->target.x;
+					resp["actionTargetY"] = ca->target.y;
+					resp["actionTargetZ"] = ca->target.z;
+					resp["actionWaypoints"] = (int)ca->waypoints.size();
+				}
 				const BattleUnit* giftSel = coop->getGiftSelectedBattleUnit();
 				resp["giftSelectedId"] = giftSel ? giftSel->getId() : -1;
 				Json::Value units(Json::arrayValue);
@@ -4675,7 +6274,22 @@ std::string TestServer::execute(const std::string& line)
 					ju["isOut"] = u->isOut();
 					ju["health"] = u->getHealth();
 					ju["tu"] = u->getTimeUnits();
+					// De-flake additive field: the unit's TU ceiling. setTimeUnits
+					// clamps to _stats.tu (BattleUnit.cpp), so the harness's old
+					// literal top-up of 200 silently became ~66 - top_up() reads
+					// this instead so its "topped up" contract is honest.
+					ju["tuMax"] = u->getBaseStats()->tu;
 					ju["stun"] = u->getStunlevel();
+					// PRD-I3 SEAM-4 diagnostic: per-unit morale, so a bystander-morale
+					// casualty divergence is visible per unit (not only in the unitsStats
+					// bucket). Harness-only.
+					ju["morale"] = u->getMorale();
+					// PRD-P9 soak: the two per-unit terms the census was missing.
+					// Fatal wounds only ever move through host-resolved damage, and
+					// energy is what a walk spends alongside TU - both are drift the
+					// item-census tripwire cannot see.
+					ju["wounds"] = u->getFatalWounds();
+					ju["energy"] = u->getEnergy();
 					ju["name"] = u->getName(_game->getLanguage());
 					ju["isPlayerSoldier"] = (u->getGeoscapeSoldier() != nullptr);
 					// PRD-J09: in-battle control split. _coop 0 = host-controlled,
@@ -4696,6 +6310,22 @@ std::string TestServer::execute(const std::string& line)
 					// kill attribution (for coop outcome cross-validation)
 					ju["murdererId"] = u->getMurdererId();
 					ju["killedBy"] = (int)u->killedBy();
+					// coop (explosion ordered-replay E5a GAP-XP introspection): the unit's
+					// gained-experience counters (BattleUnit::_exp, mutated by awardExperience/
+					// addManaExp). A parallel client-owned attacker only trains these via the
+					// hit_unit carrier (TileEngine.cpp) - exposed here so a fixture can read
+					// host==client without waiting for a full debrief.
+					{
+						const UnitStats* exp = u->getExpStats();
+						ju["expFiring"] = exp->firing;
+						ju["expThrowing"] = exp->throwing;
+						ju["expMelee"] = exp->melee;
+						ju["expReactions"] = exp->reactions;
+						ju["expBravery"] = exp->bravery;
+						ju["expPsiSkill"] = exp->psiSkill;
+						ju["expPsiStrength"] = exp->psiStrength;
+						ju["expMana"] = exp->mana;
+					}
 					ju["direction"] = u->getDirection();
 					Position p = u->getPosition();
 					ju["x"] = p.x; ju["y"] = p.y; ju["z"] = p.z;
@@ -4867,8 +6497,8 @@ std::string TestServer::execute(const std::string& line)
 		else if (cmd == "battle_action")
 		{
 			// Unified battlescape action driver. action = select|move|shoot|
-			// end_turn|abort. Reaches the BattlescapeGame via the top
-			// BattlescapeState. All ops are on the main thread (race-free).
+			// end_turn|end_turn_button|abort. Reaches the BattlescapeGame via the
+			// top BattlescapeState. All ops are on the main thread (race-free).
 			BattlescapeGame* bg = nullptr;
 			BattlescapeState* bstate = nullptr;
 			// PRD-13: left inline - assigns two vars + calls getBattleGame() per match, not pure find-last
@@ -4887,6 +6517,10 @@ std::string TestServer::execute(const std::string& line)
 			}
 			else if (act == "end_turn_button")
 			{
+				// The REAL END TURN button. requestEndTurn() above is the VANILLA
+				// end turn and never ships the co-op `PlayerTurnYour` handoff -
+				// only btnEndTurnClick does, so a test about the handoff has to
+				// press the button a player presses.
 				if (bstate)
 				{
 					bstate->btnEndTurnClick(nullptr);
@@ -4949,7 +6583,13 @@ std::string TestServer::execute(const std::string& line)
 				int coopSide = req.get("coop_side", -1).asInt();
 				int killId = req.get("unit", -1).asInt();
 				int killFaction = req.get("faction", -1).asInt();
-				const RuleDamageType* dt = _game->getMod()->getDamageType(DT_AP);
+				// coop (Phase 2c death ghost): optional nested lever to pick the damage
+				// type, so a fixture can stage a deterministic INDIRECT death (DT_HE:
+				// FixRadius -1 -> isDirect() false -> the ghost's instant-frame path)
+				// as well as the default DIRECT one. Defaults to DT_AP - existing callers
+				// are byte-identical.
+				const int dtInt = req.get("damage_type", (int)DT_AP).asInt();
+				const RuleDamageType* dt = _game->getMod()->getDamageType((ItemDamageType)dtInt);
 				Json::Value killed(Json::arrayValue);
 				for (auto* u : *sbg->getUnits())
 				{
@@ -5096,12 +6736,26 @@ std::string TestServer::execute(const std::string& line)
 					if (req.isMember("psiStrength")) setStat("psiStrength", req["psiStrength"].asInt());
 					if (req.isMember("stat"))        setStat(req["stat"].asString(), req.get("value", 0).asInt());
 					if (req.isMember("visible"))     unit->setVisible(req["visible"].asBool());
+					// coop (PRD-I3 SESSION F): mint-FREE lethal-condition levers for the
+					// boundary-death repro. setHealth/setFire/setFatalWound create NO
+					// BattleItem, so an end_turn that bleeds/burns the unit to death in
+					// prepareNewTurn makes the boundary corpse mint the SOLE mint in flight.
+					if (req.isMember("health"))      unit->setHealth(req["health"].asInt());
+					if (req.isMember("fire"))        unit->setFire(req["fire"].asInt());
+					if (req.isMember("fatalWounds"))
+					{
+						int fw = req["fatalWounds"].asInt();
+						for (int p = 0; p < BODYPART_MAX; ++p)
+							unit->setFatalWound(fw, (UnitBodyPart)p);
+					}
 					if (req.get("refill", false).asBool())
 						unit->setTimeUnits(bs->tu);
 					resp["psiSkill"] = bs->psiSkill;
 					resp["psiStrength"] = bs->psiStrength;
 					resp["visible"] = unit->getVisible();
 					resp["tu"] = unit->getTimeUnits();
+					resp["health"] = unit->getHealth();
+					resp["fatalWounds"] = unit->getFatalWounds();
 					resp["ok"] = true;
 				}
 				else if (act == "door")
@@ -5296,6 +6950,59 @@ std::string TestServer::execute(const std::string& line)
 				}
 			}
 		}
+		else if (cmd == "desync_dialog")
+		{
+			// PRD-I4 dialog introspection: the CoopDesyncNoticeState's headline and the
+			// URL/path its buttons WOULD open, plus its buttons when it is live. The
+			// statics survive the modal's dismissal by the turn cycle, so a test can read
+			// what the last-raised notice would open even after it is gone.
+			resp["ok"] = true;
+			State* top = _game->getStates().empty() ? nullptr : _game->getStates().back();
+			CoopDesyncNoticeState* dlg = dynamic_cast<CoopDesyncNoticeState*>(top);
+			resp["live"] = (dlg != nullptr);
+			if (dlg)
+			{
+				resp["headline"] = dlg->getHeadlineText();
+				resp["message"] = dlg->getMessageText();
+				resp["reportUrl"] = dlg->getReportUrl();
+				resp["openFolderTarget"] = dlg->getOpenFolderTarget();
+				resp["zipPath"] = dlg->getZipPath();
+				Json::Value btns(Json::arrayValue);
+				for (auto* s : dlg->getSurfaces())
+				{
+					if (auto* tb = dynamic_cast<TextButton*>(s))
+					{
+						Json::Value e;
+						e["text"] = tb->getText();
+						e["visible"] = tb->getVisible();
+						e["interactive"] = (dynamic_cast<InteractiveSurface*>(s) != nullptr);
+						btns.append(e);
+					}
+				}
+				resp["buttons"] = btns;
+			}
+			Json::Value st;
+			st["headline"] = CoopDesyncNoticeState::s_lastHeadline;
+			st["message"] = CoopDesyncNoticeState::s_lastMessage;
+			st["reportUrl"] = CoopDesyncNoticeState::s_lastReportUrl;
+			st["openFolderTarget"] = CoopDesyncNoticeState::s_lastOpenTarget;
+			st["zipPath"] = CoopDesyncNoticeState::s_lastZipPath;
+			st["raiseCount"] = CoopDesyncNoticeState::s_raiseCount;
+			resp["last"] = st;
+		}
+		else if (cmd == "desync_probe_dialog")
+		{
+			// TEST-ONLY: push a real CoopDesyncNoticeState with sentinel content, so a
+			// test can assert the dialog's widget layout (three buttons, correct labels)
+			// and getters deterministically - the real fire's notice is dismissed by the
+			// turn cycle within a poll or two. Nothing here launches a browser or writes.
+			std::string zip = req.get("zip", "C:/probe/desync-reports/desync-probe.zip").asString();
+			std::string url = req.get("url", "https://github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues/new?title=probe&body=probe").asString();
+			std::string headline = req.get("headline", "probe: items diverged at action 1: walk").asString();
+			std::string msg = req.get("message", "probe message").asString();
+			_game->pushState(new CoopDesyncNoticeState(msg, headline, zip, url));
+			resp["ok"] = true;
+		}
 		else if (cmd == "close_nextturn")
 		{
 			// Invoke the REAL end-of-turn close (NextTurnState::close), which the
@@ -5340,6 +7047,42 @@ std::string TestServer::execute(const std::string& line)
 				resp["pushed"] = "NextTurnState";
 			}
 		}
+		else if (cmd == "debrief_state")
+		{
+			// The debriefing SCORE page, as this machine displays it.
+			//
+			// DebriefingState::prepareDebriefing() runs on BOTH machines and builds
+			// _stats from the local save - the host's debriefing packet only carries
+			// the soldier-stats and diary pages - so these rows are the direct
+			// readout for "did the two players see the same mission result". The
+			// rows are the ones the score list actually shows (qty != 0) and the
+			// total is the same sum the STR_TOTAL_UC row prints.
+			DebriefingState* db = findState<DebriefingState>(_game);
+			if (!db)
+			{
+				resp["error"] = "no DebriefingState in state stack";
+			}
+			else
+			{
+				Json::Value rows(Json::objectValue);
+				Json::Value scores(Json::objectValue);
+				int total = 0;
+				for (const auto* ds : db->harnessStats())
+				{
+					if (ds->qty == 0)
+					{
+						continue;
+					}
+					rows[ds->item] = ds->qty;
+					scores[ds->item] = ds->score;
+					total += ds->score;
+				}
+				resp["rows"] = rows;
+				resp["scores"] = scores;
+				resp["total"] = total;
+				resp["ok"] = true;
+			}
+		}
 		else if (cmd == "dismiss_popup")
 		{
 			// Confirm/close the top geoscape popup (event intro, etc.). Handled
@@ -5543,6 +7286,13 @@ std::string TestServer::execute(const std::string& line)
 			resp["isLoadProgress"] = coop->_isLoadProgress;
 			resp["shared"] = coop->isSharedCampaign();
 			resp["gamemode"] = connectionTCP::getCoopGamemode();
+			// PRD-P5: the parallel-turns session mode. On get_coop (not only
+			// battle_state/parallel_state) because it is a SESSION property, frozen by
+			// the COOP_READY_HOST handshake at join time - a test must be able to read
+			// it from the lobby, long before a battle exists.
+			resp["parallelEnabled"] = connectionTCP::_enable_parallel_turns;
+			resp["parallelActive"] = connectionTCP::parallelTurnActive();
+			resp["clientInputBlocked"] = connectionTCP::parallelInputBlocked();
 			{
 				CoopState* top = findState<CoopState>(_game);
 				resp["coopDialog"] = top ? top->getStateCode() : -1;
@@ -5603,16 +7353,27 @@ std::string TestServer::execute(const std::string& line)
 				connectionTCP::password = req.get("password", "").asString();
 				connectionTCP::isPasswordRequired = !connectionTCP::password.empty();
 				// Preserve the gamemode from a loaded save (resume lobbies
-				// need the original PvP/PvE mode).  Only default to PVE
-				// when starting a fresh campaign.
-				if (campaign && _game->getSavedGame() && _game->getSavedGame()->isCoopSave())
+				// need the original PvP/PvE mode).  Only keep it on a genuine
+				// resume (lobbyMode 2); a fresh coop campaign (lobbyMode 1)
+				// carries no coop_gamemode key and must default to PVE.
+				// isCoopSave() is also true for a fresh campaign, so it cannot
+				// be the discriminator (mirrors LobbyMenu::setPlayerTeam).
+				if (campaign && connectionTCP::session.lobbyMode == 2)
 				{
-					// keep the gamemode from the loaded save
+					// keep the gamemode from the loaded save (genuine resume)
 				}
 				else
 				{
 					connectionTCP::_coopGamemode = 1; // PVE
 				}
+				// Ephemeral coop host port (port "0"): bind an OS-assigned TCP
+				// port and report it back so the peer's join_tcp dials the right
+				// one. A concrete port still works (manual debugging).
+				if (port == "0")
+				{
+					int p = probeEphemeralPort(SOCK_STREAM);
+					if (p > 0) port = std::to_string(p);
+				}
 				coop->setCoopSession(false);
 				coop->setPlayerTurn(3);
 				coop->setHostName(player);
@@ -5630,6 +7391,7 @@ std::string TestServer::execute(const std::string& line)
 					_game->pushState(new LobbyMenu());
 				}
 				resp["campaign"] = campaign;
+				resp["port"] = port;
 				resp["ok"] = true;
 			}
 		}
@@ -5649,6 +7411,13 @@ std::string TestServer::execute(const std::string& line)
 			connectionTCP::password = password;
 			connectionTCP::isPasswordRequired = !password.empty();
 			connectionTCP::_coopGamemode = 1; // PVE
+			// Ephemeral coop host port (port "0"): bind an OS-assigned UDP port
+			// and report it so the peer's join_udp dials the right one.
+			if (port == "0")
+			{
+				int p = probeEphemeralPort(SOCK_DGRAM);
+				if (p > 0) port = std::to_string(p);
+			}
 			coop->setCoopSession(false);
 			coop->setPlayerTurn(3);
 			coop->setHostName(player);
@@ -5664,6 +7433,7 @@ std::string TestServer::execute(const std::string& line)
 				_game->pushState(new LobbyMenu());
 			}
 			resp["campaign"] = campaign;
+			resp["port"] = port;
 			resp["ok"] = true;
 		}
 		else if (cmd == "host_menu_host")
@@ -5685,10 +7455,24 @@ std::string TestServer::execute(const std::string& line)
 				}
 				// server/port/password are optional: omitted means "leave the
 				// window's own defaults alone" (old callers behave unchanged).
-				hm->testHostWithFields(req.get("visibility", 0).asInt(),
+				int visibility = req.get("visibility", 0).asInt();
+				std::string hmPort = req.get("port", "").asString();
+				// Ephemeral coop host port (port "0"): bind an OS-assigned port of
+				// the right kind (0=TCP, 1/2=UDP; 3 hotseat has no socket) and
+				// report it so the peer's join dials the right one.
+				if (hmPort == "0" && visibility != 3)
+				{
+					int p = probeEphemeralPort(visibility == 0 ? SOCK_STREAM : SOCK_DGRAM);
+					if (p > 0) hmPort = std::to_string(p);
+				}
+				hm->testHostWithFields(visibility,
 									   req.get("server", "").asString(),
-									   req.get("port", "").asString(),
+									   hmPort,
 									   req.get("password", "").asString());
+				if (!hmPort.empty())
+				{
+					resp["port"] = hmPort;
+				}
 				resp["ok"] = true;
 			}
 		}
@@ -5953,6 +7737,15 @@ std::string TestServer::execute(const std::string& line)
 			std::string localport = req.get("localport", "3001").asString();
 			std::string player = req.get("player", "ClientPlayer").asString();
 			std::string password = req.get("password", "lan").asString();
+			// Ephemeral local UDP bind (localport "0"): let the OS assign this
+			// client's own port so two clients on the same loopback host never
+			// collide. Reported back for information; the host learns the client
+			// address from the incoming datagram, so it needs no fixed value.
+			if (localport == "0")
+			{
+				int p = probeEphemeralPort(SOCK_DGRAM);
+				if (p > 0) localport = std::to_string(p);
+			}
 			connectionTCP::password = password;
 			connectionTCP::isPasswordRequired = !password.empty();
 			coop->setCoopSession(false);
@@ -5961,6 +7754,7 @@ std::string TestServer::execute(const std::string& line)
 			bool campaign = _game->getSavedGame() && !_game->getSavedGame()->getCountries()->empty();
 			coop->setCoopCampaign(campaign);
 			coop->joinDirectLanUDP(ipaddr, port, localport, player, password);
+			resp["localport"] = localport;
 			resp["ok"] = true;
 		}
 		else if (cmd == "crashlog_probe")
diff --git a/src/CoopMod/connectionTCP.cpp b/src/CoopMod/connectionTCP.cpp
index 51b282f49..28b0371c1 100644
--- a/src/CoopMod/connectionTCP.cpp
+++ b/src/CoopMod/connectionTCP.cpp
@@ -37,8 +37,11 @@
 #include "../Savegame/AlienMission.h"
 #include "../Mod/UfoTrajectory.h"
 #include "../Savegame/Ufo.h"
+#include "../Battlescape/AIModule.h"
+#include "../Battlescape/TileEngine.h" // coop (SEAM-11): closeUfoDoors on the client deferred boundary
 #include "../Battlescape/DebriefingState.h"
 #include "../Battlescape/BattlescapeState.h"
+#include "../Battlescape/ExplosionBState.h" // coop (explosion ordered-replay E2): chain_detonation handler constructs the display-only chained state
 
 #include "../Savegame/Country.h"
 #include "../Mod/RuleCountry.h"
@@ -177,7 +180,12 @@ bool connectionTCP::_isChatActiveStatic = false;
 
 bool connectionTCP::_isActiveAISync = false;
 
-bool connectionTCP::_isActivePlayerSync = false; 
+bool connectionTCP::_isActivePlayerSync = false;
+
+// coop (#162 / 056b500db reconciliation): false at session start; set true only
+// by the coop_leaving handler when the peer leaves a skirmish debrief gracefully.
+bool connectionTCP::_peerLeftCleanly = false; 
+
 
 bool connectionTCP::_enable_time_sync = true;
 
@@ -191,6 +199,60 @@ bool connectionTCP::_enable_xcom_equipment_aliens_pvp = true;
 
 bool connectionTCP::_unbalanced_craft_soldiers_limit = false;
 
+// coop (PRD-P5): default OFF = classic alternating sub-turns. Only the
+// COOP_READY_HOST handshake (and a save load) ever writes it.
+bool connectionTCP::_enable_parallel_turns = false;
+
+// coop (PRD-P6): action-intent arbitration. All per-battle, all reset by
+// resetActionArbiter().
+std::uint32_t connectionTCP::_actionSeq = 0;
+std::uint32_t connectionTCP::peerDisplayAckedSeq = 0;
+std::uint32_t connectionTCP::_sideSeq = 0;
+// coop (GAP-10): defaults to the fixed coop base seed so a script draw before
+// the first side boundary (turn 1) still uses a defined, shared value.
+std::uint64_t connectionTCP::_scriptRngSeed = RNG::g_randomCoopSeed;
+bool connectionTCP::_sideCommitInProgress = false;
+std::uint32_t connectionTCP::_intentSlotReqId = 0;
+int connectionTCP::_intentSlotSeat = -1;
+std::string connectionTCP::_intentSlotKind;
+std::string connectionTCP::_admitBlocked;
+std::string connectionTCP::_pendBlocked;
+std::uint32_t connectionTCP::_clientReqSeq = 0;
+std::uint32_t connectionTCP::_clientPendingReqId = 0;
+std::string connectionTCP::_clientPendingKind;
+std::uint32_t connectionTCP::_clientPendingSentTicks = 0;
+std::string connectionTCP::_clientLastDenyReason;
+std::string connectionTCP::_clientLastDenyWarning;
+// coop (PRD-P7): pending-admit slots and the two display-flow counters.
+std::vector<connectionTCP::CoopPendingIntent> connectionTCP::_pendingAdmits;
+std::uint32_t connectionTCP::_openChainSeq = 0;
+std::uint32_t connectionTCP::_clientDisplaySeq = 0;
+// coop (PRD-I0): the sync-check label + the boundary pseudo-seq namespace.
+std::string connectionTCP::_openChainKind;
+std::uint32_t connectionTCP::_clientDisplaySideSeq = 0;
+std::uint32_t connectionTCP::_boundarySeq = 0;
+// coop (PRD-I3 SEAM-2 HALF 2): scoped only around the neutral->player decay call.
+bool connectionTCP::_coopBoundaryDecay = false;
+std::vector<std::string> connectionTCP::_pendingBoundaries;
+int connectionTCP::_turnAdvanceDeferred = 0;
+int connectionTCP::_turnAdvanceDeferredCount = 0;
+bool connectionTCP::_hostShipsNextTurnFields = false;
+bool connectionTCP::_testHoldActionDone = false;
+std::uint32_t connectionTCP::_heldActionDones = 0;
+bool connectionTCP::_testHoldBoundaryDone = false;
+// coop (PRD-P9 3): stuck-chain diagnostic, reset wherever _openChainSeq is.
+std::uint32_t connectionTCP::_openChainTicks = 0;
+bool connectionTCP::_openChainWarned = false;
+bool connectionTCP::_openChainInstantPending = false;  // PRD-I3 SEAM-7 ii
+// coop (wire-order Increment 7, SHAPE A): chain-open (tu,energy) snapshot; see the header.
+std::unordered_map<int, std::pair<int, int>> connectionTCP::_openChainRegenSnap;
+// coop (PRD-P8): the end-turn readiness tally. Reset with the arbiter.
+std::vector<bool> connectionTCP::_endTurnReady;
+std::vector<bool> connectionTCP::_endTurnAuto;
+std::uint32_t connectionTCP::_endTurnTallySideSeq = 0;
+std::string connectionTCP::_endTurnTallySent;
+std::string connectionTCP::_commitBlocked;
+
 bool connectionTCP::_coopCampaign = false;
 
 bool connectionTCP::_battleInit = false;
@@ -475,6 +537,725 @@ SPSCQueue<1024> g_rxQ{};
 // function so disconnect/reconnect cleanup can reset it fully between sessions.
 static std::mutex g_rxHoldMutex;
 static std::deque<std::string> g_rxHold;
+// coop (PRD-P9 rider R7): packets excluded by a condition this pump can never
+// change itself (the `endPlayerTurn` term in updateCoopTask). Rotating one of
+// those re-examines it on every tick for the rest of the session, so it is
+// parked here instead and spliced back to the FRONT of g_rxHold the moment the
+// exclusion lifts. Guarded by g_rxHoldMutex, like g_rxHold.
+static std::deque<std::string> g_rxPark;
+
+// PRD-P0: hold-queue introspection for the harness (see connectionTCP.h).
+// coop (PRD-P11): nothing is physically rotated any more - the pump consumes in
+// place - so this now counts GATE HOLDS: packets the receive gate refused, which
+// keep their position in the queue and are re-examined next pass. The name and
+// the reading ("packets the gate would not let through") are unchanged.
+std::atomic<uint32_t> g_rxRotateCount{0};
+std::atomic<uint32_t> g_rxHoldMaxSeen{0};
+
+// coop (PRD-P11): packets the GATE WOULD HAVE LET THROUGH but that were held back
+// because an earlier, still-unconsumed packet in the queue names the same unit.
+// This is the price of ordering, and the only counter that distinguishes the new
+// pump from the old one.
+std::atomic<uint32_t> g_rxSkipBlocked{0};
+// coop (PRD-P11): passes that ran with per-subject blocking DISABLED because the
+// liveness floor fired (see updateCoopTask()). Expected to stay 0 for the life of
+// a session; anything else means ordering was traded away to keep a queue moving.
+std::atomic<uint32_t> g_rxLegacyPasses{0};
+// coop (PRD-I1): whitelisted outcome packets held back because they carry the
+// seq of a chain that has not opened on this (client) machine yet - the chain
+// isolation that keeps a client's post-N sync-check state pure. Like the two
+// counters above it feeds the liveness floor and is process-monotonic.
+std::atomic<uint32_t> g_rxSeqDeferred{0};
+// coop (PHASE D.1 chain-atomicity): times the client's action_end APPLY BARRIER held
+// a marker because a packet stamped with that marker's chain had not applied yet.
+// Process-monotonic; feeds the same liveness floor as the seq/subject holds.
+std::atomic<uint32_t> g_barrierBlocks{0};
+// coop (LIVENESS FLOOR ordering-preserving drain): see connectionTCP.h. Bumped each tick
+// the stage-2 hard-floor escape hatch reverted the parallel client to the legacy
+// full-disable (0 across a run = the ordering-preserving drain carried the whole load).
+std::atomic<uint32_t> g_rxHardFloorPasses{0};
+// coop (wire-order Increment 7, SHAPE A diagnostic): host regen-carry elements emitted
+// on action_end markers; client elements applied at first-sight. Process-monotonic.
+std::atomic<uint32_t> g_regenEmitted{0};
+std::atomic<uint32_t> g_regenApplied{0};
+// coop (three-class RCA DIAGNOSTIC, 2026-08-28): capture-gated, lever-off INERT. When
+// g_diagCapture is armed (parallel_state {"diag_capture":true}) the client logs tagged,
+// position-ordered writes so a firing-run trace names the exact clobber writer (file:line
+// tag) for each residual class. No behavior change; the log is read back via parallel_state.
+std::atomic<bool> g_diagCapture{false};
+// coop (RCA): the HIGH-FREQUENCY tu/position write log (coopDiagUnit) is gated separately so
+// a lightweight capture (EXPL/GREM/TRACEB/item.mint-remove on g_diagCapture only) can run
+// WITHOUT the per-write mutex overhead that shifts the client's wall-clock timing enough to
+// mask the flaky lost-removal. --trace-mechanism arms both; --rca-trace arms g_diagCapture only.
+std::atomic<bool> g_diagHeavy{false};
+std::vector<std::string> g_diagTrace;
+std::mutex g_diagTraceMutex;
+std::atomic<uint32_t> g_diagPos{0};
+void coopDiagS(std::string s)
+{
+	if (!g_diagCapture.load(std::memory_order_relaxed)) return;
+	std::uint32_t pos = g_diagPos.fetch_add(1, std::memory_order_relaxed);
+	std::lock_guard<std::mutex> lk(g_diagTraceMutex);
+	g_diagTrace.push_back("p" + std::to_string(pos) + " " + std::move(s));
+	if (g_diagTrace.size() > 6000) g_diagTrace.erase(g_diagTrace.begin()); // option-3B/RCA: hold the full lifecycle
+}
+// unit-scoped tu/energy/position write, ALIEN probe only (id>=1000000). HIGH-frequency -
+// gated on g_diagHeavy so --rca-trace stays light.
+void coopDiagUnit(const char* tag, int unitId, long v)
+{
+	if (!g_diagHeavy.load(std::memory_order_relaxed) || unitId < 1000000) return;
+	if (!g_diagCapture.load(std::memory_order_relaxed)) return;
+	coopDiagS(std::string(tag) + " u=" + std::to_string(unitId) + " =" + std::to_string(v));
+}
+// coop (chain-atomicity Strand B): the SIDE BARRIER introspection. g_sideBarrierHolds
+// counts passes where the whitelisted `endTurn` was HELD because a stamped packet of the
+// current side was still deferred ahead of it (the client must finish side S before
+// retiring its side token). g_sideBarrierReleases / g_sideBarrierHardReleases count how a
+// held endTurn finally consumed: the ordered drain of side S (normal, liveness proof) vs
+// the legacy hard-floor escape (the documented kRxDrainHardFloorMs last-resort release).
+// Externed in TestServer for parallel_state; file-scope here to avoid a connectionTCP.h
+// wide recompile. g_sideBarrierHeldThisSide is a pump-internal latch: this side saw a hold,
+// so the eventual consume is a release. Process-monotonic like the other pump counters.
+std::atomic<uint32_t> g_sideBarrierHolds{0};
+std::atomic<uint32_t> g_sideBarrierReleases{0};
+std::atomic<uint32_t> g_sideBarrierHardReleases{0};
+static bool g_sideBarrierHeldThisSide = false;
+// coop (chain-atomicity Strand A introspection): mid-side (non-boundary) host deaths and how
+// many still shipped UNSTAMPED (_openChainSeq==0 at send = the Strand-A seq-0 legacy-consume
+// straddle). Post-fix the loose-death chain stamp opens a chain for every mid-side death, so
+// g_coopMidSideDeathsUnstamped stays 0 while g_coopMidSideDeaths proves the path ran.
+// Incremented in UnitDieBState::init (parallel host only); externed in TestServer for
+// parallel_state. Process-monotonic like the pump counters; boundary deaths are excluded.
+std::atomic<uint32_t> g_coopMidSideDeaths{0};
+std::atomic<uint32_t> g_coopMidSideDeathsUnstamped{0};
+// TEST-ONLY levers (see connectionTCP.h). Never set outside the coop test harness.
+std::atomic<bool> g_rxTestHold{false};
+std::atomic<bool> g_rxDrainDisable{false};
+std::atomic<bool> g_rxForceFloor{false};
+// coop (chain-atomicity Strand B, TEST-ONLY): disables JUST the side barrier (leaves the
+// I1 seq-gate + D.1 barrier + floor drain intact) so the SAME build measures the pre-fix
+// stale-side straddle (red: endTurn overtakes a still-deferred current-side death) against
+// the barrier-held ordering (green). Externed in TestServer; never set outside the harness.
+std::atomic<bool> g_rxSideBarrierDisable{false};
+// coop (wire-order report alignment, Phase 2): master lever for the wire-order
+// state-apply timeline. Default OFF (today's behavior). When ON, carriers in the
+// TYPE-membership state-carrier set (coopIsWireOrderStateCarrier) apply their state
+// at RX arrival in stream order instead of being display-deferred. Set via the
+// TestServer `wire_order_state` command; read back in parallel_state. Introduced as
+// a test-style lever (rx_force_floor is the template); Phase 6 decides the default.
+std::atomic<bool> g_wireOrderState{false};
+// coop DIAGNOSTIC (reject-set audit): defined in BattleUnit.cpp; armed/cleared per
+// next_turn boundary from coopApplyNextTurnUnitStates, read back in parallel_state.
+void coopWmDbgArm(bool on);
+void coopWmDbgClear();
+// coop (parallel battlescape Phase 1 - per-unit state watermark): counts stamped
+// per-unit state writes rejected because their stamp was < the unit's recorded
+// watermark (BattleUnit::coopStateAccept returned false). Total plus a per-rank
+// breakdown (0=snapshot, 1=chain carrier, 2=casualty, unused until Phase 2).
+// Parallel client only; externed in TestServer for parallel_state introspection.
+std::atomic<uint32_t> g_stateWatermarkRejects{0};
+std::atomic<uint32_t> g_stateWatermarkRejectsRank0{0};
+std::atomic<uint32_t> g_stateWatermarkRejectsRank1{0};
+std::atomic<uint32_t> g_stateWatermarkRejectsRank2{0};
+// coop (parallel battlescape Phase 1, TEST-ONLY): when true, skips the per-unit
+// state watermark check entirely (writes always apply, no reject). Parallel-client-
+// only, test-only lever; never set outside the coop test harness.
+std::atomic<bool> g_deathWatermarkDisable{false};
+// coop (parallel battlescape Phase 2b - atomic unit death): counts `unit_casualty`
+// packets the parallel client APPLIED (BattlescapeGame::coopApplyCasualty ran) and
+// how many were REJECTED by the rank-2 state watermark (a stamp < the unit's
+// recorded watermark - BattleUnit::coopStateAccept returned false). Parallel client
+// only; externed in TestServer for parallel_state introspection.
+std::atomic<uint32_t> g_casualtiesApplied{0};
+std::atomic<uint32_t> g_casualtiesRejected{0};
+// coop (parallel battlescape Phase 2b, TEST-ONLY RED lever): when true, the
+// atomic `unit_casualty` path is disabled - the HOST falls back to the legacy
+// unit_death/after_unit_death trio (UnitDieBState::init/deinit) and the CLIENT's
+// legacy-handler early-returns below stand down, so the SAME build reproduces the
+// pre-atomic transient straddle. Never set outside the coop test harness.
+std::atomic<bool> g_atomicDeathDisable{false};
+// coop (parallel battlescape Phase 2c - death ghost, TEST-ONLY RED lever): when set,
+// BattlescapeGame::coopQueueDeathGhost reverts to the Phase-2b STUB - it completes the
+// ghost immediately (no collapse animation, corpse/kit visible at apply) instead of
+// queueing it for the display-side pirouette+fall. GREEN (default) animates; RED skips,
+// so the SAME build reproduces the pre-ghost "corpse just appears" behaviour. Never set
+// outside the coop test harness.
+std::atomic<bool> g_deathGhostDisable{false};
+// coop (explosion ordered-replay E0, LEAK-OBJ): counts calls to
+// SavedBattleGame::addDestroyedObjective() blocked because the client (parallel
+// AND classic) would otherwise self-count objective destruction from its
+// neutered explode()/Tile::destroy `return true` stubs and independently drive
+// autoEndBattle/missionComplete. Host is authoritative; see NextTurnState's
+// `objectivesDestroyed` parity field. Externed in TestServer for introspection.
+std::atomic<uint32_t> g_objectiveLeakBlocked{0};
+// coop (explosion ordered-replay E0, TEST-ONLY RED lever): reverts the LEAK-OBJ
+// gate so the SAME build measures the pre-fix client-side objective inflation
+// (red) against the gated behavior (green). Never set outside the harness.
+std::atomic<bool> g_objectiveGateDisable{false};
+// coop (explosion ordered-replay E0, TEST-ONLY): does nothing yet in E0 - it only
+// has to exist and be introspectable. Wired to force the legacy (non-ordered)
+// explosion sim path in E1.
+std::atomic<bool> g_explosionReplayDisable{false};
+// coop (explosion ordered-replay E1): counts ExplosionBState instances that took
+// the display-only path (latched once per state, ExplosionBState::init) and how
+// many times that path SUPPRESSED the single explode() ray-trace call. Parallel-
+// client-only, 0 everywhere else. Externed in TestServer for introspection and in
+// ExplosionBState.cpp (where they are incremented).
+std::atomic<uint32_t> g_explosionsDisplayOnly{0};
+std::atomic<uint32_t> g_explodeCallsSuppressed{0};
+// coop (explosion ordered-replay E2): chain_detonation send/apply counters. Sent is
+// incremented by the parallel host at the chained-spawn site in ExplosionBState.cpp
+// (one per host-scan hit - the host's successive scans ARE the order); Applied is
+// incremented below in the chain_detonation handler when the parallel client replays
+// one. The two must match at side close - a mismatch means the ordered chain stream
+// dropped or duplicated a secondary. Externed in TestServer and ExplosionBState.cpp.
+std::atomic<uint32_t> g_chainDetonationsSent{0};
+std::atomic<uint32_t> g_chainDetonationsApplied{0};
+// coop (explosion ordered-replay E4, TEST-ONLY RED lever): disables the LEAK-GRAV
+// derive (the applyGravity(selected_tile)/applyGravity(aboveT) pair below, on every
+// destroy_tile the parallel client receives) so the SAME build measures the pre-
+// derive behavior - a client item/unit HOVERS where the host dropped it - against
+// the gated (green) behavior. Never set outside the coop test harness.
+std::atomic<bool> g_gravityDeriveDisable{false};
+// coop (explosion ordered-replay E5a GAP-MODULE): module_destroyed send/apply
+// counters. Sent is incremented by the parallel host at the detonate-path
+// base-module decrement (TileEngine.cpp, per decrement); Applied is incremented
+// below in the module_destroyed handler when the parallel client replays one.
+// The two must match - a mismatch means the carrier dropped or duplicated a
+// base-defense module decrement. Externed in TestServer.cpp and TileEngine.cpp
+// (sent side only).
+std::atomic<uint32_t> g_moduleDestroyedSent{0};
+std::atomic<uint32_t> g_moduleDestroyedApplied{0};
+
+// coop (parallel battlescape Phase 1 - per-unit state watermark): reads the
+// (side_seq, action_seq) stamp off an apply-side packet, if present. `stamped`
+// is false for every carrier not yet promoted to stamped (unit_fall until
+// Phase 3, psi_result's MC-revert variant, medkit, boundary/environmental
+// hit_unit, classic co-op, ...) - an unstamped write BYPASSES the watermark
+// entirely (see BattleUnit::coopStateAccept); this helper never invents a
+// fallback stamp for that case. `bnd:true` (a boundary-phase send) maxes the
+// action_seq so it always wins ties as the most recent write.
+static void coopReadStateStamp(const Json::Value& obj, bool& stamped, uint32_t& side, uint32_t& seq)
+{
+	stamped = obj.isMember("side_seq");
+	if (!stamped)
+	{
+		side = 0;
+		seq = 0;
+		return;
+	}
+	side = obj["side_seq"].asUInt();
+	seq = obj.get("action_seq", 0).asUInt();
+	if (obj.get("bnd", false).asBool())
+	{
+		seq = UINT32_MAX;
+	}
+}
+
+// coop (parallel battlescape Phase 1, TEST-ONLY SYNTHETIC RED lever): the last
+// next_turn packet actually applied by coopApplyNextTurnUnitStates(). Read by
+// connectionTCP::coopDebugReplayLastNextTurn() (parallel_state
+// {replay_last_next_turn:true}) to re-run the per-unit loop on a stale copy -
+// with the watermark ON every already-hit unit is rejected (no-op); with
+// g_deathWatermarkDisable ON the stale snapshot overwrites (the RED case).
+// Never read outside that TEST-ONLY lever.
+static Json::Value g_lastNextTurnJson = Json::nullValue;
+
+// consecutive ticks a marker has been barrier-held with no progress, plus a one-shot
+// warn latch, for the loud sustained-stall diagnostic in updateCoopTask().
+static uint32_t g_barrierStallTicks = 0;
+static bool g_barrierStallWarned = false;
+
+// coop (PRD-P11): bumped by clearNetworkSessionQueues() so a pass holding packets
+// when the session is torn down drops them instead of splicing them back into a
+// queue that was deliberately emptied. Guarded by g_rxHoldMutex.
+static uint32_t g_rxHoldGen = 0;
+
+// coop (PRD-P11): consecutive main-loop ticks that consumed NOTHING while
+// per-subject blocking was holding back at least one otherwise-consumable packet.
+// Main thread only (updateCoopTask is called from Game::run).
+static uint32_t g_rxBlockedStallTicks = 0;
+static const uint32_t kRxBlockedStallTicks = 600;   // ~10 s at 60 ticks/s
+
+// coop (LIVENESS FLOOR stage-2 backstop): the SDL tick the parallel client last stopped
+// making progress at (0 = it is making progress now). Wall-clock, not a loop-tick count, so
+// it is FPS-independent: a legitimate long animation idles between chains and never nears the
+// window, while a queue that consumes NOTHING for kRxDrainHardFloorMs (the seed-11100011-class
+// gate-hold the floor exists for) trips it. Past the window the ordering-preserving drain is
+// switched off for that pass and the floor reverts to its legacy full-disable, so the floor
+// still guarantees liveness even if the ordered drain cannot make progress (a deadlock is
+// worse than a straddle). Any consumption resets it. Main thread only.
+static uint32_t g_rxFloorStallStartMs = 0;
+static const uint32_t kRxDrainHardFloorMs = 20000;  // 20 s of ZERO consumption = a true wedge
+
+// coop (Class-A soak wedge fix): consecutive main-loop ticks the non-host client's
+// auto-shot pacing wait (_coopPacingWait) has been held with no release. Counted at
+// the game-loop rate (updateCoopTask, ~60/s), so the force-drain escape is bounded
+// in WALL TIME whatever the client's setStateInterval draw speed. Reset the instant
+// the wait clears.
+static uint32_t g_rxPacingStallTicks = 0;
+static const uint32_t kRxPacingForceDrainTicks = 600;   // ~10 s at 60 ticks/s
+
+// coop (PRD-P11, test introspection): the packets the pump actually handed to
+// onTCPMessage(), in application order. The defect this PRD fixes had no visible
+// symptom other than ORDER (a unit walked from a stale position two seconds
+// late), so a test needs to read the order back, not just the end state.
+struct RxTraceEntry
+{
+	uint32_t seq;
+	std::string state;
+	int subject;
+	// coop (parallel Phase 3, Sub-task C test introspection): whether the
+	// packet carried a boundary marker (`action_end`'s `boundary` flag) or a
+	// boundary-phase casualty (`unit_casualty`'s `bnd` flag). Neither key
+	// exists on the same field name, but at most one is ever present on a
+	// given packet, so a single bool captures either. Lets a fixture tell a
+	// TRUE boundary `action_end`/`endTurn` apart from an ordinary mid-side
+	// chain closer of the same state name - the trace alone (state+subject)
+	// cannot, and a side that has already cycled player->alien->neutral by
+	// the time a fixture reads the trace back has several of the latter.
+	bool boundary;
+	// coop (Sub-task C test introspection): a TRUE boundary marker's `kind`
+	// (connectionTCP::coopArmSyncBoundary's two callers: "endturn" - the
+	// side-close phase group, BattlescapeGame.cpp - or "sidestart" -
+	// prepareNewTurn, NextTurnState.cpp, where fatal-wound bleed-out runs and
+	// so where a `bnd` casualty's OWN boundary hash point actually is). Empty
+	// on every non-marker packet. Distinguishes the boundary a `bnd` casualty
+	// belongs to from an unrelated earlier/later one of the same state name -
+	// a full side cycle ships one of EACH kind, not one boundary total.
+	std::string kind;
+};
+static std::mutex g_rxTraceMutex;
+static std::deque<RxTraceEntry> g_rxTrace;
+static uint32_t g_rxTraceSeq = 0;
+static const size_t kRxTraceMax = 256;
+
+static void rxTraceRecord(const std::string& state, int subject, bool boundary,
+						   const std::string& kind)
+{
+	std::lock_guard<std::mutex> lock(g_rxTraceMutex);
+	RxTraceEntry e;
+	e.seq = ++g_rxTraceSeq;
+	e.state = state;
+	e.subject = subject;
+	e.boundary = boundary;
+	e.kind = kind;
+	g_rxTrace.push_back(std::move(e));
+	while (g_rxTrace.size() > kRxTraceMax)
+	{
+		g_rxTrace.pop_front();
+	}
+}
+
+Json::Value rxAppliedTrace(size_t limit)
+{
+	Json::Value out(Json::arrayValue);
+	std::lock_guard<std::mutex> lock(g_rxTraceMutex);
+	const size_t skip = (limit > 0 && g_rxTrace.size() > limit)
+							? g_rxTrace.size() - limit
+							: 0;
+	for (size_t i = skip; i < g_rxTrace.size(); ++i)
+	{
+		Json::Value e(Json::objectValue);
+		e["seq"] = static_cast<Json::UInt>(g_rxTrace[i].seq);
+		e["state"] = g_rxTrace[i].state;
+		e["unit"] = g_rxTrace[i].subject;
+		e["boundary"] = g_rxTrace[i].boundary;
+		e["kind"] = g_rxTrace[i].kind;
+		out.append(e);
+	}
+	return out;
+}
+
+// coop (test introspection): the FRONT of the receive hold queue, oldest first, each
+// packet's state + its chain stamp (action_seq/side_seq, 0/absent = unstamped legacy).
+// Read-only peek under the hold lock; the strings are re-parsed, not consumed. Lets a
+// fixture see whether a backlog is stamped (seq-gated) or legacy, and in what order.
+Json::Value rxHoldDump(size_t limit)
+{
+	Json::Value out(Json::arrayValue);
+	std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+	Json::CharReaderBuilder rb;
+	std::unique_ptr<Json::CharReader> reader(rb.newCharReader());
+	size_t n = 0;
+	for (const std::string& s : g_rxHold)
+	{
+		if (limit > 0 && n >= limit) break;
+		++n;
+		Json::Value obj;
+		std::string errs;
+		Json::Value e(Json::objectValue);
+		if (reader->parse(s.data(), s.data() + s.size(), &obj, &errs))
+		{
+			e["state"] = obj.get("state", "?").asString();
+			e["action_seq"] = static_cast<Json::UInt>(obj.get("action_seq", 0).asUInt());
+			e["side_seq"] = static_cast<Json::Int>(obj.get("side_seq", -1).asInt());
+			e["boundary"] = obj.get("boundary", false).asBool();
+		}
+		else
+		{
+			e["state"] = "<parse-error>";
+		}
+		out.append(e);
+	}
+	return out;
+}
+
+// coop (explosion ordered-replay E2, test introspection): the last few chain_detonation
+// tile positions this process has SENT (parallel host, ExplosionBState.cpp's chained-spawn
+// site) or APPLIED (parallel client, the chain_detonation handler below), as [x,y,z]
+// tuples oldest-first. Process-local, mirrors g_rxTrace's mutex+deque ring above; the
+// fixture compares the host's list (its send/scan order) against the client's list (its
+// apply order) for exact positional equality - the count-only sent/applied atomics cannot
+// distinguish "right count, wrong order" from a genuinely matching replay.
+struct ChainDetonationEntry { int x; int y; int z; };
+static std::mutex g_chainDetonationListMutex;
+static std::deque<ChainDetonationEntry> g_chainDetonationList;
+static const size_t kChainDetonationListMax = 64;
+
+void chainDetonationListRecord(int x, int y, int z)
+{
+	std::lock_guard<std::mutex> lock(g_chainDetonationListMutex);
+	g_chainDetonationList.push_back({ x, y, z });
+	while (g_chainDetonationList.size() > kChainDetonationListMax)
+	{
+		g_chainDetonationList.pop_front();
+	}
+}
+
+Json::Value chainDetonationListDump(size_t limit)
+{
+	Json::Value out(Json::arrayValue);
+	std::lock_guard<std::mutex> lock(g_chainDetonationListMutex);
+	const size_t skip = (limit > 0 && g_chainDetonationList.size() > limit)
+							? g_chainDetonationList.size() - limit
+							: 0;
+	size_t i = 0;
+	for (const auto& e : g_chainDetonationList)
+	{
+		if (i++ < skip) continue;
+		Json::Value t(Json::arrayValue);
+		t.append(e.x); t.append(e.y); t.append(e.z);
+		out.append(t);
+	}
+	return out;
+}
+
+/**
+ * coop (PRD-P11): the unit a battle packet is ABOUT, or -1 for "no single unit".
+ *
+ * The pump uses this to keep a unit's packets in the order they were sent even
+ * when it cannot consume all of them in one pass (see updateCoopTask()). The
+ * field name is per-packet - the wire has three spellings for the same thing
+ * (`id`, `unit_id`, `actor_id`) - so this is a whitelist keyed on the state
+ * string, NOT a generic "look for an id field" probe: `id` alone means a base, a
+ * craft, a vote or an item in a dozen other packets, and a namespace collision
+ * here would hold back traffic for no reason.
+ *
+ * Deliberately absent:
+ *  - tile-only hazards (`set_smoke_tile`, `set_fire_tile`, `destroy_tile`) and
+ *    `hit_tile` / `calc_explode_fov` / `hasHitUnit`: no unit subject at all.
+ *    `hit_tile` names its attacker/weapon ids directly (PHASE D.2) for
+ *    reconstructing the hitCoop call, not for pump ordering - the chain seq it
+ *    carries (coopStampChainSeq / I1) is what holds it for its own chain.
+ *  - arbitration and flow control (`action_intent`, `action_ack`, `action_deny`,
+ *    `action_done`, `action_end`, `end_turn_*`, votes): sequenced by their own
+ *    req_id/seq fields, and delaying them would stall the arbiter, not order it.
+ *  - selection/UI (`selected_unit`, `update_progress`, `AIProgress`): they name a
+ *    unit but do not act on one.
+ *  - `unit_fire`. MEASURED, and the reason this table is a whitelist rather than
+ *    "any packet with a unit id": it is the only always-consume packet that
+ *    names a unit and is not a chain closer, so it is the only one ordering could
+ *    actually DELAY - and delaying it is worse than applying it early. The peer
+ *    burns its own units: `BattleUnit::prepareHealth` subtracts fire damage and
+ *    decrements `_fire` at every turn tick, and on a peer `_fire` is written by
+ *    nothing but this packet (`setFire` early-returns off-host). A `unit_fire`
+ *    held behind an earlier packet while a turn boundary crossed therefore
+ *    burned the host's unit and not the peer's - measured as a one-item census
+ *    drift (a corpse the host had and the peer did not) in a five-turn soak.
+ */
+static int coopPacketSubject(const std::string& state, const Json::Value& obj)
+{
+	const char* field = 0;
+
+	if (state == "BattleScapeMove" || state == "turnBattlescapeUnit"
+		|| state == "kneel")
+	{
+		field = "id";
+	}
+	else if (state == "abortPath" || state == "afterBattlescapeUnitTurn"
+			 || state == "psi_attack" || state == "melee_attack"
+			 || state == "unit_death" || state == "after_unit_death"
+			 || state == "unit_casualty"
+			 || state == "hit_unit" || state == "unit_fall"
+			 || state == "convertUnit" || state == "selfDestruct"
+			 || state == "panic_action" || state == "psi_result"
+			 || state == "checkForProximityGrenades" || state == "motion_scan")
+	{
+		field = "unit_id";
+	}
+	else if (state == "ProjectileFlyBState" || state == "unit_action"
+			 || state == "action_click" || state == "medkit"
+			 || state == "active_grenade")
+	{
+		field = "actor_id";
+	}
+
+	if (!field || !obj.isMember(field) || !obj[field].isNumeric())
+	{
+		return -1;
+	}
+	const int id = obj[field].asInt();
+	return id >= 0 ? id : -1;
+}
+
+// coop (PRD-P2 unit term): was the packet the pump is dispatching applied
+// AHEAD of packets that precede it on the wire but could not be consumed in
+// this pass? A full-state snapshot like `next_turn` is not subject-keyed, so it
+// legitimately overtakes a deferred per-unit chain - and while it does, this
+// machine's unit positions are one chain behind the peer's through no fault of
+// anybody's. Read by SharedEcon::verifyBattleChecksum, which then leaves the
+// unit term alone until a stamp lands on an in-order pass.
+static std::atomic<bool> g_rxPassDeferred{false};
+
+bool rxPassDeferred()
+{
+	return g_rxPassDeferred.load(std::memory_order_relaxed);
+}
+
+// coop (wire-order report alignment, Phase 3): the client's WIRE-ORDER report cursors,
+// advanced at an action_end marker's FIRST SIGHT in the RX stream (not at display
+// consumption like _clientDisplaySeq). Under g_wireOrderState the per-action sync-check
+// report (sync_report) is sampled here, so client@N == host-ring@N by construction.
+// Per-side: g_clientApplySeq restarts when a marker names a new side (g_clientApplySideSeq).
+static std::uint32_t g_clientApplySeq = 0;
+static std::uint32_t g_clientApplySideSeq = 0;
+// coop (wire-order report alignment, Increment 4 / A4): the HIGH-WATER side_seq whose endTurn
+// REQUIRED-AT-ARRIVAL half (_scriptRngSeed adoption + the deferred neutral->player regen arm)
+// has been applied at the endTurn marker's first sight. The arrival hook fires for any side_seq
+// strictly ABOVE this mark; the endTurn handler skips the two items for any side_seq AT OR BELOW
+// it. A high-water mark (not a fire-once !=) is RACE-FREE when two endTurns are queued together
+// under backlog: both correctly skip because side_seq is monotonic (a fire-once cursor would let
+// the earlier endTurn's handler re-apply, and under increment 5 that re-arms AFTER next_turn
+// consumed it - a leak). Reset to 0 per battle in resetActionArbiter(fullReset); real side_seqs
+// start at 1 (bumped before send).
+static std::uint32_t g_endTurnArrivalSideSeq = 0;
+// coop (wire-order report alignment, Increment 5): the HIGH-WATER boundary pseudo-seq (bseq)
+// whose boundary sync sample has been emitted at the boundary marker's first sight, so the
+// sample fires exactly once per boundary. bseq is monotonic across the whole battle; reset to
+// 0 per battle in resetActionArbiter(fullReset).
+static std::uint32_t g_clientApplyBoundarySeq = 0;
+
+// coop (PRD-P10 follow-up): the packet that OPENS the replay chain a given
+// CLOSER ends, or 0 when there is no such pairing.
+//
+// The receive pump exempts closers from the per-subject ordering rule (see
+// `chainCloser` below) because holding one back can deadlock: a closer ends the
+// chain that is holding the receive gate, so making it wait for a mid-chain
+// packet of the same unit would leave nothing able to open the gate again.
+// That exemption is right for a MID-chain packet and wrong for the chain's own
+// OPENER - and the two are told apart here.
+//
+// `unit_death` pairs with `hit_unit`, NOT with its shot-chain opener
+// (`ProjectileFlyBState`, keyed on the shooter - a different subject the ordering
+// rule could never pair anyway). `hit_unit` carries the victim's post-damage
+// health/stun/wounds and is keyed on the SAME victim as `unit_death`; the host
+// emits hit_unit BEFORE unit_death (the death animation starts from the hit's
+// result), but hit_unit is a gate-parked outcome packet (not whitelisted) while
+// unit_death is a closer, so without this pairing the closer overtook the parked
+// hit_unit and the client applied the death from the PRE-hit health - leaving the
+// victim host-UNCONSCIOUS / peer-DEAD (or vice versa) until next_turn, the
+// unitsCombat health/stun straddle the PRD-I3 casualty burn-in kept surfacing at
+// ai/expl seqs (wire trace: client applied unit_death 3 s before the parked
+// hit_unit). No deadlock: the chain holding the gate is the shooter-keyed shot
+// replay, which unit_death does not end, so hit_unit still drains and applies
+// first, then unit_death (`after_unit_death` chains behind unit_death as before).
+static const char* coopChainOpener(const std::string& closer)
+{
+	if (closer == "abortPath") return "BattleScapeMove";
+	if (closer == "unit_death") return "hit_unit";
+	if (closer == "after_unit_death") return "unit_death";
+	return 0;
+}
+
+// coop (PRD-I3 SEAM-4): apply the host's post-casualty absolute morale to every
+// living unit named in a death packet's `bystander_morale` array.
+// BattlescapeGame::checkForCasualties changes the morale of EVERY living unit on
+// any death/stun (losing squad loses, winning squad gains, murderer kill bonus); a
+// parallel thin client never runs it for a kill it only DISPLAYS (coopDeath just
+// animates the death), so this array is its sole carrier of that squad-wide change.
+// ABSOLUTE overwrite -> idempotent: safe on both death packets and against
+// next_turn's later bulk re-ship. Present-gated (absent = older peer). The CALLER
+// gates on parallelTurnActive() && !getHost() so a classic client - which replays
+// the attack and runs its own checkForCasualties - stays byte-identical.
+static void coopApplyBystanderMorale(SavedBattleGame* battle, const Json::Value& obj)
+{
+	if (!battle || !obj.isMember("bystander_morale"))
+		return;
+	const Json::Value& arr = obj["bystander_morale"];
+	for (Json::ArrayIndex i = 0; i < arr.size(); ++i)
+	{
+		int id = arr[i]["id"].asInt();
+		int morale = arr[i]["morale"].asInt();
+		for (auto* bu : *battle->getUnits())
+		{
+			if (bu->getId() == id)
+			{
+				bu->setCoopMorale(morale);
+				break;
+			}
+		}
+	}
+}
+
+// coop (PRD-I1): the whitelisted always-consume packets that carry a per-chain
+// `action_seq` (stamped at their send sites by connectionTCP::coopStampChainSeq).
+// These are the ones that can leak a FUTURE chain's mutation into the client's
+// post-N sync-check state, so the pump defers one whose chain has not opened
+// locally yet. Kept in lockstep with the always-consume list in updateCoopTask()
+// and with coopStampChainSeq's callers; a packet named here that carries no seq
+// simply never trips the gate (seq 0 = legacy always-consume: old peer, classic
+// co-op, boundary explosion).
+static bool coopIsChainOutcomePacket(const std::string& state)
+{
+	return state == "hit_tile" || state == "destroy_tile"
+		|| state == "set_explosive_tile"
+		|| state == "set_fire_tile" || state == "set_smoke_tile"
+		|| state == "unit_fire" || state == "calc_explode_fov"
+		|| state == "hasHitUnit"
+		// coop (item 5 B, alien-replay decoupling): the death-chain victim carriers. Pure
+		// host absolutes (hit_unit damage/wounds; unit_death status/pos; after_unit_death
+		// corpse mint on the ordered clock, item 3), display-only on the parallel client.
+		// Seq-gate them so each folds into the exact chain it belongs to, in order - the
+		// prerequisite for applying them while the display is busy (gateAllows below).
+		|| state == "hit_unit" || state == "unit_death" || state == "after_unit_death"
+		// coop (parallel battlescape Phase 2b - atomic unit death): `unit_casualty`
+		// replaces the unit_death/after_unit_death pair on the parallel host and carries
+		// the SAME chain stamp (or bnd:true+side_seq at a boundary) - seq-gate it exactly
+		// like its legacy predecessors.
+		|| state == "unit_casualty"
+		// coop (explosion ordered-replay E2): the parallel host's per-secondary chain
+		// carrier - one per checkForTerrainExplosions scan hit, in the host's scan order.
+		// Seq-gated like destroy_tile/set_explosive_tile so it folds into the exact chain
+		// it belongs to, in order; NOT whitelisted, NOT subject-keyed (coopPacketSubject
+		// returns -1 for it, same as destroy_tile - there is no per-unit/per-actor id to
+		// key on), NOT a chainCloser/opener pairing.
+		|| state == "chain_detonation"
+		// coop (explosion ordered-replay E4 / atomic-death Phase 3): the host's
+		// UnitFallBState landed-tile carrier, now stamped (or bnd:true+side_seq at a
+		// boundary) like its chain-mates. Subject-keyed on the fallen unit
+		// (coopPacketSubject's unit_id case, unchanged) so it folds in FIFO after the
+		// spawn/blast that dropped it; seq-gated so a lagging client does not apply it
+		// ahead of its own chain's opener.
+		|| state == "unit_fall"
+		// coop (explosion ordered-replay E5a GAP-MODULE): the parallel host's
+		// detonate-path base-module decrement carrier. Seq-gated like
+		// chain_detonation so it folds into the exact chain it belongs to, in
+		// order; NOT whitelisted, NOT subject-keyed (coopPacketSubject returns -1
+		// for it, same as destroy_tile/chain_detonation - there is no per-unit/
+		// per-actor id to key on).
+		|| state == "module_destroyed";
+}
+
+// coop (wire-order report alignment, Phase 2): the TYPE-membership state-carrier set.
+// Owner ruling (2026-08-25): wire-order routing is by wire `state` string, NOT by the
+// coopStampChainSeq stamp - do not add stamps to migrate a carrier. When g_wireOrderState
+// is ON, a carrier named here applies its canonical state at RX arrival in stream order
+// (stripped from the display-cursor seq-deferral below); lever-off it is never consulted.
+// Increments A+B+C: Increment A is the flagship alien-death wound/casualty carriers
+// (already decoupled, so only the seq-deferral strip was needed). Increment B adds the
+// per-actor instant-effect replay packets and the fall carrier. Increment C adds the
+// items/terrain chain-outcome carriers already whitelisted in coopIsChainOutcomePacket
+// above.
+static bool coopIsWireOrderStateCarrier(const std::string& state)
+{
+	return
+		// order-1 (unitsCombat): flagship alien-death carriers (Increment A) plus the
+		// per-actor instant-effect carriers (Increment B) - panic resolution, kneel,
+		// grenade/mine prime (BA_PRIME and BA_UNPRIME both ship "active_grenade" -
+		// see coopSendPrimePacket), medikit use, and the mind-control state carrier.
+		// Each mutates synchronously with no BattleState/animation of its own, so there
+		// is no display timeline to preserve by holding it on the cursor. NOTE psi_result:
+		// the PVE flavour (pvp:false, connectionTCP.cpp:11260) is the host-resolved
+		// victim-state copy we migrate; the legacy PVP inverted-flip flavour (pvp:true)
+		// shares this wire string but is only reachable in PvP gamemodes, which never run
+		// with the lever on in the Phase-2..5 validation matrix (lever-off both are
+		// untouched). Phase 6's default-on decision revisits PvP explicitly.
+		state == "hit_unit" || state == "unit_casualty"
+		|| state == "panic_action" || state == "kneel" || state == "active_grenade" || state == "medkit"
+		|| state == "psi_result"
+		// order-2 (unitsCore): the fall-resolution carrier (Increment B).
+		|| state == "unit_fall"
+		// order-3 (items/terrain, Increment C): the chain-outcome carriers - these
+		// resolve terrain/items, not units, so they carry no per-unit display timeline
+		// to preserve either. Reuses the exact strings coopIsChainOutcomePacket and the
+		// gateAllows whitelist already match on.
+		|| state == "hit_tile" || state == "destroy_tile"
+		|| state == "set_explosive_tile" || state == "set_fire_tile" || state == "set_smoke_tile"
+		|| state == "module_destroyed" || state == "explode_items"
+		// order-boundary (Increment 5): the two boundary-phase state movers. next_turn is the
+		// sidestart snapshot (bulk unit apply + teleport-on-mismatch + tile reset + turn-machine
+		// advance); admitting it at RX arrival - BEFORE the new side's rank-1 carriers, matching
+		// wire order - keeps the rank-0 watermark from rejecting the snapshot (no epoch reset
+		// needed), and puts it ahead of the boundary sample's wire position. fuse_events (fuse
+		// timers + removeItem) precedes next_turn in the boundary emit and rides along. Their
+		// display-halves stay task-gated: next_turn's parked-outcome display-copy clear (A2)
+		// moves to the boundary marker's display consumption in the action_end handler.
+		|| state == "next_turn" || state == "fuse_events";
+}
+
+size_t rxHoldSize()
+{
+	std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+	return g_rxHold.size();
+}
+
+// coop (PRD-P9 soak finding): apply an actor's post-action TU/energy from a
+// replay packet that carries them. Presence-gated on BOTH fields, so a packet
+// from an older build (or one whose sender had no actor in scope) is applied
+// exactly as it always was.
+static void coopApplyActorCost(const Json::Value& obj, int unitId,
+							   SavedBattleGame* battle);
+
+size_t rxParkSize()
+{
+	std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+	return g_rxPark.size();
+}
+
+// coop (PRD-P11, test-only): append a packet to the hold queue exactly as the
+// transport drain would. The ordering property this PRD fixes depends on the
+// STATE OF THE QUEUE at the moment a packet lands - gate closed, an earlier
+// packet about the same unit still unconsumed - and reproducing that from the
+// game side is a timing race. Called from TestServer's `rx_inject` (main thread,
+// between two updateCoopTask() ticks) and from nowhere else.
+void rxInjectForTest(std::string&& payload)
+{
+	std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+	g_rxHold.emplace_back(std::move(payload));
+}
+
+static void coopApplyActorCost(const Json::Value& obj, int unitId,
+							   SavedBattleGame* battle)
+{
+	if (unitId < 0 || !battle || !obj.isMember("tu"))
+	{
+		return;
+	}
+	for (auto* unit : *battle->getUnits())
+	{
+		if (unit->getId() != unitId)
+		{
+			continue;
+		}
+		unit->setTimeUnits(obj["tu"].asInt());
+		if (obj.isMember("energy"))
+		{
+			unit->setCoopEnergy(obj["energy"].asInt());
+		}
+		return;
+	}
+}
 
 // TX-queue drop counter (test harness diagnostic; see connectionTCP.h).
 std::atomic<uint64_t> g_txDropCount{0};
@@ -550,6 +1331,17 @@ static void clearSnapshotSlots()
 	}
 }
 
+// coop (option 3B): conflation slots still holding an un-applied (dirty) snapshot - part of
+// the LIVE drain gauge that proves "nothing left to apply". Read-only, production-inert.
+size_t snapshotPendingCount()
+{
+	std::lock_guard<std::mutex> lk(g_snapMx);
+	size_t n = 0;
+	for (int i = 0; i < SNAP_COUNT; ++i)
+		if (g_snapDirty[i]) ++n;
+	return n;
+}
+
 // ===== Time helper =====
 static inline uint64_t now_ms()
 {
@@ -602,8 +1394,15 @@ void clearNetworkSessionQueues()
 	{
 		std::lock_guard<std::mutex> lock(g_rxHoldMutex);
 		g_rxHold.clear();
+		g_rxPark.clear();
+		// coop (PRD-P11): tell an in-flight pump pass that what it is holding
+		// belongs to a session that is over.
+		++g_rxHoldGen;
 	}
 
+	// coop (Class-A soak wedge fix): a new session starts with no pacing-wait stall.
+	g_rxPacingStallTicks = 0;
+
 	clearSnapshotSlots();
 }
 
@@ -702,6 +1501,58 @@ bool connectionTCP::campaignEnded()
 	return save && save->getEnding() != END_NONE;
 }
 
+// The skirmish twin of campaignEnded(): has the NEW BATTLE > COOP mission run
+// its course on this machine? A skirmish session exists only to play one
+// mission, so once the debriefing is up the session is spent: closing that
+// screen drops the whole world (DebriefingState::btnOkClick sees
+// monthsPassed == -1 and goes through GoToMainMenuState).
+//
+// Terms, all three needed:
+//   lobbyMode == 0   - a skirmish session, not a campaign one (a campaign's
+//                      post-mission life continues on the geoscape, so its
+//                      drops keep taking the freeze/wait route).
+//   no live battle   - a drop DURING the mission is a real drop; that is the
+//                      rejoin/freeze case and must keep its dialogs.
+//   coopMissionEnd   - set by the DebriefingState constructor for every co-op
+//                      session, i.e. the mission actually reached its scoring
+//                      screen. Without it, the pre-battle lobby (host still on
+//                      the NEW BATTLE setup screen) would look identical.
+//
+// Why it matters: a skirmish leaves a GeoscapeState buried under the battle
+// (the world arrives through LoadGameState on BOTH machines), so anything that
+// re-opens the lobby after the mission hands the player a RESUME GAME button
+// that pops straight down to that dead geoscape - a half-torn world of exactly
+// the shape issue #82 exists to prevent.
+bool connectionTCP::skirmishMissionOver()
+{
+	if (connectionTCP::session.lobbyMode != 0)
+		return false;
+	if (!_staticGame || !_staticGame->getSavedGame())
+		return false;
+	if (coopBattleLive(_staticGame))
+		return false;
+	return _staticGame->getCoopMod()->coopMissionEnd;
+}
+
+// coop (#162): narrower than skirmishMissionOver() - a skirmish debrief is actually
+// ON SCREEN right now (monthsPassed == -1 + a DebriefingState on the stack). The
+// disconnect-notice gate uses it to separate "the peer dropped while I am reading
+// my results" (raise the notice) from "I already dismissed my debrief and am in the
+// post-OK transition to the menu" (stay silent - 056b500db's window).
+bool connectionTCP::debriefOpen()
+{
+	if (!_staticGame || !_staticGame->getSavedGame())
+		return false;
+	if (_staticGame->getSavedGame()->getMonthsPassed() != -1)
+		return false;
+	for (State* st : _staticGame->getStates())
+	{
+		if (dynamic_cast<DebriefingState*>(st) != nullptr)
+			return true;
+	}
+	return false;
+}
+
 bool connectionTCP::localLoadsAllowed()
 {
 	// Same liveness terms the save gate uses, WITHOUT the host escape: a live
@@ -761,6 +1612,9 @@ Json::Value connectionTCP::buildCampaignStartPacket(const SavedGame* save)
 	root["saveID"] = static_cast<Json::Int64>(connectionTCP::saveID);
 	// PRD-J01: propagate the campaign economy model so the client adopts it.
 	root["campaignType"] = static_cast<int>(save->getCampaignType());
+	// PRD-P5: and the parallel-turns session mode, so a client that started its
+	// world from this packet (rather than from a streamed save) still agrees.
+	root["enable_parallel_turns"] = connectionTCP::_enable_parallel_turns;
 	int idx = 0;
 	for (const auto& p : save->getCoopPlayers())
 	{
@@ -1269,7 +2123,12 @@ void connectionTCP::refreshBattleGiftControlState()
 
 	if (battleState && localWasSpectator)
 	{
-		const int restoredTurn = _isActivePlayerSync ? 2 : 1;
+		// coop (PRD-P5): in parallel mode there is no off-turn state to come back
+		// to - both machines hold 2 for the whole player side, so a player who
+		// receives a soldier while in commanding-spectator mode is simply active
+		// again. `_isActivePlayerSync` must NOT be read here: it is the EXECUTOR
+		// role in parallel (host true / client false), not "is it my turn".
+		const int restoredTurn = parallelTurnActive() ? 2 : (_isActivePlayerSync ? 2 : 1);
 		setPlayerTurn(restoredTurn);
 		battleState->setCurrentTurn(restoredTurn);
 		if (restoredTurn == 2)
@@ -1278,6 +2137,9 @@ void connectionTCP::refreshBattleGiftControlState()
 		}
 		else
 		{
+			// Unreachable in parallel mode (restoredTurn is always 2). The
+			// persistent "X's Turn" banner (showMessage(msg, -1), repainted every
+			// frame) would otherwise sit on top of every later warning.
 			battleState->showCoopWarning(getCurrentClientName() + "'s Turn");
 		}
 	}
@@ -2001,6 +2863,39 @@ void connectionTCP::updateCoopTask()
 	// coopMissionEnd path in GeoscapeState).
 	processPendingSoldierGifts();
 
+	// coop (PRD-P6): the client's 10 s pending-intent watchdog. On the main
+	// thread, so the warning flash it may raise touches the battlescape safely.
+	tickActionIntents();
+
+	// coop (PRD-P7): the executor's two main-thread duties.
+	//  - close the admitted chain that has drained, so the client can report it
+	//    displayed. Needed here as well as at the popState() drain point because
+	//    three admitted kinds (kneel, prime, medikit) push no BattleState at all
+	//    and therefore never reach a pop.
+	//  - admit ONE deferred input. Not done from popState(): executing an action
+	//    pushes states back onto the queue the pop is still walking.
+	if (parallelTurnActive() && getHost())
+	{
+		coopCloseActionChain();
+		// coop (PRD-I0): and one armed boundary marker, on the same "the executor
+		// is idle" terms. Before coopAdmitPendingIntents() so the boundary hash is
+		// taken ahead of whatever action the new side admits first.
+		coopFlushSyncBoundary();
+		// coop (PRD-P9 3): after the close attempt, so a chain that has just
+		// drained is never reported stuck.
+		coopCheckStuckChain();
+		coopAdmitPendingIntents();
+		// coop (PRD-P8): the readiness tally and the side commit, in that order.
+		// Auto readiness is re-derived first (a seat whose last unit just died is
+		// ready NOW), the echo goes out only when the tally actually moved, and
+		// the commit is re-evaluated LAST - after coopAdmitPendingIntents(), so an
+		// intent admitted this same tick has already cleared its seat's ready bit
+		// and the commit it was racing (E14) simply does not fire.
+		recomputeEndTurnAuto();
+		coopCheckSideCommit();
+		sendEndTurnTallyIfChanged();
+	}
+
 	// COOP living quarters: re-report our guest headcount whenever it changes.
 	// Driven from here rather than from each mutation site (transfer, gift,
 	// sack, base loss) so no path can forget it; sendGuestCensus is a cheap
@@ -2191,7 +3086,13 @@ void connectionTCP::updateCoopTask()
 		// lost". Either player may close a finished game first, and neither
 		// exit is allowed to interrupt the other's end-of-game screens. The
 		// plain teardown below still runs, so nothing is left half-attached.
-		if (allow_cutscene == true && !campaignEnded())
+		//
+		// A finished SKIRMISH is the same story with a different end screen:
+		// once both players are reading their debriefing, whoever presses OK
+		// first leaves through GoToMainMenuState, and that ordinary exit must
+		// not throw a "has left the server" / "connection lost" popup over the
+		// other player's debriefing (skirmishMissionOver).
+		if (allow_cutscene == true && !campaignEnded() && (!skirmishMissionOver() || (debriefOpen() && !_peerLeftCleanly)))
 		{
 			// Make sure it calls disconnectTCP, otherwise it may get stuck.
 			if (getServerOwner() == true)
@@ -2244,17 +3145,137 @@ void connectionTCP::updateCoopTask()
 		}
 	}
 
+	// coop (PRD-P9 rider R7): un-park anything the `endPlayerTurn` exclusion put
+	// aside, as soon as that exclusion no longer holds. Restored to the FRONT,
+	// because a parked packet arrived before everything queued behind it - which
+	// is strictly closer to FIFO than the rotate this replaced.
+	{
+		std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+		if (!g_rxPark.empty() && _coopEnd != 1
+			&& !(_game->getSavedGame() && !_game->getSavedGame()->getSavedBattle()))
+		{
+			while (!g_rxPark.empty())
+			{
+				g_rxHold.emplace_front(std::move(g_rxPark.back()));
+				g_rxPark.pop_back();
+			}
+		}
+	}
+
+	// coop (PRD-P11): the pump walks the hold queue IN ORDER and consumes IN
+	// PLACE. It used to rotate a packet it could not consume to the BACK of
+	// g_rxHold and carry on, which reordered the stream against itself: the
+	// always-consume packets sitting behind the blocked one were applied as the
+	// pass continued, so a `BattleScapeMove` blocked once could end up permanently
+	// behind its own follow-ups. Measured on a badly backed-up client
+	// (rxRotates > 200k): the host sent Move(47) abortPath(37) Move(37)
+	// abortPath(27); the peer applied abortPath(37) Move(37) abortPath(27) and only
+	// then Move(47), two seconds later - walking unit 47 from a stale position with
+	// nothing left to correct it.
+	//
+	// So nothing is rotated. A packet that cannot be consumed keeps its place in
+	// the queue; the pass steps over it, remembers the unit it names in
+	// `blockedSubjects`, and consumes no later packet about that unit - not even
+	// one on the always-consume list. Only four always-consume packets carry a unit
+	// subject at all (`unit_fire` plus the three chain-closing exemptions
+	// `abortPath` / `unit_death` / `after_unit_death`), so tile hazards, votes and
+	// flow control are completely unaffected and still consume the moment the gate
+	// allows.
+	//
+	// Preserved exactly: the gate itself (depth 0 or the whitelist), the three
+	// per-action exemptions, `action_end`'s gated consumption (PRD-P7 - it must not
+	// jump the line), g_rxPark (PRD-P9 R7), and the pass-consumed-nothing exit that
+	// keeps the pump from busy-waiting.
+	//
+	// LIVENESS FLOOR: holding `abortPath` behind an unconsumed packet for the same
+	// unit is the one case that could in principle wedge - that exemption exists so
+	// a walk the peer cannot finish can be closed from outside. If a whole tick
+	// consumes nothing while per-subject blocking is holding something back, and
+	// that repeats for kRxBlockedStallTicks ticks, the next tick runs with blocking
+	// disabled (counted in g_rxLegacyPasses) so this pump can never be stuck longer
+	// than the old one would have been. It is expected never to fire.
+	const bool legacyOrder = (g_rxBlockedStallTicks >= kRxBlockedStallTicks)
+		|| g_rxForceFloor.load(std::memory_order_relaxed);
+	// coop (LIVENESS FLOOR, ordering-preserving drain): the floor is the last-resort
+	// backstop that must never wedge, but wholesale-disabling ordering when it fires
+	// reorders a long alien display's death-chain carriers - the client applies hit_unit /
+	// unit_death / after_unit_death out of order relative to the chain markers that sample
+	// the per-action sync hash, and the four buckets straddle (terrain / unitsCore /
+	// unitsCombat / items / itemIdCtr) at the ai/expl seqs. Measured red on
+	// test_parallel_floor_drain: with the floor engaged and this drain OFF, unitsCore 11
+	// unitsCombat 9 items 6 itemIdCtr 6; with it ON, all zero.
+	//
+	// On the parallel REPLAY CLIENT the floor no longer disorders: it KEEPS the I1 seq-gate
+	// and the D.1 apply barrier intact, so the death-chain carriers stay held to their own
+	// chain and the pump consumes exactly what it could when the floor was not engaged, in
+	// order - the per-action hash is never polluted. (Per-subject ordering stays disabled as
+	// in the legacy floor: the durable straddle the collapse causes is the seq-gate/barrier
+	// one - proven by test_parallel_floor_drain, strict-clean with only those two restored -
+	// and the death carriers are decoupled/apply-immediately by item 5B, which per-subject
+	// FIFO holding would undo.) It also deliberately does NOT force the gated markers through
+	// the display-depth gate: forcing one advances _clientDisplaySeq and samples the chain
+	// hash while the display animation is still mid-flight, which itself straddles unitsCore
+	// (measured: forcing regressed unitsCore 0->24). Progress instead comes from the display
+	// idling normally (marker applies, cursor advances) or, failing that, the hard-floor
+	// escape hatch below.
+	//
+	// LIVENESS: the floor's job is to break a genuine wedge, so keeping ordering intact
+	// cannot be the whole story. If the ordered drain makes NO progress while it is holding
+	// work back for kRxDrainHardFloorMs of wall clock (g_rxFloorStallStartMs), drainFloor
+	// goes false and the floor reverts to its legacy full-disable for that pass - a deadlock is
+	// worse than a straddle. A healthy display idle resets the run, so the backstop never fires
+	// in normal play. Off the parallel client (classic co-op, PvP, host) the floor is unchanged,
+	// byte-identical (there the stamps are absent so the seq-gate/barrier are inert anyway and
+	// only per-subject ordering was ever disabled). g_rxDrainDisable (test-only) forces the
+	// legacy path from the start so red (burst) and green (ordered) share a build.
+	const bool drainFloor = legacyOrder
+		&& !g_rxDrainDisable.load(std::memory_order_relaxed)
+		&& parallelTurnActive() && !getHost()
+		&& !(g_rxFloorStallStartMs != 0
+			&& (SDL_GetTicks() - g_rxFloorStallStartMs) >= kRxDrainHardFloorMs);
+	// coop (LIVENESS FLOOR stage-2): this tick reverts to the legacy full-disable because the
+	// ordered drain could not make progress (or the drain is test-disabled) - counted so a
+	// fixture can prove the ordered path carried the load (0 = the backstop never fired).
+	const bool hardFloorThisTick = legacyOrder && parallelTurnActive() && !getHost()
+		&& !g_rxDrainDisable.load(std::memory_order_relaxed) && !drainFloor;
+	if (hardFloorThisTick) g_rxHardFloorPasses.fetch_add(1, std::memory_order_relaxed);
+	bool blockedSomething = false;
+	size_t consumedThisTick = 0;
+	// coop (PHASE D.1): set in any pass where the apply-barrier held a marker, read
+	// after the passes for the sustained-stall diagnostic.
+	bool barrierHeldThisTick = false;
+
 	for (;;)
 	{
 		size_t passCount = 0;
+		uint32_t holdGen = 0;
 		{
 			std::lock_guard<std::mutex> lock(g_rxHoldMutex);
 			if (g_rxHold.empty())
 				break;
 			passCount = g_rxHold.size();
+			holdGen = g_rxHoldGen;
+			// PRD-P0: hold-queue high-water mark (test introspection only).
+			if ((uint32_t)passCount > g_rxHoldMaxSeen.load(std::memory_order_relaxed))
+				g_rxHoldMaxSeen.store((uint32_t)passCount, std::memory_order_relaxed);
 		}
 
 		size_t consumedThisPass = 0;
+		// Packets this pass could not consume, in their original relative order.
+		// Spliced back onto the FRONT of g_rxHold when the pass ends, so the queue
+		// is exactly what it was minus what was applied.
+		std::deque<std::string> deferred;
+		// The units named by `deferred`. Bounded by the unit count, so a linear
+		// scan is cheaper than any container with an allocation in it.
+		std::vector<int> blockedSubjects;
+		// coop (PRD-P10 follow-up): and WHICH packet seeded each of them, so the
+		// closer carve-out can tell a mid-chain blocker (jump it - that is the
+		// deadlock the carve-out exists for) from the chain's own opener (wait for
+		// it - see coopChainOpener). Parallel to blockedSubjects.
+		std::vector<std::string> blockedBy;
+		// coop (PHASE D.1): lowest current-side chain seq DEFERRED in this pass; the
+		// action_end apply-barrier reads it (0 = none deferred). Per-pass by construction.
+		std::uint32_t minDeferredChainSeqThisPass = 0;
 
 		for (size_t i = 0; i < passCount; ++i)
 		{
@@ -2292,7 +3313,7 @@ void connectionTCP::updateCoopTask()
 				if (Options::logPacketMessages == true && Options::logInfoToFile == true)
 				{			
 					std::string str_debug =
-						std::string("task completed: ") + (_coop_task_completed ? "true" : "false") +
+						std::string("task completed: ") + (coopTaskCompleted() ? "true" : "false") +
 						"   connection status: " + std::to_string(onConnect) + 
 						"   packet name: " + stateString +
 						"   packet data: " + obj.toStyledString();
@@ -2301,25 +3322,478 @@ void connectionTCP::updateCoopTask()
 				}
 
 				// Make operator precedence explicit:
-				const bool consumeNow =
-						 (_coop_task_completed || ((stateString == "abortPath" && _coopWalkInit) ||
-						 (stateString == "unit_death" && _coopInitDeath) ||
-						 (stateString == "after_unit_death" && _coopInitDeath)) ||
-					 stateString == "vote_request" || stateString == "vote_start" || stateString == "vote_cast" || stateString == "vote_update" || stateString == "vote_result" || stateString == "vote_cooldown" || stateString == "custom_battle_craft_locked" || stateString == "close_event" || stateString == "click_close" || stateString == "minimap_data" || stateString == "AIProgress" || stateString == "update_progress" || stateString == "DebriefingState" || stateString == "endTurn" || stateString == "hit_tile" || stateString == "destroy_tile" || stateString == "set_fire_tile" || stateString == "set_smoke_tile" || stateString == "unit_fire" || stateString == "calc_explode_fov" || stateString == "hasHitUnit") &&
-					!(stateString == "endPlayerTurn" && (_coopEnd == 1 || (_game->getSavedGame() && !_game->getSavedGame()->getSavedBattle())));
+				//
+				// coop (PRD-P6 pre-task): `coopTaskCompleted()` is now "gate depth
+				// 0" rather than a bool. The three per-action exemptions after it
+				// are unchanged and still needed - each names a packet that CLOSES
+				// the very chain currently holding the gate (`abortPath` ends the
+				// walk that took it; the two death packets end the shot that took
+				// it), so waiting for depth 0 would deadlock them.
+				// coop (PRD-P9 rider R7): hoisted out of the expression below so the
+				// pump can tell "not yet" (rotate and try again next pass) from "not
+				// while this holds" (park). `_coopEnd` only ever moves inside the
+				// endPlayerTurn handler - the very handler this term excludes - so a
+				// rotated one is re-examined every tick for the rest of the session.
+				const bool endTurnExcluded =
+					(stateString == "endPlayerTurn"
+					 && (_coopEnd == 1 || (_game->getSavedGame() && !_game->getSavedGame()->getSavedBattle())));
+
+				// coop (wire-order report alignment, Phase 3): sample the per-action
+				// sync-check at the marker's FIRST SIGHT in the wire stream, not at
+				// display consumption. Every chain-<=N state carrier precedes marker N
+				// on the FIFO and (Phase 2) applies at arrival, so state here is exactly
+				// N-complete and <=N-only. Fires ONCE per marker: the monotonic guard
+				// (seq > cursor, cursor reset on a new side) rejects the re-examinations a
+				// deferred marker gets on later passes. Boundary markers are handled by the
+				// SEPARATE first-sight block below (Increment 5) - excluded here so the two
+				// samplers (per-action sync_report vs boundary action_done) do not overlap.
+				if (g_wireOrderState.load(std::memory_order_relaxed) && !getHost()
+					&& parallelTurnActive() && stateString == "action_end"
+					&& !obj.get("boundary", false).asBool())
+				{
+					const std::uint32_t aSeq =
+						static_cast<std::uint32_t>(obj.get("action_seq", 0).asUInt());
+					const std::uint32_t aSide =
+						static_cast<std::uint32_t>(obj.get("side_seq", _sideSeq).asUInt());
+					if (aSeq != 0)
+					{
+						if (aSide != g_clientApplySideSeq)
+						{
+							// a new side's markers have begun arriving - reset the
+							// per-side apply cursor at WIRE-ORDER time (not at the
+							// display-timed resetActionArbiter, which may lag).
+							g_clientApplySideSeq = aSide;
+							g_clientApplySeq = 0;
+						}
+						if (aSeq > g_clientApplySeq)
+						{
+							g_clientApplySeq = aSeq;
+							// coop (wire-order Increment 7, SHAPE A): apply this chain's
+							// changed-units (tu,energy) ABSOLUTES at first-sight, BEFORE
+							// sampling (arrival timeline), so the client's still-draining
+							// unitsRegen is corrected at wire position N and the later
+							// sidestart boundary sample (unitsRegen is sidestart-only
+							// compared) reads the host's post-chain value instead of a
+							// replay that has not caught up. Present-gated (absent = older
+							// peer / lever-off); reuses coopApplyActorCost, the abortPath
+							// PRD-P9 walk-end carry. Once per marker via this same cursor.
+							if (obj.isMember("regen") && _game->getSavedGame()
+								&& _game->getSavedGame()->getSavedBattle())
+							{
+								SavedBattleGame* rb = _game->getSavedGame()->getSavedBattle();
+								const Json::Value& regen = obj["regen"];
+								for (Json::ArrayIndex ri = 0; ri < regen.size(); ++ri)
+								{
+									coopApplyActorCost(regen[ri],
+										regen[ri].get("unit_id", -1).asInt(), rb);
+									coopDiagUnit("regen.tu@3368", regen[ri].get("unit_id", -1).asInt(),
+										regen[ri].get("tu", -1).asInt());
+								}
+								g_regenApplied.fetch_add(regen.size(), std::memory_order_relaxed);
+							}
+							Json::Value rep;
+							rep["state"] = "sync_report";
+							rep["seq"] = static_cast<Json::UInt>(aSeq);
+							rep["side_seq"] = static_cast<Json::UInt>(aSide);
+							rep["seat"] = localSeat();
+							SharedEcon::syncCheckAttach(_game, rep);
+							sendTCPPacketData(rep.toStyledString());
+						}
+					}
+				}
+
+				// coop (wire-order report alignment, Increment 5): the BOUNDARY sync sample,
+				// moved from consumption (coopEmitBoundaryDone) to the boundary marker's FIRST
+				// SIGHT in the wire stream. By this point next_turn (a wire-order carrier) has
+				// applied its state-half at RX arrival, and the marker precedes the NEXT side's
+				// carriers on the wire, so the sample is post-next_turn and un-contaminated by
+				// the next side. Fires ONCE per boundary via the bseq high-water mark; emits the
+				// same payload coopEmitBoundaryDone did (syncCheckAttachBoundary). Consumption
+				// still advances the display cursor and clears the A2 copies (action_end
+				// handler); only the SAMPLE moved. Honors _testHoldBoundaryDone like the emit.
+				if (g_wireOrderState.load(std::memory_order_relaxed) && !getHost()
+					&& parallelTurnActive() && stateString == "action_end"
+					&& obj.get("boundary", false).asBool() && !_testHoldBoundaryDone)
+				{
+					const std::uint32_t bSeq =
+						static_cast<std::uint32_t>(obj.get("bseq", 0).asUInt());
+					if (bSeq != 0 && bSeq > g_clientApplyBoundarySeq)
+					{
+						g_clientApplyBoundarySeq = bSeq;
+						if (g_diagCapture.load(std::memory_order_relaxed)
+							&& _game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+							for (auto* du : *_game->getSavedGame()->getSavedBattle()->getUnits())
+							{
+								coopDiagUnit("SAMPLE.tu", du->getId(), du->getTimeUnits());
+								if (du->getId() >= 1000000)
+								{
+									const Position dp = du->getPosition();
+									coopDiagS("SAMPLE.core bseq=" + std::to_string(bSeq)
+										+ " u=" + std::to_string(du->getId())
+										+ " live=" + std::to_string((int)du->getStatus())
+										+ " fac=" + std::to_string((int)du->getFaction())
+										+ " x=" + std::to_string(dp.x) + " y=" + std::to_string(dp.y)
+										+ " z=" + std::to_string(dp.z));
+								}
+							}
+						Json::Value rep;
+						rep["state"] = "action_done";
+						rep["seq"] = 0;
+						rep["seat"] = localSeat();
+						rep["boundary"] = true;
+						rep["bseq"] = static_cast<Json::UInt>(bSeq);
+						SharedEcon::syncCheckAttachBoundary(_game, rep);
+						sendTCPPacketData(rep.toStyledString());
+					}
+				}
+
+				// coop (wire-order report alignment, Increment 4 / A4): apply endTurn's
+				// REQUIRED-AT-ARRIVAL half at the endTurn marker's FIRST SIGHT in the wire
+				// stream, before next_turn (which consumes both). Only two items qualify
+				// (census A4 classification): the script-RNG seed (GAP-10 - endTurn-timed,
+				// read by next_turn's deferred scripts via
+				// SavedBattleGame::newTurnUpdateScripts) and the deferred neutral->player
+				// regen arm (consumed by next_turn's state-half). Everything else in the
+				// endTurn handler - the side token, clearClientPendingIntent,
+				// resetActionArbiter, the active-sync flags, the global RNG::setSeed, the
+				// ALIENS banner - is display-flow bookkeeping and stays at consumption
+				// (moving resetActionArbiter early would let an in-flight action_done observe
+				// a reset arbiter). Fires ONCE per endTurn via g_endTurnArrivalSideSeq; the
+				// handler skips these two items when the cursor covers the marker.
+				if (g_wireOrderState.load(std::memory_order_relaxed) && !getHost()
+					&& parallelTurnActive() && stateString == "endTurn"
+					&& obj.isMember("side_seq"))
+				{
+					const std::uint32_t etSide =
+						static_cast<std::uint32_t>(obj["side_seq"].asUInt());
+					if (etSide > g_endTurnArrivalSideSeq)
+					{
+						g_endTurnArrivalSideSeq = etSide;
+						if (obj.isMember("seed"))
+							_scriptRngSeed = obj["seed"].asUInt64();
+						if (_hostShipsNextTurnFields && obj.get("side", -1).asInt() == 2)
+						{
+							_turnAdvanceDeferred = 1;
+							++_turnAdvanceDeferredCount;
+						}
+					}
+				}
+
+				// coop (PRD-P11): the three per-action exemptions, hoisted so the
+				// ordering rule below can see them. A packet that qualifies ONLY
+				// through one of these is the CLOSER of the chain currently holding
+				// the gate, and must never be held back by the ordering rule - see
+				// the carve-out where `subjectHeld` is computed.
+				// coop (parallel Phase 3, Sub-task A): the unit_death/after_unit_death
+				// disjuncts only ever qualify in classic - the parallel host ships
+				// unit_casualty instead (Phase 2a/2b), so the legacy trio never arrives
+				// on a parallel client's wire and these two clauses are permanently
+				// false there. Gated for clarity/hardening; classic keeps both,
+				// byte-identical. `abortPath` is unaffected (walk chains exist in both
+				// modes).
+				const bool chainCloser =
+						((stateString == "abortPath" && _coopWalkInit) ||
+						 (!parallelTurnActive() && stateString == "unit_death" && _coopInitDeath) ||
+						 (!parallelTurnActive() && stateString == "after_unit_death" && _coopInitDeath));
+
+				// coop (PRD-I3 SEAM-2 HALF 2): a set_smoke_tile/set_fire_tile carrying
+				// `bnd:true` is the neutral->player boundary decay. It belongs to NO chain
+				// (the whitelist exists for mid-chain outcome resolution), so it must ride
+				// the ordered gate: it fails the whitelist and the chain-outcome seq test
+				// below and queues like ordinary gated traffic, applying in FIFO after the
+				// ai-chain replay and before next_turn. Absent flag = old host / mid-side
+				// hazard = the current whitelist behaviour (presence-gated compat).
+				const bool boundaryHazardPacket =
+						(stateString == "set_fire_tile" || stateString == "set_smoke_tile")
+						&& obj.get("bnd", false).asBool();
+
+				const bool coopDecoupledWorldCarrier =
+						 parallelTurnActive() && !getHost()
+						 // coop (parallel Phase 3, Sub-task A): unit_death/after_unit_death
+						 // REMOVED - this whole block only ever fires in parallel
+						 // (parallelTurnActive() && !getHost() above), and the legacy trio
+						 // never arrives on a parallel client's wire (Phase 2a/2b ship
+						 // unit_casualty instead), so the two disjuncts were permanently
+						 // dead. hit_unit (still sent every hit) and unit_casualty (its
+						 // Phase 2b replacement, INCLUDING a bnd:true boundary casualty -
+						 // the legacy boundary trio took this same branch before) remain.
+						 && (stateString == "hit_unit" || stateString == "unit_casualty")
+						 && _game && _game->getSavedGame()
+						 && _game->getSavedGame()->getSavedBattle()
+						 && _game->getSavedGame()->getSavedBattle()->getSide() != FACTION_PLAYER;
+				const bool gateAllows =
+						 ((coopTaskCompleted() && !g_rxTestHold.load(std::memory_order_relaxed)) || chainCloser || coopDecoupledWorldCarrier ||
+					 stateString == "desync_report" || stateString == "action_intent" || stateString == "action_ack" || stateString == "action_deny" || stateString == "action_done" || stateString == "end_turn_ready" || stateString == "end_turn_tally" || stateString == "vote_request" || stateString == "vote_start" || stateString == "vote_cast" || stateString == "vote_update" || stateString == "vote_result" || stateString == "vote_cooldown" || stateString == "custom_battle_craft_locked" || stateString == "close_event" || stateString == "click_close" || stateString == "minimap_data" || stateString == "AIProgress" || stateString == "update_progress" || stateString == "DebriefingState" || stateString == "endTurn" || stateString == "hit_tile" || stateString == "destroy_tile" || stateString == "set_explosive_tile" || (stateString == "set_fire_tile" && !boundaryHazardPacket) || (stateString == "set_smoke_tile" && !boundaryHazardPacket) || stateString == "unit_fire" || stateString == "calc_explode_fov" || stateString == "hasHitUnit" || stateString == "coop_leaving"
+					// coop (wire-order report alignment, Phase 2): under the lever, a
+					// wire-order-set carrier is admitted at RX arrival regardless of
+					// task-busy, same as the whitelist above - it no longer waits on
+					// coopTaskCompleted(). Boundary-decay hazards are excluded
+					// (!boundaryHazardPacket) so set_fire_tile/set_smoke_tile `bnd:true`
+					// packets keep riding their existing task-gated timeline; boundary
+					// semantics are out of Phase 2 scope. Lever-off this disjunct is
+					// `(false && ...)`, so the OR-group's truth is unchanged.
+					|| (g_wireOrderState.load(std::memory_order_relaxed) && coopIsWireOrderStateCarrier(stateString) && !boundaryHazardPacket)) &&
+					!endTurnExcluded;
+
+				// coop (PRD-P11): the unit this packet is about, and whether an
+				// earlier packet still in the queue already names it.
+				//
+				// CARVE-OUT (measured, PRD-P11 soak): a chain closer is exempt.
+				// Holding one back is not a delay, it is a deadlock - `abortPath`
+				// ends the walk that holds the gate, so anything queued between
+				// that walk's `BattleScapeMove` (already consumed) and its
+				// `abortPath` - a mid-walk reaction hit, say - would block the
+				// only packet that can open the gate again. Measured with the
+				// carve-out missing: the liveness floor below fired twice in a
+				// five-turn soak, i.e. two ten-second stalls. The closers are also
+				// the packets whose ordering matters least: each one ENDS a chain
+				// this machine has already started, so there is nothing of that
+				// unit's left to overtake.
+				const int subject = coopPacketSubject(stateString, obj);
+				bool subjectHeld = false;
+				if (subject >= 0 && !legacyOrder && !chainCloser)
+				{
+					for (size_t b = 0; b < blockedSubjects.size(); ++b)
+					{
+						if (blockedSubjects[b] == subject)
+						{
+							subjectHeld = true;
+							break;
+						}
+					}
+				}
+
+				// coop (PRD-P10 follow-up; root-caused off a PRD-P9 soak failure):
+				// `_coopWalkInit` / `_coopInitDeath` are GLOBAL "a replay chain is
+				// running here" flags, not per unit. So while ANY unit's walk replay
+				// was running, an `abortPath` for a DIFFERENT unit counted as a chain
+				// closer, skipped the ordering rule above and overtook that unit's own
+				// still-queued `BattleScapeMove`. The peer then teleport-corrected the
+				// unit, replayed the walk on top - `movePlayerTarget` starts by putting
+				// the unit back on the packet's start tile and re-pathing locally - and
+				// had no closer left to correct the result, so it kept whatever its own
+				// truncated path spent. Measured: an alien a tile off with 2 energy of
+				// skew that survived the side, i.e. the residual UNIT CENSUS DRIFT.
+				// The death pair inverts the same way and is worse: `unit_death` carries
+				// the victim's status AT THE START of the death (STANDING), so applying
+				// it after `after_unit_death` puts a corpse back on its feet on 0 HP.
+				//
+				// A closer may still jump a MID-chain packet - that is the exemption the
+				// carve-out was written for and it stays. It may not jump the OPENER of
+				// the chain it closes: the wire is FIFO, so an opener still queued ahead
+				// of its closer means this machine has not started that chain at all and
+				// there is nothing yet for the closer to close.
+				bool closerOvertakesOpener = false;
+				if (chainCloser && subject >= 0 && !legacyOrder)
+				{
+					if (const char* opener = coopChainOpener(stateString))
+					{
+						for (size_t b = 0; b < blockedSubjects.size(); ++b)
+						{
+							if (blockedSubjects[b] == subject && blockedBy[b] == opener)
+							{
+								closerOvertakesOpener = true;
+								break;
+							}
+						}
+					}
+				}
+
+				// coop (PRD-I1): a whitelisted outcome packet carries the seq of the
+				// chain it belongs to (connectionTCP::coopStampChainSeq). If that chain
+				// has not opened locally yet - its seq is beyond the chain the client is
+				// currently displaying (_clientDisplaySeq + 1) - applying it now would
+				// jump ahead of its own opener and contaminate the client's post-N
+				// sync-check state, so it is held IN PLACE (P11-style, no rotation) until
+				// the client catches up. Same side only: a packet from a side that has
+				// already closed here takes the legacy always-consume path, mirroring
+				// I0's stale action_end marker rule, so a boundary arbiter reset cannot
+				// strand it. An absent/zero action_seq is legacy (classic co-op, boundary
+				// explosions, old peer): always-consume, bidirectionally. Disabled while
+				// the liveness floor is engaged, exactly like per-subject ordering.
+				bool seqDeferred = false;
+				// coop (wire-order report alignment, Phase 2): under the lever, a
+				// wire-order-set carrier is never seq-deferred - it applies at RX
+				// arrival in stream order instead of waiting on the display cursor.
+				if (!getHost() && (!legacyOrder || drainFloor) && coopIsChainOutcomePacket(stateString) && !boundaryHazardPacket
+					&& !(g_wireOrderState.load(std::memory_order_relaxed) && coopIsWireOrderStateCarrier(stateString)))
+				{
+					const std::uint32_t pktSeq =
+						static_cast<std::uint32_t>(obj.get("action_seq", 0).asUInt());
+					if (pktSeq != 0)
+					{
+						const std::uint32_t pktSide = static_cast<std::uint32_t>(
+							obj.get("side_seq", _sideSeq).asUInt());
+						if (pktSide == _sideSeq && pktSeq > _clientDisplaySeq + 1)
+						{
+							seqDeferred = true;
+						}
+					}
+				}
 
-				if (consumeNow)
+				// coop (PHASE D.1 chain-atomicity): the action_end APPLY BARRIER. A marker must
+				// not be consumed - its chain's post-N hash must not be sampled - until every
+				// packet the host stamped with this marker's (side_seq, action_seq) has applied.
+				// The host sends all of a chain's stamped packets BEFORE its action_end on the
+				// ordered stream, so any unapplied one is a packet THIS pass has already stepped
+				// over and DEFERRED (it sits ahead of the marker in FIFO): if this pass deferred a
+				// current-side stamped packet whose seq is <= this marker's (a boundary marker
+				// follows every chain, so ANY deferred current-side chain packet blocks it), hold
+				// the marker. Never a spin - the blocker already arrived and drains on its own
+				// gate; the 600-tick legacy floor (legacyOrder) disables this like the seq gate.
+				bool barrierBlocked = false;
+				if (!getHost() && (!legacyOrder || drainFloor) && stateString == "action_end"
+					&& minDeferredChainSeqThisPass != 0)
+				{
+					const std::uint32_t mSide = static_cast<std::uint32_t>(
+						obj.get("side_seq", _sideSeq).asUInt());
+					if (mSide == _sideSeq)
+					{
+						const bool mBoundary = obj.get("boundary", false).asBool();
+						const std::uint32_t mSeq = static_cast<std::uint32_t>(
+							obj.get("action_seq", 0).asUInt());
+						if (mBoundary || minDeferredChainSeqThisPass <= mSeq)
+						{
+							barrierBlocked = true;
+						}
+					}
+				}
+				// coop (chain-atomicity Strand B): the SIDE BARRIER. `endTurn` is whitelisted,
+				// so it would consume the instant the gate allows - advancing _sideSeq and
+				// zeroing _clientDisplaySeq (resetActionArbiter) - even while a STAMPED packet
+				// of the CURRENT side is still deferred ahead of it this pass
+				// (minDeferredChainSeqThisPass != 0, which is same-side by construction).
+				// Retiring the side token then strands that straggler: next pass its
+				// pktSide != _sideSeq, so seqDeferred no longer holds it (that gate is
+				// same-side only) and it legacy-consumes out of order, straddling the boundary
+				// hash. Hold endTurn until side S has drained so the client finishes side S
+				// before retiring its token. The host already blocks at the boundary for the
+				// client's boundary ack (P8), and the boundary marker sits BEHIND this endTurn
+				// on the wire, so this only reorders client-local consumption - it adds no host
+				// wait it was not already doing. LIVENESS: the deferred side-S packets drain as
+				// _clientDisplaySeq advances off their own chain markers (ahead of endTurn,
+				// never held here), so the hold cannot starve; and it is disabled under the
+				// legacy hard floor exactly like seqDeferred/barrierBlocked, so the
+				// kRxDrainHardFloorMs backstop is the documented last-resort release.
+				bool sideBarrierBlocked = false;
+				if (!getHost() && parallelTurnActive() && (!legacyOrder || drainFloor)
+					&& !g_rxSideBarrierDisable.load(std::memory_order_relaxed)
+					&& stateString == "endTurn" && minDeferredChainSeqThisPass != 0)
+				{
+					sideBarrierBlocked = true;
+				}
+				if (gateAllows && !subjectHeld && !closerOvertakesOpener && !seqDeferred && !barrierBlocked && !sideBarrierBlocked)
 				{
+					// See rxPassDeferred(): anything already deferred in this pass
+					// precedes this packet on the wire and has NOT been applied yet.
+					g_rxPassDeferred.store(!deferred.empty(), std::memory_order_relaxed);
+					rxTraceRecord(stateString, subject,
+								   obj.get("boundary", false).asBool() || obj.get("bnd", false).asBool(),
+								   obj.get("kind", "").asString());
 					onTCPMessage(stateString, obj);
 					++consumedThisPass;
+					// coop (Strand B): a HELD endTurn has now consumed. Attribute the release:
+					// the ordered side-S drain (normal) vs the legacy hard-floor escape.
+					if (stateString == "endTurn" && g_sideBarrierHeldThisSide)
+					{
+						if (hardFloorThisTick)
+							g_sideBarrierHardReleases.fetch_add(1, std::memory_order_relaxed);
+						else
+							g_sideBarrierReleases.fetch_add(1, std::memory_order_relaxed);
+						g_sideBarrierHeldThisSide = false;
+					}
+				}
+				else if (endTurnExcluded)
+				{
+					// PRD-P9 rider R7: park, do not rotate. Nothing this loop does can
+					// lift the exclusion, so rotating burns a queue traversal every tick
+					// forever (measured: five-figure rxRotates on an otherwise idle
+					// battle). The un-park above puts it back the moment it can apply.
+					std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+					g_rxPark.emplace_back(std::move(jsonStr));
 				}
 				else
 				{
-					// Rotate to the back so we can try the next message.
+					// coop (PHASE D.1 chain-atomicity): remember the lowest current-side chain seq
+					// this pass DEFERS, so a later action_end for that chain (and any boundary marker,
+					// which follows every chain) waits for it. Reads the stamp off the deferred packet
+					// itself, so it is carrier-agnostic: it accounts for every stamped carrier
+					// (hit_unit, unit_death, Inventory, explode_items, spawn_units, ...) whether it
+					// rides the ordered gate or the always-consume whitelist. The marker excludes itself.
+					if (stateString != "action_end")
+					{
+						const std::uint32_t pSeq = static_cast<std::uint32_t>(
+							obj.get("action_seq", 0).asUInt());
+						if (pSeq != 0)
+						{
+							const std::uint32_t pSide = static_cast<std::uint32_t>(
+								obj.get("side_seq", _sideSeq).asUInt());
+							if (pSide == _sideSeq
+								&& (minDeferredChainSeqThisPass == 0 || pSeq < minDeferredChainSeqThisPass))
+							{
+								minDeferredChainSeqThisPass = pSeq;
+							}
+						}
+					}
+					// coop (PRD-P11): keep the packet's PLACE. Everything behind it
+					// that names the same unit waits with it (a chain closer is
+					// never blocked, but it still SEEDS the block - a packet that
+					// arrived after it must not be applied before it).
+					// coop (PRD-I1): a seq-deferred packet must NOT seed a per-subject
+					// block - it is held on its own chain seq, and blocking its subject
+					// would wrongly hold a same-unit packet of the CURRENT chain (only
+					// unit_fire among the outcome packets carries a subject at all).
+					if (subject >= 0 && !legacyOrder && !subjectHeld && !seqDeferred)
+					{
+						blockedSubjects.push_back(subject);
+						blockedBy.push_back(stateString);
+					}
+					if (barrierBlocked)
+					{
+						// coop (PHASE D.1): the apply-barrier held this marker. Feeds the liveness
+						// floor like every other hold, so it can never outlast the 600-tick floor.
+						blockedSomething = true;
+						barrierHeldThisTick = true;
+						++g_barrierBlocks;
+					}
+					else if (seqDeferred)
+					{
+						// coop (PRD-I1): a chain-isolation hold. Counted on its own, and -
+						// like a subject hold - it feeds the liveness floor so a wedged seq
+						// gate can never outlast the 600-tick legacy-pass floor (which
+						// disables this gate too, see legacyOrder above).
+						blockedSomething = true;
+						++g_rxSeqDeferred;
+					}
+					else if (sideBarrierBlocked)
+					{
+						// coop (Strand B): the side barrier held endTurn. Latch that this side
+						// saw a hold (so the eventual consume counts as a release) and feed the
+						// liveness floor like every other hold, so the barrier can never outlast
+						// the 600-tick floor / hard-floor backstop.
+						blockedSomething = true;
+						g_sideBarrierHeldThisSide = true;
+						g_sideBarrierHolds.fetch_add(1, std::memory_order_relaxed);
+					}
+					else if (gateAllows)
+					{
+						// The gate said yes and ordering said no: the one case the old
+						// pump got wrong.
+						blockedSomething = true;
+						++g_rxSkipBlocked;
+					}
+					else
 					{
-						std::lock_guard<std::mutex> lock(g_rxHoldMutex);
-						g_rxHold.emplace_back(std::move(jsonStr));
+						++g_rxRotateCount;   // PRD-P0: gate-hold counter (test introspection)
+						// TEST-ONLY (rx_hold): the lever gates markers + non-whitelisted packets
+						// (display-busy emulation) so a backlog of seq-deferred STAMPED chains builds
+						// with their markers held - the exact state a long real display leaves - and the
+						// liveness floor trips ON DEMAND. Feeding it here engages the floor even before a
+						// seq-gate hold would. Never set outside the harness -> production identical.
+						if (g_rxTestHold.load(std::memory_order_relaxed))
+							blockedSomething = true;
 					}
+					deferred.emplace_back(std::move(jsonStr));
 				}
 			}
 			catch (const std::exception& e)
@@ -2333,26 +3807,157 @@ void connectionTCP::updateCoopTask()
 				// Write a crash-style log file into user/logs/crash_YYYY-MM-DD_HH-MM-SS.log
 				CRASH_LOG(msg);
 
-				// Put back to the *back* to avoid pinning the head.
-				{
-					std::lock_guard<std::mutex> lock(g_rxHoldMutex);
-					g_rxHold.emplace_back(std::move(jsonStr));
-				}
+				// coop (PRD-P11): keep its place like any other unconsumed packet
+				// (it used to go to the back, which is the reordering this PRD
+				// removes). The session is being torn down anyway.
+				deferred.emplace_back(std::move(jsonStr));
 				onConnect = -3;
 				break;
 			}
 		}
 
+		// coop (PRD-P11): put the untouched packets back, in order, AHEAD of
+		// everything the pass did not reach.
+		bool sessionReset = false;
+		{
+			std::lock_guard<std::mutex> lock(g_rxHoldMutex);
+			if (g_rxHoldGen != holdGen)
+			{
+				// clearNetworkSessionQueues() ran while this pass was inside
+				// onTCPMessage(): the queue was deliberately emptied, so what we
+				// are holding belongs to a session that is over.
+				sessionReset = true;
+				deferred.clear();
+			}
+			while (!deferred.empty())
+			{
+				g_rxHold.emplace_front(std::move(deferred.back()));
+				deferred.pop_back();
+			}
+		}
+
+		consumedThisTick += consumedThisPass;
+
 		// If nothing progressed this pass, stop to avoid busy-waiting
-		if (consumedThisPass == 0)
+		if (sessionReset || consumedThisPass == 0)
 			break;
 	}
 
-	// coop
-	// UNABLE TO CONNECT TO SERVER
-	if (onConnect == 0)
+	// coop (LIVENESS FLOOR stage-2 backstop): the WALL-CLOCK stall run - consecutive
+	// parallel-client ticks that consumed nothing WHILE the ordering machinery was holding
+	// work back (blockedSomething) - a genuine can't-make-progress wedge. Counted independent
+	// of legacyOrder (unlike g_rxBlockedStallTicks, which the floor resets), because the
+	// ordered drain may keep the floor engaged for a long time and the backstop's job is to
+	// measure how long real progress has actually stalled. ANY consumption (an ordinary
+	// display idle draining the next chain, an arbiter packet) resets it, so a legitimate long
+	// animation - which idles between chains - never approaches the threshold; only a queue
+	// that consumes NOTHING for kRxDrainHardFloorMs (the seed-11100011-class gate-hold
+	// the floor exists for) does. Immune to the rx_force_floor test lever, which forces
+	// legacyOrder but does not change what the pump consumes.
+	if (parallelTurnActive() && !getHost() && consumedThisTick == 0 && blockedSomething)
 	{
-		onConnect = -1;
+		if (g_rxFloorStallStartMs == 0)
+		{
+			g_rxFloorStallStartMs = SDL_GetTicks();
+			// SDL_GetTicks() can return 0 at startup; a sentinel of 0 means "not stalling", so
+			// bump a genuine 0 to 1 (1 ms of error, harmless).
+			if (g_rxFloorStallStartMs == 0) g_rxFloorStallStartMs = 1;
+		}
+	}
+	else
+		g_rxFloorStallStartMs = 0;
+
+	// coop (PRD-P11): the liveness floor (see the pump's header comment).
+	if (legacyOrder)
+	{
+		++g_rxLegacyPasses;
+		g_rxBlockedStallTicks = 0;
+	}
+	else if (consumedThisTick == 0 && blockedSomething)
+	{
+		++g_rxBlockedStallTicks;
+	}
+	else
+	{
+		g_rxBlockedStallTicks = 0;
+	}
+
+	// coop (PHASE D.1 chain-atomicity): loud, bounded introspection for a SUSTAINED
+	// apply-barrier stall. The barrier only holds a marker while a stamped packet of
+	// its chain has ARRIVED but not applied; that drains on its own gate, so a long
+	// stall is a real ordering/attribution bug (or a peer far behind). Warn once past
+	// ~3 s; the legacy floor above then forces the marker through, so it never wedges.
+	if (barrierHeldThisTick && consumedThisTick == 0)
+	{
+		if (++g_barrierStallTicks == 180 && !g_barrierStallWarned)
+		{
+			g_barrierStallWarned = true;
+			Log(LOG_WARNING) << "coop: action_end apply-barrier stalled ~3s - side_seq="
+							 << _sideSeq << " clientDisplaySeq=" << _clientDisplaySeq
+							 << " rxHold=" << rxHoldSize() << " barrierBlocks="
+							 << g_barrierBlocks.load();
+		}
+	}
+	else
+	{
+		g_barrierStallTicks = 0;
+		g_barrierStallWarned = false;
+	}
+
+	// coop (PRD-P7): client display fast-forward. A packet still sitting in the
+	// hold queue behind a closed receive gate means the executor has already moved
+	// on while this machine is still animating. If what it is animating is nothing
+	// but locomotion, there is nothing to wait for: `abortPath`'s teleport-correct
+	// fixes the endpoint exactly either way, so only the animation length changes.
+	if (parallelTurnActive() && !getHost() && !coopTaskCompleted() && rxHoldSize() > 0)
+	{
+		SavedGame* pgSave = _game ? _game->getSavedGame() : nullptr;
+		SavedBattleGame* pgBattle = pgSave ? pgSave->getSavedBattle() : nullptr;
+		BattlescapeGame* pgGame = pgBattle ? pgBattle->getBattleGame() : nullptr;
+		if (pgGame && pgGame->chainIsSkippable())
+		{
+			pgGame->setCoopFastForward(true);
+		}
+	}
+
+	// coop (Class-A soak wedge fix): liveness floor for the auto-shot pacing wait.
+	// ExplosionBState parks a multi-shot replay on _coopPacingWait until the host's
+	// flip packet lands; if that packet never comes (a host/client shot-count
+	// divergence, likeliest on hazard-heavy turns), the ProjectileFlyBState beneath
+	// it holds the receive gate for the rest of the battle and this machine falls
+	// arbitrarily far behind. The existing per-subject/seq floor (kRxBlockedStallTicks)
+	// does NOT cover it: a gate held with only gate-rotated (non-whitelisted) traffic
+	// leaves `blockedSomething` false, so it never counts. Count the pacing wait
+	// itself here and, past the floor, raise _coopForceDrainReplay, which
+	// ExplosionBState::think() consumes to end the wait. Reset the moment the wait
+	// clears, so a normal sub-second wait never nears the floor and speed-skew (which
+	// enters/exits the wait per shot) never accumulates.
+	if (parallelTurnActive() && !getHost() && _coopPacingWait)
+	{
+		if (++g_rxPacingStallTicks >= kRxPacingForceDrainTicks)
+		{
+			_coopForceDrainReplay = true;
+			++_coopForceDrainCount;
+			g_rxPacingStallTicks = 0;
+		}
+	}
+	else
+	{
+		g_rxPacingStallTicks = 0;
+	}
+
+	// coop (Class-A soak wedge fix, A3): host-side peer-liveness tripwire. A peer that
+	// wedges mid-replay goes silent - it never diverges, so no per-term detector fires,
+	// yet it stops answering boundary markers while this machine keeps crossing them.
+	// checkPeerLiveness latches the shared desync path on a sustained boundary-answer
+	// gap (host-only, PVE-only, self-guarded).
+	SharedEcon::checkPeerLiveness(_game);
+
+	// coop
+	// UNABLE TO CONNECT TO SERVER
+	if (onConnect == 0)
+	{
+		onConnect = -1;
 
 		// the attempt is over either way: never leave "Connecting..." up. A
 		// join to a port nobody is listening on used to sit on it forever.
@@ -3825,7 +5430,6 @@ void connectionTCP::executeVoteAction(const std::string& action)
 
 void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 {
-
 	// PRD-J03: single early hook routing the shared_* economy protocol into the
 	// SharedEcon dispatch table (the anti-if-chain requirement). If SharedEcon
 	// consumes the message, it never falls through to the if-chain below.
@@ -3977,6 +5581,17 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 	}
 
+	// coop (#162 / 056b500db reconciliation): the peer pressed OK on its skirmish
+	// debriefing and is leaving gracefully (sent just before its socket closes). Latch
+	// it so the onConnect==-2 disconnect-notice gate stays silent for this clean exit,
+	// while an ABRUPT drop - which sends no coop_leaving - still raises the notice.
+	// Whitelisted in the receive gate so it is never parked past the FIN; the latch is
+	// reset at disconnectTCP teardown and on a fresh client attach.
+	if (stateString == "coop_leaving")
+	{
+		_peerLeftCleanly = true;
+	}
+
 	// refused by the campaign roster gate (flow-redesign F3)
 	if (stateString == "lobby_join_refused")
 	{
@@ -4128,6 +5743,11 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		CoopCampaignType campaignType =
 			static_cast<CoopCampaignType>(obj.get("campaignType", 0).asInt());
 
+		// PRD-P5: the host's parallel-turns mode rides the campaign start too
+		// (COOP_READY_HOST already set it; this keeps the two in step for a
+		// client whose world is built from this packet). Missing key = classic.
+		connectionTCP::_enable_parallel_turns = obj.get("enable_parallel_turns", false).asBool();
+
 		if (campaignType == CoopCampaignType::Shared)
 		{
 			// PRD-J02: a SHARED client is a replica - it never builds its own
@@ -5223,6 +6843,32 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 				AbortCoopWalk = true;
 
 				_game->getSavedGame()->getSavedBattle()->getBattleGame()->abortCoopPath(x, y, z, unit_id, setDirection, setFaceDirection);
+				// coop (SEAM-3 door B): apply the hinged doors the executor opened during the
+				// walk, cost-free (MCD swap + lighting/FOV, no TU) via the fix-A costFree path.
+				// The peer's own replay walk left hinged doors state-neutral, so this is the
+				// sole authority for them. Additive + presence-gated (old host omits it).
+				if (obj.isMember("doors_opened"))
+				{
+					SavedBattleGame* sbgDoors = _game->getSavedGame()->getSavedBattle();
+					const Json::Value& doorsArr = obj["doors_opened"];
+					for (Json::ArrayIndex di = 0; di < doorsArr.size(); ++di)
+					{
+						Position dpos(doorsArr[di]["x"].asInt(),
+									  doorsArr[di]["y"].asInt(),
+									  doorsArr[di]["z"].asInt());
+						Tile* dt = sbgDoors->getTile(dpos);
+						if (dt)
+						{
+							TilePart dpart = (TilePart)doorsArr[di]["part"].asInt();
+							dt->openDoor(dpart, 0, BA_NONE, false, true);
+							// coop (UFO-door authority): a UFO door can span several tiles; mirror the
+							// executor's checkAdjacentDoors so the peer opens the whole run, not just the
+							// primary. Hinged doors are single-tile (isUfoDoor false), so this is skipped.
+							if (dt->isUfoDoor(dpart) && sbgDoors->getTileEngine())
+								sbgDoors->getTileEngine()->checkAdjacentDoors(dpos, dpart);
+						}
+					}
+				}
 
 				for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
 				{
@@ -5237,6 +6883,35 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 						unit->setDirectionTurretCoop(setTurretDirection);
 						unit->setTurretToDirectionCoop(setTurretToDirection);
 
+						// coop (PRD-P9 rider R2): the walk's END STATE, not just where it
+						// stopped. `abortPath` closes every replayed walk, and it used to
+						// correct position and facing only - so a peer whose animation had
+						// been truncated (a slow machine, an interrupted fast-forward) kept
+						// whatever TU its own truncated walk had spent. Measured drift: 2 TU
+						// on the executor against 44 on the peer at a 1:300 speed skew. Both
+						// fields are additive and presence-gated, so an older peer ignores
+						// them and behaves exactly as before.
+						if (obj.isMember("tu"))
+						{
+							unit->setTimeUnits(obj["tu"].asInt());
+							coopDiagUnit("abortPath.tu@6858", unit->getId(), obj["tu"].asInt());
+						}
+						if (obj.isMember("energy"))
+						{
+							unit->setCoopEnergy(obj["energy"].asInt());
+						}
+
+						// coop (PRD-I3): the walk's END kneel state. UnitWalkBState stands a kneeled
+						// unit up on its first step (BattlescapeGame::kneel), a kneel-bit mutation that
+						// ships on no packet of its own; abortPath is the walk closer that now carries
+						// it. Applied on the PARALLEL NON-HOST machine only - the classic peer runs its
+						// own walk replay and stands the unit up itself, so gating here keeps classic
+						// byte-identical (L4 criterion 6). Presence-gated: an older executor omits it.
+						if (parallelTurnActive() && !getHost() && obj.isMember("kneeled"))
+						{
+							unit->kneel(obj["kneeled"].asBool());
+						}
+
 						_game->getSavedGame()->getSavedBattle()->getBattleGame()->teleport(x, y, z, unit);
 
 						break;
@@ -5591,8 +7266,16 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 			{
 				_game->getSavedGame()->getSavedBattle()->getBattleState()->setSelectedCoopUnit(actor_id);
 
-				_game->getSavedGame()->getSavedBattle()->setKneelReserved(kneel);
-				_game->getSavedGame()->getSavedBattle()->setTUReserved((BattleActionType)reverse);
+				// coop (PRD-P8 §5): the reserve fields piggybacked on this packet
+				// are classic-only. PRD-P5 already stopped SENDING `selected_unit`
+				// in parallel mode (the peer's selection is its own there), so this
+				// is dead code in parallel today - guarded anyway, because it is a
+				// second door into the same per-machine setting.
+				if (!parallelTurnActive())
+				{
+					_game->getSavedGame()->getSavedBattle()->setKneelReserved(kneel);
+					_game->getSavedGame()->getSavedBattle()->setTUReserved((BattleActionType)reverse);
+				}
 			}
 		}
 	}
@@ -5994,57 +7677,356 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 	}
 
-	if (stateString == "GamePausedON")
+	// coop (PRD-P8 §5): the reserve mirror is a CLASSIC-mode packet. In parallel
+	// mode reserve is a per-machine setting - both players are acting at once, so
+	// one player's reserve has no business gating the other's soldiers - and the
+	// setting that matters travels per-action on `action_intent` instead. The
+	// senders are suppressed there (BattlescapeState::coopSendReserveState); these
+	// two guards are belt-and-braces for a peer that suppressed neither.
+	if (stateString == "TU_COOP")
 	{
-
-		if (gamePaused == 0)
+		if (!parallelTurnActive())
 		{
-			gamePaused = 2;
-			setPlayerTurn(1);
+			int reverse = obj["reverse"].asInt();
+
+			_game->getSavedGame()->getSavedBattle()->setTUReserved((BattleActionType)reverse);
 		}
+	}
 
-		if (onTcpHost == true)
+	if (stateString == "kneel_reserved")
+	{
+		if (!parallelTurnActive())
 		{
+			bool battle_action = obj["battle_action"].asBool();
 
-			_waitBC = false;
+			_game->getSavedGame()->getSavedBattle()->setKneelReserved(battle_action);
 		}
-		else
+	}
+
+	// coop (PRD-P6): the client asks, the host decides and executes. All three
+	// are whitelisted in the hold queue (PROTOCOL.md "Interrupt whitelist
+	// additions") because none of them carries a peer-side sim mutation - the
+	// ACTION they lead to rides the normal broadcast packets, which stay behind
+	// the receive gate and therefore still apply in chain order.
+	if (stateString == "action_intent")
+	{
+		// only the executor arbitrates; anybody else silently ignores it.
+		if (getHost() && parallelTurnActive())
 		{
+			const std::uint32_t reqId = static_cast<std::uint32_t>(obj.get("req_id", 0).asUInt());
+			const int seat = obj.get("seat", -1).asInt();
+			const std::uint32_t sideSeq = static_cast<std::uint32_t>(obj.get("side_seq", 0).asUInt());
+
+			SavedBattleGame* battle = _game->getSavedGame() ? _game->getSavedGame()->getSavedBattle() : nullptr;
+			BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+
+			std::string denyReason;
+			std::string denyWarning;
+			// the validator's short cause, for the log only - "invalid" alone
+			// names five different branches and is useless in a bug report.
+			std::string denyDetail;
+			// coop (PRD-P7): true = the intent was DEFERRED, not answered. The ack
+			// is owed when the pending slot is admitted, so nothing travels now.
+			bool pended = false;
+
+			if (!bg || sideSeq != _sideSeq || battle->getSide() != FACTION_PLAYER
+				|| _sideCommitInProgress)
+			{
+				// a stale side token, the AI already holds the field, or (PRD-P8
+				// E14) the side commit won the race and this intent lost it
+				denyReason = "turn_over";
+				denyWarning = "STR_COOP_TURN_OVER";
+			}
+			else
+			{
+				const std::string bad = bg->coopValidateIntent(obj.toStyledString(), seat, denyWarning);
+				if (!bad.empty())
+				{
+					denyReason = "invalid";
+					denyDetail = bad;
+				}
+				else if (!canAdmitAction())
+				{
+					// coop (PRD-P7): a chain of pure locomotion in the way is a WAIT,
+					// not a refusal - defer the intent and stop watching the walk.
+					// Anything else keeps PRD-P6's `busy`.
+					pended = coopPendIntent(seat, reqId, obj.get("kind", "").asString(),
+											obj.toStyledString(), false);
+					if (!pended)
+					{
+						denyReason = "busy";
+						denyWarning = "STR_COOP_PLAYER_BUSY";
+					}
+				}
+			}
 
-			_waitBH = false;
+			if (pended)
+			{
+				// deliberately silent: coopAdmitPendingIntents() acks on admission
+			}
+			else if (!denyReason.empty())
+			{
+				Log(LOG_INFO) << "coop: action_intent req " << reqId << " (seat "
+							  << seat << ", " << obj.get("kind", "").asString()
+							  << " unit " << obj.get("unit_id", -1).asInt()
+							  << ") denied " << denyReason
+							  << (denyDetail.empty() ? "" : "/" + denyDetail);
+				Json::Value root;
+				root["state"] = "action_deny";
+				root["req_id"] = static_cast<Json::UInt>(reqId);
+				root["reason"] = denyReason;
+				root["warning"] = denyWarning;
+				root["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+				sendTCPPacketData(root.toStyledString());
+			}
+			else
+			{
+				_intentSlotReqId = reqId;
+				_intentSlotSeat = seat;
+				_intentSlotKind = obj.get("kind", "").asString();
+
+				// coop (PRD-P8): a seat that is still acting is not done. This is
+				// the E14 abort: the commit condition is re-evaluated on the next
+				// tick and no longer holds.
+				noteSeatActed(seat);
+
+				Json::Value ack;
+				ack["state"] = "action_ack";
+				ack["req_id"] = static_cast<Json::UInt>(reqId);
+				ack["action_seq"] = static_cast<Json::UInt>(stampAdmittedAction(_intentSlotKind));
+				sendTCPPacketData(ack.toStyledString());
+
+				// From here on it is an ordinary HOST action: every existing send
+				// site fires because the host holds _isActivePlayerSync (the
+				// PRD-P5 executor invariant), so the client displays this chain
+				// exactly as it displays a host action in classic co-op.
+				bg->coopExecuteIntent(obj.toStyledString());
+			}
 		}
 	}
 
-	if (stateString == "GamePausedOFF")
+	if (stateString == "action_ack")
 	{
-
-		if (onTcpHost == true)
+		const std::uint32_t reqId = static_cast<std::uint32_t>(obj.get("req_id", 0).asUInt());
+		// PROTOCOL.md: the slot clears on ACK RECEIPT. Not on the broadcast - the
+		// action packets carry no action_seq until PRD-P7, so a broadcast-based
+		// clear would leave the slot stuck until the 10 s timeout after EVERY
+		// intent. A stale ack (the slot was already replaced by a newer input)
+		// matches no req_id and clears nothing.
+		if (reqId != 0 && reqId == _clientPendingReqId)
 		{
-
-			_waitBC = true;
+			clearClientPendingIntent();
 		}
-		else
+		// coop (PRD-P7): never move the watermark BACKWARDS - `action_end` may
+		// already have carried the client past this ack's value.
+		const std::uint32_t acked = static_cast<std::uint32_t>(obj.get("action_seq", 0).asUInt());
+		if (acked > _actionSeq)
 		{
+			_actionSeq = acked;
+		}
+	}
 
-			_waitBH = true;
+	if (stateString == "action_deny")
+	{
+		const std::uint32_t reqId = static_cast<std::uint32_t>(obj.get("req_id", 0).asUInt());
+		if (obj.isMember("side_seq"))
+		{
+			_sideSeq = static_cast<std::uint32_t>(obj["side_seq"].asUInt());
 		}
+		if (reqId == 0 || reqId == _clientPendingReqId)
+		{
+			clearClientPendingIntent();
+			const std::string warning = obj.get("warning", "").asString();
+			// The flash fades, and off the player side BattlescapeState::warning
+			// swallows it outright - so the reason is remembered here as well.
+			_clientLastDenyReason = obj.get("reason", "").asString();
+			_clientLastDenyWarning = warning;
+			if (warning == "STR_COOP_PLAYER_BUSY")
+			{
+				// coop (parallel turns): peer-busy no longer flashes the toolbar
+				// widget - it drives the persistent map banner instead. The banner
+				// keys on isBusy(), so arm a short click-sync window here in case a
+				// mirror-packet gap left us momentarily not-busy at deny receipt.
+				_coopWaitDenyTicks = 30;
+			}
+			else if (!warning.empty())
+			{
+				flashBattleWarning(warning);
+			}
+			Log(LOG_INFO) << "coop: action_intent req " << reqId << " denied ("
+						  << _clientLastDenyReason << ")";
+		}
+	}
 
-		setPlayerTurn(gamePaused);
-		gamePaused = 0;
+	// coop (PRD-P7): "chain N has no more packets coming" - the host's drain
+	// marker. NOT whitelisted, so the client consumes it only at receive-gate
+	// depth 0, which is precisely when it has finished DISPLAYING that chain.
+	if (stateString == "action_end")
+	{
+		// coop (PRD-I0): a BOUNDARY marker allocates nothing in the action
+		// namespace - it only asks this machine to hash. Consuming it here means
+		// the gate was at depth 0, so the boundary's own packets (`fuse_events`,
+		// `next_turn`) are already applied.
+		if (obj.get("boundary", false).asBool())
+		{
+			if (!getHost())
+			{
+				// coop (wire-order Increment 5 / A2): the parked-outcome display copies'
+				// GAP-4b orphan-hygiene clear rides the DISPLAY timeline here (boundary marker
+				// consumption - the gate is at depth 0, so this side's melee/self-destruct
+				// replays have drained), so next_turn's carrier apply at RX arrival does not
+				// starve a still-queued replay. Lever-off the copies are empty (no-op).
+				_meleeResultsDisplay.clear();
+				_selfDestructResultsDisplay.clear();
+				// coop (wire-order Increment 5): the boundary sync sample moved to the boundary
+				// marker's FIRST SIGHT (wire position, mirroring the per-action sync_report) -
+				// see the first-sight hook in updateCoopTask. Skip the consumption-timed emit
+				// lever-on; lever-off keep it here, byte-identical.
+				if (!g_wireOrderState.load(std::memory_order_relaxed))
+					coopEmitBoundaryDone(static_cast<std::uint32_t>(obj.get("bseq", 0).asUInt()));
+			}
+		}
+		const std::uint32_t seq = static_cast<std::uint32_t>(obj.get("action_seq", 0).asUInt());
+		const std::uint32_t markerSide =
+			static_cast<std::uint32_t>(obj.get("side_seq", _sideSeq).asUInt());
+		// coop (PRD-I0): a marker from a side that has ALREADY CLOSED here.
+		//
+		// This is a wedge, not a curiosity, and PRD-I0's AI-side stamping is what
+		// created it. `endTurn` is whitelisted, `action_end` is not, so the boundary
+		// resets this machine's arbiter (`_clientDisplaySeq` back to 0) while the tail
+		// of the previous side's markers is still queued behind the receive gate.
+		// Before I0 the alien side stamped nothing, so no such marker existed; now it
+		// does, and adopting its HIGH seq after the reset freezes `_clientDisplaySeq`
+		// above every seq the new side will ever stamp - after which
+		// `seq > _clientDisplaySeq` is false for the rest of the battle, the client
+		// never reports again, and the executor's display-backlog term refuses every
+		// action with `busy`. Measured: a soak wedged solid at the turn-3 boundary and
+		// spent 40 minutes denying intents.
+		//
+		// The report still goes out (the sync-check ring is keyed on (side_seq, seq),
+		// so the entry can still be answered) - it just must not move a watermark.
+		if (!getHost() && obj.isMember("side_seq") && markerSide != _sideSeq)
+		{
+			coopEmitStaleActionDone(seq, markerSide);
+		}
+		else if (!getHost() && seq > _clientDisplaySeq)
+		{
+			// coop (PRD-I0): remember the side the MARKER named, not this machine's
+			// current `_sideSeq` - see the send site for why they differ.
+			_clientDisplaySideSeq = markerSide;
+			_clientDisplaySeq = seq;
+			if (seq > _actionSeq)
+			{
+				// the host's own actions carry no ack, so this is where the client
+				// learns how far the executor has got.
+				_actionSeq = seq;
+			}
+			coopEmitActionDone();
+		}
 	}
 
-	if (stateString == "TU_COOP")
+	// coop (PRD-P7): the display flow-control return leg. Whitelisted (it carries
+	// no sim mutation), so it reaches the arbiter even while the host is mid-chain.
+	// The `<= _actionSeq` guard drops a report that crossed a side boundary in
+	// flight - without it the uint32 backlog term would underflow and block
+	// admission for the rest of the battle.
+	if (stateString == "action_done")
 	{
-		int reverse = obj["reverse"].asInt();
+		if (getHost())
+		{
+			const std::uint32_t seq = static_cast<std::uint32_t>(obj.get("seq", 0).asUInt());
+			// coop (PRD-I0): and only when the report belongs to the side that is
+			// running. The seq namespace restarts every side, so a report from the
+			// previous one carries a number that is perfectly valid for THIS side and
+			// would credit chains the peer has not displayed. Presence-gated: an older
+			// peer stamps no `side_seq` and keeps the P7 behaviour exactly.
+			const bool sameSide = !obj.isMember("side_seq")
+				|| static_cast<std::uint32_t>(obj["side_seq"].asUInt()) == _sideSeq;
+			if (sameSide && seq > peerDisplayAckedSeq && seq <= _actionSeq)
+			{
+				peerDisplayAckedSeq = seq;
+			}
+			// coop (PRD-I0): the deferred half of the sync-check. Additive - a
+			// report with no "h" is an older peer and is skipped silently.
+			SharedEcon::syncCheckCompare(_game, obj);
+		}
+	}
 
-		_game->getSavedGame()->getSavedBattle()->setTUReserved((BattleActionType)reverse);
+	// coop (wire-order report alignment, Phase 3): the per-action sync-check report,
+	// sampled at the client's wire-order marker first-sight. Mirrors the action_done
+	// deferred-compare leg; present-gated by syncCheckCompare itself (a report with no
+	// "h" is silently skipped). Host-only. Under the lever this REPLACES action_done as
+	// the per-action hash pairing; the boundary hash still rides action_done (boundary:true).
+	if (stateString == "sync_report")
+	{
+		if (getHost())
+		{
+			SharedEcon::syncCheckCompare(_game, obj);
+		}
 	}
 
-	if (stateString == "kneel_reserved")
+	// coop (PRD-P8): a seat arming or disarming its END TURN. Host-only - the
+	// tally is the executor's, and the echo (`end_turn_tally`) is what every
+	// other machine reads. Whitelisted like the rest of the arbiter traffic: it
+	// carries no sim mutation and must reach the host even mid-chain, otherwise a
+	// player could not answer while the other one was walking.
+	if (stateString == "end_turn_ready")
 	{
-		bool battle_action = obj["battle_action"].asBool();
+		if (getHost() && parallelTurnActive())
+		{
+			const int seat = obj.get("seat", -1).asInt();
+			const bool want = obj.get("ready", false).asBool();
+			const std::uint32_t sideSeq = static_cast<std::uint32_t>(obj.get("side_seq", 0).asUInt());
+			ensureEndTurnSeats();
+			if (sideSeq != _sideSeq)
+			{
+				// a toggle aimed at a side that has already closed
+				Log(LOG_INFO) << "coop: end_turn_ready from seat " << seat
+							  << " dropped (side_seq " << sideSeq << " != " << _sideSeq << ")";
+			}
+			else if (seat >= 0 && static_cast<size_t>(seat) < _endTurnReady.size())
+			{
+				_endTurnReady[static_cast<size_t>(seat)] = want;
+			}
+		}
+	}
 
-		_game->getSavedGame()->getSavedBattle()->setKneelReserved(battle_action);
+	// coop (PRD-P8): the executor's tally echo. A machine that is not the host
+	// adopts it wholesale - including its OWN bit, which confirms (or quietly
+	// undoes) the optimistic flip its button press made.
+	if (stateString == "end_turn_tally")
+	{
+		if (!getHost())
+		{
+			const std::uint32_t sideSeq = static_cast<std::uint32_t>(obj.get("side_seq", 0).asUInt());
+			// `end_turn_tally` is whitelisted and `endTurn` is not, so a tally can
+			// overtake the boundary packet that would have advanced _sideSeq here.
+			// Accepting >= (rather than ==) is what keeps the two orders equivalent;
+			// a tally from a side already closed is the only thing dropped.
+			if (sideSeq + 1 > _endTurnTallySideSeq)
+			{
+				ensureEndTurnSeats();
+				std::vector<bool> ready(_endTurnReady.size(), false);
+				std::vector<bool> autos(_endTurnAuto.size(), false);
+				const Json::Value& rs = obj["ready_seats"];
+				for (Json::ArrayIndex i = 0; i < rs.size(); ++i)
+				{
+					const int s = rs[i].asInt();
+					if (s >= 0 && static_cast<size_t>(s) < ready.size())
+						ready[static_cast<size_t>(s)] = true;
+				}
+				const Json::Value& as = obj["auto_seats"];
+				for (Json::ArrayIndex i = 0; i < as.size(); ++i)
+				{
+					const int s = as[i].asInt();
+					if (s >= 0 && static_cast<size_t>(s) < autos.size())
+						autos[static_cast<size_t>(s)] = true;
+				}
+				_endTurnReady = ready;
+				_endTurnAuto = autos;
+				_endTurnTallySideSeq = sideSeq;
+			}
+		}
 	}
 
 	if (stateString == "kneel")
@@ -6053,6 +8035,30 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		int id = obj["id"].asInt();
 		BattlescapeState* battlestate = _game->getSavedGame()->getSavedBattle()->getBattleState();
 		battlestate->toggeCoopKneel(id);
+		// coop (PRD-I3 SEAM-1): mirror the executor's post-action kneel instead of
+		// trusting the peer's own re-decide. toggeCoopKneel re-ran kneel(), whose
+		// reserve gate can refuse a kneel the executor performed (the peer's local
+		// reserve is not replicated in parallel mode), leaving the kneeler off by the
+		// kneel cost AND on the wrong kneeling bit. Force the shipped final tu/energy
+		// (the same P9 cost-replication helper as active_grenade / medkit) and the
+		// kneeling bit so the two copies agree. Presence-gated: an older sender omits
+		// them and the legacy re-decide above stands (bidirectional compat).
+		if (obj.isMember("tu"))
+		{
+			SavedBattleGame* battleForKneel = _game->getSavedGame()->getSavedBattle();
+			coopApplyActorCost(obj, id, battleForKneel);
+			if (obj.isMember("kneeled"))
+			{
+				for (auto* u : *battleForKneel->getUnits())
+				{
+					if (u->getId() == id)
+					{
+						u->kneel(obj["kneeled"].asBool());
+						break;
+					}
+				}
+			}
+		}
 	}
 
 	if (stateString == "BattleScapeMove")
@@ -6102,6 +8108,27 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 	}
 
+	// coop (PRD-P3 GAP-1): mid-battle spawns are host decisions. The peer re-runs
+	// the very same spawn code from the host's seed and manifest so it mints the
+	// same unit and item ids instead of rolling (and creating) its own.
+	if (stateString == "spawn_units")
+	{
+
+		if (_game->getSavedGame())
+		{
+			if (_game->getSavedGame()->getSavedBattle())
+			{
+				if (_game->getSavedGame()->getSavedBattle()->getBattleGame())
+				{
+
+					_game->getSavedGame()->getSavedBattle()->getBattleGame()->spawn_units(obj.toStyledString());
+
+				}
+			}
+		}
+
+	}
+
 	if (stateString == "melee_attack")
 	{
 
@@ -6244,12 +8271,26 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 					int type = obj["type"].asInt();
 					std::string hand = obj["hand"].asString();
 
-					bool fusetimer = obj["fusetimer"].asInt();
+					// coop: the fuse the item ACTUALLY ended on, and it is an int.
+					// Reading it into a bool clipped every fuse to 1 (and turned the
+					// -1 a failed prime / an unprime ships into 1, arming a grenade
+					// the executor never armed) before handing it to
+					// coopActiveGranade(..., int fusetimer, ...). Pre-existing in
+					// classic co-op; PRD-P6's re-broadcast made it clip a parallel
+					// client's intent-primed fuses too.
+					int fusetimer = obj["fusetimer"].asInt();
 
 					int item_id = obj["item_id"].asInt();
 
 					_game->getSavedGame()->getSavedBattle()->getBattleState()->coopActiveGranade(actor_id, type, hand, fusetimer, item_id);
 
+					// coop (PRD-P9 soak finding): charge the actor the way the executor
+					// did. Presence-gated, so an older peer's packet behaves exactly as
+					// before. Without it the two copies of the soldier drift apart by the
+					// action's cost on every use - this kind pushes no BattleState, so
+					// nothing else on the peer would ever charge it.
+					coopApplyActorCost(obj, actor_id, _game->getSavedGame()->getSavedBattle());
+
 				}
 			}
 		}
@@ -6271,7 +8312,14 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 					std::string hand = obj["hand"].asString();
 
 					bool fuse = obj["fuse"].asBool();
-					bool fusetimer = obj["fusetimer"].asInt();
+					// coop (PRD-P9 rider R1): the fuse is an INT and coopActionClick takes
+					// an int. Reading it into a bool clipped every fuse above 1 to 1 and
+					// turned the -1 an unprime ships into 1, arming a grenade the sender
+					// had just disarmed - the same defect PRD-P7 fixed on the
+					// `active_grenade` receive. This path is classic-only (a parallel
+					// client suppresses `action_click` outright), so it is a classic
+					// co-op fix rather than a parallel-mode one.
+					int fusetimer = obj["fusetimer"].asInt();
 
 					int target_x = obj["target_x"].asInt();
 					int target_y = obj["target_y"].asInt();
@@ -6335,7 +8383,23 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 					BattlescapeState* battlestate = _game->getSavedGame()->getSavedBattle()->getBattleState();
 
-					battlestate->coopHealing(actor_id, type, part, medkit_state, action_result, time);
+					// coop (PRD-P6): additive identification of the healer and the
+					// medikit that acted; absent from an older peer's packet, in
+					// which case the classic branch runs unchanged.
+					battlestate->coopHealing(actor_id, type, part, medkit_state, action_result, time,
+											 obj.get("healer_id", -1).asInt(),
+											 obj.get("weapon_id", -1).asInt(),
+											 obj.get("weapon_type", "").asString(),
+											 obj.get("hand", "").asString());
+
+					// coop (PRD-P9 soak finding): charge the actor the way the executor
+					// did. Presence-gated, so an older peer's packet behaves exactly as
+					// before. Without it the two copies of the soldier drift apart by the
+					// action's cost on every use - this kind pushes no BattleState, so
+					// nothing else on the peer would ever charge it.
+					// keyed on the HEALER, not `actor_id` (which is the patient here).
+					coopApplyActorCost(obj, obj.get("healer_id", -1).asInt(),
+									   _game->getSavedGame()->getSavedBattle());
 
 				}
 			}
@@ -6413,6 +8477,11 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 						auto* spawnType = _game->getSavedGame()->getSavedBattle()->getMod()->getUnit(spawnUnitType);
 						unit->setSpawnUnit(spawnType);
 
+						// coop (PRD-P4): park the built-in ids before the respawn
+						// runs; the guard inside convertUnit adopts them.
+						SharedEcon::storeSpawnManifest(_game->getSavedGame()->getSavedBattle(),
+													   "convert", unit_id, obj);
+
 						_game->getSavedGame()->getSavedBattle()->convertUnit(unit);
 
 						break;
@@ -6425,6 +8494,17 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 	if (stateString == "after_unit_death")
 	{
+		// coop (parallel battlescape Phase 2b - atomic unit death, DEFENSIVE): on the
+		// parallel client with the atomic path ON, the host never sends this legacy
+		// carrier - `unit_casualty` replaces it - so this should be unreachable there.
+		// Guard it anyway rather than silently double-applying if something upstream
+		// regresses. `g_atomicDeathDisable` (TEST-ONLY RED lever) stands this down: with
+		// the atomic path OFF the host falls back to sending the legacy trio, and the
+		// client must process it exactly as before to reproduce the pre-atomic straddle.
+		if (parallelTurnActive() && !getHost() && !g_atomicDeathDisable.load(std::memory_order_relaxed))
+		{
+			return;
+		}
 
 		if (_game->getSavedGame())
 		{
@@ -6432,6 +8512,59 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 			if (_game->getSavedGame()->getSavedBattle())
 			{
 
+				// coop (PRD-P4): the corpse id-manifest. This packet POST-dates the
+				// peer's own corpse creation - that was triggered by the earlier
+				// `unit_death`, and this one only reaches the handler once that replay
+				// has completed - so the manifest is applied by REMAPPING the corpses
+				// that already exist (path b, hole H3). Path (a), the guard around
+				// UnitDieBState's creation loop, is what would consume it if the two
+				// ever crossed the other way round; whichever fires first wins and the
+				// manifest is dropped, so the pair is idempotent.
+				SavedBattleGame* coopBattle = _game->getSavedGame()->getSavedBattle();
+				const int coopDeadUnitId = obj["unit_id"].asInt();
+				const bool coopParallelClient = parallelTurnActive() && !getHost();
+				// coop (item 3, mint-at-apply): park the host's minted corpse ids for this death.
+				// On the parallel replay client the mint below consumes them at CREATE; on a classic
+				// client the corpse already exists (animation clock) and remapCorpseIds re-stamps it.
+				const bool coopHaveCorpseManifest =
+					SharedEcon::storeSpawnManifest(coopBattle, "corpse", coopDeadUnitId, obj);
+				if (coopParallelClient)
+				{
+					// coop (item 3, mint-at-apply): the parallel replay client did NOT mint this
+					// death's corpse on its animation clock - UnitDieBState::convertUnitToCorpse is
+					// display-only there. Create it HERE, on the ordered bookkeeping clock, adopting
+					// the host's manifest ids at CREATE (the CoopSubjectGuard inside coopMintCorpse
+					// consumes the manifest parked just above), so the corpse exists with the host's
+					// exact ids by the time this chain's action_end sync-check hash samples. Runs
+					// while the victim still holds its tile (unit_death shipped isTile=true and the
+					// display-only convert left the link intact), so itemDropInventory still spills
+					// the kit to the floor. overKill is derived from the synced health exactly as
+					// UnitDieBState's ctor does, so this machine takes the host's corpse/no-corpse branch.
+					for (auto* coopVictim : *coopBattle->getUnits())
+					{
+						if (coopVictim->getId() == coopDeadUnitId)
+						{
+							coopBattle->getBattleGame()->coopMintCorpse(coopVictim, coopVictim->getOverKillDamage() != 0);
+							break;
+						}
+					}
+				}
+				else if (coopHaveCorpseManifest)
+				{
+					SharedEcon::remapCorpseIds(coopBattle, coopDeadUnitId);
+				}
+				// coop (PRD-I3 Session F window 2): the host ids for this death have now arrived
+				// (and on the parallel client the mint above adopted them at create), so any
+				// local-id corpse minted for it is reconciled - items/itemIdCtr may compare it again.
+				SharedEcon::clearCorpseRemapPending(coopDeadUnitId);
+
+				// coop (PRD-I3 SEAM-4): apply the host's post-casualty bystander morale
+				// on the parallel client only; absolute overwrite, idempotent.
+				if (coopParallelClient)
+				{
+					coopApplyBystanderMorale(coopBattle, obj);
+				}
+
 				for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
 				{
 
@@ -6460,6 +8593,7 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 						unit->setMotionPointsCoop(motionpoints);
 						unit->setTimeUnits(time);
+						coopDiagUnit("after_unit_death.tu@8557", unit->getId(), time);
 						unit->setHealth(health);
 						unit->setCoopMorale(morale);
 						unit->setCoopEnergy(energy);
@@ -6467,17 +8601,64 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 						unit->setStunlevelCoop(stunlevel);
 						
+						// coop (chain-atomicity, fatalWounds gap): apply the death carrier's fatal
+						// wounds so a reordered next_turn bulk snapshot that resurrected the dying
+						// unit's pre-hit wounds cannot leave the client's post-death wounds stale.
+						// Parallel client only (classic replays damage(), byte-identical); present-
+						// gated for old hosts that never shipped the field.
+						if (parallelTurnActive() && !getHost() && obj.isMember("fatalWounds"))
+						{
+							const Json::Value& deathFatalArray = obj["fatalWounds"];
+							for (int part = 0; part < BODYPART_MAX && part < deathFatalArray.size(); ++part)
+							{
+								unit->setFatalWoundCoop(part, deathFatalArray[part].asInt());
+							}
+						}
+						
 						int status_int = obj["status"].asInt();
 						UnitStatus unitStatus = intToUnitstatus(status_int);
 						unit->setCoopStatus(unitStatus);
 
+						// coop: the host's kill ATTRIBUTION (UnitDieBState::coopWriteKillAttribution).
+						// This machine derives killedBy/murdererId for itself only when it happens to
+						// run its own checkForCasualties over the same victim - which it does for a
+						// death caused by an action it is replaying, and NOT for one it never replays
+						// as a local attack chain (a reaction-fire kill during the alien side). There
+						// the alien kept the ctor default `_killedBy = its own faction` and
+						// DebriefingState scored it as no kill at all, so the two players saw
+						// different alien-kill counts and different mission scores.
+						//
+						// Additive: absent means an older peer, so keep whatever was derived locally.
+						// Never re-derived here - the executor decides who killed whom, always.
+						if (obj.isMember("killedBy"))
+						{
+							unit->killedBy((UnitFaction)obj["killedBy"].asInt());
+						}
+						if (obj.isMember("murdererId"))
+						{
+							unit->setMurdererId(obj["murdererId"].asInt());
+						}
+
 						// TILE
 						bool isTile = obj["isTile"].asBool();
 
-						if (!isTile)
+						// coop (PRD-P10): NOT while this machine's own death replay is
+						// still queued. See SharedEcon::corpseReplayPending - unlinking
+						// here is what made the executor drop a casualty's kit on the
+						// floor while the peer kept it on the body, and what made an
+						// ALIEN casualty lose its corpse and its drop entirely
+						// (UnitDieBState::init pops a tile-less non-PLAYER unit). The
+						// replay unlinks the tile itself, immediately after the drop.
+						if (!isTile && !SharedEcon::corpseReplayPending(unit->getId()))
 						{
 
-							if (unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+							// coop (parallel Phase 3, Sub-task B): in parallel the atomic
+							// unit_casualty already carried the explicit final status above
+							// (this handler is legacy-trio-only and never runs in parallel -
+							// see Sub-task A - but gate the INFERENCE anyway, defense in
+							// depth). The tile unlink itself stays ungated: classic still
+							// reads it.
+							if (!parallelTurnActive() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
 							{
 								unit->setCoopStatus(STATUS_DEAD);
 							}
@@ -6485,7 +8666,7 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 							unit->setTile(nullptr, _game->getSavedGame()->getSavedBattle());
 						}
 
-						if (!unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+						if (!parallelTurnActive() && !unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
 						{
 							unit->setCoopStatus(STATUS_DEAD);
 						}
@@ -6502,7 +8683,21 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 	if (stateString == "selfDestruct")
 	{
 
-		
+		// coop (PRD-P3 GAP-4b): the host rolled the BA_SELF_DESTRUCT chance before it
+		// sent this, so park the answer for the ExplosionBState damageCoop is about to
+		// push. Absent = older peer: fall back to this machine's own roll, as before.
+		if (obj.isMember("triggered"))
+		{
+			// coop (wire-order Increment 3 / A2): lever-on the parallel client parks into
+			// the display-side copy so next_turn's state-half clear cannot starve the
+			// still-queued ExplosionBState self-destruct replay. Lever-off / host: canonical.
+			if (g_wireOrderState.load(std::memory_order_relaxed)
+				&& parallelTurnActive() && !getHost())
+				_selfDestructResultsDisplay.push_back(obj["triggered"].asBool() ? 1 : 0);
+			else
+				_selfDestructResults.push_back(obj["triggered"].asBool() ? 1 : 0);
+		}
+
 		if (_game->getSavedGame())
 		{
 
@@ -6542,6 +8737,15 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		{
 			SavedBattleGame* sbg = _game->getSavedGame()->getSavedBattle();
 			const Json::Value& arr = obj["items"];
+			// coop (TRACE A DIAGNOSTIC, RCA lost-removal): log the explode_items ARRIVAL
+			// (this is a wire-order carrier, so reaching here means it was NOT dropped-in-RX
+			// for these ids), and per item the LOOKUP RESULT + whether an item of that TYPE
+			// exists at all on the client - discriminates arrived-but-lookup-missed
+			// (id-mismatch: type present, other ids) from item-absent (mint still pending /
+			// never existed). Capture-gated (g_diagCapture), production-inert.
+			if (g_diagCapture.load(std::memory_order_relaxed))
+				coopDiagS("EXPL_RX explode_items n=" + std::to_string(arr.size())
+					+ " clientItems=" + std::to_string(sbg->getItems()->size()));
 			for (Json::ArrayIndex i = 0; i < arr.size(); ++i)
 			{
 				int itemId = arr[i]["id"].asInt();
@@ -6555,6 +8759,22 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 						break;
 					}
 				}
+				if (g_diagCapture.load(std::memory_order_relaxed) && itemType == "STR_STUN_BOMB")
+				{
+					std::string idsOfType;
+					int typeCount = 0;
+					for (auto* bi : *sbg->getItems())
+						if (bi->getRules() && bi->getRules()->getType() == itemType)
+						{
+							++typeCount;
+							idsOfType += " id" + std::to_string(bi->getId())
+								+ "/cid" + std::to_string(bi->getCoopID());
+						}
+					coopDiagS("EXPL_RX.item id=" + std::to_string(itemId) + " t=" + itemType
+						+ " found=" + std::to_string(victim ? 1 : 0)
+						+ " typeCountOnClient=" + std::to_string(typeCount)
+						+ " present:[" + idsOfType + " ]");
+				}
 				if (victim)
 				{
 					sbg->removeItem(victim);
@@ -6581,13 +8801,10 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 					int center_z = obj["center_z"].asInt();
 
 					int power = obj["power"].asInt();
-					int damageType_int = obj["damageType"].asInt();
 					bool rangeAtack = obj["rangeAtack"].asBool();
 					int terrainMeleeTilePart = obj["terrainMeleeTilePart"].asInt();
 
 					uint64_t seed = obj["seed"].asUInt64();
-					int smokeRNG = obj["smokeRNG"].asInt();
-					_smokeRNGs.push_back(smokeRNG);
 
 					float ArmorEffectiveness = obj["ArmorEffectiveness"].asFloat();
 					bool FireBlastCalc = obj["FireBlastCalc"].asBool();
@@ -6665,16 +8882,40 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 					dmg->ToTile = ToTile;
 					dmg->ToWound = ToWound;
 
-					if (!_battleActions.empty())
+					// coop (PHASE D.2 / chain-atomicity): reconstruct the attack DIRECTLY
+					// from the packet's identity fields - no parked-attack FIFO, no
+					// attack_id match, no drop path. The host ships exactly the fields
+					// hitCoop consumes. `attacker` is load-bearing: voxelCheck excludes it
+					// from the raycast that picks which tile part the hit lands on, so a
+					// wrong/absent attacker could pick a different part and diverge the
+					// terrain outcome. The item pointers feed the reconstructed
+					// BattleActionAttack that hitCoop forwards to hitUnit (which early-returns
+					// on a coop client, so a null item is harmless); ids are looked up here,
+					// never fabricated (issue #74).
+					SavedBattleGame* sbg = _game->getSavedGame()->getSavedBattle();
+					BattleActionAttack oldest{};
+					oldest.type = (BattleActionType)obj.get("ba_type", 0).asInt();
+					int attackerId = obj.get("attacker_id", -1).asInt();
+					if (attackerId >= 0)
 					{
-						BattleActionAttack oldest = _battleActions.front();  
-				
-						_game->getSavedGame()->getSavedBattle()->getBattleGame()->hitCoop(oldest, Position(center_x, center_y, center_z), power, dmg, rangeAtack, terrainMeleeTilePart, seed);
-
-						_battleActions.erase(_battleActions.begin()); 
-				
+						for (auto* u : *sbg->getUnits())
+						{
+							if (u->getId() == attackerId) { oldest.attacker = u; break; }
+						}
+					}
+					int weaponItemId = obj.get("weapon_item_id", -1).asInt();
+					int damageItemId = obj.get("damage_item_id", -1).asInt();
+					if (weaponItemId >= 0 || damageItemId >= 0)
+					{
+						for (auto* bi : *sbg->getItems())
+						{
+							if (weaponItemId >= 0 && bi->getId() == weaponItemId) oldest.weapon_item = bi;
+							if (damageItemId >= 0 && bi->getId() == damageItemId) oldest.damage_item = bi;
+						}
 					}
 
+					sbg->getBattleGame()->hitCoop(oldest, Position(center_x, center_y, center_z), power, dmg, rangeAtack, terrainMeleeTilePart, seed);
+
 				}
 
 			}
@@ -6686,6 +8927,15 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 	// unit_death
 	if (stateString == "unit_death")
 	{
+		// coop (parallel battlescape Phase 2b - atomic unit death, DEFENSIVE): see the
+		// matching guard on `after_unit_death` above - unreachable on the parallel
+		// client with the atomic path ON (the host sends `unit_casualty` instead), and
+		// stood down under `g_atomicDeathDisable` (TEST-ONLY RED lever) so the legacy
+		// trio still applies when the host falls back to sending it.
+		if (parallelTurnActive() && !getHost() && !g_atomicDeathDisable.load(std::memory_order_relaxed))
+		{
+			return;
+		}
 
 		if (_game->getSavedGame())
 		{
@@ -6695,6 +8945,14 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 				_game->getSavedGame()->getSavedBattle()->abortPathCoop();
 
+				// coop (PRD-I3 SEAM-4): apply the host's post-casualty bystander morale
+				// on the parallel client only (a classic client replays checkForCasualties
+				// itself, so it stays byte-identical); absolute overwrite, idempotent.
+				if (parallelTurnActive() && !getHost())
+				{
+					coopApplyBystanderMorale(_game->getSavedGame()->getSavedBattle(), obj);
+				}
+
 				for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
 				{
 	
@@ -6724,12 +8982,27 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 							unit->setMotionPointsCoop(motionpoints);
 							unit->setTimeUnits(time);
+							coopDiagUnit("unit_death.tu@8920", unit->getId(), time);
 							unit->setHealth(health);
 							unit->setCoopMorale(morale);
 							unit->setCoopEnergy(energy);
 							unit->setCoopMana(mana);
 
 							unit->setStunlevelCoop(stunlevel);
+							
+							// coop (chain-atomicity, fatalWounds gap): apply the death carrier's fatal
+							// wounds so a reordered next_turn bulk snapshot that resurrected the dying
+							// unit's pre-hit wounds cannot leave the client's post-death wounds stale.
+							// Parallel client only (classic replays damage(), byte-identical); present-
+							// gated for old hosts that never shipped the field.
+							if (parallelTurnActive() && !getHost() && obj.isMember("fatalWounds"))
+							{
+								const Json::Value& deathFatalArray = obj["fatalWounds"];
+								for (int part = 0; part < BODYPART_MAX && part < deathFatalArray.size(); ++part)
+								{
+									unit->setFatalWoundCoop(part, deathFatalArray[part].asInt());
+								}
+							}
 
 							int pos_x = obj["pos_x"].asInt();
 							int pos_y = obj["pos_y"].asInt();
@@ -6745,19 +9018,49 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 							UnitStatus unitStatus = intToUnitstatus(status_int);
 							unit->setCoopStatus(unitStatus);
 
+							// coop: the host's kill ATTRIBUTION (UnitDieBState::coopWriteKillAttribution).
+							// This machine derives killedBy/murdererId for itself only when it happens to
+							// run its own checkForCasualties over the same victim - which it does for a
+							// death caused by an action it is replaying, and NOT for one it never replays
+							// as a local attack chain (a reaction-fire kill during the alien side). There
+							// the alien kept the ctor default `_killedBy = its own faction` and
+							// DebriefingState scored it as no kill at all, so the two players saw
+							// different alien-kill counts and different mission scores.
+							//
+							// Additive: absent means an older peer, so keep whatever was derived locally.
+							// Never re-derived here - the executor decides who killed whom, always.
+							if (obj.isMember("killedBy"))
+							{
+								unit->killedBy((UnitFaction)obj["killedBy"].asInt());
+							}
+							if (obj.isMember("murdererId"))
+							{
+								unit->setMurdererId(obj["murdererId"].asInt());
+							}
+
 							int damageType_int = obj["damageType"].asInt();
 							bool noSound = obj["noSound"].asBool();
 							const RuleDamageType* damageType = _game->getMod()->getDamageType(intToItemDamageType(damageType_int));
 
 							_game->getSavedGame()->getSavedBattle()->getBattleGame()->coopDeath(unit, damageType, noSound);
 
-							// TILE
-							bool isTile = obj["isTile"].asBool();
+							// TILE. coop (PRD-P9 soak finding): DEFAULT TRUE. `unit_death` did
+							// not carry the field at all, and Json::Value::asBool() on a
+							// missing key is false - so every death unlinked the peer's unit
+							// from its tile before the die state ran, and the inventory it
+							// should have dropped stayed on the corpse.
+							bool isTile = obj.get("isTile", true).asBool();
 
 							if (!isTile)
 							{
 
-								if (unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+								// coop (parallel Phase 3, Sub-task B): gate the tile-less
+								// DEAD-status inference - unneeded and could misfire in
+								// parallel now that unit_casualty carries the explicit final
+								// status (this whole handler is legacy-trio-only and never
+								// runs in parallel - see Sub-task A). Keep the tile unlink
+								// itself ungated: classic still reads it.
+								if (!parallelTurnActive() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
 								{
 									unit->setCoopStatus(STATUS_DEAD);
 								}
@@ -6765,7 +9068,7 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 								unit->setTile(nullptr, _game->getSavedGame()->getSavedBattle());
 							}
 
-							if (!unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+							if (!parallelTurnActive() && !unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
 							{
 								unit->setCoopStatus(STATUS_DEAD);
 							}
@@ -6782,28 +9085,161 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 	}
 
-	if (stateString == "set_smoke_tile")
+	// coop (parallel battlescape Phase 2b - atomic unit death): `unit_casualty`,
+	// the parallel HOST's single atomic carrier for a casualty - replaces the
+	// unit_death/after_unit_death pair (still sent under `atomic_death_disable`,
+	// see the legacy handlers' early-returns above). This handler does ONLY the
+	// unit lookup, the rank-2 state watermark, abortPathCoop, and the bystander-
+	// morale apply; the actual per-unit/world apply is
+	// BattlescapeGame::coopApplyCasualty (BattlescapeGame.cpp) - split so the
+	// watermark reject can bail out before any world mutation runs.
+	if (stateString == "unit_casualty")
 	{
+		BattleUnit* coopCasualtyUnit = nullptr;
+		if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+		{
+			const int coopCasualtyUnitId = obj.get("unit_id", -1).asInt();
+			for (auto* unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
+			{
+				if (unit->getId() == coopCasualtyUnitId)
+				{
+					coopCasualtyUnit = unit;
+					break;
+				}
+			}
+		}
 
-		if (_game->getSavedGame())
+		if (!coopCasualtyUnit)
 		{
+			Log(LOG_INFO) << "coop (Phase 2b unit_casualty): no local unit "
+						  << obj.get("unit_id", -1).asInt() << " - packet dropped";
+			return;
+		}
 
-			if (_game->getSavedGame()->getSavedBattle())
-			{
+		// coop (parallel battlescape Phase 1 - per-unit state watermark, rank 2):
+		// a stamp older than the unit's recorded watermark is dropped instead of
+		// clobbering a newer absolute. `coopStateAccept` both checks AND records,
+		// so a re-delivered exact duplicate (>=) is idempotently accepted.
+		bool stateStamped = false;
+		uint32_t stateSide = 0, stateSeq = 0;
+		coopReadStateStamp(obj, stateStamped, stateSide, stateSeq);
+		if (parallelTurnActive() && !getHost() && !g_deathWatermarkDisable.load(std::memory_order_relaxed)
+			&& stateStamped && !coopCasualtyUnit->coopStateAccept(stateSide, stateSeq, 2))
+		{
+			++g_casualtiesRejected;
+			return;
+		}
 
-				int tile_pos_x = obj["tile_pos_x"].asInt();
-				int tile_pos_y = obj["tile_pos_y"].asInt();
-				int tile_pos_z = obj["tile_pos_z"].asInt();
+		_game->getSavedGame()->getSavedBattle()->abortPathCoop();
 
-				int smoke = obj["smoke"].asInt();
-				int animation_offset = obj["animation_offset"].asInt();
-				int overlaps = obj["overlaps"].asInt();
+		// coop (PRD-I3 SEAM-4): see the unit_death/after_unit_death handlers above -
+		// same absolute overwrite, same idempotence, same parallel-client-only scope
+		// (the caller already established this handler only ever runs there).
+		coopApplyBystanderMorale(_game->getSavedGame()->getSavedBattle(), obj);
 
-				Tile* selected_tile = _game->getSavedGame()->getSavedBattle()->getTile(Position(tile_pos_x, tile_pos_y, tile_pos_z));
+		_game->getSavedGame()->getSavedBattle()->getBattleGame()->coopApplyCasualty(obj);
 
-				selected_tile->setSmokeCoop(smoke, animation_offset, overlaps);
-			}
-		}
+		// Make sure the Battlescape does not get stuck...
+		_hasHitUnit = -1;
+
+		++g_casualtiesApplied;
+	}
+
+	// coop (PRD-P10): the panic OUTCOME (UnitPanicBState, host-resolved).
+	//
+	// Everything a panic DOES already crossed on its own packet - the dropped
+	// hand weapons on `Inventory`, the flee walk on the walk packet, a
+	// berserker's shots on `ProjectileFlyBState`. What did not was the state
+	// UnitPanicBState itself writes when the panic ends: status back to
+	// STANDING, TU cleared, +15 morale. The peer had adopted the PANICKING
+	// status from `next_turn` (sent before the host resolves anything) and kept
+	// it, with a full turn's TU, for the rest of the battle.
+	//
+	// Deliberately NOT in the always-consume list above: it must stay behind
+	// the same receive gate as `next_turn` so the two cannot swap places (a
+	// rotated `next_turn` would otherwise re-stamp the pre-panic TU on top of
+	// this outcome).
+	if (stateString == "panic_action")
+	{
+		SavedBattleGame* panicBattle = _game && _game->getSavedGame()
+										   ? _game->getSavedGame()->getSavedBattle()
+										   : nullptr;
+		if (panicBattle)
+		{
+			const int panicUnitId = obj["unit_id"].asInt();
+			for (auto* unit : *panicBattle->getUnits())
+			{
+				if (unit->getId() != panicUnitId)
+				{
+					continue;
+				}
+
+				// coop (parallel battlescape Phase 1 - per-unit state watermark):
+				// panic_action is a rank-1 chain carrier (stamped via
+				// UnitPanicBState.cpp:178). A stamp older than the unit's recorded
+				// watermark is dropped instead of clobbering a newer absolute.
+				bool stateStamped = false;
+				uint32_t stateSide = 0, stateSeq = 0;
+				coopReadStateStamp(obj, stateStamped, stateSide, stateSeq);
+				if (!parallelTurnActive() || getHost() || !stateStamped
+					|| g_deathWatermarkDisable.load(std::memory_order_relaxed)
+					|| unit->coopStateAccept(stateSide, stateSeq, 1))
+				{
+					unit->setTimeUnits(obj["time"].asInt());
+					coopDiagUnit("panic_action.tu@9125", unit->getId(), obj["time"].asInt());
+					unit->setCoopEnergy(obj["energy"].asInt());
+					unit->setHealth(obj["health"].asInt());
+					unit->setCoopMorale(obj["morale"].asInt());
+					unit->setCoopMana(obj["mana"].asInt());
+					unit->setStunlevelCoop(obj["stunlevel"].asInt());
+					unit->setDirection(obj["setDirection"].asInt());
+					unit->setFaceDirection(obj["setFaceDirection"].asInt());
+
+					// Never RESURRECT: the same rule UnitDieBState's replay follows.
+					// A unit that died while panicking (a berserker walking into
+					// reaction fire) is already STATUS_DEAD here, and the host's
+					// outcome - captured before the death - must not undo that.
+					if (!unit->isOut())
+					{
+						unit->setCoopStatus(intToUnitstatus(obj["status"].asInt()));
+					}
+
+					Log(LOG_INFO) << "coop (PRD-P10): panic outcome applied to unit "
+								  << panicUnitId << " - tu " << unit->getTimeUnits()
+								  << ", morale " << unit->getMorale();
+				}
+				else
+				{
+					++g_stateWatermarkRejects;
+					++g_stateWatermarkRejectsRank1;
+				}
+				break;
+			}
+		}
+	}
+
+	if (stateString == "set_smoke_tile")
+	{
+
+		if (_game->getSavedGame())
+		{
+
+			if (_game->getSavedGame()->getSavedBattle())
+			{
+
+				int tile_pos_x = obj["tile_pos_x"].asInt();
+				int tile_pos_y = obj["tile_pos_y"].asInt();
+				int tile_pos_z = obj["tile_pos_z"].asInt();
+
+				int smoke = obj["smoke"].asInt();
+				int animation_offset = obj["animation_offset"].asInt();
+				int overlaps = obj["overlaps"].asInt();
+
+				Tile* selected_tile = _game->getSavedGame()->getSavedBattle()->getTile(Position(tile_pos_x, tile_pos_y, tile_pos_z));
+
+				selected_tile->setSmokeCoop(smoke, animation_offset, overlaps);
+			}
+		}
 	}
 
 	if (stateString == "set_fire_tile")
@@ -6857,10 +9293,120 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 				selected_tile->setExplosive(explosive, explosive_type, true);
 
+				// coop (explosion ordered-replay E1, LEAK-GRAV derive): the parallel client no
+				// longer runs explode()'s per-affected-tile applyGravity (TileEngine.cpp
+				// :3914-3917 - gated off by ExplosionBState::_coopReplayDisplay). Derive it
+				// here instead: contents settle only when the floor under them changed this
+				// blast, and the host ships a destroy_tile for exactly the tile(s) whose part
+				// it actually destroyed (Tile::destroy sends unconditionally on every
+				// successful destroy, any part - Tile.cpp:606-626), so applying gravity to
+				// this tile PLUS the tile above it, on every destroy_tile receipt, covers both
+				// of the host's own per-affected-tile applyGravity targets (the tile itself and
+				// its ceiling) whenever the relevant O_FLOOR destroy actually happened; when it
+				// did not, applyGravity is a no-op (TileEngine::applyGravity reads only the
+				// CURRENT hasNoFloor/haveNoFloorBelow state, so an extra or non-matching call
+				// changes nothing - verified against TileEngine.cpp:5641-5695). Parallel-client
+				// only + off when the replay lever forces the old sim (which runs its own
+				// gravity via the gated explode() call above). Classic co-op / PvP / host /
+				// single-player untouched.
+				if (parallelTurnActive() && !getHost()
+					&& !OpenXcom::g_explosionReplayDisable.load(std::memory_order_relaxed)
+					&& !OpenXcom::g_gravityDeriveDisable.load(std::memory_order_relaxed))
+				{
+					TileEngine* te = _game->getSavedGame()->getSavedBattle()->getTileEngine();
+					if (te)
+					{
+						te->applyGravity(selected_tile);
+						Tile* aboveT = _game->getSavedGame()->getSavedBattle()->getTile(
+							Position(tile_pos_x, tile_pos_y, tile_pos_z + 1));
+						if (aboveT) te->applyGravity(aboveT);
+					}
+				}
+
+			}
+
+		}
+
+	}
+
+	// set explosive tile (coop chain-atomicity item-2): host-shipped explosive-charge
+	// consumption. Mirrors the host's ExplosionBState zero so the parallel replay client
+	// stops deriving the charge from its own display loop. Stamped -> rides the ordered
+	// gate and the D.1 action_end apply barrier exactly like destroy_tile (an absent/seq-0
+	// action_seq = boundary explosion / classic / old peer = legacy always-consume).
+	if (stateString == "set_explosive_tile")
+	{
+		if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+		{
+			int tile_pos_x = obj["tile_pos_x"].asInt();
+			int tile_pos_y = obj["tile_pos_y"].asInt();
+			int tile_pos_z = obj["tile_pos_z"].asInt();
+
+			int explosive = obj["explosive"].asInt();
+			int explosive_type = obj["explosive_type"].asInt();
+
+			Tile *selected_tile = _game->getSavedGame()->getSavedBattle()->getTile(Position(tile_pos_x, tile_pos_y, tile_pos_z));
+
+			if (selected_tile)
+			{
+				selected_tile->setExplosive(explosive, explosive_type, true);
 			}
+		}
+	}
 
+	// coop (explosion ordered-replay E2): the parallel client replays the host's
+	// chain in the host's order. Ordered/stamped (coopIsChainOutcomePacket) so it
+	// applies in wire = host-scan order. E2 spawns the display-only chained
+	// ExplosionBState at apply (bookkeeping clock; rough timing OK - E3 moves the
+	// start to the display moment via the ghost queue). The chained state is itself
+	// display-only (_coopReplayDisplay true -> E1/E2 gates suppress its sim).
+	if (stateString == "chain_detonation")
+	{
+		if (parallelTurnActive() && !getHost()
+			&& _game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+		{
+			SavedBattleGame* sbg = _game->getSavedGame()->getSavedBattle();
+			int cx = obj["tile_pos_x"].asInt();
+			int cy = obj["tile_pos_y"].asInt();
+			int cz = obj["tile_pos_z"].asInt();
+			Tile* ct = sbg->getTile(Position(cx, cy, cz));
+			BattlescapeGame* cbg = sbg->getBattleGame();
+			if (ct && cbg)
+			{
+				Position cp = ct->getPosition().toVoxel();
+				cp += Position(8, 8, 0);
+				ExplosionBState* chained = new ExplosionBState(
+					cbg, cp, BattleActionAttack{ BA_NONE, nullptr }, ct, false, 0, 1);
+				cbg->statePushBack(chained);
+				++OpenXcom::g_chainDetonationsApplied;
+				chainDetonationListRecord(cx, cy, cz);
+			}
 		}
+	}
 
+	// coop (explosion ordered-replay E5a GAP-MODULE): the base-module decrement in
+	// detonate() (TileEngine.cpp) is host-only for coop (client early-return, classic
+	// idiom) with no carrier - DebriefingState scores base defense from getModuleMap(),
+	// so a parallel client's base-defense result silently drifts from the host's. Apply
+	// the host's decrement here. Not subject-keyed / not stamped (like destroy_tile /
+	// chain_detonation) - see coopIsChainOutcomePacket. Parallel-client-only; the
+	// hit-path decrements are already machine-symmetric and are NOT carriered.
+	if (stateString == "module_destroyed")
+	{
+		if (parallelTurnActive() && !getHost()
+			&& _game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+		{
+			SavedBattleGame* sbg = _game->getSavedGame()->getSavedBattle();
+			int gx = obj["gx"].asInt();
+			int gy = obj["gy"].asInt();
+			auto& moduleMap = sbg->getModuleMap();
+			if (gx >= 0 && gx < (int)moduleMap.size()
+				&& gy >= 0 && gy < (int)moduleMap[gx].size())
+			{
+				moduleMap[gx][gy].second--;
+				++OpenXcom::g_moduleDestroyedApplied;
+			}
+		}
 	}
 
 	if (stateString == "unit_fire")
@@ -6920,22 +9466,222 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 						const Json::Value& fatalArray = obj["fatalWounds"];
 
-						for (int part = 0; part < BODYPART_MAX && part < fatalArray.size(); ++part)
+						// coop (parallel battlescape Phase 1 - per-unit state watermark):
+						// hit_unit is a rank-1 chain carrier, stamped via coopStampChainSeq
+						// (TileEngine.cpp:3305) EXCEPT boundary/environmental hits
+						// (_openChainSeq==0 -> unstamped -> bypasses the watermark, same
+						// as classic co-op below).
+						bool stateStamped = false;
+						uint32_t stateSide = 0, stateSeq = 0;
+						coopReadStateStamp(obj, stateStamped, stateSide, stateSeq);
+						if (!parallelTurnActive() || getHost() || !stateStamped
+							|| g_deathWatermarkDisable.load(std::memory_order_relaxed)
+							|| unit->coopStateAccept(stateSide, stateSeq, 1))
 						{
-							unit->setFatalWoundCoop(part, fatalArray[part].asInt());
-						}
+							for (int part = 0; part < BODYPART_MAX && part < fatalArray.size(); ++part)
+							{
+								unit->setFatalWoundCoop(part, fatalArray[part].asInt());
+							}
 
-						unit->setHealth(health);
-						unit->setStunlevelCoop(stunlevel);
+							unit->setHealth(health);
+							unit->setStunlevelCoop(stunlevel);
+							// coop (PRD-I3): a parallel thin client does NOT replay the attack,
+							// so hit_unit is the ONLY carrier of the victim's post-damage combat
+							// stats. Apply the additive fields the executor now ships (morale/
+							// energy/mana/tu, all written by BattleUnit::damage()) so the
+							// per-action unitsStats hash matches AT the hit instead of only after
+							// next_turn's bulk repair. Parallel-scoped so classic replay (which
+							// runs its own damage()) stays byte-identical; present-gated for old
+							// peers.
+							if (parallelTurnActive() && !getHost())
+							{
+								if (obj.isMember("morale")) unit->setCoopMorale(obj["morale"].asInt());
+								if (obj.isMember("energy")) unit->setCoopEnergy(obj["energy"].asInt());
+								if (obj.isMember("mana")) unit->setCoopMana(obj["mana"].asInt());
+								if (obj.isMember("tu")) { unit->setTimeUnits(obj["tu"].asInt()); coopDiagUnit("hit_unit.tu@9438", unit->getId(), obj["tu"].asInt()); }
+								// coop (PRD-I3 saveBlob close): the victim's post-damage per-side armor
+								// (hit_unit is the sole carrier; classic replays damage() and never diverges).
+								if (obj.isMember("armor"))
+								{
+									const Json::Value& armorArr = obj["armor"];
+									for (int side = 0; side < SIDE_MAX && side < (int)armorArr.size(); ++side)
+									{
+										unit->setArmor(armorArr[side].asInt(), (UnitSide)side);
+									}
+								}
+								// coop (kill-credit fix): murdererId/killedBy can change on the
+								// host AFTER a unit is down (e.g. a later blast catches the downed
+								// body's tile, TileEngine.cpp:3281), but the thin client never runs
+								// damage() itself, so without this hit_unit is silent on it and the
+								// client's credit drifts from the host's. Watermark-accepted like
+								// the other per-unit fields above; parallel-client-only so host/
+								// classic (which already have the correct value locally) stay
+								// byte-identical. Present-gated for older peers.
+								if (obj.isMember("murdererId")) unit->setMurdererId(obj["murdererId"].asInt());
+								if (obj.isMember("killedBy")) unit->killedBy((UnitFaction)obj["killedBy"].asInt());
+							}
+						}
+						else
+						{
+							++g_stateWatermarkRejects;
+							++g_stateWatermarkRejectsRank1;
+						}
 						break;
 
 					}
 
 				}
 
+				// coop (E5a GAP-XP): the parallel thin client never replays
+				// awardExperience (TileEngine.cpp:3264 is dead behind hitUnit's own
+				// client early-return, :3222-3230), so a client-owned soldier's
+				// combat XP from a replayed shot/melee/psi hit is never trained -
+				// debrief shows no stat improvement. hit_unit already fires per-hit;
+				// the host additionally ships the ATTACKER's post-award absolute exp
+				// counters (TileEngine.cpp hit_unit send, after killedBy) so the
+				// client can apply them without re-running awardExperience itself.
+				// Present-gated (older peer / non-attack hits omit the fields);
+				// parallel-client-only so classic/PvP/host (which compute this
+				// locally) stay byte-identical.
+				if (parallelTurnActive() && !getHost()
+					&& obj.isMember("attacker_id") && obj.isMember("exp_firing"))
+				{
+					const int attackerId = obj["attacker_id"].asInt();
+					for (auto& atkUnit : *_game->getSavedGame()->getSavedBattle()->getUnits())
+					{
+						if (atkUnit->getId() != attackerId)
+						{
+							continue;
+						}
+
+						UnitStats expStats;
+						expStats.bravery = (Sint16)obj["exp_bravery"].asInt();
+						expStats.reactions = (Sint16)obj["exp_reactions"].asInt();
+						expStats.firing = (Sint16)obj["exp_firing"].asInt();
+						expStats.throwing = (Sint16)obj["exp_throwing"].asInt();
+						expStats.psiSkill = (Sint16)obj["exp_psi_skill"].asInt();
+						expStats.psiStrength = (Sint16)obj["exp_psi_strength"].asInt();
+						expStats.melee = (Sint16)obj["exp_melee"].asInt();
+						expStats.mana = (Sint16)obj["exp_mana"].asInt();
+						atkUnit->setExpStatsCoop(expStats);
+						break;
+					}
+				}
+
+			}
+		}
+
+	}
+
+	// coop (PRD-I3 z-gravity close): the host's UnitFallBState landed a unit whose
+	// floor a mid-side blast destroyed. The parallel thin client never runs the fall
+	// (UnitFallBState is _isActivePlayerSync-gated = host-only in
+	// BattlescapeGame::think), so its copy floats a level up until next_turn re-ships
+	// positions - a unitsCore z-divergence for the whole side (test_coop_outcome_gaps)
+	// and the saveBlob `floating` bit. Apply the host's landed tile as an ABSOLUTE
+	// position (position only, never-resurrect) and clear the floating bit the vanished
+	// floor set, mirroring keepWalking's end (setTile refreshes _haveNoFloorBelow but
+	// leaves _floating). Sent host-only in parallel so classic/old peers never see it;
+	// gated non-host and present-checked here for safety. Rides the ORDERED gate (not
+	// the always-consume whitelist) and is subject-keyed on the fallen unit, so it
+	// applies in FIFO after the spawn/blast that minted and dropped it.
+	if (stateString == "unit_fall")
+	{
+		SavedBattleGame* fallBattle = (getCoopStatic() && !_isActivePlayerSync && _game && _game->getSavedGame())
+									  ? _game->getSavedGame()->getSavedBattle() : nullptr;
+		if (fallBattle)
+		{
+			const int fallUnitId = obj["unit_id"].asInt();
+			const Position fallPos(obj["x"].asInt(), obj["y"].asInt(), obj["z"].asInt());
+			for (auto* unit : *fallBattle->getUnits())
+			{
+				if (unit->getId() != fallUnitId)
+				{
+					continue;
+				}
+				// coop (parallel battlescape Phase 1 - per-unit state watermark):
+				// unit_fall is not stamped yet (Phase 3 will flip it on) - wrapped
+				// now so that flip is additive. `stateStamped` is false today, so
+				// this always takes the accept branch (bypass), byte-identical.
+				bool stateStamped = false;
+				uint32_t stateSide = 0, stateSeq = 0;
+				coopReadStateStamp(obj, stateStamped, stateSide, stateSeq);
+				if (!parallelTurnActive() || getHost() || !stateStamped
+					|| g_deathWatermarkDisable.load(std::memory_order_relaxed)
+					|| unit->coopStateAccept(stateSide, stateSeq, 1))
+				{
+					// Never RESURRECT: unit_death owns a dead/knocked-out unit's state.
+					if (!unit->isOut() && unit->getPosition() != fallPos)
+					{
+						unit->setTile(fallBattle->getTile(fallPos), fallBattle);
+						unit->setPosition(fallPos);
+						if (unit->isFloating() && !unit->haveNoFloorBelow())
+						{
+							unit->setFloatingCoop(false);
+						}
+					}
+				}
+				else
+				{
+					++g_stateWatermarkRejects;
+					++g_stateWatermarkRejectsRank1;
+				}
+				break;
 			}
 		}
+	}
+
+	// coop (PRD-P3 GAP-9): the host's end-of-side fuse outcome. A client makes no
+	// BattleItem::fuseTimeEvent() rolls of its own, so this is the ONLY thing that
+	// detonates or removes a timed item there.
+	//
+	// Deviation from PROTOCOL's first sketch (which hung this off `next_turn`):
+	// next_turn only crosses at the START of the player's turn, so a fuse decided
+	// when the PLAYER side ended would not reach the peer until an entire alien
+	// side had run - a whole side of the peer holding items the host had destroyed.
+	// Its own state string is additive and silently ignored by an older peer.
+	if (stateString == "fuse_events")
+	{
+		if (_game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+		{
+			SavedBattleGame* sbg = _game->getSavedGame()->getSavedBattle();
+
+			// A failed roll re-arms or disables the fuse instead of detonating.
+			const Json::Value& fuses = obj["fuses"];
+			for (Json::ArrayIndex i = 0; i < fuses.size(); ++i)
+			{
+				int itemId = fuses[i]["id"].asInt();
+				for (auto* bi : *sbg->getItems())
+				{
+					if (bi->getId() == itemId)
+					{
+						bi->setFuseTimer(fuses[i]["timer"].asInt());
+						break;
+					}
+				}
+			}
 
+			// Exploded grenades and swept items alike: the blast CONSEQUENCES already
+			// reached this machine on the host's explosion packets (hit_unit,
+			// explode_items, set_fire_tile, destroy_tile) - what never crossed was the
+			// disappearance of the item itself.
+			for (const char* key : { "exploded", "removed" })
+			{
+				const Json::Value& arr = obj[key];
+				for (Json::ArrayIndex i = 0; i < arr.size(); ++i)
+				{
+					int itemId = arr[i].asInt();
+					for (auto* bi : *sbg->getItems())
+					{
+						if (bi->getId() == itemId)
+						{
+							sbg->removeItem(bi);
+							break;
+						}
+					}
+				}
+			}
+		}
 	}
 
 	if (stateString == "checkForProximityGrenades")
@@ -6952,18 +9698,51 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 					int unit_id = obj["unit_id"].asInt();
 
-					for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
+					// coop (PRD-P3 GAP-8): a sweep packet carrying `removed_items` is
+					// the HOST's removal list, not an invitation to re-scan. The peer
+					// used to decide for itself which non-grenade items a proximity
+					// fuse had swept away, off its own RNG::percent(specialChance)
+					// roll inside fuseProximityEvent().
+					if (obj.isMember("removed_items"))
 					{
-
-						if (unit->getId() == unit_id)
+						SavedBattleGame* sbg = _game->getSavedGame()->getSavedBattle();
+						const Json::Value& gone = obj["removed_items"];
+						for (Json::ArrayIndex i = 0; i < gone.size(); ++i)
+						{
+							int itemId = gone[i]["id"].asInt();
+							std::string itemType = gone[i]["type"].asString();
+							for (auto* bi : *sbg->getItems())
+							{
+								if (bi->getId() == itemId && bi->getRules()->getType() == itemType)
+								{
+									sbg->removeItem(bi);
+									break;
+								}
+							}
+						}
+					}
+					else
+					{
+						// coop (PRD-P4): a death trap the host had to CREATE names the
+						// id it minted. Park it before the replay runs - the peer's
+						// checkForProximityGrenadesCoop creates its own copy inside a
+						// guard, which is where the id is adopted.
+						SharedEcon::storeSpawnManifest(_game->getSavedGame()->getSavedBattle(),
+													   "death_trap", unit_id, obj);
+
+						for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
 						{
-		
-							_game->getSavedGame()->getSavedBattle()->getBattleGame()->checkForProximityCoop(unit);
 
-							break;
+							if (unit->getId() == unit_id)
+							{
 
-						}
+								_game->getSavedGame()->getSavedBattle()->getBattleGame()->checkForProximityCoop(unit);
+
+								break;
+
+							}
 
+						}
 					}
 
 
@@ -6980,6 +9759,22 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 		_hasHitUnit = -1;
 
+		// PRD-P3 GAP-4b: a parked melee/self-destruct outcome that was never consumed
+		// (its replay was skipped) must not poison the next turn's attack.
+		_meleeResults.clear();
+		_selfDestructResults.clear();
+		// coop (wire-order Increment 5 / A2): the parked-outcome DISPLAY copies' GAP-4b
+		// orphan-hygiene clear moved OUT of here to the boundary marker's display consumption
+		// (the action_end handler). Lever-on next_turn's state-half applies at RX arrival
+		// (it is now a wire-order carrier) while this side's melee/self-destruct display
+		// replays are still draining - clearing the copies here would starve a still-queued
+		// replay. Lever-off the copies are always empty, so the relocation is a no-op
+		// (byte-identical). The CANONICAL clear above stays (state-half, at arrival - the
+		// display reads the copies, not these vectors).
+		// PRD-P4: same hygiene for a Tier-A id-manifest whose replay never happened
+		// (the host minted corpses for a death this machine did not corpse-ify).
+		SharedEcon::clearSpawnManifests();
+
 		if (_game->getSavedGame())
 		{
 
@@ -6988,6 +9783,78 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 				bool end = obj["end"].asBool();
 
+				// PRD-P2 3b: the host stamped its three battle terms on this packet.
+				// Compare them against ours: a mismatch means the two battles have
+				// drifted apart. Detection only - logs, notifies once and raises the
+				// harness flag; it must NEVER restream the world mid-battle.
+				//
+				// BEFORE the bulk apply below, and that placement is the whole reason
+				// the unit term can see anything: `next_turn` REPAIRS unit position and
+				// status wholesale from the host's snapshot, so a compare made after it
+				// would find the two machines agreeing every single time - a detector
+				// silent by construction. The item terms do not care (nothing below
+				// touches an item), so all three move together.
+				// coop (PRD-I3 SEAM-10): converge each unit's ABSOLUTE faction from the
+				// host snapshot BEFORE the tripwire samples it. A mind-controlled unit
+				// reverts to its original faction at the host's NEUTRAL->PLAYER boundary
+				// (SavedBattleGame::endTurn -> prepareNewTurn), which the parallel client
+				// DEFERS to this packet - so its dead/expired MC victim keeps the player
+				// faction until now. verifyBattleChecksum below hashes faction in its
+				// battleUnits term and samples PRE-apply, and next_turn's bulk apply does
+				// not carry faction, so the revert has to land here or the detector fires
+				// on a divergence next_turn is about to repair (and the persistent unitsCore
+				// census drift would survive too). Host-authoritative absolute; PVE only
+				// (the PVP _coop_mindcontrolled path is an inverted per-machine flip);
+				// present-gated (absent = old host).
+				if (getCoopGamemode() != 2 && getCoopGamemode() != 3 && obj.isMember("units"))
+				{
+					for (Json::ArrayIndex ui = 0; ui < obj["units"].size(); ++ui)
+					{
+						if (!obj["units"][ui].isMember("faction")) continue;
+						int fid = obj["units"][ui]["unit_id"].asInt();
+						int nf = obj["units"][ui]["faction"].asInt();
+						if (nf < 0) continue;
+						for (auto& fu : *_game->getSavedGame()->getSavedBattle()->getUnits())
+						{
+							if (fu->getId() == fid)
+							{
+								if ((int)fu->getFaction() != nf)
+									fu->convertToFaction((UnitFaction)nf);
+								break;
+							}
+						}
+					}
+				}
+
+				// coop (PRD-I3 SEAM-11): every item's ammo absolute. The parallel client replayed
+				// shots for display and ran its own spendAmmoForAction (drifts on a diverging
+				// autoshot/abort count); a chain-close absolute is clobbered by the still-running
+				// replay's later spend, so next_turn ships it - applied AFTER every replay drained,
+				// mid-turn drift heals by the SIDESTART where saveBlob compares. PVE parallel only
+				// (classic replays authoritatively -> byte-identical); present-gated for old hosts.
+				if (parallelTurnActive() && !getHost() && obj.isMember("itemAmmo")
+					&& _game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+				{
+					SavedBattleGame* ammoBattle = _game->getSavedGame()->getSavedBattle();
+					for (Json::ArrayIndex ai = 0; ai < obj["itemAmmo"].size(); ++ai)
+					{
+						int aid = obj["itemAmmo"][ai]["id"].asInt();
+						int aqty = obj["itemAmmo"][ai]["qty"].asInt();
+						for (BattleItem* bi : *ammoBattle->getItems())
+						{
+							if (bi && bi->getId() == aid) { bi->setAmmoQuantity(aqty); break; }
+						}
+					}
+				}
+
+				// coop (explosion ordered-replay E0): host-authoritative objective counter. The client
+				// no longer self-counts (LEAK-OBJ gate), so converge to the host's absolute here.
+				// Parallel only (classic client already byte-identical apart from the gate); present-gated.
+				if (connectionTCP::parallelTurnActive() && obj.isMember("objectivesDestroyed"))
+					_game->getSavedGame()->getSavedBattle()->setObjectivesDestroyed(obj["objectivesDestroyed"].asInt());
+
+				SharedEcon::verifyBattleChecksum(_game, obj, "next_turn");
+
 				_game->getSavedGame()->getSavedBattle()->abortPathCoop();
 
 				// tiles
@@ -7029,184 +9896,126 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 					tile->setSmokeCoop(getSmoke, animation_offset, overlaps);
 				}
 
-				for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
+				// coop (parallel battlescape Phase 1 - per-unit state watermark): stash
+				// this applied snapshot for the TEST-ONLY synthetic replay lever
+				// (parallel_state {replay_last_next_turn:true}), then run the per-unit
+				// bulk-apply loop (factored into coopApplyNextTurnUnitStates so the live
+				// path and the replay lever share one copy - see connectionTCP.h). Units
+				// whose stamped write is rejected also skip their
+				// coopApplyDeferredTurnStart() further down (the later absolute that
+				// caused the reject already includes the turn-start regen).
+				g_lastNextTurnJson = obj;
+				std::unordered_set<int> stateWatermarkRejectedUnits = coopApplyNextTurnUnitStates(obj);
+
+				// coop (PRD-I3 Option D-lite): the parallel client's turn machine follows
+				// next_turn. The host stamps the authoritative turn/side on it (additive: an
+				// old host omits them and the client keeps its legacy inline advance). Authored
+				// AFTER the bulk apply above has settled every unit's faction/status, so the
+				// deterministic-increment pass sees the same PLAYER-faction / isOut view the
+				// host had at neutral->player (a soldier that fell during the alien side is out
+				// on both machines by then and skipped identically).
+				if (obj.isMember("turn") && obj.isMember("side")
+					&& connectionTCP::parallelTurnActive() && !getHost())
 				{
-
-					for (int i = 0; i < obj["units"].size(); i++)
+					_hostShipsNextTurnFields = true;
+					battle->setTurnCoop(obj["turn"].asInt());
+					battle->setSideCoop(obj["side"].asInt());
+					if (_turnAdvanceDeferred)
 					{
-
-						int json_id = obj["units"][i]["unit_id"].asInt();
-
-						// Check if the same unit
-						if (unit->getId() == json_id)
+						// run only the deterministic per-unit terms the deferred neutral->player
+						// advance would have run and next_turn does NOT re-ship (turnsSinceStunned,
+						// dontReselect, meleeAttackedBy); the re-shipped stats are already applied.
+						for (auto* bu : *battle->getUnits())
 						{
+							// exactly the units SavedBattleGame::endTurn prepareNewTurn's at
+							// neutral->player: PLAYER-faction, plus a hostile converted to neutral
+							// during the player turn (SavedBattleGame.cpp:1637). HOSTILE/NEUTRAL
+							// units already took their increment at the kept side 0 / side 1.
+							if (bu->getFaction() == FACTION_PLAYER
+								|| (bu->getFaction() == FACTION_NEUTRAL && bu->getOriginalFaction() == FACTION_HOSTILE))
+							{
+								// coop (parallel battlescape Phase 1 - per-unit state watermark):
+								// a unit whose stamped next_turn snapshot was rejected above
+								// already has a newer absolute in place - that absolute already
+								// includes the turn-start regen, so do not re-run it here.
+								if (stateWatermarkRejectedUnits.count(bu->getId()) == 0)
+								{
+									bu->coopApplyDeferredTurnStart();
+								}
+							}
+						}
+						_turnAdvanceDeferred = 0;
+					}
 
-							int time = obj["units"][i]["time"].asInt();
-							int health = obj["units"][i]["health"].asInt();
-							int energy = obj["units"][i]["energy"].asInt();
-							int morale = obj["units"][i]["morale"].asInt();
-							int mana = obj["units"][i]["mana"].asInt();
-							int stunlevel = obj["units"][i]["stunlevel"].asInt();
-
-							int motionpoints = obj["units"][i]["motionpoints"].asInt();
+					// coop (PRD-I3 SEAM-11): the host closes sliding (ufo) doors at every
+					// endTurn (BattlescapeGame::endTurn -> closeUfoDoors), but the parallel
+					// client DEFERS the neutral->player boundary, so a door a NEUTRAL unit
+					// (terror-site civilian) left open never closes here - the isUfoDoorOpen
+					// bit then diverges permanently in the saveBlob binTiles blob. Mirror the
+					// host: close them at the deferred apply (idempotent, keeps a door with a
+					// unit in it open on both). Before the sidestart hash, so it heals there.
+					if (battle->getTileEngine()) battle->getTileEngine()->closeUfoDoors();
+				}
 
-							int setDirection = obj["units"][i]["setDirection"].asInt();
-							int setFaceDirection = obj["units"][i]["setFaceDirection"].asInt();
+			}
+		}
 
-							int setTurretDirection = obj["units"][i]["setTurretDirection"].asInt();
-							int setTurretToDirection = obj["units"][i]["setTurretToDirection"].asInt();
+	}
 
-							bool respawn = obj["units"][i]["respawn"].asBool();
+	// coop: the PEER's battle drift tripwire fired and it has written a diagnostic
+	// bundle. Write ours too - one side of a disagreement proves nothing, and the
+	// pair is only comparable if both halves are captured at nearly the same
+	// instant. Symmetric on purpose (either machine can be the detector), and
+	// captureDesyncReport never re-sends when it was itself told, so there is no
+	// ping-pong. An older peer simply drops an unknown state string, which is the
+	// additive contract.
+	if (stateString == "desync_report")
+	{
+		SharedEcon::DesyncTerms report;
+		report.peerItemId = obj.get("peer_itemId", -1).asInt64();
+		report.peerCensus = obj.get("peer_census", -1).asInt64();
+		report.peerUnits = obj.get("peer_units", -1).asInt64();
+		SharedEcon::battleChecksumTerms(_game, report.localItemId, report.localCensus, report.localUnits);
+		report.context = obj.get("context", "next_turn").asString();
+		// PRD-I4: carry the detector's attribution so this peer's bundle is equally
+		// attributed (additive; an older detector simply omits it).
+		if (obj.isMember("attribution")) report.attribution = obj["attribution"];
+		report.viaPeerReport = true;
+		SharedEcon::captureDesyncReport(_game, report);
+	}
 
-							int fire = obj["units"][i]["fire"].asInt();
-							unit->setFireCoop(fire);
+	// ufo damage
+	if (stateString == "ufo_damage")
+	{
 
-							unit->setRespawn(respawn);
+		if (_game->getSavedGame() && playerInsideCoopBase == false)
+		{
 
-							unit->setDirection(setDirection);
-							unit->setFaceDirection(setFaceDirection);
+			int ufo_id = obj["ufo_id"].asInt();
+			int damage = obj["damage"].asInt();
 
-							unit->setDirectionTurretCoop(setTurretDirection);
-							unit->setTurretToDirectionCoop(setTurretToDirection);
+			int status_int = obj["status"].asInt();
+			Ufo::UfoStatus status = intToUfostatus(status_int);
+			std::string altitude = obj["altitude"].asString();
+			bool detected = obj["detected"].asBool();
 
-							unit->setMotionPointsCoop(motionpoints);
+			int wave = obj["wave"].asInt();
+			int crash_id = obj["crash_id"].asInt();
+			int land_id = obj["land_id"].asInt();
 
-							unit->setCoopEnergy(energy);
-							unit->setTimeUnits(time);
-							
-							unit->setHealth(health);
-							unit->setCoopMorale(morale);
-				
-							unit->setCoopMana(mana);
-							unit->setStunlevelCoop(stunlevel);
+			std::string craft_rule = obj["craft_rule"].asString();
+			int craft_id = obj["craft_id"].asInt();
 
-							const Json::Value& fatalArray = obj["units"][i]["fatalWounds"];
+			bool end = obj["end"].asBool();
+			bool survived = obj["survived"].asBool();
 
-							for (int part = 0; part < BODYPART_MAX && part < fatalArray.size(); ++part)
-							{
-								unit->setFatalWoundCoop(part, fatalArray[part].asInt());
-							}
+			bool minimized = obj["minimized"].asBool();
 
+			for (auto& i_ufo : *_game->getSavedGame()->getUfos())
+			{
 
-							int pos_x = obj["units"][i]["pos_x"].asInt();
-							int pos_y = obj["units"][i]["pos_y"].asInt();
-							int pos_z = obj["units"][i]["pos_z"].asInt();
-
-							// mind control (client)
-							if (unit->_coop_mindcontrolled == true)
-							{
-
-								unit->_coop_mindcontrolled = false;
-
-								if (unit->getCoop() == 0)
-								{
-		
-									unit->setCoop(1);
-
-									if (_game->getCoopMod()->getHost() == false)
-									{
-										unit->convertToFaction(FACTION_PLAYER);
-										unit->setOriginalFaction(FACTION_PLAYER);
-									}
-									else
-									{
-										unit->convertToFaction(FACTION_HOSTILE);
-										unit->setOriginalFaction(FACTION_HOSTILE);
-									}
-
-								}
-								else if (unit->getCoop() == 1)
-								{
-									
-									unit->setCoop(0);
-
-									if (_game->getCoopMod()->getHost() == true)
-									{
-										unit->convertToFaction(FACTION_PLAYER);
-										unit->setOriginalFaction(FACTION_PLAYER);
-									}
-									else
-									{
-										unit->convertToFaction(FACTION_HOSTILE);
-										unit->setOriginalFaction(FACTION_HOSTILE);
-									}
-
-								}
-							}
-
-							// Check if positions do not match
-							if (unit->getPosition().x != pos_x || unit->getPosition().y != pos_y || unit->getPosition().z != pos_z)
-							{
-
-								_game->getSavedGame()->getSavedBattle()->getBattleGame()->teleport(pos_x, pos_y, pos_z, unit);
-							}
-
-							int status_int = obj["units"][i]["status"].asInt();
-							UnitStatus unitStatus = intToUnitstatus(status_int);
-
-							unit->setCoopStatus(unitStatus);
-
-							// TILE
-							bool isTile = obj["units"][i]["isTile"].asBool();
-
-							if (!isTile)
-							{
-
-								if (unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
-								{
-									unit->setCoopStatus(STATUS_DEAD);
-								}
-
-								unit->setTile(nullptr, _game->getSavedGame()->getSavedBattle());
-							}
-
-							if (!unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
-							{
-								unit->setCoopStatus(STATUS_DEAD);
-							}
-
-							break;
-
-						}
-					}
-				}
-			}
-		}
-
-	}
-
-	// ufo damage
-	if (stateString == "ufo_damage")
-	{
-
-		if (_game->getSavedGame() && playerInsideCoopBase == false)
-		{
-
-			int ufo_id = obj["ufo_id"].asInt();
-			int damage = obj["damage"].asInt();
-
-			int status_int = obj["status"].asInt();
-			Ufo::UfoStatus status = intToUfostatus(status_int);
-			std::string altitude = obj["altitude"].asString();
-			bool detected = obj["detected"].asBool();
-
-			int wave = obj["wave"].asInt();
-			int crash_id = obj["crash_id"].asInt();
-			int land_id = obj["land_id"].asInt();
-
-			std::string craft_rule = obj["craft_rule"].asString();
-			int craft_id = obj["craft_id"].asInt();
-
-			bool end = obj["end"].asBool();
-			bool survived = obj["survived"].asBool();
-
-			bool minimized = obj["minimized"].asBool();
-
-			for (auto& i_ufo : *_game->getSavedGame()->getUfos())
-			{
-
-				if (i_ufo->_coop_ufo_id == ufo_id && i_ufo->_coop == false)
-				{
+				if (i_ufo->_coop_ufo_id == ufo_id && i_ufo->_coop == false)
+				{
 
 					// damage
 					if (damage > i_ufo->lastPlayerUfoDamage)
@@ -8396,6 +11205,17 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 			if (_game->getSavedGame()->getSavedBattle())
 			{
 
+				// coop (wire-order Increment 4 / A4): lever-on, this endTurn's
+				// required-at-arrival half (_scriptRngSeed + defer-arm) was applied at the
+				// marker's first sight (see the endTurn hook in updateCoopTask). Skip
+				// re-applying those two here; the rest of the handler runs at consumption as
+				// today. Cursor-matched so a marker the arrival hook did not cover still
+				// applies here; lever-off / host the flag is false (byte-identical).
+				const bool etArrivalApplied =
+					g_wireOrderState.load(std::memory_order_relaxed) && parallelTurnActive()
+					&& !getHost() && obj.isMember("side_seq")
+					&& static_cast<std::uint32_t>(obj["side_seq"].asUInt()) <= g_endTurnArrivalSideSeq;
+
 				pve2_init = true;
 
 				_battleInit = false;
@@ -8405,20 +11225,79 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 				_waitBC = false;
 				_waitBH = false;
 
-				int side = obj["side"].asInt();
-
-				_game->getSavedGame()->getSavedBattle()->setSideCoop(side);
+				// coop (PRD-P5 §5): side-boundary reseed. Only the parallel host
+				// stamps it (classic still ships the seed on `PlayerTurnYour`), so
+				// an absent key means "classic packet, do not touch the stream".
+				if (obj.isMember("seed"))
+				{
+					RNG::setSeed(obj["seed"].asUInt64());
+					// coop (GAP-10): adopt the boundary seed for the mod script-RNG
+					// seed-replay. Set from `endTurn` only (all three side closes),
+					// NOT from `next_turn` - the deferred neutral->player scripts must
+					// still see the side-2 `endTurn` seed when next_turn runs them.
+					// coop (wire-order Increment 4 / A4): _scriptRngSeed adoption moved to the
+					// endTurn marker's FIRST SIGHT lever-on (before next_turn's deferred scripts
+					// read it); skip here when the arrival hook covered this marker. RNG::setSeed
+					// above stays at consumption (category ii - re-set at the script pass via
+					// SavedBattleGame::newTurnUpdateScripts, not needed at arrival).
+					if (!etArrivalApplied)
+						_scriptRngSeed = obj["seed"].asUInt64();
+				}
 
-				if (side == 0)
+				// coop (PRD-P6): the side token every intent is validated against.
+				// The host owns it and stamps it on the one packet that crosses at
+				// every side transition; a client acting into a side that has
+				// already closed is denied `turn_over` instead.
+				if (obj.isMember("side_seq"))
 				{
+					_sideSeq = static_cast<std::uint32_t>(obj["side_seq"].asUInt());
+					clearClientPendingIntent();
+					// coop (PRD-P7): the host zeroed _actionSeq/peerDisplayAckedSeq
+					// on its side of this very packet (BattlescapeGame::endTurn).
+					// A client that kept its old display watermark would never
+					// report `action_done` against the new, lower sequence again and
+					// the executor's backlog term would wedge shut for good.
+					resetActionArbiter(false);
+				}
 
-					BattlescapeState* battlestate = _game->getSavedGame()->getSavedBattle()->getBattleState();
-					battlestate->endTurnCoop();
+				int side = obj["side"].asInt();
 
+				// coop (PRD-I3 Option D-lite): defer the NEUTRAL->PLAYER advance (its _turn++
+				// and player-side regen) on the parallel client so _turn/_side follow the gated
+				// next_turn instead of racing ahead of the display. PLAYER->HOSTILE (side 0)
+				// and HOSTILE->NEUTRAL (side 1) stay prompt: the host ships this packet AT its
+				// own transition, so consuming them cannot lead it, and side 0 is the ONE that
+				// pushes the ALIENS banner (endBattleTurnCoop never sets _endTurnRequested) and
+				// gives the hostile/neutral units their per-side increments before they can die
+				// mid-side. Only kept when the host authors turn/side on next_turn; an old host
+				// (no fields learned) keeps the legacy inline advance - bidirectional compat.
+				if (connectionTCP::parallelTurnActive() && !getHost()
+					&& _hostShipsNextTurnFields && side == 2)
+				{
+					// coop (wire-order Increment 4 / A4): the deferred neutral->player regen
+					// arm moved to the endTurn marker's FIRST SIGHT lever-on (before next_turn's
+					// state-half consumes it); skip the re-arm here when the arrival hook covered
+					// this marker. The else branch (side 0/1 setSideCoop + ALIENS banner) is
+					// display-half and always runs at consumption.
+					if (!etArrivalApplied)
+					{
+						_turnAdvanceDeferred = 1;
+						++_turnAdvanceDeferredCount; // coop (PRD-I3 rider): monotonic arm count
+					}
 				}
 				else
 				{
-					_game->getSavedGame()->getSavedBattle()->getBattleGame()->endBattleTurnCoop();
+					_game->getSavedGame()->getSavedBattle()->setSideCoop(side);
+
+					if (side == 0)
+					{
+						BattlescapeState* battlestate = _game->getSavedGame()->getSavedBattle()->getBattleState();
+						battlestate->endTurnCoop();
+					}
+					else
+					{
+						_game->getSavedGame()->getSavedBattle()->getBattleGame()->endBattleTurnCoop();
+					}
 				}
 
 			}
@@ -8529,17 +11408,24 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 				if (ret == 0 && _game->getSavedGame()->getSavedBattle()->getBattleGame())
 				{
 
+					// coop (PRD-I3 Option D-lite): keep the _coopEnd state transitions (the rx
+					// pump gates on _coopEnd), but on the parallel client do NOT let this AI-done
+					// heuristic flip _side to NEUTRAL/PLAYER ahead of the host - the side is
+					// tracked from the host-authored setSideCoop(side) above and from next_turn.
+					const bool dliteClient = connectionTCP::parallelTurnActive() && !getHost();
 					if (_coopEnd == 0)
 					{
 				
-						_game->getSavedGame()->getSavedBattle()->setSideCoop(2);
+						if (!dliteClient)
+							_game->getSavedGame()->getSavedBattle()->setSideCoop(2);
 						_coopEnd = 1;
 					
 					}
 					else if (_coopEnd == 1)
 					{
 
-						_game->getSavedGame()->getSavedBattle()->setSideCoop(0);
+						if (!dliteClient)
+							_game->getSavedGame()->getSavedBattle()->setSideCoop(0);
 						_coopEnd = 0;
 
 					}
@@ -8690,8 +11576,67 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 	{
 
 		int unit_id = obj["unit_id"].asInt();
-
-		if (_game->getSavedGame())
+		// coop (PRD-P3 GAP-2): "pvp" absent means an older peer, which only ever sent
+		// the PVP flavour - so the legacy inverted flip stays the default.
+		bool psiPvp = obj.get("pvp", true).asBool();
+
+		if (!psiPvp)
+		{
+			// PVE/PVE2: the host RESOLVED the attack (TileEngine::psiAttack
+			// early-returns false here) and ships the victim's post-state. Copy it;
+			// nothing is re-derived, because reduceByBravery / convertToFaction /
+			// recoverTimeUnits all read state only the host has changed.
+			if (obj.get("success", false).asBool()
+				&& _game->getSavedGame() && _game->getSavedGame()->getSavedBattle())
+			{
+				for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
+				{
+					if (unit->getId() != unit_id)
+					{
+						continue;
+					}
+					// coop (parallel battlescape Phase 1 - per-unit state watermark):
+					// this is the state-copy psi_result flavour, stamped via
+					// coopStampChainSeq (TileEngine.cpp:5334) - rank 1 chain carrier.
+					// The legacy PVP inverted-flip flavour (pvp:true, below) is never
+					// stamped and always bypasses.
+					bool stateStamped = false;
+					uint32_t stateSide = 0, stateSeq = 0;
+					coopReadStateStamp(obj, stateStamped, stateSide, stateSeq);
+					if (!parallelTurnActive() || getHost() || !stateStamped
+						|| g_deathWatermarkDisable.load(std::memory_order_relaxed)
+						|| unit->coopStateAccept(stateSide, stateSeq, 1))
+					{
+						int newFaction = obj.get("faction", -1).asInt();
+						if (newFaction >= 0 && (int)unit->getFaction() != newFaction)
+						{
+							unit->convertToFaction((UnitFaction)newFaction);
+							if (newFaction == (int)FACTION_NEUTRAL && unit->getAIModule())
+							{
+								unit->getAIModule()->setTargetFaction(FACTION_HOSTILE);
+							}
+							unit->allowReselect();
+							unit->abortTurn();
+						}
+						unit->setMindControllerId(obj.get("mindControllerId", 0).asInt());
+						unit->setCoopMorale(obj.get("morale", unit->getMorale()).asInt());
+						unit->setTimeUnits(obj.get("tu", unit->getTimeUnits()).asInt());
+						coopDiagUnit("psi_result.tu@11560", unit->getId(), obj.get("tu", unit->getTimeUnits()).asInt());
+						// coop: the host's recoverTimeUnits() restored ENERGY as well as TU.
+						// Additive - absent means an older peer, so leave energy alone.
+						unit->setCoopEnergy(obj.get("energy", unit->getEnergy()).asInt());
+						unit->setCoop(obj.get("coop", unit->getCoop()).asInt());
+					}
+					else
+					{
+						++g_stateWatermarkRejects;
+						++g_stateWatermarkRejectsRank1;
+					}
+					break;
+				}
+			}
+		}
+		else if (_game->getSavedGame())
 		{
 
 			if (_game->getSavedGame()->getSavedBattle())
@@ -8857,6 +11802,7 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 
 								unit->setMotionPointsCoop(motionpoints);
 								unit->setTimeUnits(time);
+								coopDiagUnit("PlayerTurnYour.tu@11749", unit->getId(), time);
 								unit->setHealth(health);
 								unit->setCoopMorale(morale);
 								unit->setCoopEnergy(energy);
@@ -9489,6 +12435,9 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		}
 
 		// past every gate: a real client is now attached to the session
+		// coop (#162): fresh session - a stale graceful-leave latch from a previous
+		// client must never suppress this one's crash notice.
+		_peerLeftCleanly = false;
 		connectionTCP::session.clientAttached();
 
 		// issue #93: a joiner arriving while a SKIRMISH battle is already running is
@@ -9620,6 +12569,12 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		connectionTCP::_enable_other_player_footsteps = Options::EnableOtherPlayerFootsteps;
 		root["enable_other_player_footsteps"] = connectionTCP::_enable_other_player_footsteps;
 
+		// parallel battlescape turns (PRD-P5). The HOST's option decides the mode
+		// for the whole session; a client's own setting is irrelevant. A peer that
+		// does not know the key reads false = classic (old-build degrade).
+		connectionTCP::_enable_parallel_turns = Options::EnableCoopParallelTurns;
+		root["enable_parallel_turns"] = connectionTCP::_enable_parallel_turns;
+
 		// enable host only time speed
 		connectionTCP::_enable_host_only_time_speed = Options::EnableHostOnlyTimeSpeed;
 		root["enable_host_only_time_speed"] = connectionTCP::_enable_host_only_time_speed;
@@ -9754,6 +12709,10 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		bool enable_other_player_footsteps = obj["enable_other_player_footsteps"].asBool();
 		connectionTCP::_enable_other_player_footsteps = enable_other_player_footsteps;
 
+		// parallel battlescape turns (PRD-P5). get(..., false): an older host does
+		// not send the key at all, and the missing key must mean classic mode.
+		connectionTCP::_enable_parallel_turns = obj.get("enable_parallel_turns", false).asBool();
+
 		// enable host only time speed
 		bool enable_host_only_time_speed = obj["enable_host_only_time_speed"].asBool();
 		connectionTCP::_enable_host_only_time_speed = enable_host_only_time_speed;
@@ -10660,200 +13619,1763 @@ void connectionTCP::onTCPMessage(std::string stateString, Json::Value obj)
 		sendFileBase = true;
 	}
 
-	if (stateString == "SEND_FILE_CLIENT_BASE" && onTcpHost == true)
+	if (stateString == "SEND_FILE_CLIENT_BASE" && onTcpHost == true)
+	{
+
+		sendBaseFile();
+
+		sendFileClient = true;
+		sendFileBase = true;
+	}
+
+	if (stateString == "MAP_RESULT_CLIENT_BASE" && onTcpHost == false)
+	{
+
+		writeHostMapFile2();
+
+		CoopState* coopWindow = new CoopState(55);
+		coopWindow->loadWorld();
+
+	}
+
+	if (stateString == "MAP_RESULT_HOST_BASE" && onTcpHost == true)
+	{
+
+		writeHostMapFile2();
+
+		CoopState* coopWindow = new CoopState(55);
+		coopWindow->loadWorld();
+
+	}
+}
+
+/**
+ * coop (parallel battlescape Phase 1 - per-unit state watermark): next_turn's
+ * per-unit bulk-apply loop. The stamp lives at the packet ROOT (not per-unit,
+ * unlike hit_unit/panic_action/psi_result) - read once and reused for every
+ * unit's tie-break. Factored out of onTCPMessage so the TEST-ONLY synthetic
+ * replay lever (coopDebugReplayLastNextTurn) can re-run exactly this loop
+ * against a stashed snapshot without re-running the rest of the handler
+ * (melee/manifest hygiene, the SEAM-10 faction pass, tiles, the checksum
+ * tripwire, or the turn/side advance). Caller must ensure
+ * _game->getSavedGame()->getSavedBattle() is non-null.
+ */
+std::unordered_set<int> connectionTCP::coopApplyNextTurnUnitStates(Json::Value& obj)
+{
+	// coop DIAGNOSTIC (reject-set audit): fresh capture for THIS boundary, armed only
+	// when SEAM-7 field capture is on (inert otherwise - no behavior change).
+	coopWmDbgClear();
+	coopWmDbgArm(SharedEcon::syncFieldCapture());
+	bool stateStamped = false;
+	uint32_t stateSide = 0, stateSeq = 0;
+	coopReadStateStamp(obj, stateStamped, stateSide, stateSeq);
+	std::unordered_set<int> stateWatermarkRejectedUnits;
+
+	for (auto& unit : *_game->getSavedGame()->getSavedBattle()->getUnits())
+	{
+
+		for (int i = 0; i < obj["units"].size(); i++)
+		{
+
+			int json_id = obj["units"][i]["unit_id"].asInt();
+
+			// Check if the same unit
+			if (unit->getId() == json_id)
+			{
+
+				// coop (parallel battlescape Phase 1 - per-unit state watermark):
+				// rank 0 (snapshot); stateStamped/stateSide/stateSeq are read once above.
+				//
+				// coop (Phase 3b, owner re-ruling 2026-08-26): a watermark EPOCH RESET
+				// here was tried and REVERTED - lever-on, decoupled same-side carriers
+				// apply at RX arrival BEFORE this gate-held snapshot, so the rank-0
+				// reject below is the watermark PROTECTING the later outcome from a
+				// late-applying next_turn (the rotated-next_turn hazard, see the
+				// panic_action comment near connectionTCP.cpp:8940). The 3b fix is to
+				// apply next_turn's STATE-half at RX arrival (wire position) instead,
+				// leaving this precedence logic untouched; the rank-0 rejects then
+				// vanish because the snapshot is no longer late. See docs repo
+				// parallel/boundary-residual-investigation-2026-08-26.md.
+				if (!parallelTurnActive() || getHost() || !stateStamped
+					|| g_deathWatermarkDisable.load(std::memory_order_relaxed)
+					|| unit->coopStateAccept(stateSide, stateSeq, 0))
+				{
+
+				int time = obj["units"][i]["time"].asInt();
+				int health = obj["units"][i]["health"].asInt();
+				int energy = obj["units"][i]["energy"].asInt();
+				int morale = obj["units"][i]["morale"].asInt();
+				int mana = obj["units"][i]["mana"].asInt();
+				int stunlevel = obj["units"][i]["stunlevel"].asInt();
+
+				int motionpoints = obj["units"][i]["motionpoints"].asInt();
+
+				int setDirection = obj["units"][i]["setDirection"].asInt();
+				int setFaceDirection = obj["units"][i]["setFaceDirection"].asInt();
+
+				int setTurretDirection = obj["units"][i]["setTurretDirection"].asInt();
+				int setTurretToDirection = obj["units"][i]["setTurretToDirection"].asInt();
+
+				bool respawn = obj["units"][i]["respawn"].asBool();
+
+				int fire = obj["units"][i]["fire"].asInt();
+				unit->setFireCoop(fire);
+
+				// coop (PRD-I3 Session F saveBlob close): the host's ABSOLUTE floating bit.
+				// PARALLEL client only - classic replays the fall itself; present-gated for
+				// old hosts. Real kneel-eligibility reader; a unit_fall coverage gap left it
+				// diverging on the parallel client at sidestart (saveBlob `floating`).
+				if (parallelTurnActive() && !getHost() && obj["units"][i].isMember("floating"))
+					unit->setFloatingCoop(obj["units"][i]["floating"].asBool());
+
+				unit->setRespawn(respawn);
+
+				unit->setDirection(setDirection);
+				unit->setFaceDirection(setFaceDirection);
+
+				unit->setDirectionTurretCoop(setTurretDirection);
+				unit->setTurretToDirectionCoop(setTurretToDirection);
+
+				unit->setMotionPointsCoop(motionpoints);
+
+				unit->setCoopEnergy(energy);
+				unit->setTimeUnits(time);
+				coopDiagUnit("nextturn.tu@13682", unit->getId(), time);
+
+				unit->setHealth(health);
+				unit->setCoopMorale(morale);
+
+				unit->setCoopMana(mana);
+				unit->setStunlevelCoop(stunlevel);
+
+				const Json::Value& fatalArray = obj["units"][i]["fatalWounds"];
+
+				for (int part = 0; part < BODYPART_MAX && part < fatalArray.size(); ++part)
+				{
+					unit->setFatalWoundCoop(part, fatalArray[part].asInt());
+				}
+
+
+				int pos_x = obj["units"][i]["pos_x"].asInt();
+				int pos_y = obj["units"][i]["pos_y"].asInt();
+				int pos_z = obj["units"][i]["pos_z"].asInt();
+
+				// mind control (client)
+				if (unit->_coop_mindcontrolled == true)
+				{
+
+					unit->_coop_mindcontrolled = false;
+
+					if (unit->getCoop() == 0)
+					{
+
+						unit->setCoop(1);
+
+						if (_game->getCoopMod()->getHost() == false)
+						{
+							unit->convertToFaction(FACTION_PLAYER);
+							unit->setOriginalFaction(FACTION_PLAYER);
+						}
+						else
+						{
+							unit->convertToFaction(FACTION_HOSTILE);
+							unit->setOriginalFaction(FACTION_HOSTILE);
+						}
+
+					}
+					else if (unit->getCoop() == 1)
+					{
+
+						unit->setCoop(0);
+
+						if (_game->getCoopMod()->getHost() == true)
+						{
+							unit->convertToFaction(FACTION_PLAYER);
+							unit->setOriginalFaction(FACTION_PLAYER);
+						}
+						else
+						{
+							unit->convertToFaction(FACTION_HOSTILE);
+							unit->setOriginalFaction(FACTION_HOSTILE);
+						}
+
+					}
+				}
+
+				// Check if positions do not match
+				if (unit->getPosition().x != pos_x || unit->getPosition().y != pos_y || unit->getPosition().z != pos_z)
+				{
+
+					_game->getSavedGame()->getSavedBattle()->getBattleGame()->teleport(pos_x, pos_y, pos_z, unit);
+				}
+
+				int status_int = obj["units"][i]["status"].asInt();
+				UnitStatus unitStatus = intToUnitstatus(status_int);
+
+				unit->setCoopStatus(unitStatus);
+
+				// TILE
+				bool isTile = obj["units"][i]["isTile"].asBool();
+
+				// coop (PRD-P10): the same exemption `after_unit_death` takes,
+				// for the same reason and at the harder moment. The last
+				// casualty of an alien side dies a frame or two before the
+				// side closes, so this per-turn stamp routinely arrives while
+				// the peer's UnitDieBState is still queued - and unlinking
+				// here cost that replay its itemDropInventory, leaving the
+				// dead soldier's whole kit on the body while it lay on the
+				// floor on the executor.
+				if (!isTile && !SharedEcon::corpseReplayPending(unit->getId()))
+				{
+
+					// coop (parallel Phase 3, Sub-task B): gate the tile-less DEAD-status
+					// inference - unneeded and could misfire in parallel now that
+					// unit_casualty already carried the explicit final status when the
+					// death applied. Keep the tile unlink itself ungated: classic still
+					// reads it.
+					if (!parallelTurnActive() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+					{
+						unit->setCoopStatus(STATUS_DEAD);
+					}
+
+					unit->setTile(nullptr, _game->getSavedGame()->getSavedBattle());
+				}
+
+				if (!parallelTurnActive() && !unit->getTile() && unit->getStatus() != STATUS_DEAD && unit->getStatus() != STATUS_UNCONSCIOUS)
+				{
+					unit->setCoopStatus(STATUS_DEAD);
+				}
+
+				}
+				else
+				{
+					++g_stateWatermarkRejects;
+					++g_stateWatermarkRejectsRank0;
+					stateWatermarkRejectedUnits.insert(unit->getId());
+					// coop (rank0 reject trace, owner ruling 2026-08-30): capture-gated persistent
+					// trace of THIS next_turn rank-0 watermark reject - the unit, the incoming next_turn
+					// stamp (side,seq,0) vs the recorded (beating) stamp (side,seq,rank), the battle turn
+					// (=> run phase: ambush turns 1-5 vs quiet turns 6+), and the rejected snapshot payload
+					// vs the value the watermark PROTECTED (the client's current value, set by the newer
+					// write). Lets a reject be classified STALE-benign (protected value newer/authoritative)
+					// vs FRESH-lost (a needed next_turn value dropped). Logged to BOTH the diag ring and
+					// openxcom.log (ring-eviction-proof) so heavy-diag runs still keep it. Inert unless
+					// diag_capture armed; NO state effect.
+					if (g_diagCapture.load(std::memory_order_relaxed))
+					{
+						SavedBattleGame* sbgWm = _game->getSavedGame() ? _game->getSavedGame()->getSavedBattle() : nullptr;
+						int turnWm = sbgWm ? sbgWm->getTurn() : -1;
+						std::string wm = "WMREJECT u=" + std::to_string(unit->getId())
+							+ " turn=" + std::to_string(turnWm)
+							+ " in=(" + std::to_string(stateSide) + "," + std::to_string(stateSeq) + ",0)"
+							+ " rec=(" + std::to_string(unit->_coopStateSideSeq) + "," + std::to_string(unit->_coopStateActionSeq)
+							+ "," + std::to_string((unsigned)unit->_coopStateRank) + ")"
+							+ " snapHP=" + std::to_string(obj["units"][i]["health"].asInt())
+							+ " curHP=" + std::to_string(unit->getHealth())
+							+ " snapTU=" + std::to_string(obj["units"][i]["time"].asInt())
+							+ " curTU=" + std::to_string(unit->getTimeUnits())
+							+ " snapStun=" + std::to_string(obj["units"][i]["stunlevel"].asInt())
+							+ " curStun=" + std::to_string(unit->getStunlevel())
+							+ " snapStatus=" + std::to_string(obj["units"][i]["status"].asInt())
+							+ " curStatus=" + std::to_string((int)unit->getStatus());
+						coopDiagS(wm);
+						Log(LOG_INFO) << "[COOP] " << wm;
+					}
+				}
+
+				break;
+
+			}
+		}
+	}
+
+	return stateWatermarkRejectedUnits;
+}
+
+/**
+ * coop (parallel battlescape Phase 1, TEST-ONLY SYNTHETIC RED lever): re-runs
+ * coopApplyNextTurnUnitStates on the last applied next_turn snapshot
+ * (g_lastNextTurnJson). Only reachable via the parallel_state TestServer
+ * command ({"replay_last_next_turn": true}); never fires in shipped mode. A
+ * no-op if no next_turn has applied yet (g_lastNextTurnJson still null) or the
+ * battle is gone.
+ */
+void connectionTCP::coopDebugReplayLastNextTurn()
+{
+	if (g_lastNextTurnJson.isNull())
+	{
+		return;
+	}
+	if (!(_game && _game->getSavedGame() && _game->getSavedGame()->getSavedBattle()))
+	{
+		return;
+	}
+	coopApplyNextTurnUnitStates(g_lastNextTurnJson);
+}
+
+void connectionTCP::sendBaseFile()
+{
+
+	// saving is not allowed if in battle and inside another player's base!
+	if (!_game->getSavedGame()->getSavedBattle() && _game->getCoopMod()->playerInsideCoopBase == false)
+	{
+		if (_game->getCoopMod()->coopMissionEnd == false)
+		{
+			_game->getSavedGame()->saveCoopToMemory("basehost", _game->getMod(), "basehost");
+		}
+	}
+
+}
+
+std::string connectionTCP::getPing()
+{
+	return current_ping;
+}
+
+bool connectionTCP::isCoopSession()
+{
+	return coopSession;
+}
+
+void connectionTCP::setCoopSession(bool session)
+{
+	coopSession = session;
+}
+
+void connectionTCP::setServerOwner(bool owner)
+{
+	session.setRole(owner ? CoopRole::Host : CoopRole::None);
+}
+
+void connectionTCP::setCoopCampaign(bool coop)
+{
+	_coopCampaign = coop;
+}
+
+bool connectionTCP::getCoopCampaign()
+{
+	return _coopCampaign;
+}
+
+// PRD-J01: true only when the active save is a SHARED co-op campaign.
+bool connectionTCP::isSharedCampaign()
+{
+	SavedGame* save = _game ? _game->getSavedGame() : nullptr;
+	return save && save->isCoopSave()
+		&& save->getCampaignType() == CoopCampaignType::Shared;
+}
+
+// Static mirror of isSharedCampaign() for engine-level callers that hold no CoopMod
+// instance (e.g. Craft capacity accounting). Reads the same authoritative save via the
+// static Game pointer.
+bool connectionTCP::isSharedCampaignStatic()
+{
+	SavedGame* save = _staticGame ? _staticGame->getSavedGame() : nullptr;
+	return save && save->isCoopSave()
+		&& save->getCampaignType() == CoopCampaignType::Shared;
+}
+
+// PRD-J02: a SHARED client holds a replica of the host's single authoritative
+// world. Host = seat 0 owns the world; every other seat is a replica.
+bool connectionTCP::isSharedReplica()
+{
+	return isSharedCampaign() && !getHost();
+}
+
+// PRD-J02: hand the host's authoritative world to the single-client streamer.
+// Serializes FRESH (not a stale stored blob) into a scratch key, then routes it
+// through the same resume-blob lane the client already knows how to adopt
+// (streamer sendProgressLoadBlob path -> MAP_RESULT_LOAD_PROGRESS ->
+// CoopState(555) -> LoadGameState). Reuses the existing file-transfer chunking;
+// no second chunk protocol. Host only; caller must ensure the streamer is idle.
+void connectionTCP::streamSharedWorldToClient()
+{
+	if (!getServerOwner() || !_game->getSavedGame())
+	{
+		return;
+	}
+
+	const std::string key = "shared_world";
+	connectionTCP::saveError = false;
+	_game->getSavedGame()->saveCoopToMemory(key, _game->getMod(), key);
+
+	std::string blob;
+	{
+		std::lock_guard<std::mutex> lock(coopFilesMutex);
+		auto it = coopFilesHost.find(key);
+		if (it != coopFilesHost.end())
+		{
+			blob = it->second;
+		}
+	}
+
+	if (blob.empty())
+	{
+		Log(LOG_ERROR) << "[coop-shared] streamSharedWorldToClient: no world blob"
+		               << " (saveError=" << connectionTCP::saveError << ")";
+		return;
+	}
+
+	// snapshot for the streamer thread (same fields request_load_progress sets)
+	sendProgressLoadBlob = blob;
+	sendProgressLoadFileToClient = key;
+	sendFileClient = true;
+
+	Log(LOG_INFO) << "[coop-shared] streaming authoritative world to client ("
+	              << blob.size() << " bytes)";
+}
+
+// PRD-J10: desync repair. A replica reported a world-checksum mismatch; hand it a
+// fresh authoritative world down the same J02 bootstrap lane. LoadGameState parks
+// EVERY client that adopts a streamed world in COOP_DLG_CLIENT_RESUME_HOLD until a
+// campaign_begun arrives, and mid-session there is no operator BEGIN click to send
+// one - the resume_ack handler covers that for us now (issue #91), for this
+// restream and every other, so there is nothing to arm here.
+void connectionTCP::sharedResyncStream()
+{
+	if (!getServerOwner() || !isSharedCampaign() || !_game->getSavedGame())
+	{
+		return;
+	}
+	if (sendFileClient)
+	{
+		// The streamer is single-slot and already busy (bootstrap/resume/post-battle
+		// transfer in flight). Drop this request rather than corrupt that transfer -
+		// the replica's next mismatching checksum re-asks once its guard expires.
+		Log(LOG_WARNING) << "[coop-shared] resync request dropped: streamer busy";
+		return;
+	}
+
+	streamSharedWorldToClient();
+	if (!sendFileClient)
+	{
+		Log(LOG_ERROR) << "[coop-shared] resync restream failed to serialize the world";
+	}
+}
+
+// PRD-J01: this machine's seat. Host is always 0; a client's seat is its
+// roster index, carried today by coop_save_owner_player_id (2-player: 1).
+//
+// Do not use getHost() here. onTcpHost describes the current transport/file-
+// transfer direction and is temporarily changed during save/world transfers.
+// Using it as player identity can make the sender look like the receiver, for
+// example causing a player to receive their own soldier-gift popup.
+//
+// getServerOwner() identifies the actual multiplayer host: the player who
+// created and owns the server. This is the stable value that should be used
+// when determining whether the local player occupies host seat 0.
+//
+// getHost() has a different meaning. It describes the temporary mission/save
+// transfer role and may change during synchronization. In my opinion,
+// getHost() should be renamed to isMissionGiver() to make this distinction
+// clear. getServerOwner() could also be renamed to isServerHost().
+//
+// A cleaner long-term solution would still be to assign a permanent
+// session.localSeatId when the roster locks and use that value directly.
+int connectionTCP::localSeat()
+{
+	if (getServerOwner())
+		return 0;
+	return coop_save_owner_player_id > 0 ? coop_save_owner_player_id : 1;
+}
+
+// coop (PRD-P6 pre-task): the receive gate's acquire/release. `completed` keeps
+// the pre-P6 bool call shape: false = "a chain started here" (acquire), true =
+// "that chain finished" (release). Depth 0 is the only state in which the hold
+// queue may hand a peer packet to onTCPMessage().
+//
+// Clamped at zero because releases outnumber acquires in practice: the two
+// teardown sites reset the depth outright, and a BState that was still holding
+// the gate when the battle ended releases afterwards.
+void connectionTCP::setCoopTaskCompleted(bool completed)
+{
+	if (completed)
+	{
+		if (_coopTaskDepth > 0)
+		{
+			--_coopTaskDepth;
+		}
+	}
+	else
+	{
+		++_coopTaskDepth;
+	}
+}
+
+// coop (PRD-P5): the parallel shared player side. See PROTOCOL.md "Core
+// invariant". PVP/PVP2 (gamemode 2/3) are adversarial by construction - the two
+// sides must not act at once - and hotseat has only one machine, so both are
+// excluded. Static so the battle-side guards (BattleUnit, the BStates) can ask
+// without a connectionTCP instance.
+bool connectionTCP::parallelTurnActive()
+{
+	if (!_enable_parallel_turns)
+		return false;
+	if (!getCoopStatic() || _isHotseatActive)
+		return false;
+	const int gamemode = getCoopGamemode();
+	return gamemode == 1 || gamemode == 4;
+}
+
+// coop: "am I the non-executor machine during a parallel player side?" PRD-P5
+// used this as a blanket input gate; PRD-P6 replaced that with action intents
+// and PRD-P8 replaced its last gate (END TURN) with the readiness toggle. What
+// is left are the two classic UI-mirror packets a client must not send, because
+// they are commands to the peer and `action_intent` is what replaced them
+// (PROTOCOL.md: `action_click` / `active_grenade`).
+bool connectionTCP::parallelInputBlocked()
+{
+	return parallelTurnActive() && !getHost();
+}
+
+// coop (PRD-P6): may the executor start a new action chain right now?
+// PROTOCOL.md "Ordering invariants" 3. Deliberately conservative: the peer
+// applies action packets one at a time behind the receive gate, so admitting a
+// second chain while the first is still running would interleave two chains on
+// the client's display. PRD-P7 adds the display-backlog term.
+bool connectionTCP::canAdmitAction()
+{
+	_admitBlocked.clear();
+	// static: reach the running game through the static mirror, not `_game`.
+	SavedGame* save = _staticGame ? _staticGame->getSavedGame() : nullptr;
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+	if (!bg)
+	{
+		_admitBlocked = "no_battle";
+		return false;
+	}
+	if (battle->getSide() != FACTION_PLAYER)
+	{
+		_admitBlocked = "ai_side";
+		return false;
+	}
+	if (_sideCommitInProgress)
+	{
+		_admitBlocked = "side_commit";
+		return false;
+	}
+	if (bg->isBusy())
+	{
+		_admitBlocked = "states";
+		return false;
+	}
+	connectionTCP* coop = _staticGame->getCoopMod();
+	if (coop && !coop->coopTaskCompleted())
+	{
+		_admitBlocked = "gate_depth";
+		return false;
+	}
+	// coop (PRD-P7): display flow control. The peer applies action packets one
+	// chain at a time, so running more than one chain ahead of what it has
+	// finished DISPLAYING just piles up lag it can never see through. Host-only:
+	// on a client `_actionSeq` is a mirror of what it has been told and
+	// peerDisplayAckedSeq is its own display watermark, so the subtraction would
+	// mean something different there. The `>` guard keeps the uint32 term safe if
+	// a stale `action_done` ever outruns the counter across a side boundary.
+	if (getHost() && _actionSeq > peerDisplayAckedSeq && (_actionSeq - peerDisplayAckedSeq) >= 2)
+	{
+		_admitBlocked = "display_backlog";
+		return false;
+	}
+	return true;
+}
+
+std::uint32_t connectionTCP::stampAdmittedAction(const std::string& kind)
+{
+	// coop (PRD-P7): the chain that is now running owes the client an `action_end`.
+	// If the previous chain never got its marker out (a stateless kind admitted and
+	// completed inside one frame), this overwrites it - the client's watermark then
+	// jumps straight to the newer seq, which is exactly as correct and self-heals.
+	_openChainSeq = ++_actionSeq;
+	// coop (PRD-I0): the label this chain's sync-check ring entry carries.
+	_openChainKind = kind;
+	// coop (PRD-I3 SEAM-7 ii): kneel/prime/medikit emit their replay packet from
+	// executeAction AFTER the actor settles; hold this chain's action_end until then
+	// (coopCloseActionChain), so the packet reaches the wire first (and stamped).
+	_openChainInstantPending = (kind == "kneel" || kind == "prime" || kind == "medikit");
+	// coop (PRD-P9 3): restart the stuck-chain clock with the chain itself.
+	_openChainTicks = SDL_GetTicks();
+	_openChainWarned = false;
+	// coop (wire-order Increment 7, SHAPE A): snapshot every unit's (tu, energy) at
+	// chain OPEN so coopCloseActionChain can diff and ship ONLY the units this chain
+	// changed as the action_end marker's `regen` array (the actor plus any in-chain
+	// reaction-firer, and actor-less expl chains, by construction). Lever-gated; the
+	// map stays empty lever-off so the marker is byte-identical. A stateless kind that
+	// overwrites an un-drained chain (see above) simply re-snapshots here - the lost
+	// chain's carry self-heals at next_turn exactly as it did pre-Increment-7.
+	if (g_wireOrderState.load(std::memory_order_relaxed) && _staticGame)
+	{
+		_openChainRegenSnap.clear();
+		SavedGame* sg = _staticGame->getSavedGame();
+		SavedBattleGame* sb = sg ? sg->getSavedBattle() : nullptr;
+		if (sb)
+		{
+			for (auto* u : *sb->getUnits())
+				_openChainRegenSnap[u->getId()] =
+					std::make_pair(u->getTimeUnits(), u->getEnergy());
+		}
+	}
+	return _actionSeq;
+}
+
+/**
+ * coop (PRD-I1): tag a whitelisted outcome packet with the chain and side it
+ * belongs to, so the client can hold it until that chain opens locally instead
+ * of letting it jump ahead of its own opener (which contaminates the client's
+ * post-N sync-check state - the exact false-mismatch class PRD-I1 removes).
+ *
+ * Stamps ONLY inside an admitted or AI chain on the parallel host: `_openChainSeq`
+ * is non-zero there and nowhere else (set by stampAdmittedAction, which only the
+ * parallel executor reaches, and cleared at the chain drain and every arbiter
+ * reset). So classic co-op, boundary explosions (chain closed, _openChainSeq == 0)
+ * and every non-parallel send carry no seq and keep the legacy always-consume
+ * behaviour on both machines - the field is additive and an older peer ignores it.
+ */
+void connectionTCP::coopStampChainSeq(Json::Value& root)
+{
+	if (_openChainSeq == 0)
+	{
+		return;
+	}
+	root["action_seq"] = static_cast<Json::UInt>(_openChainSeq);
+	root["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+}
+
+/**
+ * coop (PRD-I3 SEAM-3 a): give a host explosion that begins OUTSIDE any admitted
+ * chain its own seq. A shot/grenade whose triggering action already drained (queue
+ * momentarily empty -> coopCloseActionChain zeroed _openChainSeq), or a spontaneous
+ * detonation, runs its ExplosionBState with _openChainSeq == 0, so coopStampChainSeq
+ * ships its destroy_tile (and hit_tile / set_smoke_tile / ...) UNSTAMPED = seq-0
+ * legacy always-consume. A lagging client then applies that outcome immediately and
+ * can fold it into a neighbouring chain's post-N sync-check hash - the transient
+ * terrain mapDataID straddle at ai/boundary seqs (SEAM-3 a; heals by sidestart).
+ * Opening an admitted chain here makes those outcomes carry a seq, so the client
+ * defers them on the same I1 gate an in-chain destroy uses (Ordering invariant 6,
+ * apply-before-hash), and both machines hash the explosion at its own action_end.
+ * No-op unless the parallel host is between chains; the chain closes normally when
+ * the explosion and any terrain-chain consequence drain (coopCloseActionChain).
+ * The boundary phase is excluded by the caller (ExplosionBState::_coopBoundaryExpl):
+ * a boundary explosion's destroys are already applied before the endturn/sidestart
+ * marker's ordered hash, and a mid-phase action_end there would race the markers.
+ */
+void connectionTCP::coopStampLooseOutcomeChain(const char* kind)
+{
+	if (!parallelTurnActive() || !getHost() || _openChainSeq != 0)
+	{
+		return;
+	}
+	stampAdmittedAction(kind ? kind : "expl");
+}
+
+/**
+ * coop (PRD-I3 SEAM-2 HALF 2): open/close the boundary-decay scope around the ONE
+ * neutral->player SavedBattleGame::prepareNewTurn call (its sole caller). A host
+ * tile-hazard send made inside the scope is tagged `bnd:true`, which routes it
+ * onto the ordered receive gate instead of the always-consume whitelist.
+ */
+void connectionTCP::coopSetBoundaryDecay(bool active)
+{
+	_coopBoundaryDecay = active;
+}
+
+/**
+ * coop (PRD-I3 SEAM-2 HALF 2): stamp `bnd:true` on a host set_smoke_tile /
+ * set_fire_tile send that is part of the boundary-phase decay. Additive and
+ * presence-gated: absent = the mid-side / classic / old-host case, which keeps
+ * the whitelist behaviour on both machines.
+ */
+void connectionTCP::coopStampBoundaryOrigin(Json::Value& root)
+{
+	if (_coopBoundaryDecay)
+	{
+		root["bnd"] = true;
+	}
+}
+
+// coop (PRD-P6): `fullReset` = a new battle or a session teardown (everything,
+// including the side and request sequences). Otherwise a side boundary: the
+// action sequence and PRD-P7's display term, which MUST move together.
+void connectionTCP::resetActionArbiter(bool fullReset)
+{
+	_actionSeq = 0;
+	peerDisplayAckedSeq = 0;
+	// coop (PRD-P7): the two display-flow terms reset with _actionSeq, for exactly
+	// the reason peerDisplayAckedSeq does - a client left holding a watermark from
+	// the previous side would never report `action_done` against the new, lower
+	// sequence and the executor's backlog term would wedge shut.
+	_openChainSeq = 0;
+	_clientDisplaySeq = 0;
+	_clientDisplaySideSeq = 0;
+	_openChainKind.clear();
+	_openChainTicks = 0;
+	_openChainWarned = false;
+	_openChainInstantPending = false;
+	// coop (wire-order Increment 7, SHAPE A): the chain-open (tu,energy) snapshot is
+	// scoped to the open chain; drop it with the rest of the _openChain* state so a
+	// side boundary / battle reset never diffs against a stale baseline. Empty (no-op)
+	// lever-off and on the client, which never populates it.
+	_openChainRegenSnap.clear();
+	_pendingAdmits.clear();
+	_sideCommitInProgress = false;
+	_intentSlotReqId = 0;
+	_intentSlotSeat = -1;
+	_intentSlotKind.clear();
+	_admitBlocked.clear();
+	if (fullReset)
+	{
+		_sideSeq = 0;
+		_clientReqSeq = 0;
+		// coop (wire-order Increment 4 / A4): re-arm the endTurn arrival high-water mark per
+		// battle, so a new battle's low side_seqs are above the mark and their endTurn
+		// first-sight applies fire again (side_seq restarts near 0 each battle).
+		g_endTurnArrivalSideSeq = 0;
+		// coop (wire-order Increment 5): same for the boundary sample's bseq high-water mark.
+		g_clientApplyBoundarySeq = 0;
+		clearClientPendingIntent();
+		clearClientLastDeny();
+		// coop (PRD-I0): the boundary namespace and the sync-check ring are scoped
+		// to a BATTLE, not to a side - the ring's action entries are keyed on
+		// (side_seq, seq) so they survive a boundary safely, and the boundary seqs
+		// must stay monotonic across every side of the battle.
+		_boundarySeq = 0;
+		_pendingBoundaries.clear();
+		// coop (PRD-I3 Option D-lite): a deferred turn advance is battle-scoped; discard
+		// it (and re-learn the host's next_turn capability) on a full reset - battle init
+		// and CoopState teardown both land here, so a stale flag can never cross battles.
+		_turnAdvanceDeferred = 0;
+		_turnAdvanceDeferredCount = 0;
+		_hostShipsNextTurnFields = false;
+		SharedEcon::resetSyncCheck();
+	}
+	// coop (PRD-P8): readiness is scoped to a side exactly the way _actionSeq is,
+	// so it is reset from the same call - a seat carrying "I am done" across a
+	// boundary would close the next side the instant it opened.
+	resetEndTurnReady();
+}
+
+void connectionTCP::clearClientPendingIntent()
+{
+	_clientPendingReqId = 0;
+	_clientPendingKind.clear();
+	_clientPendingSentTicks = 0;
+}
+
+void connectionTCP::clearClientLastDeny()
+{
+	_clientLastDenyReason.clear();
+	_clientLastDenyWarning.clear();
+}
+
+// coop (PRD-P6): the client's send half. ONE pending slot - a second input
+// simply replaces it, and the ack/deny of the replaced intent is dropped on
+// arrival because its req_id no longer matches.
+bool connectionTCP::sendActionIntent(Json::Value intent, const std::string& kind)
+{
+	intent["state"] = "action_intent";
+	intent["req_id"] = static_cast<Json::UInt>(++_clientReqSeq);
+	intent["seat"] = localSeat();
+	intent["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+	intent["kind"] = kind;
+
+	_clientPendingReqId = _clientReqSeq;
+	_clientPendingKind = kind;
+	_clientPendingSentTicks = SDL_GetTicks();
+
+	sendTCPPacketData(intent.toStyledString());
+	return true;
+}
+
+// coop (PRD-P6): PROTOCOL.md "Timeouts" - no ack/deny inside 10 s means the
+// intent is gone. A transport failure is already PING/PONG's business, so all
+// this has to do is stop the one-slot pending from wedging shut.
+void connectionTCP::tickActionIntents()
+{
+	if (_clientPendingReqId == 0)
+	{
+		return;
+	}
+	const std::uint32_t now = SDL_GetTicks();
+	if (now - _clientPendingSentTicks < 10000)
+	{
+		return;
+	}
+	Log(LOG_INFO) << "coop: action_intent req " << _clientPendingReqId << " ("
+				  << _clientPendingKind << ") timed out with no ack/deny";
+	clearClientPendingIntent();
+	flashBattleWarning("STR_COOP_ACTION_TIMEOUT");
+}
+
+// coop (PRD-P6): the deny/timeout flash. BattlescapeState::warning() translates
+// the key and posts it with the widget's normal fade - PRD-P5 dropped the
+// persistent off-turn banners that used to squat on that same widget.
+void connectionTCP::flashBattleWarning(const std::string& key)
+{
+	if (_game && _game->getSavedGame() && _game->getSavedGame()->getSavedBattle()
+		&& _game->getSavedGame()->getSavedBattle()->getBattleState())
+	{
+		_game->getSavedGame()->getSavedBattle()->getBattleState()->warning(key);
+	}
+}
+
+// ---- coop (PRD-P7): pending-admit + display flow control --------------------
+
+// coop (PRD-P9 rider R4): how long the executor may sit on a DEFERRED input.
+// Deliberately inside the client's 10 s pending-intent watchdog
+// (tickActionIntents), so a slot that cannot be admitted in time comes back as
+// a real `action_deny` the player can read, instead of the client timing out
+// locally and the host running the action afterwards into an ack whose req_id
+// no longer matches anything.
+static const std::uint32_t COOP_PEND_TIMEOUT_MS = 8000;
+
+// coop (PRD-P9 3): a chain open this long is a bug, not a slow animation.
+static const std::uint32_t COOP_STUCK_CHAIN_MS = 120000;
+
+/// Refuses one deferred input. A remote seat gets the ordinary `action_deny`; the
+/// executor's own deferred click never travelled, so it just flashes locally.
+static void coopRefusePendingIntent(connectionTCP* coop,
+									const connectionTCP::CoopPendingIntent& slot,
+									const std::string& reason)
+{
+	if (!coop)
+	{
+		return;
+	}
+	const std::string warning = (reason == "turn_over") ? "STR_COOP_TURN_OVER"
+														: "STR_COOP_PLAYER_BUSY";
+	if (slot.local)
+	{
+		coop->flashBattleWarning(warning);
+		return;
+	}
+	Json::Value root;
+	root["state"] = "action_deny";
+	root["req_id"] = static_cast<Json::UInt>(slot.reqId);
+	root["reason"] = reason;
+	root["warning"] = warning;
+	root["side_seq"] = static_cast<Json::UInt>(connectionTCP::_sideSeq);
+	coop->sendTCPPacketData(root.toStyledString());
+}
+
+/**
+ * coop (PRD-P7): take an input the arbiter cannot admit YET, instead of refusing
+ * it outright.
+ *
+ * The only chain worth deferring behind is one that is pure locomotion: it has no
+ * outcome to wait for, so the arbiter can stop watching it (the fast-forward) and
+ * run the deferred input the moment the queue drains. Anything else - a shot in
+ * flight, an explosion, a side commit - keeps PRD-P6's `busy` refusal, because the
+ * world the player clicked against is about to change.
+ */
+bool connectionTCP::coopPendIntent(int seat, std::uint32_t reqId, const std::string& kind,
+								   const std::string& intentJson, bool localOrigin)
+{
+	_pendBlocked.clear();
+	if (!parallelTurnActive() || !getHost() || !_staticGame)
+	{
+		_pendBlocked = "not_executor";
+		return false;
+	}
+	SavedGame* save = _staticGame->getSavedGame();
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+	if (!bg || battle->getSide() != FACTION_PLAYER || _sideCommitInProgress)
+	{
+		_pendBlocked = "side";
+		return false;
+	}
+	if (!bg->chainIsSkippable())
+	{
+		// the two cases read very differently in a log: an EMPTY queue means the
+		// chain drained between the admission check and here (nothing to defer
+		// behind), a non-empty one means the chain is doing something that must be
+		// watched.
+		_pendBlocked = bg->isBusy() ? "not_skippable" : "chain_drained";
+		return false;
+	}
+
+	// One slot per seat, newest wins: the player changed their mind, so the older
+	// click is the one that is refused.
+	for (auto it = _pendingAdmits.begin(); it != _pendingAdmits.end(); ++it)
+	{
+		if (it->seat == seat)
+		{
+			CoopPendingIntent replaced = *it;
+			_pendingAdmits.erase(it);
+			coopRefusePendingIntent(_staticGame->getCoopMod(), replaced, "busy");
+			break;
+		}
+	}
+
+	CoopPendingIntent slot;
+	slot.reqId = reqId;
+	slot.seat = seat;
+	slot.kind = kind;
+	slot.json = intentJson;
+	slot.local = localOrigin;
+	// PRD-P9 rider R4: the expiry clock starts when the input is taken.
+	slot.deferTicks = SDL_GetTicks();
+	_pendingAdmits.push_back(slot);
+
+	bg->setCoopFastForward(true);
+	return true;
+}
+
+/**
+ * coop (PRD-P7): drop every deferred input.
+ *
+ * Called when a fast-forwarded chain stops being skippable - reaction fire is the
+ * case that matters. The player aimed their deferred click at a battlefield that
+ * has just been shot up, so re-clicking is the honest answer.
+ */
+void connectionTCP::coopDenyPendingIntents(const std::string& reason)
+{
+	if (_pendingAdmits.empty())
+	{
+		return;
+	}
+	std::vector<CoopPendingIntent> dropped;
+	dropped.swap(_pendingAdmits);
+	connectionTCP* coop = _staticGame ? _staticGame->getCoopMod() : nullptr;
+	for (const auto& slot : dropped)
+	{
+		coopRefusePendingIntent(coop, slot, reason);
+	}
+}
+
+/**
+ * coop (PRD-P7): admit ONE deferred input, from the main-thread tick.
+ *
+ * Not called from popState(): executing an action pushes states back onto the
+ * queue that the pop is still walking. One per tick is deliberate too - the
+ * admitted chain has to start before the next slot can be judged, and any slot
+ * left over keeps the fast-forward armed so the queue keeps compressing.
+ */
+void connectionTCP::coopAdmitPendingIntents()
+{
+	if (_pendingAdmits.empty() || !parallelTurnActive() || !getHost())
+	{
+		return;
+	}
+	SavedGame* save = _game ? _game->getSavedGame() : nullptr;
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+	if (!bg)
+	{
+		coopDenyPendingIntents("turn_over");
+		return;
+	}
+	if (battle->getSide() != FACTION_PLAYER || _sideCommitInProgress)
+	{
+		coopDenyPendingIntents("turn_over");
+		return;
+	}
+
+	// coop (PRD-P9 rider R4): expire before admitting. A deferred slot had no
+	// bound of its own - PRD-P7 relied on the chain in front draining - so a
+	// wedged chain (or a peer that stops reporting its display) could hold an
+	// input past the CLIENT's 10 s watchdog and then run it for a seat that had
+	// already given up on it. Refusing at 8 s keeps the answer inside the
+	// client's window, so the player is told rather than surprised.
+	{
+		const std::uint32_t nowTicks = SDL_GetTicks();
+		for (auto it = _pendingAdmits.begin(); it != _pendingAdmits.end(); )
+		{
+			if (it->deferTicks != 0 && nowTicks - it->deferTicks >= COOP_PEND_TIMEOUT_MS)
+			{
+				CoopPendingIntent expired = *it;
+				it = _pendingAdmits.erase(it);
+				Log(LOG_INFO) << "coop: deferred intent req " << expired.reqId
+							  << " (seat " << expired.seat << ", " << expired.kind
+							  << ") expired after " << COOP_PEND_TIMEOUT_MS
+							  << " ms without an admission; refusing it";
+				coopRefusePendingIntent(_game ? _game->getCoopMod() : nullptr,
+										expired, "busy");
+			}
+			else
+			{
+				++it;
+			}
+		}
+		if (_pendingAdmits.empty())
+		{
+			return;
+		}
+	}
+
+	if (!canAdmitAction())
+	{
+		return;
+	}
+
+	CoopPendingIntent slot = _pendingAdmits.front();
+	_pendingAdmits.erase(_pendingAdmits.begin());
+
+	// Re-validated at ADMIT time, not at defer time: TU, ownership and the actor's
+	// own health may all have moved while the chain in front was running.
+	std::string warning;
+	const std::string bad = bg->coopValidateIntent(slot.json, slot.seat, warning);
+	if (!bad.empty())
+	{
+		if (slot.local)
+		{
+			flashBattleWarning(warning.empty() ? "STR_COOP_ACTION_REFUSED" : warning);
+		}
+		else
+		{
+			Json::Value root;
+			root["state"] = "action_deny";
+			root["req_id"] = static_cast<Json::UInt>(slot.reqId);
+			root["reason"] = "invalid";
+			root["warning"] = warning;
+			root["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+			sendTCPPacketData(root.toStyledString());
+		}
+	}
+	else
+	{
+		_intentSlotReqId = slot.reqId;
+		_intentSlotSeat = slot.seat;
+		_intentSlotKind = slot.kind;
+
+		// coop (PRD-P8): same rule as an immediately-admitted intent - a seat
+		// whose deferred input has just started is not done with the side.
+		noteSeatActed(slot.seat);
+
+		const std::uint32_t seq = stampAdmittedAction(slot.kind);
+		if (!slot.local)
+		{
+			// PROTOCOL.md: the ack goes out at ADMIT time, which for a deferred
+			// intent is now rather than when it arrived.
+			Json::Value ack;
+			ack["state"] = "action_ack";
+			ack["req_id"] = static_cast<Json::UInt>(slot.reqId);
+			ack["action_seq"] = static_cast<Json::UInt>(seq);
+			sendTCPPacketData(ack.toStyledString());
+		}
+		bg->coopExecuteIntent(slot.json, slot.local);
+	}
+
+	// Somebody is still waiting: keep skipping past whatever just started.
+	if (!_pendingAdmits.empty() && bg->chainIsSkippable())
+	{
+		bg->setCoopFastForward(true);
+	}
+}
+
+/**
+ * coop (PRD-P7): "chain N has no more packets coming".
+ *
+ * PROTOCOL.md deviation, documented there: the frozen sketch stamped `action_seq`
+ * on every broadcast packet of the chain. A stamp can only say "chain N STARTED",
+ * and three admitted kinds (kneel, prime, medikit) push no BattleState and may
+ * ship a single packet or - a turn that turns nothing, a walk with no path - none
+ * at all. The client would then never learn that chain N existed, never report it
+ * displayed, and the backlog term would wedge the arbiter for the rest of the
+ * side. One marker at the drain point says exactly the thing the flow control
+ * needs, rides the ordinary receive gate (so the client consumes it only once its
+ * display of that chain has finished), and costs no per-packet work.
+ */
+void connectionTCP::coopNoteInstantExecuted()
+{
+	// coop (PRD-I3 SEAM-7 ii): executeAction has just emitted the instant kind's
+	// replay packet, so the action_end hold can lift (see coopCloseActionChain).
+	_openChainInstantPending = false;
+}
+
+void connectionTCP::coopCloseActionChain()
+{
+	if (_openChainSeq == 0 || !parallelTurnActive() || !getHost() || !_staticGame)
+	{
+		return;
+	}
+	connectionTCP* coop = _staticGame->getCoopMod();
+	if (!coop)
+	{
+		return;
+	}
+	SavedGame* save = _staticGame->getSavedGame();
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+	if (bg && bg->isBusy())
+	{
+		return; // the chain is still running
+	}
+	if (!coop->coopTaskCompleted())
+	{
+		return;
+	}
+	// coop (PRD-I3 SEAM-7 ii): an instant-kind chain whose replay packet is still
+	// owed - hold the marker so the packet reaches the wire first. executeAction
+	// clears this (coopNoteInstantExecuted) the instant it has sent the packet, so
+	// the hold lasts at most until the next tick and never strands the chain.
+	if (_openChainInstantPending)
+	{
+		return;
+	}
+	// coop (PRD-I0): the executor's hash point. This is the ONE place per admitted
+	// chain where the host is provably quiescent (isBusy false, receive gate at
+	// depth 0), so "the state after chain N" is well defined here and nowhere else.
+	// Recorded BEFORE the marker goes out, so the peer's answer can never arrive
+	// before the entry it will be matched against exists.
+	SharedEcon::syncCheckRecord(_staticGame, _openChainSeq, _sideSeq, false,
+								_openChainKind);
+
+	Json::Value root;
+	root["state"] = "action_end";
+	root["action_seq"] = static_cast<Json::UInt>(_openChainSeq);
+	// coop (PRD-I0): the side this seq belongs to, echoed back on `action_done`.
+	// The client CANNOT derive it: `endTurn` is on the interrupt whitelist while
+	// `action_end` deliberately is not, so the client's own `_sideSeq` routinely
+	// runs ahead of the markers still queued behind the receive gate. Measured
+	// without this: two of the alien side's last chains reported under the NEXT
+	// side's token, found no ring entry and were silently dropped as stale.
+	root["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+	// coop (wire-order Increment 7, SHAPE A): diff the chain-open (tu,energy) snapshot
+	// against the now-quiescent state (this is the ONE provably-quiescent point per
+	// chain, same guarantee the syncCheckRecord ring above relies on) and ship ONLY the
+	// units this chain changed as `regen`. The client applies these ABSOLUTES at the
+	// marker's first-sight, BEFORE it samples, so a slow client's still-draining tu/
+	// energy is corrected at wire position N rather than waiting on its own replay -
+	// which is exactly why the sidestart unitsRegen(tu) straddle heals a compare early
+	// (see docs parallel/boundary-residual-investigation-2026-08-26.md). Generalizes
+	// coopApplyActorCost (abortPath's PRD-P9 walk-end tu/energy carry) to every chain.
+	// Present-gated (absent = older peer / lever-off => byte-identical marker).
+	// DO-NOT-ADD morale: it is boundary-authored (endTurn death-morale cascade) and
+	// already covered by next_turn + hit_unit's bystander-morale carrier; a straddling
+	// pre-cascade morale absolute applied wire-after next_turn would MINT a new
+	// unitsRegen(morale) divergence. A future session must not add it here.
+	if (g_wireOrderState.load(std::memory_order_relaxed) && battle && !_openChainRegenSnap.empty())
+	{
+		Json::Value regen(Json::arrayValue);
+		for (auto* u : *battle->getUnits())
+		{
+			auto it = _openChainRegenSnap.find(u->getId());
+			if (it == _openChainRegenSnap.end())
+				continue; // spawned mid-chain: no baseline, leave it to next_turn's snapshot
+			const int tu = u->getTimeUnits();
+			const int en = u->getEnergy();
+			if (tu == it->second.first && en == it->second.second)
+				continue; // unchanged during this chain
+			Json::Value ru;
+			ru["unit_id"] = u->getId();
+			ru["tu"] = tu;
+			ru["energy"] = en;
+			regen.append(ru);
+		}
+		if (!regen.empty())
+		{
+			root["regen"] = regen;
+			g_regenEmitted.fetch_add(regen.size(), std::memory_order_relaxed);
+		}
+		_openChainRegenSnap.clear();
+	}
+	_openChainSeq = 0;
+	_openChainKind.clear();
+	_openChainTicks = 0;
+	_openChainWarned = false;
+	coop->sendTCPPacketData(root.toStyledString());
+}
+
+/**
+ * coop (PRD-I0): the boundary pseudo-seq marker.
+ *
+ * The side-close phase group (fuses, terrain explosions, SavedBattleGame::endTurn)
+ * and the side start (`next_turn` / prepareNewTurn) are the two places state moves
+ * WITHOUT any admitted chain to hang a hash on - they are also where several known
+ * seams live, so leaving them unhashed would mean every divergence introduced at a
+ * boundary got attributed to the first action of the next side.
+ *
+ * The marker rides `action_end` with `"boundary": true` rather than a new state
+ * string. That is not a saving, it is the mechanism: `action_end` is deliberately
+ * NOT on the interrupt whitelist, so the client consumes it only at receive-gate
+ * depth 0 - i.e. once every packet the host sent before it (the boundary's
+ * `fuse_events` / `next_turn`) has been APPLIED. Hash-after-apply on the client is
+ * what the boundary comparison needs, and it is the opposite of the legacy
+ * tripwire's compare-before-apply, which stays exactly as it is.
+ */
+void connectionTCP::coopArmSyncBoundary(const char* kind)
+{
+	if (!parallelTurnActive() || !getHost() || !kind)
+	{
+		return;
+	}
+	_pendingBoundaries.push_back(kind);
+}
+
+/**
+ * coop (PRD-I0): ship at most one armed boundary marker, once the executor is
+ * quiescent - the same two terms `coopCloseActionChain` waits on.
+ *
+ * Arming and sending are separate because the side-close phases run INSIDE
+ * BattlescapeGame::endTurn(), which can still have explosion or death chains
+ * queued behind it. Hashing there would compare the host mid-chain against a
+ * client that has applied those chains' packets. Waiting costs nothing: the host
+ * hashes at SEND time and the client hashes at CONSUME time, so both are the
+ * state "at this marker's position in the stream" whenever that turns out to be.
+ * The label ("endturn" / "sidestart") is a diagnostic, not part of the compare.
+ */
+void connectionTCP::coopFlushSyncBoundary()
+{
+	if (_pendingBoundaries.empty() || !parallelTurnActive() || !getHost() || !_staticGame)
+	{
+		return;
+	}
+	connectionTCP* coop = _staticGame->getCoopMod();
+	SavedGame* save = _staticGame->getSavedGame();
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	if (!coop || !battle)
+	{
+		// The battle ended under an armed marker: there is nothing to hash and
+		// nobody to answer, so drop the whole queue rather than carry it into the
+		// next battle.
+		_pendingBoundaries.clear();
+		return;
+	}
+	BattlescapeGame* bg = battle->getBattleGame();
+	if ((bg && bg->isBusy()) || !coop->coopTaskCompleted())
+	{
+		return;
+	}
+	const std::string kind = _pendingBoundaries.front();
+	_pendingBoundaries.erase(_pendingBoundaries.begin());
+	coopSendSyncBoundary(kind.c_str());
+}
+
+// coop (wire-order Increment 6): flush a pending SIDESTART boundary at the player-turn-start
+// point - called from BattlescapeGame::think() right before handlePanickingPlayer, where
+// _states is empty (the side-close explosion/death chains have drained) and the start-of-turn
+// panic/berserk has NOT yet run. Records the ring + emits the marker at the boundary STATE
+// (post-side-close, pre-panic), so the host ring equals next_turn's snapshot and the client's
+// wire-first-sight sample, and the panic carriers land AFTER the marker on both timelines. This
+// fixes the sidestart unitsRegen residual (host ring was previously recorded post-panic-drain
+// because coopFlushSyncBoundary's !isBusy wait overshoots next_turn into the start-of-turn
+// panic). Scoped to the sidestart kind; an endturn boundary at the front is left for the normal
+// deferred tick flush. Lever-off: no-op (the tick flush is unchanged, byte-identical).
+void connectionTCP::coopFlushSidestartBoundaryEarly()
+{
+	if (!g_wireOrderState.load(std::memory_order_relaxed))
+	{
+		return;
+	}
+	if (!parallelTurnActive() || !getHost())
+	{
+		return;
+	}
+	if (_pendingBoundaries.empty() || _pendingBoundaries.front() != "sidestart")
+	{
+		return;
+	}
+	// coopFlushSyncBoundary flushes the front (the sidestart here) after its own
+	// !isBusy && coopTaskCompleted() guard, which is satisfied at this quiescent point.
+	coopFlushSyncBoundary();
+}
+
+void connectionTCP::coopSendSyncBoundary(const char* kind)
+{
+	if (!parallelTurnActive() || !getHost() || !_staticGame)
+	{
+		return;
+	}
+	connectionTCP* coop = _staticGame->getCoopMod();
+	if (!coop)
+	{
+		return;
+	}
+	SavedGame* save = _staticGame->getSavedGame();
+	if (!save || !save->getSavedBattle())
+	{
+		return;
+	}
+	const std::uint32_t seq = ++_boundarySeq;
+	SharedEcon::syncCheckRecord(_staticGame, seq, 0, true, kind ? kind : "boundary");
+	// coop (three-class RCA DIAGNOSTIC, class 3): the HOST's authoritative alien core at
+	// the boundary ring-record point (pre-panic per Increment 6), to compare against the
+	// client's SAMPLE.core. Capture-gated, boundary-only (bounded).
+	if (g_diagCapture.load(std::memory_order_relaxed))
+		for (auto* hu : *save->getSavedBattle()->getUnits())
+			if (hu->getId() >= 1000000)
+			{
+				const Position hp = hu->getPosition();
+				coopDiagS("HOSTCORE bseq=" + std::to_string(seq) + " u=" + std::to_string(hu->getId())
+					+ " live=" + std::to_string((int)hu->getStatus())
+					+ " x=" + std::to_string(hp.x) + " y=" + std::to_string(hp.y)
+					+ " z=" + std::to_string(hp.z) + " tu=" + std::to_string(hu->getTimeUnits()));
+			}
+
+	Json::Value root;
+	root["state"] = "action_end";
+	// action_seq 0: the marker allocates nothing in the per-side action namespace,
+	// so PRD-P7's `_clientDisplaySeq` watermark and the display-backlog term are
+	// untouched by it (see connectionTCP::_boundarySeq for why that matters).
+	root["action_seq"] = 0;
+	root["boundary"] = true;
+	root["bseq"] = static_cast<Json::UInt>(seq);
+	root["kind"] = kind ? kind : "boundary";
+	coop->sendTCPPacketData(root.toStyledString());
+}
+
+/**
+ * coop (PRD-P9 3): the stuck-chain diagnostic.
+ *
+ * There is no distributed lock in this design, so there is nothing to break open
+ * when a chain stops draining - but a chain that has been "running" for two
+ * minutes is always a bug (a BattleState that never pops, a receive gate whose
+ * depth never returns to 0, a peer that stopped reporting `action_done`), and
+ * the arbiter state that says WHICH is gone by the time anyone looks. So this
+ * logs it exactly once per chain, with every term the admission check reads.
+ */
+void connectionTCP::coopCheckStuckChain()
+{
+	if (_openChainSeq == 0 || _openChainTicks == 0 || _openChainWarned)
+	{
+		return;
+	}
+	if (SDL_GetTicks() - _openChainTicks < COOP_STUCK_CHAIN_MS)
+	{
+		return;
+	}
+	_openChainWarned = true;
+
+	SavedGame* stuckSave = _staticGame ? _staticGame->getSavedGame() : nullptr;
+	SavedBattleGame* stuckBattle = stuckSave ? stuckSave->getSavedBattle() : nullptr;
+	BattlescapeGame* stuckBg = stuckBattle ? stuckBattle->getBattleGame() : nullptr;
+	connectionTCP* stuckCoop = _staticGame ? _staticGame->getCoopMod() : nullptr;
+	const std::uint32_t backlog =
+		_actionSeq > peerDisplayAckedSeq ? _actionSeq - peerDisplayAckedSeq : 0;
+	canAdmitAction();   // refreshes _admitBlocked for the line below
+	Log(LOG_WARNING) << "coop: action chain " << _openChainSeq
+					 << " has been open for over " << (COOP_STUCK_CHAIN_MS / 1000)
+					 << " s - seat " << _intentSlotSeat << " req " << _intentSlotReqId
+					 << " (" << _intentSlotKind << "); isBusy="
+					 << (stuckBg && stuckBg->isBusy() ? 1 : 0)
+					 << " gateDepth=" << (stuckCoop ? stuckCoop->coopTaskDepth() : -1)
+					 << " rxHold=" << rxHoldSize() << " rxPark=" << rxParkSize()
+					 << " displayBacklog=" << backlog
+					 << " pendingAdmits=" << _pendingAdmits.size()
+					 << " admitBlocked=" << (_admitBlocked.empty() ? "-" : _admitBlocked)
+					 << " sideCommit=" << (_sideCommitInProgress ? 1 : 0);
+}
+
+/**
+ * coop (PRD-P7): the client's single `action_done` emit point.
+ *
+ * `_clientDisplaySeq` is written only when the gated `action_end` marker is
+ * CONSUMED, and a gated consume by definition happens at receive-gate depth 0 -
+ * i.e. the moment the display of that chain finished. So there is exactly one
+ * place this can fire from, and it cannot fire early.
+ */
+void connectionTCP::coopEmitActionDone()
+{
+	if (!parallelTurnActive() || getHost())
 	{
-
-		sendBaseFile();
-
-		sendFileClient = true;
-		sendFileBase = true;
+		return;
 	}
-
-	if (stateString == "MAP_RESULT_CLIENT_BASE" && onTcpHost == false)
+	if (_clientDisplaySeq == 0 || _clientDisplaySeq <= peerDisplayAckedSeq)
 	{
-
-		writeHostMapFile2();
-
-		CoopState* coopWindow = new CoopState(55);
-		coopWindow->loadWorld();
-
+		return;
 	}
-
-	if (stateString == "MAP_RESULT_HOST_BASE" && onTcpHost == true)
+	// TEST-ONLY (TestServer `hold_action_done`), default off: park the report
+	// rather than ship it. peerDisplayAckedSeq stays put, so the release path
+	// re-enters here and emits the newest seq - which subsumes every parked one.
+	if (_testHoldActionDone)
 	{
-
-		writeHostMapFile2();
-
-		CoopState* coopWindow = new CoopState(55);
-		coopWindow->loadWorld();
-
+		++_heldActionDones;
+		return;
+	}
+	peerDisplayAckedSeq = _clientDisplaySeq;
+	Json::Value root;
+	root["state"] = "action_done";
+	root["seq"] = static_cast<Json::UInt>(peerDisplayAckedSeq);
+	root["seat"] = localSeat();
+	// coop (PRD-I0): the client's hash point, riding the report it was sending
+	// anyway. `side_seq` disambiguates the seq - `_actionSeq` restarts at 0 every
+	// side, so without it a report that crossed a boundary in flight would be
+	// compared against a brand-new chain carrying the same low number. It is the
+	// value the MARKER carried, never this machine's live `_sideSeq`.
+	root["side_seq"] = static_cast<Json::UInt>(_clientDisplaySideSeq);
+	// coop (wire-order report alignment, Phase 3): under the lever the per-action
+	// hash ships via sync_report (sampled at the marker's wire-order first sight);
+	// this action_done keeps its display-ack role only. Lever-off: attach as before.
+	if (!g_wireOrderState.load(std::memory_order_relaxed))
+	{
+		SharedEcon::syncCheckAttach(_game, root);
 	}
+	sendTCPPacketData(root.toStyledString());
 }
 
-void connectionTCP::sendBaseFile()
+/**
+ * coop (PRD-I0): answer a marker whose side has already closed here.
+ *
+ * Same message, deliberately none of the bookkeeping: `_clientDisplaySeq` and
+ * `peerDisplayAckedSeq` belong to the side that is running now, and a seq from
+ * the previous one is a larger number in a namespace that has restarted. Moving
+ * either of them with it is the wedge documented at the call site. The host
+ * likewise refuses to credit it (its `action_done` handler compares `side_seq`),
+ * so this exists purely so the sync-check ring entry gets its answer instead of
+ * ageing out as "the peer stopped reporting".
+ */
+void connectionTCP::coopEmitStaleActionDone(std::uint32_t seq, std::uint32_t sideSeq)
 {
-
-	// saving is not allowed if in battle and inside another player's base!
-	if (!_game->getSavedGame()->getSavedBattle() && _game->getCoopMod()->playerInsideCoopBase == false)
+	if (!parallelTurnActive() || getHost() || seq == 0)
 	{
-		if (_game->getCoopMod()->coopMissionEnd == false)
-		{
-			_game->getSavedGame()->saveCoopToMemory("basehost", _game->getMod(), "basehost");
-		}
+		return;
 	}
-
+	Json::Value root;
+	root["state"] = "action_done";
+	root["seq"] = static_cast<Json::UInt>(seq);
+	root["seat"] = localSeat();
+	root["side_seq"] = static_cast<Json::UInt>(sideSeq);
+	// coop (wire-order report alignment, Phase 3): under the lever this ring entry
+	// was already answered by sync_report at the marker's wire-order first sight;
+	// do not re-sample the hash here. Lever-off: attach as before.
+	if (!g_wireOrderState.load(std::memory_order_relaxed))
+	{
+		SharedEcon::syncCheckAttach(_game, root);
+	}
+	sendTCPPacketData(root.toStyledString());
 }
 
-std::string connectionTCP::getPing()
+/**
+ * coop (PRD-I0): the client's BOUNDARY hash point.
+ *
+ * Called from the `action_end` handler when the marker carries `boundary: true`.
+ * That handler runs at receive-gate depth 0, so everything the host sent before
+ * the marker has already been applied here - which is exactly the state the host
+ * hashed on its side of the boundary.
+ */
+void connectionTCP::coopEmitBoundaryDone(std::uint32_t bseq)
 {
-	return current_ping;
+	if (!parallelTurnActive() || getHost() || bseq == 0)
+	{
+		return;
+	}
+	// coop (Class-A soak wedge fix, A3 test lever): park only the BOUNDARY answer so
+	// the host's g_syncLastComparedBoundarySeq freezes while per-chain acks keep
+	// flowing - the peer-went-dark-on-boundaries condition the liveness tripwire
+	// detects, forced deterministically without stalling the host's commit.
+	if (_testHoldBoundaryDone)
+	{
+		return;
+	}
+	Json::Value root;
+	root["state"] = "action_done";
+	// No `seq`: the boundary namespace is separate and must not move PRD-P7's
+	// display watermark. The host's `action_done` handler reads seq 0 as a no-op.
+	root["seq"] = 0;
+	root["seat"] = localSeat();
+	root["boundary"] = true;
+	root["bseq"] = static_cast<Json::UInt>(bseq);
+	SharedEcon::syncCheckAttachBoundary(_game, root);
+	sendTCPPacketData(root.toStyledString());
 }
 
-bool connectionTCP::isCoopSession()
-{
-	return coopSession;
-}
+// ---- coop (PRD-P8): end-turn readiness gate ---------------------------------
 
-void connectionTCP::setCoopSession(bool session)
+void connectionTCP::ensureEndTurnSeats()
 {
-	coopSession = session;
+	const size_t want = static_cast<size_t>(std::max(1, seatCount()));
+	if (_endTurnReady.size() < want)
+	{
+		_endTurnReady.resize(want, false);
+	}
+	if (_endTurnAuto.size() < want)
+	{
+		_endTurnAuto.resize(want, false);
+	}
 }
 
-void connectionTCP::setServerOwner(bool owner)
+/**
+ * coop (PRD-P8): everything a side boundary must forget.
+ *
+ * Deliberately co-located with the arbiter reset (resetActionArbiter calls this)
+ * rather than owning its own reset site: readiness is scoped to a side exactly
+ * the way `_actionSeq` is, and the two drifting apart is what would let a seat
+ * carry a stale "I am done" across a boundary and close the NEXT side instantly.
+ */
+void connectionTCP::resetEndTurnReady()
 {
-	session.setRole(owner ? CoopRole::Host : CoopRole::None);
+	_endTurnReady.assign(_endTurnReady.size(), false);
+	_endTurnAuto.assign(_endTurnAuto.size(), false);
+	_endTurnTallySideSeq = _sideSeq;
+	_endTurnTallySent.clear();
+	_commitBlocked.clear();
 }
 
-void connectionTCP::setCoopCampaign(bool coop)
+bool connectionTCP::endTurnSeatReady(int seat)
 {
-	_coopCampaign = coop;
+	if (seat < 0)
+	{
+		return false;
+	}
+	const size_t i = static_cast<size_t>(seat);
+	return (i < _endTurnReady.size() && _endTurnReady[i])
+		|| (i < _endTurnAuto.size() && _endTurnAuto[i]);
 }
 
-bool connectionTCP::getCoopCampaign()
+int connectionTCP::endTurnReadyCount()
 {
-	return _coopCampaign;
+	int n = 0;
+	const int seats = std::max(1, seatCount());
+	for (int s = 0; s < seats; ++s)
+	{
+		if (endTurnSeatReady(s))
+		{
+			++n;
+		}
+	}
+	return n;
 }
 
-// PRD-J01: true only when the active save is a SHARED co-op campaign.
-bool connectionTCP::isSharedCampaign()
+bool connectionTCP::endTurnAllReady()
 {
-	SavedGame* save = _game ? _game->getSavedGame() : nullptr;
-	return save && save->isCoopSave()
-		&& save->getCampaignType() == CoopCampaignType::Shared;
+	const int seats = std::max(1, seatCount());
+	return endTurnReadyCount() >= seats;
 }
 
-// Static mirror of isSharedCampaign() for engine-level callers that hold no CoopMod
-// instance (e.g. Craft capacity accounting). Reads the same authoritative save via the
-// static Game pointer.
-bool connectionTCP::isSharedCampaignStatic()
+/**
+ * coop (PRD-P8): auto readiness is DERIVED, not remembered.
+ *
+ * PRD-P8 §1 names three events that have to move it - a unit dying, a
+ * mind-control `setCoop` flip, an in-battle gift - and hooking each one is three
+ * chances to miss a fourth (a unit going unconscious, a stun wearing off, a
+ * spawned reinforcement). Re-deriving the whole thing from the live roster on
+ * the executor's tick is cheaper than any of those hooks and cannot miss a site:
+ * a seat is auto-ready exactly while it commands no live FACTION_PLAYER unit, so
+ * gaining one clears it for free. Explicit readiness is a separate bit and is
+ * never touched here.
+ */
+void connectionTCP::recomputeEndTurnAuto()
 {
+	ensureEndTurnSeats();
 	SavedGame* save = _staticGame ? _staticGame->getSavedGame() : nullptr;
-	return save && save->isCoopSave()
-		&& save->getCampaignType() == CoopCampaignType::Shared;
-}
-
-// PRD-J02: a SHARED client holds a replica of the host's single authoritative
-// world. Host = seat 0 owns the world; every other seat is a replica.
-bool connectionTCP::isSharedReplica()
-{
-	return isSharedCampaign() && !getHost();
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	if (!battle)
+	{
+		return;
+	}
+	const int seats = std::max(1, seatCount());
+	std::vector<int> live(static_cast<size_t>(seats), 0);
+	for (auto* u : *battle->getUnits())
+	{
+		if (!u || u->getFaction() != FACTION_PLAYER || u->isOut())
+		{
+			continue;
+		}
+		const int seat = u->getCoop();
+		if (seat >= 0 && seat < seats)
+		{
+			++live[static_cast<size_t>(seat)];
+		}
+	}
+	for (int s = 0; s < seats; ++s)
+	{
+		_endTurnAuto[static_cast<size_t>(s)] = (live[static_cast<size_t>(s)] == 0);
+	}
 }
 
-// PRD-J02: hand the host's authoritative world to the single-client streamer.
-// Serializes FRESH (not a stale stored blob) into a scratch key, then routes it
-// through the same resume-blob lane the client already knows how to adopt
-// (streamer sendProgressLoadBlob path -> MAP_RESULT_LOAD_PROGRESS ->
-// CoopState(555) -> LoadGameState). Reuses the existing file-transfer chunking;
-// no second chunk protocol. Host only; caller must ensure the streamer is idle.
-void connectionTCP::streamSharedWorldToClient()
+/**
+ * coop (PRD-P8): the tally echo.
+ *
+ * PRD-P8 §1 asks for an echo "after EVERY change (incl. auto)". Sending it from
+ * the tick against a remembered signature is that, with one frame of latency and
+ * without a send call at every mutation site - the auto half in particular has no
+ * single site to hang one on (see recomputeEndTurnAuto).
+ */
+void connectionTCP::sendEndTurnTallyIfChanged()
 {
-	if (!getServerOwner() || !_game->getSavedGame())
+	if (!parallelTurnActive() || !getHost())
 	{
 		return;
 	}
+	ensureEndTurnSeats();
+	const int seats = std::max(1, seatCount());
 
-	const std::string key = "shared_world";
-	connectionTCP::saveError = false;
-	_game->getSavedGame()->saveCoopToMemory(key, _game->getMod(), key);
+	// A cheap character signature first: this runs on EVERY main-thread tick, and
+	// building a Json::Value + toStyledString() just to compare it would allocate
+	// per frame for a message that changes a handful of times per side.
+	std::string sig = std::to_string(_sideSeq) + ":" + std::to_string(seats) + ":";
+	for (int s = 0; s < seats; ++s)
+	{
+		sig += _endTurnReady[static_cast<size_t>(s)] ? 'R'
+			 : (_endTurnAuto[static_cast<size_t>(s)] ? 'A' : '.');
+	}
+	if (sig == _endTurnTallySent)
+	{
+		return;
+	}
+	_endTurnTallySent = sig;
+	_endTurnTallySideSeq = _sideSeq;
 
-	std::string blob;
+	Json::Value root;
+	root["state"] = "end_turn_tally";
+	root["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+	root["ready_seats"] = Json::Value(Json::arrayValue);
+	root["auto_seats"] = Json::Value(Json::arrayValue);
+	for (int s = 0; s < seats; ++s)
 	{
-		std::lock_guard<std::mutex> lock(coopFilesMutex);
-		auto it = coopFilesHost.find(key);
-		if (it != coopFilesHost.end())
+		if (_endTurnReady[static_cast<size_t>(s)])
 		{
-			blob = it->second;
+			root["ready_seats"].append(s);
+		}
+		if (_endTurnAuto[static_cast<size_t>(s)])
+		{
+			root["auto_seats"].append(s);
 		}
 	}
+	root["total"] = seats;
+	sendTCPPacketData(root.toStyledString());
+}
 
-	if (blob.empty())
+/**
+ * coop (PRD-P8): a seat that just had an action admitted did not mean "I am
+ * done". Only the EXPLICIT bit is cleared - auto readiness is derived from the
+ * roster and a seat with no units left cannot have had an action admitted.
+ */
+void connectionTCP::noteSeatActed(int seat)
+{
+	if (!parallelTurnActive() || !getHost() || seat < 0)
 	{
-		Log(LOG_ERROR) << "[coop-shared] streamSharedWorldToClient: no world blob"
-		               << " (saveError=" << connectionTCP::saveError << ")";
 		return;
 	}
-
-	// snapshot for the streamer thread (same fields request_load_progress sets)
-	sendProgressLoadBlob = blob;
-	sendProgressLoadFileToClient = key;
-	sendFileClient = true;
-
-	Log(LOG_INFO) << "[coop-shared] streaming authoritative world to client ("
-	              << blob.size() << " bytes)";
+	ensureEndTurnSeats();
+	const size_t i = static_cast<size_t>(seat);
+	if (i < _endTurnReady.size() && _endTurnReady[i])
+	{
+		_endTurnReady[i] = false;
+		// the tick's echo picks the change up; nothing else has to remember to.
+	}
 }
 
-// PRD-J10: desync repair. A replica reported a world-checksum mismatch; hand it a
-// fresh authoritative world down the same J02 bootstrap lane. LoadGameState parks
-// EVERY client that adopts a streamed world in COOP_DLG_CLIENT_RESUME_HOLD until a
-// campaign_begun arrives, and mid-session there is no operator BEGIN click to send
-// one - the resume_ack handler covers that for us now (issue #91), for this
-// restream and every other, so there is nothing to arm here.
-void connectionTCP::sharedResyncStream()
+/**
+ * coop (PRD-P8): the END TURN button during a parallel side.
+ *
+ * There is no side owner any more, so the press cannot close anything: it arms
+ * (or disarms) THIS machine's readiness. The host owns the tally outright, a
+ * client ships `end_turn_ready` and shows its own bit optimistically until the
+ * echo confirms it.
+ */
+void connectionTCP::toggleEndTurnReady()
 {
-	if (!getServerOwner() || !isSharedCampaign() || !_game->getSavedGame())
+	if (!parallelTurnActive())
 	{
 		return;
 	}
-	if (sendFileClient)
+	ensureEndTurnSeats();
+	const int seat = localSeat();
+	if (seat < 0 || static_cast<size_t>(seat) >= _endTurnReady.size())
 	{
-		// The streamer is single-slot and already busy (bootstrap/resume/post-battle
-		// transfer in flight). Drop this request rather than corrupt that transfer -
-		// the replica's next mismatching checksum re-asks once its guard expires.
-		Log(LOG_WARNING) << "[coop-shared] resync request dropped: streamer busy";
 		return;
 	}
+	const bool want = !_endTurnReady[static_cast<size_t>(seat)];
+	_endTurnReady[static_cast<size_t>(seat)] = want;
 
-	streamSharedWorldToClient();
-	if (!sendFileClient)
+	if (getHost())
 	{
-		Log(LOG_ERROR) << "[coop-shared] resync restream failed to serialize the world";
+		// the tick echoes the new tally; the commit is re-evaluated there too.
+		return;
 	}
+	Json::Value root;
+	root["state"] = "end_turn_ready";
+	root["seat"] = seat;
+	root["ready"] = want;
+	SavedGame* save = _game ? _game->getSavedGame() : nullptr;
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	root["turn"] = battle ? battle->getTurn() : 0;
+	root["side_seq"] = static_cast<Json::UInt>(_sideSeq);
+	sendTCPPacketData(root.toStyledString());
 }
 
-// PRD-J01: this machine's seat. Host is always 0; a client's seat is its
-// roster index, carried today by coop_save_owner_player_id (2-player: 1).
-//
-// Do not use getHost() here. onTcpHost describes the current transport/file-
-// transfer direction and is temporarily changed during save/world transfers.
-// Using it as player identity can make the sender look like the receiver, for
-// example causing a player to receive their own soldier-gift popup.
-//
-// getServerOwner() identifies the actual multiplayer host: the player who
-// created and owns the server. This is the stable value that should be used
-// when determining whether the local player occupies host seat 0.
-//
-// getHost() has a different meaning. It describes the temporary mission/save
-// transfer role and may change during synchronization. In my opinion,
-// getHost() should be renamed to isMissionGiver() to make this distinction
-// clear. getServerOwner() could also be renamed to isServerHost().
-//
-// A cleaner long-term solution would still be to assign a permanent
-// session.localSeatId when the roster locks and use that value directly.
-int connectionTCP::localSeat()
+/**
+ * coop (PRD-P8): the side commit.
+ *
+ * Four terms, in the order PROTOCOL.md "Ordering invariants" 4 lists them: every
+ * seat ready, the arbiter idle (no chain, receive gate open, no commit already
+ * running), and the peer's DISPLAY drained - the last one is why this lives on
+ * the tick rather than inside the toggle handler. The client can be several
+ * chains behind when the last seat arms, and closing the side then would tear
+ * down the very state it is still drawing.
+ *
+ * Everything after the barrier is PRD-P5's verified boundary flow, moved here
+ * wholesale from btnEndTurnClick: `_sideSeq` is NOT bumped here, because
+ * BattlescapeGame::endTurn() - which endTurnCoop() ultimately reaches - is the
+ * site that both bumps it and stamps it on the `endTurn` packet the client reads
+ * (PRD-P6 as-built). Bumping it twice would leave every client intent stale for
+ * the whole next side.
+ */
+void connectionTCP::coopCheckSideCommit()
 {
-	if (getServerOwner())
-		return 0;
-	return coop_save_owner_player_id > 0 ? coop_save_owner_player_id : 1;
+	_commitBlocked.clear();
+	if (!parallelTurnActive() || !getHost() || !_game)
+	{
+		_commitBlocked = "not_executor";
+		return;
+	}
+	if (_sideCommitInProgress)
+	{
+		_commitBlocked = "side_commit";
+		return;
+	}
+	SavedGame* save = _game->getSavedGame();
+	SavedBattleGame* battle = save ? save->getSavedBattle() : nullptr;
+	BattlescapeGame* bg = battle ? battle->getBattleGame() : nullptr;
+	BattlescapeState* bstate = battle ? battle->getBattleState() : nullptr;
+	if (!bg || !bstate || battle->isPreview() || battle->getSide() != FACTION_PLAYER)
+	{
+		_commitBlocked = "no_side";
+		return;
+	}
+	if (!_battleInit)
+	{
+		// the per-turn co-op handshake has not re-armed yet
+		_commitBlocked = "battle_init";
+		return;
+	}
+	if (!_game->isState(bstate))
+	{
+		// a modal is up (inventory, pause, a vote): the player is not looking at
+		// the battle, so do not pull it out from under them.
+		_commitBlocked = "not_top_state";
+		return;
+	}
+	ensureEndTurnSeats();
+	if (!endTurnAllReady())
+	{
+		_commitBlocked = "not_ready";
+		return;
+	}
+	if (!canAdmitAction())
+	{
+		_commitBlocked = _admitBlocked.empty() ? "admit" : _admitBlocked;
+		return;
+	}
+	if (peerDisplayAckedSeq < _actionSeq)
+	{
+		// PROTOCOL.md `action_done`: the end-turn display drain barrier.
+		_commitBlocked = "display_backlog";
+		return;
+	}
+
+	Log(LOG_INFO) << "coop (PRD-P8): all " << seatCount() << " seat(s) ready - "
+				  << "committing the parallel player side (turn "
+				  << battle->getTurn() << ", side_seq " << _sideSeq << ")";
+
+	// From here nothing may be admitted: a client intent that arrives now is
+	// denied `turn_over`, and so is anything still deferred (E14).
+	_sideCommitInProgress = true;
+	coopDenyPendingIntents("turn_over");
+
+	// PRD-P5's verified boundary flow. The host stays the executor for the AI
+	// side that follows; the per-turn co-op init handshake re-arms from scratch,
+	// exactly as it does on the classic path.
+	_isActivePlayerSync = true;
+	_isActiveAISync = true;
+	_battleInit = false;
+	_waitBH = false;
+	_waitBC = false;
+
+	bstate->endTurnCoop();
 }
 
 // PRD-J01: active roster size (host + clients). Falls back to the legacy
@@ -11768,7 +16290,6 @@ void connectionTCP::hostTCPServer(std::string servername, std::string str_port)
 {
 
 	sendTcpServerName = servername;
-	gamePaused = 0;
 	_waitBC = false;
 	_waitBH = false;
 	_battleWindow = false;
@@ -11809,7 +16330,6 @@ void connectionTCP::hostTCPServer(std::string servername, std::string str_port)
 void connectionTCP::connectTCPServer(std::string ipaddress, std::string str_port)
 {
 	ipAddress = ipaddress;
-	gamePaused = 0;
 	_waitBC = false;
 	_waitBH = false;
 	_battleWindow = false;
@@ -11854,7 +16374,6 @@ void connectionTCP::connectTCPServer(std::string ipaddress, std::string str_port
 // the transport start. Session is derived from the shared password (both peers).
 void connectionTCP::hostDirectLanUDP(std::string str_port, std::string player, std::string password)
 {
-	gamePaused = 0;
 	_waitBC = false;
 	_waitBH = false;
 	_battleWindow = false;
@@ -11876,7 +16395,6 @@ void connectionTCP::joinDirectLanUDP(std::string ipaddress, std::string str_port
 									 std::string str_localport, std::string player, std::string password)
 {
 	ipAddress = ipaddress;
-	gamePaused = 0;
 	_waitBC = false;
 	_waitBH = false;
 	_battleWindow = false;
@@ -12165,7 +16683,22 @@ void connectionTCP::disconnectTCP(bool isMain)
 			else if (connectionTCP::session.lobbyClosed == true
 				&& !customBattleDebriefing)
 			{
-				_game->pushState(new LobbyMenu);
+				// ...but NOT once the skirmish mission is over. The peer left
+				// because they closed their debriefing; the host is still
+				// reading its own, and a lobby dropped on top of it offers
+				// RESUME GAME - which pops the debriefing away and lands the
+				// host on the dead geoscape the skirmish world was loaded onto
+				// (issue #82's half-torn world). The host's own debriefing OK
+				// is the exit, and it goes through GoToMainMenuState.
+				if (skirmishMissionOver())
+				{
+					Log(LOG_INFO) << "[coop] lobby re-open suppressed: the skirmish "
+						"mission is over; the debriefing owns the trip to the main menu";
+				}
+				else
+				{
+					_game->pushState(new LobbyMenu);
+				}
 			}
 			else if (customBattleDebriefing)
 			{
@@ -12214,15 +16747,21 @@ void connectionTCP::disconnectTCP(bool isMain)
 		connectionTCP::no_bases = false;
 		connectionTCP::isCoopBaseLoading = false;
 
-		gamePaused = 0;
 		playerInsideCoopBase = false;
 
-		_coop_task_completed = true;
+		resetCoopTaskDepth();
+		// PRD-P6: no arbiter state may survive a session teardown.
+		resetActionArbiter(true);
 
 		_isActiveAISync = false;
 
 		_isActivePlayerSync = false;
 
+		// coop (#162): the graceful-leave latch is per-session - clear it here so a
+		// clean leave in one session can never suppress a real crash notice in the
+		// next. The onConnect==-2 gate has already read it by the time teardown runs.
+		_peerLeftCleanly = false;
+
 		_clientPanicHandle = false;
 
 		sendFileClient = false;
diff --git a/src/CoopMod/connectionTCP.h b/src/CoopMod/connectionTCP.h
index d79d26135..31c76f1ba 100644
--- a/src/CoopMod/connectionTCP.h
+++ b/src/CoopMod/connectionTCP.h
@@ -129,6 +129,13 @@ struct SPSCQueue
 		return tail == head;
 	}
 
+	// coop (option 3B): current occupancy - for the live drain gauge.
+	size_t size() const
+	{
+		std::lock_guard<std::mutex> lk(m);
+		return (head + N - tail) % N;
+	}
+
 	bool full() const
 	{
 		std::lock_guard<std::mutex> lk(m);
@@ -149,6 +156,85 @@ extern int tcp_port;
 // this via the coop_stats command to detect the "TX queue full" backlog bug).
 extern std::atomic<uint64_t> g_txDropCount;
 
+// PRD-P0 (harness introspection, test-only): receive-gate readout.
+// updateCoopTask() parks every packet this machine is not yet allowed to
+// consume in a file-scope hold deque and rotates the unconsumed ones to the
+// back of it, so a test that sees a peer "not react" cannot otherwise tell a
+// dropped packet from one still waiting on the local task to finish. Free
+// functions/counters (not members) because the deque itself is file-scope in
+// connectionTCP.cpp - same shape as g_txDropCount above, and like it both
+// counters are process-monotonic (never reset).
+bool rxPassDeferred();             // PRD-P2: this dispatch overtook a deferred packet
+size_t rxHoldSize();               // current hold-queue depth
+size_t rxParkSize();               // PRD-P9 R7: packets parked, not rotated
+size_t snapshotPendingCount();     // option 3B: dirty conflation slots (live drain gauge)
+extern std::atomic<uint32_t> g_rxRotateCount;   // PRD-P11: gate holds (nothing rotates now)
+extern std::atomic<uint32_t> g_rxHoldMaxSeen;   // hold-queue high-water mark
+// coop (PRD-P11): the in-order pump. The queue is consumed IN PLACE and a packet
+// the gate refuses keeps its position, so a unit's packets can never be applied
+// out of the order they were sent.
+extern std::atomic<uint32_t> g_rxSkipBlocked;   // held back: an earlier packet names the same unit
+extern std::atomic<uint32_t> g_rxLegacyPasses;  // liveness-floor engagements (expected 0)
+extern std::atomic<uint32_t> g_rxSeqDeferred;   // PRD-I1: outcome packet held for its own chain's opener
+extern std::atomic<uint32_t> g_barrierBlocks;   // PHASE D.1: action_end held until its chain's stamped packets applied
+// coop (LIVENESS FLOOR ordering-preserving drain): times the stage-2 hard-floor escape
+// hatch reverted the parallel replay client to the legacy full-disable (the ordered drain
+// could not make progress). Process-monotonic; 0 across a run means the ordering-preserving
+// drain carried the whole load and the backstop never fired.
+extern std::atomic<uint32_t> g_rxHardFloorPasses;
+// coop (wire-order Increment 7, SHAPE A diagnostic): regen-carry elements the HOST
+// emitted on action_end markers, and elements the CLIENT applied at first-sight.
+extern std::atomic<uint32_t> g_regenEmitted;
+extern std::atomic<uint32_t> g_regenApplied;
+// coop (three-class RCA DIAGNOSTIC): capture-gated tagged write log; lever-off inert.
+extern std::atomic<bool> g_diagCapture;
+// coop (RCA): gates the HIGH-frequency per-write tu/position log (coopDiagUnit) separately,
+// so a lightweight capture avoids the per-write mutex overhead. See connectionTCP.cpp.
+extern std::atomic<bool> g_diagHeavy;
+extern std::vector<std::string> g_diagTrace;
+extern std::mutex g_diagTraceMutex;
+void coopDiagS(std::string s);
+void coopDiagUnit(const char* tag, int unitId, long v);
+// coop (option 3): the wire-order master lever (defined connectionTCP.cpp:639), exposed so
+// SharedEcon.cpp's syncCheckCompare/verifyBattleChecksum can gate the boundary persistence
+// alarm on it (lever-off = byte-identical). Standard g_ atomic extern pattern.
+extern std::atomic<bool> g_wireOrderState;
+// TEST-ONLY levers (default false, set ONLY by the test server via
+// parallel_state {rx_hold} / {rx_drain_disable}). g_rxTestHold parks the pump's
+// consumption by emulating a permanently-busy display FOR THE GATE ONLY (whitelisted
+// carriers still flow, action_end markers hold) and feeds the stall count, so the
+// 600-tick liveness floor trips on demand and (markers never idling) stays engaged - the
+// genuine wedge the stage-2 hard-floor backstop must drain. g_rxDrainDisable forces the
+// floor back to its legacy full-disable so the SAME build measures the pre-fix
+// out-of-order burst (red) against the ordering-preserving drain (green). Never set
+// outside the coop test harness -> production identical.
+extern std::atomic<bool> g_rxTestHold;
+extern std::atomic<bool> g_rxDrainDisable;
+// TEST-ONLY: force the liveness floor to engage every tick regardless of the stall count,
+// WITHOUT gating any packet - so a naturally-slow client (whose real display gates its
+// action_end markers and idles between chains) runs under the engaged floor, the exact
+// state the rare real stall produces. Lets the fixture measure the pre-fix out-of-order
+// burst (rx_drain_disable) vs the ordered drain deterministically. Never set in production.
+extern std::atomic<bool> g_rxForceFloor;
+// The last `limit` packets the pump applied, oldest first: [{seq,state,unit}].
+// Test-only introspection; `unit` is -1 for a packet that names no single unit.
+Json::Value rxAppliedTrace(size_t limit);
+// Test introspection: the front of the receive hold queue with each packet's chain stamp.
+Json::Value rxHoldDump(size_t limit);
+// Append a packet to the hold queue as if it had just arrived (TestServer only).
+void rxInjectForTest(std::string&& payload);
+
+// coop (explosion ordered-replay E2, test introspection): the last few chain_detonation
+// tile positions THIS process has either SENT (parallel host, ExplosionBState.cpp's
+// chained-spawn send site - its scan order) or APPLIED (parallel client, the
+// chain_detonation handler below), as [x,y,z] tuples oldest-first. Process-local (each
+// side is its own OpenXcom.exe/port in the test harness), so a fixture reads the host's
+// list as its send order and the client's list as its receive order and diffs the two for
+// exact positional equality - the count-only g_chainDetonationsSent/Applied above cannot
+// distinguish "right count, wrong order" from a genuinely matching replay.
+void chainDetonationListRecord(int x, int y, int z);
+Json::Value chainDetonationListDump(size_t limit);
+
 // ===== Geoscape sync conflation slot =====
 // The two GeoscapeState::think() heartbeats are full-state, last-write-wins
 // snapshots. Instead of FIFO-queuing every per-frame copy onto g_txQ (which
@@ -560,12 +646,24 @@ class connectionTCP
 	void joinDirectLanUDP(std::string ipaddress, std::string port, std::string localport,
 	                      std::string player, std::string password);
 	void onTCPMessage(std::string data, Json::Value obj);
+	/// coop (parallel battlescape Phase 1 - per-unit state watermark): next_turn's
+	/// per-unit bulk-apply loop, factored out of onTCPMessage so the TEST-ONLY
+	/// synthetic replay lever (parallel_state {replay_last_next_turn:true}) can
+	/// re-run exactly this loop against a stashed snapshot. Returns the unit ids
+	/// whose stamped write was rejected by the watermark (the live caller uses
+	/// this to also skip their coopApplyDeferredTurnStart()). Caller must ensure
+	/// _game->getSavedGame()->getSavedBattle() is non-null.
+	std::unordered_set<int> coopApplyNextTurnUnitStates(Json::Value& obj);
+	/// coop (parallel battlescape Phase 1, TEST-ONLY SYNTHETIC RED lever): re-runs
+	/// coopApplyNextTurnUnitStates on the last applied next_turn snapshot
+	/// (g_lastNextTurnJson). Only reachable via the parallel_state TestServer
+	/// command; never fires in shipped mode. No-op if no next_turn has applied yet.
+	void coopDebugReplayLastNextTurn();
 	void sendBaseFile();
 	void sendMissionFile();
 	/// issue #93: stream the RUNNING skirmish battle to a rejoining client.
 	void streamSkirmishBattleToClient();
 	void sendSaveProgressFile();
-	int gamePaused = 0; // 0 = no set, 1 = team, 2 = your
 	bool cancel_connect = false;
 	int getCurrentTurn();
 	void loadHostMap();
@@ -624,7 +722,30 @@ class connectionTCP
 	static bool getHost();
 	static int getHostSpaceAvailable();
 	static void setHostSpaceAvailable(int _hostSpace);
-	bool _coop_task_completed = true; // is the co-op task completed (walk, turn, shoot, etc.)?
+	// coop (PRD-P6 pre-task): the receive gate, as a DEPTH COUNTER.
+	//
+	// It used to be `bool _coop_task_completed`. A bool cannot nest, and the
+	// chains that hold it do: an InfoboxState opening and closing inside a shot
+	// (InfoboxState ctor/dtor vs ProjectileFlyBState::init/deinit) wrote the gate
+	// back OPEN while the projectile was still in flight, so a peer packet could
+	// interleave into the middle of a local action chain. Depth 0 == "completed";
+	// every holder takes a reference and gives it back.
+	//
+	// Writers go through setCoopTaskCompleted(false/true) (acquire/release) and
+	// the two teardown sites through resetCoopTaskDepth(). Holders that can have
+	// their init() re-entered (a BattleState is re-init'ed whenever something
+	// pushed IN FRONT of it pops) must acquire at most once - they carry their own
+	// `held` flag; see UnitWalkBState.
+	int _coopTaskDepth = 0;
+	/// Is no co-op action chain in progress (walk, turn, shoot, melee, psi, modal)?
+	bool coopTaskCompleted() const { return _coopTaskDepth <= 0; }
+	/// Current gate depth (0 = open). Test introspection / arbiter admission.
+	int coopTaskDepth() const { return _coopTaskDepth; }
+	/// false = acquire (++), true = release (-- , clamped at 0). Same call shape
+	/// the pre-P6 bool API had, so every writer site reads unchanged.
+	void setCoopTaskCompleted(bool completed);
+	/// Teardown only: force the gate open, whatever is still holding it.
+	void resetCoopTaskDepth() { _coopTaskDepth = 0; }
 	size_t _coop_selected_craft_id = 0;
 	std::string getPing();
 	bool isCoopSession(); // is the co-op session created? (does not consider whether a player has joined)
@@ -669,6 +790,344 @@ class connectionTCP
 	static std::string seatName(int seat);  // player name for a seat
 	// no mode = 0, PVE = 1, PVP = 2, PVP2 = 3, PVE2 = 4,
 	static int getCoopGamemode();
+	/// coop (PRD-P5): is the parallel shared player side live right now?
+	/// PROTOCOL.md: `_enable_parallel_turns && gamemode in {1,4} && !hotseat`
+	/// (plus an actual co-op session). While it is true both machines hold
+	/// isYourTurn == 2 and `_isActivePlayerSync == getHost()` - the executor
+	/// invariant every existing send/RNG guard is already written against.
+	static bool parallelTurnActive();
+	/// coop: is this machine a CLIENT during a parallel player side? PRD-P5
+	/// used it as a blanket input gate; PRD-P6 replaced that with action
+	/// intents and PRD-P8 replaced its last gate (END TURN) with the per-seat
+	/// readiness toggle, so all it still answers is "am I the non-executor
+	/// machine" - which the two classic UI-mirror send sites still ask.
+	static bool parallelInputBlocked();
+
+	// ---- coop (PRD-P6): action-intent arbitration -------------------------
+	// The client never executes battle sim in parallel mode: it ships an
+	// `action_intent`, the host validates + executes + broadcasts, and the
+	// client displays the broadcast exactly as it displays a host action in
+	// classic co-op. See PROTOCOL.md.
+
+	/// HOST-owned. +1 per ADMITTED action (the host's own and every client
+	/// intent). Stamped on `action_ack`; the broadcast packets carry it only
+	/// from PRD-P7 on. Reset at each side boundary TOGETHER with
+	/// peerDisplayAckedSeq - resetting one alone underflows P7's uint32
+	/// backlog term `(_actionSeq - peerDisplayAckedSeq)` and blocks admission
+	/// for the rest of the battle.
+	static std::uint32_t _actionSeq;
+	/// PRD-P7's display-flow term: the highest chain the PEER has reported having
+	/// finished DISPLAYING (`action_done`). Lives next to _actionSeq so the two
+	/// counters can never be reset apart. On a client this is instead the highest
+	/// chain THIS machine has reported done, so the same readout means "how far
+	/// the display has got" on either side.
+	static std::uint32_t peerDisplayAckedSeq;
+	/// HOST: the admitted chain that still owes the client an `action_end`
+	/// (0 = none open). Stamped by stampAdmittedAction(), cleared when the marker
+	/// goes out. PRD-P7.
+	static std::uint32_t _openChainSeq;
+	/// CLIENT: the chain seq the display is currently working through - the value
+	/// the next `action_done` will carry. PRD-P7.
+	static std::uint32_t _clientDisplaySeq;
+	/// HOST (PRD-I0): the kind that was admitted as `_openChainSeq` ("walk",
+	/// "shoot", "ai", ...). The arbiter's `_intentSlotKind` cannot serve: it is
+	/// written only on the two CLIENT-intent admit paths, so the executor's own
+	/// clicks and every AI chain would be attributed to whatever the last client
+	/// happened to do. Purely a label on the sync-check ring entry.
+	static std::string _openChainKind;
+	/// CLIENT (PRD-I0): the `side_seq` the last consumed `action_end` marker
+	/// named. NOT this machine's `_sideSeq`: `endTurn` is whitelisted and
+	/// `action_end` is not, so the live token routinely runs ahead of the markers
+	/// still queued behind the receive gate, and reporting under it would send
+	/// the tail of a side's chains into the next side's key space.
+	static std::uint32_t _clientDisplaySideSeq;
+	/// HOST-owned (PRD-I0): the BOUNDARY pseudo-seq counter - one per side-close
+	/// phase group, one per side start. Its OWN namespace, monotonic for the whole
+	/// battle, deliberately NOT drawn from `_actionSeq`:
+	///  * `_actionSeq` resets every side, so two boundary hashes taken either side
+	///    of a reset would collide with the first real actions of the new side;
+	///  * and, decisively, boundary seqs would enter PRD-P7's display-backlog term.
+	///    A peer that predates PRD-I0 reports nothing for them, so the executor
+	///    would sit at backlog 2 from the first side start and refuse every action
+	///    for the rest of the battle. An additive field must never be able to wedge
+	///    an older peer.
+	static std::uint32_t _boundarySeq;
+	/// HOST (PRD-I3 SEAM-2 HALF 2): true only for the duration of the
+	/// neutral->player SavedBattleGame::prepareNewTurn tile-decay call, so the
+	/// set_smoke_tile/set_fire_tile sends it drives carry `bnd:true`. Those flagged
+	/// packets ride the ORDERED receive gate (not the always-consume whitelist), so
+	/// the client's ai-seq hazard hashes sample pre-decay state. Set/cleared around
+	/// the single call site; a mid-side explosion hazard is never inside the scope.
+	static bool _coopBoundaryDecay;
+	/// TEST-ONLY lever, default false, set ONLY by the test server
+	/// (`hold_action_done`). While true the client PARKS its `action_done`
+	/// reports instead of shipping them: the packet is unchanged, it just leaves
+	/// later, so a test can hold the host's end-turn drain barrier open for as
+	/// long as it likes instead of racing a ~200 ms round trip. Releasing emits
+	/// the latest parked seq (`_clientDisplaySeq` is already the newest, and
+	/// peerDisplayAckedSeq is deliberately NOT advanced while held, so one emit
+	/// clears the whole backlog). `_heldActionDones` counts the reports parked
+	/// since the hold was engaged - 0 means the client never finished displaying
+	/// anything, i.e. the barrier was never exercised and a scenario asserting on
+	/// it would be vacuous.
+	static bool _testHoldActionDone;
+	static std::uint32_t _heldActionDones;
+	/// TEST-ONLY lever (`hold_action_done {boundary:true}`), default false. While
+	/// true the client PARKS only its BOUNDARY `action_done` (coopEmitBoundaryDone),
+	/// leaving the per-chain report flowing. That freezes the host's
+	/// g_syncLastComparedBoundarySeq while per-chain acks keep the host committing
+	/// and crossing boundaries - the exact "peer went dark on boundaries" condition
+	/// A3's peer-liveness tripwire detects, forced deterministically.
+	static bool _testHoldBoundaryDone;
+	/// HOST (PRD-P9 3): the SDL tick `_openChainSeq` was stamped at, and whether
+	/// the stuck-chain warning has already been logged for it. Diagnostic only -
+	/// there is no distributed lock to break, so all this can do is say so once,
+	/// with the arbiter state a bug report would otherwise have to guess at.
+	static std::uint32_t _openChainTicks;
+	static bool _openChainWarned;
+	/// HOST (PRD-I3 SEAM-7 ii): an instant-kind chain (kneel/prime/medikit) whose
+	/// replay packet has NOT been emitted yet. executeAction sends it AFTER the actor
+	/// state settles; kneel()'s reaction-fire/FOV can fire coopChainChanged ->
+	/// coopCloseActionChain in between, which would send the chain's action_end BEFORE
+	/// the packet (and unstamped). While set, coopCloseActionChain holds off so the
+	/// packet always precedes its own action_end on the wire. Cleared the moment the
+	/// executor has emitted it (coopNoteInstantExecuted, from executeAction's tail).
+	static bool _openChainInstantPending;
+	/// HOST (wire-order Increment 7, SHAPE A): per-unit (tu, energy) captured at
+	/// stampAdmittedAction (chain open), diffed at coopCloseActionChain to ship ONLY
+	/// the units whose tu/energy changed during the chain as the marker's `regen`
+	/// array. Generalizes abortPath's PRD-P9 walk-end tu/energy carry to every chain
+	/// (incl. actor-less expl chains and in-chain multi-actor spend). unitId -> (tu,
+	/// energy). Lever-gated (g_wireOrderState); empty/unused lever-off so the
+	/// action_end packet stays byte-identical. DO-NOT-ADD morale: it is boundary-
+	/// authored (endTurn death-morale cascade) and already covered by next_turn + the
+	/// hit_unit bystander-morale carrier; a straddling pre-cascade morale absolute
+	/// applied wire-after next_turn would MINT a new unitsRegen(morale) divergence.
+	static std::unordered_map<int, std::pair<int, int>> _openChainRegenSnap;
+	/// HOST-owned, +1 per side transition; the staleness token an intent
+	/// carries. The client adopts the value stamped on the `endTurn` packet.
+	static std::uint32_t _sideSeq;
+	/// coop (PRD-P3 GAP-10 script-RNG seed-replay): the side-boundary RNG seed
+	/// the host stamps on `endTurn` and the client adopts. newTurnUpdateScripts
+	/// reseeds the global RNG to this around the mod newTurnUnit/newTurnItem script
+	/// loops so both machines' randomChance/randomRange draw the same sequence.
+	/// Defaults to the fixed coop base seed so turn-1 (pre-first-boundary) is defined.
+	static std::uint64_t _scriptRngSeed;
+	/// HOST: true from the END TURN press until the next player side opens.
+	static bool _sideCommitInProgress;
+	/// HOST: the one-slot pending intent (per seat; P6 executes on admission,
+	/// so the slot records the intent whose chain is running).
+	static std::uint32_t _intentSlotReqId;
+	static int _intentSlotSeat;
+	static std::string _intentSlotKind;
+	/// HOST: why canAdmitAction() last refused ("" = it did not).
+	static std::string _admitBlocked;
+	/// HOST: why coopPendIntent() last refused to DEFER ("" = it took the input).
+	/// PRD-P7; the counterpart of _admitBlocked for the pending-admit decision.
+	static std::string _pendBlocked;
+	/// CLIENT: monotonic req_id source (from 1, per battle).
+	static std::uint32_t _clientReqSeq;
+	/// CLIENT: the single pending slot. 0 = nothing outstanding.
+	static std::uint32_t _clientPendingReqId;
+	static std::string _clientPendingKind;
+	static std::uint32_t _clientPendingSentTicks;
+	/// CLIENT: the last `action_deny` it was sent - reason and warning key.
+	/// The flash fades (and BattlescapeState::warning swallows it entirely off
+	/// the player side), so this is the only stable readout of WHY an intent was
+	/// refused. Test introspection; cleared with the request sequence.
+	static std::string _clientLastDenyReason;
+	static std::string _clientLastDenyWarning;
+
+	// ---- coop (PRD-P7): pending-admit + display flow control ----------------
+	/// One deferred input. The executor keeps at most one per seat: a newer input
+	/// from the same seat REPLACES it and the replaced one is refused `busy`.
+	struct CoopPendingIntent
+	{
+		std::uint32_t reqId = 0;   // 0 = the executor's own local click
+		int seat = -1;
+		std::string kind;
+		std::string json;          // the serialized `action_intent` body
+		bool local = false;
+		/// PRD-P9 rider R4: SDL tick this slot was deferred at. The CLIENT gives
+		/// up on an unanswered intent after 10 s, so a slot that outlives
+		/// COOP_PEND_TIMEOUT_MS is refused rather than admitted into a seat that
+		/// has already forgotten it.
+		std::uint32_t deferTicks = 0;
+	};
+	static std::vector<CoopPendingIntent> _pendingAdmits;
+
+	/// HOST: take this input as PENDING instead of refusing it, when the chain in
+	/// the way is pure locomotion (BattlescapeGame::chainIsSkippable). Arms the
+	/// fast-forward. Returns false when the caller must fall back to `busy`.
+	static bool coopPendIntent(int seat, std::uint32_t reqId, const std::string& kind,
+							   const std::string& intentJson, bool localOrigin);
+	/// HOST: drop every pending input with a deny (default `busy`) - what reaction
+	/// fire interrupting a fast-forwarded walk does, because the positions and TU
+	/// the player clicked against may have moved a long way.
+	static void coopDenyPendingIntents(const std::string& reason = "busy");
+	/// HOST, main-thread tick: admit ONE pending input if the arbiter will take it.
+	/// Deliberately not called from popState() - executing an action re-enters the
+	/// state queue, and the drain point is in the middle of a pop.
+	void coopAdmitPendingIntents();
+	/// HOST: ship the `action_end` marker for the chain that has just drained, so
+	/// the client can say when it has finished DISPLAYING it. Idempotent.
+	static void coopCloseActionChain();
+	/// HOST (PRD-I3 SEAM-7 ii): executeAction has emitted the current instant kind's
+	/// replay packet - release the coopCloseActionChain hold (a no-op otherwise).
+	static void coopNoteInstantExecuted();
+	/// HOST (PRD-P9 3): log ONCE if the open chain has been running for over two
+	/// minutes. Purely diagnostic; it frees nothing.
+	static void coopCheckStuckChain();
+	/// CLIENT: the single `action_done` emit point (PROTOCOL.md). No-op unless a
+	/// newly displayed chain seq is outstanding.
+	void coopEmitActionDone();
+	/// HOST (PRD-I0): allocate a BOUNDARY pseudo-seq, remember this machine's
+	/// bucket hashes for it, and ship the marker that tells the client to do the
+	/// same. Rides `action_end` (with `"boundary": true`) rather than a new state
+	/// string, precisely because `action_end` is NOT whitelisted: the client
+	/// consumes it at receive-gate depth 0, which is what makes "hash after the
+	/// boundary packets have been applied" true rather than hopeful.
+	/// @a kind is "endturn" (the side-close phase group) or "sidestart".
+	static void coopSendSyncBoundary(const char* kind);
+	/// HOST (PRD-I0): remember that a boundary marker is owed. The side-close
+	/// phases can still have explosion/death chains queued behind them, so the
+	/// marker is sent from the main-thread tick once the executor is quiescent.
+	static void coopArmSyncBoundary(const char* kind);
+	/// HOST (PRD-I0), main-thread tick: send one armed boundary marker if idle.
+	static void coopFlushSyncBoundary();
+	/// HOST (wire-order Increment 6): flush a pending SIDESTART boundary EARLY - at the
+	/// player-turn-start point BEFORE handlePanickingPlayer runs - so the ring captures the
+	/// boundary STATE (post-side-close-drain, pre-start-of-turn panic/berserk), matching
+	/// next_turn's snapshot and the client's wire-first-sight sample. Lever-gated
+	/// (g_wireOrderState) and scoped to the sidestart kind; endturn boundaries keep the
+	/// deferred !isBusy flush. Lever-off: no-op (the normal tick flush is unchanged).
+	static void coopFlushSidestartBoundaryEarly();
+	/// HOST (PRD-I0): boundary markers armed but not yet shipped.
+	static std::vector<std::string> _pendingBoundaries;
+	/// coop (PRD-I3 Option D-lite): the parallel client defers its NEUTRAL->PLAYER
+	/// turn-machine advance off the whitelisted endTurn packet and flushes it at the
+	/// gated next_turn apply, so _turn/_side follow the display. _turnAdvanceDeferred
+	/// is the pending flag (exposed on parallel_state); _hostShipsNextTurnFields learns
+	/// from the first fields-bearing next_turn whether the host authors turn/side (an
+	/// old host never does, so the client keeps the legacy inline advance).
+	static int _turnAdvanceDeferred;
+	/// coop (PRD-I3 rider): MONOTONIC count of NEUTRAL->PLAYER advance deferrals this
+	/// battle. The transient _turnAdvanceDeferred bool arms and clears inside one
+	/// next_turn window, which a test poll can miss; this only rises, so a test reads
+	/// a before/after delta instead of racing the flag. Reset with the flag on a full
+	/// resetActionArbiter (battle-scoped).
+	static int _turnAdvanceDeferredCount;
+	static bool _hostShipsNextTurnFields;
+	/// CLIENT (PRD-I0): answer a boundary marker with this machine's buckets.
+	void coopEmitBoundaryDone(std::uint32_t bseq);
+	/// CLIENT (PRD-I0): answer an `action_end` whose side has already closed here,
+	/// WITHOUT moving either display watermark. See the call site: adopting such a
+	/// marker's seq freezes `_clientDisplaySeq` above the new side's whole range
+	/// and wedges the executor's display-backlog term for the rest of the battle.
+	void coopEmitStaleActionDone(std::uint32_t seq, std::uint32_t sideSeq);
+
+	/// May the executor start a new action chain right now? PROTOCOL.md
+	/// "Ordering invariants" 3: no BattleState queued, receive gate open, no
+	/// side commit under way, and (PRD-P7) the client's undisplayed backlog
+	/// below 2.
+	static bool canAdmitAction();
+	/// Stamps an admitted action: ++_actionSeq, returns the new value. @a kind
+	/// (PRD-I0) labels the chain for the sync-check ring; it is a diagnostic
+	/// label only and nothing branches on it.
+	static std::uint32_t stampAdmittedAction(const std::string& kind = std::string());
+	/// coop (PRD-I1): tag a whitelisted outcome packet (@a root) with the chain
+	/// and side it belongs to, so the client defers it until that chain opens
+	/// locally instead of letting it overtake its own opener. No-op outside an
+	/// admitted/AI chain on the parallel host (_openChainSeq == 0).
+	static void coopStampChainSeq(Json::Value& root);
+	/// coop (PRD-I3 SEAM-3 a): if the parallel host is running an explosion with
+	/// NO open admitted chain, open one (kind @a kind) so its destroy_tile/hazard
+	/// outcome carries a seq and the client holds it on the I1 apply-before-hash
+	/// gate instead of applying it immediately (the loose-destroy terrain straddle).
+	/// No-op off the parallel host or when a chain is already open.
+	static void coopStampLooseOutcomeChain(const char* kind);
+	/// coop (PRD-I3 SEAM-2 HALF 2): open/close the boundary-decay scope around the
+	/// neutral->player prepareNewTurn call. While open, coopStampBoundaryOrigin()
+	/// tags a host tile-hazard send with `bnd:true`.
+	static void coopSetBoundaryDecay(bool active);
+	/// coop (PRD-I3 SEAM-2 HALF 2): tag @a root with `bnd:true` when a host
+	/// set_smoke_tile/set_fire_tile send is the boundary-phase decay, so the client
+	/// gates it in FIFO instead of whitelisting it. No-op (field absent) otherwise -
+	/// additive, an older peer ignores it and keeps the whitelist behaviour.
+	static void coopStampBoundaryOrigin(Json::Value& root);
+	/// Battle start / side boundary / teardown: counters and slots back to a
+	/// known state. `fullReset` also zeroes the side and request sequences.
+	static void resetActionArbiter(bool fullReset);
+	/// CLIENT: ships an intent and takes the pending slot (a second input
+	/// REPLACES the slot - the stale ack is then ignored by req_id).
+	bool sendActionIntent(Json::Value intent, const std::string& kind);
+	/// CLIENT: drops the pending slot (ack received, deny received, timeout).
+	static void clearClientPendingIntent();
+	/// CLIENT: forgets the last deny (test introspection reset).
+	static void clearClientLastDeny();
+	/// Main-thread tick: the 10 s pending-intent timeout.
+	void tickActionIntents();
+	/// Flashes a translatable key on the battlescape warning widget, if there
+	/// is a battlescape. The deny UX; survives thanks to PRD-P5 dropping the
+	/// persistent off-turn banners that used to squat on that widget.
+	void flashBattleWarning(const std::string& key);
+
+	// ---- coop (PRD-P8): end-turn readiness gate ---------------------------
+	// A parallel side has no single owner, so it cannot be closed by one
+	// player's button press. Every seat arms its readiness (explicitly, or
+	// automatically once it has nothing left to command) and the executor
+	// commits the side when the last one arms. PROTOCOL.md
+	// `end_turn_ready` / `end_turn_tally` - standalone messages, NOT VoteSession.
+
+	/// Seat-indexed EXPLICIT readiness (an END TURN press). Host-authoritative;
+	/// a client holds the echoed tally plus its own optimistic bit.
+	static std::vector<bool> _endTurnReady;
+	/// Seat-indexed AUTO readiness: "this seat has no live commandable unit
+	/// left". Derived, never pressed - recomputed by the executor every tick, so
+	/// a death, a mind-control flip and a gift all clear/raise it with no
+	/// per-site hook to forget.
+	static std::vector<bool> _endTurnAuto;
+	/// The `side_seq` the currently-held tally belongs to. A tally for a
+	/// DIFFERENT side is adopted silently (no peer flash) - the all-clear that
+	/// follows a commit is not somebody cancelling.
+	static std::uint32_t _endTurnTallySideSeq;
+	/// HOST: character signature of the last `end_turn_tally` put on the wire
+	/// ("<side_seq>:<seats>:" then one of R/A/. per seat), so the tick echo only
+	/// builds and sends a packet when something actually changed.
+	static std::string _endTurnTallySent;
+	/// HOST: why coopCheckSideCommit() last refused ("" = it did not, or it
+	/// committed). Test introspection.
+	static std::string _commitBlocked;
+
+	/// Grows both readiness vectors to seatCount(). Cheap; called before any read.
+	static void ensureEndTurnSeats();
+	/// Everything a side boundary / teardown must forget. Lives inside
+	/// resetActionArbiter() so it can never be reset apart from the arbiter.
+	static void resetEndTurnReady();
+	/// Is `seat` ready by either route?
+	static bool endTurnSeatReady(int seat);
+	/// How many seats are ready (either route) - the tally UI's numerator.
+	static int endTurnReadyCount();
+	/// Are ALL seats ready? (the commit's first term)
+	static bool endTurnAllReady();
+	/// HOST: re-derive `_endTurnAuto` from the live roster.
+	static void recomputeEndTurnAuto();
+	/// HOST: put `end_turn_tally` on the wire if the tally changed since the last
+	/// send. The "echo after EVERY change" of PRD-P8 §1, driven from the tick so
+	/// no mutation site can forget it.
+	void sendEndTurnTallyIfChanged();
+	/// HOST: this seat just had an action ADMITTED, so its explicit ready is
+	/// stale (it clearly did not mean "I am done"). Auto readiness is derived and
+	/// is left alone.
+	static void noteSeatActed(int seat);
+	/// LOCAL: the END TURN button in parallel mode. Flips this machine's own
+	/// readiness; a client ships `end_turn_ready`, the host just updates the
+	/// tally it owns.
+	void toggleEndTurnReady();
+	/// HOST, main-thread tick: close the side once every seat is ready, the
+	/// arbiter is idle and the peer's display backlog has drained.
+	void coopCheckSideCommit();
+
 	void createCoopMenu();
 	static void sendTCPPacketStaticData2(std::string data);
 	void writeHostMapFile2();
@@ -735,14 +1194,51 @@ class connectionTCP
 	bool _coopWalkInit = false;
 	bool _coopAllow = true;
 
+	// coop (Class-A soak wedge fix): the auto-shot pacing wait in
+	// ExplosionBState::think() (the non-host client parking a multi-shot replay on
+	// `_hasHitUnit == 1` until the host's flip packet lands). Set true while that
+	// state is waiting, false the instant it is released. It is the ONE display
+	// state that can hold the receive gate (via the ProjectileFlyBState beneath it,
+	// _coopInitDeath) for the whole rest of the battle when the flip never arrives -
+	// a client/host shot-count divergence, likeliest on hazard-heavy turns where a
+	// terrain-chain ExplosionBState reads the same shared pacing flag. updateCoopTask
+	// counts consecutive game-loop ticks it stays set (g_rxPacingStallTicks) and,
+	// past kRxPacingForceDrainTicks, raises _coopForceDrainReplay so the state can
+	// advance instead of starving forever. Counted at the game-loop rate, NOT the
+	// setStateInterval-throttled think() rate, so the escape is wall-time bounded
+	// regardless of the client's draw speed.
+	bool _coopPacingWait = false;
+	/// Set by updateCoopTask when _coopPacingWait has been held past the stall
+	/// floor; consumed (and cleared) by ExplosionBState::think(), which force-releases
+	/// the pacing wait. A last-resort liveness escape, never armed under normal lag.
+	bool _coopForceDrainReplay = false;
+	/// Monotonic count of force-drains (introspection / regression guard). Expected
+	/// 0 across a clean soak; a non-zero value in the field means a real wedge was
+	/// broken, which A3's peer-liveness tripwire would have surfaced too.
+	std::uint32_t _coopForceDrainCount = 0;
+
 	int _coopPVPwin = 0; // 0 = not set, 1 = xcom, 2 = ufo
 
 	bool _clientPanicHandle = false;
 
+	// coop (parallel turns): click-sync window for the "Please wait for <player>'s
+	// action" banner. A BUSY action_deny arms this to N frames so the banner is up
+	// on the exact deny even if a mirror-packet gap left this machine momentarily
+	// not-busy; BattlescapeState::updateCoopWaitBanner() reads and decrements it.
+	int _coopWaitDenyTicks = 0;
+
 	static bool _isActiveAISync;
 
 	static bool _isActivePlayerSync;
 
+	// coop (#162 / 056b500db reconciliation): set true when the peer sent a
+	// `coop_leaving` before its socket closed - i.e. it pressed OK on a skirmish
+	// debriefing and left gracefully, which is NOT a drop. The disconnect-notice
+	// gate reads it so a graceful leave stays silent while an ABRUPT drop (no
+	// `coop_leaving`) still raises the notice. One-shot per session; reset at
+	// every disconnectTCP teardown and on a fresh client attach.
+	static bool _peerLeftCleanly;
+
 	bool _onClickClose = false;
 
 	int _currentAmmoID = -1;
@@ -762,6 +1258,13 @@ class connectionTCP
 
 	static bool _unbalanced_craft_soldiers_limit;
 
+	// coop (PRD-P5): the SESSION's parallel-turns mode. Mirrors the HOST's
+	// Options::EnableCoopParallelTurns across the COOP_READY_HOST handshake, so
+	// both machines answer parallelTurnActive() identically for the whole
+	// session. A peer that never sends the key (old build) leaves this false =
+	// classic mode, which is the free backwards-compatibility degrade.
+	static bool _enable_parallel_turns;
+
 	int walk_end_unit_id = -1;
 
 	bool AbortCoopWalk = false;
@@ -786,9 +1289,31 @@ class connectionTCP
 	int _melee_target_id = -1;
 	int _melee_hit_number = -1;
 
-	std::vector<BattleActionAttack> _battleActions;
-
-	std::vector <int> _smokeRNGs;
+	// coop (PRD-P3 GAP-4b): parked hit/miss decisions, FIFO. The melee sender rolls
+	// in MeleeAttackBState::init (before the ExplosionBState it pushes can roll it)
+	// and ships the boolean on the SAME packet, so the receiver has the answer
+	// parked before its own chain starts - a follow-up packet would race it.
+	// TileEngine::meleeAttack pops one; BA_CQB never touches this queue.
+	std::vector<int> _meleeResults;
+	// Same shape for the BA_SELF_DESTRUCT chance: the host rolls it in
+	// BattleUnit::damage (which is already host-only) and ships it on the existing
+	// selfDestruct packet, because ExplosionBState::init - where the roll used to
+	// live - runs after that packet has already gone out.
+	std::vector<int> _selfDestructResults;
+	// coop (wire-order report alignment, Increment 3 / A2): display-side copies of the
+	// two parked-outcome queues above. Lever-on, the parallel CLIENT's receiver-park
+	// writes HERE (not the canonical vectors) and its display replay consumes from here,
+	// so next_turn's state-half clear of the canonical queue (increment 5, at RX arrival)
+	// cannot starve a still-queued melee / self-destruct replay. Empty lever-off and on
+	// the host, so the display-first consume (TileEngine::meleeAttack, ExplosionBState)
+	// falls through to the canonical queue byte-identically.
+	std::vector<int> _meleeResultsDisplay;
+	std::vector<int> _selfDestructResultsDisplay;
+	// coop (PRD-P3 GAP-4b): close-quarters outcome shipped with the shot packet.
+	// The peer does not run the CQB check at all (its redirect already rides the
+	// packet's target coords); it only applies the defender's cost.
+	bool _cqbBlocked = false;
+	int _cqbDefenderId = -1;
 
 	bool pve2_init = false;
 
@@ -942,6 +1467,19 @@ class connectionTCP
 	// to recover from, it is two players walking away from a finished game, so
 	// every "the other player vanished" notice and freeze is suppressed.
 	static bool campaignEnded();
+	// The skirmish twin of campaignEnded(): a NEW BATTLE > COOP mission has run
+	// and finished, so the only thing the world is still holding up is the
+	// debriefing each player is reading. Closing that debriefing ends the world
+	// (DebriefingState::btnOkClick -> GoToMainMenuState for a monthsPassed == -1
+	// save), so a peer leaving now is EXPECTED - they closed theirs first - not a
+	// drop to report or to re-open a lobby for.
+	static bool skirmishMissionOver();
+	// coop (#162): is a skirmish DebriefingState open right now (monthsPassed == -1
+	// + a DebriefingState on the state stack)? skirmishMissionOver() stays true
+	// through the post-OK menu transition too, so this narrower predicate is what
+	// separates "the peer dropped while I am reading results" (show the notice)
+	// from "I already dismissed my debrief and am on my way to the menu" (silent).
+	static bool debriefOpen();
 	// PRD-08 C7: may this machine LOAD a local save RIGHT NOW? False whenever a
 	// live coop session is attached (host OR client) - loading mid-session forks
 	// the served world silently. True when solo / after the session ends (the
diff --git a/src/Engine/CrossPlatform.cpp b/src/Engine/CrossPlatform.cpp
index b73c36a5e..3467f859e 100644
--- a/src/Engine/CrossPlatform.cpp
+++ b/src/Engine/CrossPlatform.cpp
@@ -1484,6 +1484,64 @@ std::string now()
 	return result;
 }
 
+/**
+ * I5 next-launch crash reporter: after the dying process has written its dump and
+ * log, drop a marker naming those files so a HEALTHY next launch can offer to
+ * bundle them for the developers. Best-effort and self-contained on purpose - the
+ * JSON is hand-rolled (no allocations through jsoncpp inside a crashing process)
+ * and every failure is swallowed, so this can never disturb the crash dialog.
+ * Windows paths carry backslashes, so JSON-escape the values.
+ */
+static void writeCrashPendingMarker(const std::string &timestamp,
+	const std::string &dumpPath, const std::string &logPath,
+	const std::string &version, const std::string &exceptionCode)
+{
+	auto esc = [](const std::string &in) {
+		std::string o;
+		o.reserve(in.size() + 8);
+		for (char c : in)
+		{
+			switch (c)
+			{
+			case '"':  o += "\\\""; break;
+			case '\\': o += "\\\\"; break;
+			case '\n': o += "\\n";  break;
+			case '\r': o += "\\r";  break;
+			case '\t': o += "\\t";  break;
+			default:
+				if ((unsigned char)c < 0x20)
+				{
+					char b[8];
+					sprintf(b, "\\u%04x", (unsigned char)c);
+					o += b;
+				}
+				else
+				{
+					o += c;
+				}
+			}
+		}
+		return o;
+	};
+	std::ostringstream j;
+	j << "{\n";
+	j << "  \"timestamp\": \"" << esc(timestamp) << "\",\n";
+	j << "  \"dump\": \"" << esc(dumpPath) << "\",\n";
+	j << "  \"log\": \"" << esc(logPath) << "\",\n";
+	j << "  \"version\": \"" << esc(version) << "\",\n";
+	j << "  \"exception\": \"" << esc(exceptionCode) << "\"\n";
+	j << "}\n";
+	const std::string marker = Options::getUserFolder() + "crash-pending.json";
+	const std::string data = j.str();
+	SDL_RWops *rw = SDL_RWFromFile(marker.c_str(), "w");
+	if (rw)
+	{
+		SDL_RWwrite(rw, data.c_str(), data.size(), 1);
+		SDL_RWclose(rw);
+		Log(LOG_FATAL) << "Crash reporter marker written to " << marker;
+	}
+}
+
 /**
  * Logs the details of this crash and shows an error.
  * @param ex Pointer to exception data (PEXCEPTION_POINTERS on Windows, signal int on Unix)
@@ -1492,6 +1550,10 @@ std::string now()
 void crashDump(void *ex, const std::string &err)
 {
 	std::ostringstream error;
+	// I5 crash reporter fields, filled by whichever platform branch runs below.
+	std::string crashDumpPath;      // full path to the .dmp (empty if none written)
+	std::string crashExceptionCode; // human-readable exception code / signal
+	std::string crashTimestamp;     // the dump's timestamp, reused for the marker
 #ifdef _MSC_VER
 	PEXCEPTION_POINTERS exception = (PEXCEPTION_POINTERS)ex;
 	std::exception *cppException = 0;
@@ -1508,13 +1570,19 @@ void crashDump(void *ex, const std::string &err)
 		error << "code 0x" << std::hex << exception->ExceptionRecord->ExceptionCode;
 		break;
 	}
+	{
+		std::ostringstream ec;
+		ec << "0x" << std::hex << exception->ExceptionRecord->ExceptionCode;
+		crashExceptionCode = ec.str();
+	}
 	Log(LOG_FATAL) << "A fatal error has occurred: " << error.str();
 	if (ex)
 	{
 		stackTrace(exception->ContextRecord);
 	}
+	crashTimestamp = now();
 	std::string dumpName = Options::getUserFolder();
-	dumpName += now() + ".dmp";
+	dumpName += crashTimestamp + ".dmp";
 	HANDLE dumpFile = CreateFileA(dumpName.c_str(), GENERIC_READ | GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
 	MINIDUMP_EXCEPTION_INFORMATION exceptionInformation;
 	exceptionInformation.ThreadId = GetCurrentThreadId();
@@ -1523,6 +1591,7 @@ void crashDump(void *ex, const std::string &err)
 	if (MiniDumpWriteDump(GetCurrentProcess(), GetCurrentProcessId(), dumpFile, MiniDumpNormal, exception ? &exceptionInformation : NULL, NULL, NULL))
 	{
 		Log(LOG_FATAL) << "Crash dump generated at " << dumpName;
+		crashDumpPath = dumpName; // I5: only mark a dump that was actually written
 	}
 	else
 	{
@@ -1548,7 +1617,21 @@ void crashDump(void *ex, const std::string &err)
 	}
 	Log(LOG_FATAL) << "A fatal error has occurred: " << error.str();
 	stackTrace(0);
+	{
+		std::ostringstream ec;
+		if (ex) ec << "signal " << *((int*)ex); else ec << "std::exception";
+		crashExceptionCode = ec.str();
+	}
 #endif
+	// I5: next-launch crash reporter marker - written LAST, after the dump and log,
+	// so a failure here can never cost us the crash artifacts. Only fired when a
+	// dump was actually written (the POSIX handler writes none, so the reporter is
+	// a Windows path today); a healthy next launch reads this and offers to bundle.
+	if (!crashDumpPath.empty())
+	{
+		writeCrashPendingMarker(crashTimestamp, crashDumpPath, getLogFileName(),
+			std::string(OPENXCOM_VERSION_SHORT) + OPENXCOM_VERSION_GIT, crashExceptionCode);
+	}
 	std::ostringstream msg;
 	msg << "OpenXcom has crashed: " << error.str() << std::endl;
 	msg << "Log file: " << getLogFileName() << std::endl;
diff --git a/src/Engine/Options.cpp b/src/Engine/Options.cpp
index 53f812ac4..c9616f947 100644
--- a/src/Engine/Options.cpp
+++ b/src/Engine/Options.cpp
@@ -578,11 +578,21 @@ void createAdvancedOptionsOTHER()
 	_info.push_back(OptionInfo(OPTION_OTHER, "UnbalancedCraftSoldiersLimit", &UnbalancedCraftSoldiersLimit, false, "Unbalanced Craft Soldiers Limit", "STR_BASESCAPE"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "EnableReactionFirePvp", &EnableReactionFirePvp, true, "Enable Reaction Fire in PvP", "STR_BATTLESCAPE"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "EnableOtherPlayerFootsteps", &EnableOtherPlayerFootsteps, true,"Enable Other Player Footstep Sounds", "STR_BATTLESCAPE"));
+	_info.push_back(OptionInfo(OPTION_OTHER, "coopFollowPeerActions", &coopFollowPeerActions, true, "Follow Teammate Actions with Camera", "STR_BATTLESCAPE"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "EnableXcomEquipmentAliensPVP", &EnableXcomEquipmentAliensPVP, true, "Enable XCOM Equipment for Aliens in PVP", "STR_BATTLESCAPE"));
+	// coop (PRD-P5): both players act during the same player side. Read by the HOST
+	// only - it ships the value on COOP_READY_HOST and the client mirrors it into
+	// connectionTCP::_enable_parallel_turns, so the session mode is decided once.
+	_info.push_back(OptionInfo(OPTION_OTHER, "EnableCoopParallelTurns", &EnableCoopParallelTurns, false, "Parallel Battlescape Turns", "STR_BATTLESCAPE"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "debugMode", &debugMode, true, "Enable Debug Mode (requires restart)", "STR_AI"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "logInfoToFile", &logInfoToFile, false, "Write INFO messages to log file", "STR_AI"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "logPacketMessages", &logPacketMessages, false, "Write packet messages to log files (heavy logging)", "STR_AI"));
 	_info.push_back(OptionInfo(OPTION_OTHER, "EnableHotseatDebugMode", &EnableHotseatDebugMode, false, "Enable Hotseat Debug Mode", "STR_AI"));
+	// coop (PRD-P5 §4): TEMPORARY dev plumbing, deleted by PRD-P6. With it on the
+	// co-op client's input executes LOCALLY and replicates NOTHING (every executor
+	// send site is _isActivePlayerSync-gated and the client permanently holds
+	// false), so the two machines intentionally diverge. Smoke-testing the input
+	// path only - never a play mode.
 
 }
 
diff --git a/src/Engine/Options.inc.h b/src/Engine/Options.inc.h
index 6c267e404..24d85afb6 100644
--- a/src/Engine/Options.inc.h
+++ b/src/Engine/Options.inc.h
@@ -101,6 +101,10 @@ OPT bool debugMode;
 OPT bool logInfoToFile;
 OPT bool logPacketMessages;
 OPT bool EnableHotseatDebugMode;
+// PRD-P1: follow a replayed teammate action with the camera (classic coop).
+// Default true = the pre-P1 behaviour. PRD-P5 suppresses camera-follow during a
+// parallel player side regardless of this option.
+OPT bool coopFollowPeerActions;
 
 OPT bool oxceAlternateCraftEquipmentManagement;
 OPT bool oxceBaseInfoScaleEnabled;
@@ -194,3 +198,9 @@ OPT std::vector< std::pair<std::string, bool> > mods; // ordered list of availab
 OPT SoundFormat currentSound;
 
 OPT int battleXcomSpeedOrig;
+
+// PRD-P0/P5 parallel battlescape turns. Declared here (no OptionInfo yet) so
+// the test harness can set them before PRD-P5 lands the toggle that reads
+// them; P5 registers them in createAdvancedOptionsOTHER() for the UI +
+// options.cfg persistence and drops the default-init in Options.cpp.
+OPT bool EnableCoopParallelTurns;
diff --git a/src/Geoscape/GeoscapeState.cpp b/src/Geoscape/GeoscapeState.cpp
index 71e01080e..431c13ede 100644
--- a/src/Geoscape/GeoscapeState.cpp
+++ b/src/Geoscape/GeoscapeState.cpp
@@ -1236,8 +1236,6 @@ void GeoscapeState::init()
 
 		_game->getCoopMod()->inventory_battle_window = true;
 
-		_game->getCoopMod()->gamePaused = 0;
-
 		_game->getCoopMod()->_battleWindow = false;
 		_game->getCoopMod()->_battleInit = false;
 
diff --git a/src/Menu/MainMenuState.cpp b/src/Menu/MainMenuState.cpp
index 6b541958a..261cbf602 100644
--- a/src/Menu/MainMenuState.cpp
+++ b/src/Menu/MainMenuState.cpp
@@ -36,6 +36,7 @@
 #include "../Savegame/SavedGame.h"
 #include "../Engine/FileMap.h"
 #include "../Engine/SDL2Helpers.h"
+#include "../CoopMod/SharedEcon.h" // PRD-I5: next-launch crash reporter
 #include <fstream>
 
 namespace OpenXcom
@@ -181,6 +182,17 @@ void GoToMainMenuState::init()
 	Screen::updateScale(Options::geoscapeScale, Options::baseXGeoscape, Options::baseYGeoscape, true);
 	_game->getScreen()->resetDisplay(false);
 	_game->setState(new MainMenuState(_updateCheck));
+
+	// PRD-I5: next-launch crash reporter. Fires only on the fresh-boot transition
+	// (StartState -> GoToMainMenuState(true)), i.e. once per launch, at the main-menu
+	// altitude (world already torn down by setSavedGame(0) above) - the same
+	// "before the main menu" altitude the save-upgrade flow lives at. Best-effort
+	// and O(one stat call) when no marker exists; pushed AFTER setState so it lands
+	// on top of the freshly-set MainMenuState. Never blocks startup.
+	if (_updateCheck)
+	{
+		SharedEcon::maybeReportPreviousCrash(_game);
+	}
 }
 
 /**
diff --git a/src/Savegame/BattleItem.cpp b/src/Savegame/BattleItem.cpp
index fc0e60890..9219d5f89 100644
--- a/src/Savegame/BattleItem.cpp
+++ b/src/Savegame/BattleItem.cpp
@@ -1087,6 +1087,15 @@ int BattleItem::getId() const
 	return _id;
 }
 
+/**
+ * coop (PRD-P4): re-stamps the item's id with the host's.
+ * @param id The id the HOST minted for this instance.
+ */
+void BattleItem::setIdCoop(int id)
+{
+	_id = id;
+}
+
 /**
  * Gets the corpse's unit.
  * @return Pointer to BattleUnit.
diff --git a/src/Savegame/BattleItem.h b/src/Savegame/BattleItem.h
index 02758b7fd..f5dd97923 100644
--- a/src/Savegame/BattleItem.h
+++ b/src/Savegame/BattleItem.h
@@ -89,6 +89,11 @@ class BattleItem
 	const RuleItem *getRules() const;
 	/// Gets the item's ammo quantity
 	int getAmmoQuantity() const;
+	/// coop (PRD-I3 SEAM-11): the RAW _ammoQuantity field, NOT getAmmoQuantity()'s
+	/// clipSize==-1 special (which returns 255). The save serializes the raw field, so
+	/// the coop ammo-sync must ship the raw value or a self-powered weapon reads -1 on
+	/// the host but 255 on a peer that adopted getAmmoQuantity().
+	int getAmmoQuantityRaw() const { return _ammoQuantity; }
 	/// Sets the item's ammo quantity.
 	void setAmmoQuantity(int qty);
 
@@ -197,6 +202,15 @@ class BattleItem
 	void setTile(Tile *tile);
 	/// Gets it's unique id.
 	int getId() const;
+	/// coop (PRD-P4): re-stamps this item's unique id with the HOST's.
+	///
+	/// The id is normally minted once, from SavedBattleGame::_itemId, and is the
+	/// identity every co-op packet keys on. For a Tier-A spawn (a deterministic set
+	/// created independently on both machines - corpses, death traps, convertUnit
+	/// built-ins) the host ships the ids it minted and the peer re-stamps its own
+	/// copies with them, so the two machines keep denoting the same instance.
+	/// NOT a general-purpose setter: only the id-manifest apply path may call it.
+	void setIdCoop(int id);
 	/// Gets the corpse's unit.
 	BattleUnit *getUnit();
 	/// Gets the corpse's unit.
diff --git a/src/Savegame/BattleUnit.cpp b/src/Savegame/BattleUnit.cpp
index e3491ad8a..59ea15db8 100644
--- a/src/Savegame/BattleUnit.cpp
+++ b/src/Savegame/BattleUnit.cpp
@@ -20,6 +20,7 @@
 #include "BattleItem.h"
 #include <sstream>
 #include <algorithm>
+#include <array>
 #include "../Engine/Collections.h"
 #include "../Engine/Surface.h"
 #include "../Engine/Script.h"
@@ -2017,16 +2018,34 @@ int BattleUnit::damage(Position relative, int damage, const RuleDamageType *type
 			&& !hasAlreadyExploded() && selfDestructItem)
 		{
 			setAlreadyExploded(true);
+			// coop (PRD-P3 GAP-4b): ExplosionBState::init rolls
+			// RNG::percent(getSpecialChance()) for a BA_SELF_DESTRUCT, and it does so
+			// AFTER this packet has already gone out - so the two machines could
+			// disagree about whether the corpse actually detonates. Roll it here
+			// instead (this whole function is host-only) and park it for the local
+			// ExplosionBState while the peer gets it on the packet.
+			bool triggered = true;
+			const bool coopHostSD = connectionTCP::getCoopStatic() == true && connectionTCP::getHost() == true;
+			if (coopHostSD)
+			{
+				triggered = RNG::percent(selfDestructItem->getRules()->getSpecialChance());
+				save->getBattleGame()->getCoopMod()->_selfDestructResults.push_back(triggered ? 1 : 0);
+			}
 			Position p = getPosition().toVoxel();
 			save->getBattleGame()->statePushNext(new ExplosionBState(save->getBattleGame(), p, BattleActionAttack{ BA_SELF_DESTRUCT, this, selfDestructItem, selfDestructItem }, 0));
 
 			// coop
-			if (connectionTCP::getCoopStatic() == true && connectionTCP::getHost() == true)
+			if (coopHostSD)
 			{
 
 				Json::Value root;
 				root["state"] = "selfDestruct";
+				// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+				// client's action_end apply-barrier accounts for this parked self-destruct
+				// pre-roll (no-op off the parallel host, _openChainSeq==0).
+				connectionTCP::coopStampChainSeq(root);
 				root["unit_id"] = _id;
+				root["triggered"] = triggered;
 
 				connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
 
@@ -2378,6 +2397,43 @@ int BattleUnit::getCoop() const
 	return _coop;
 }
 
+/**
+ * Accepts a stamped coop per-unit state write only if its stamp is >= the
+ * unit's recorded watermark (lexicographic compare on side_seq, action_seq,
+ * rank). On accept, records the new stamp. Equal stamps accept (idempotent
+ * re-delivery of the same chain link).
+ */
+// coop DIAGNOSTIC (reject-set audit, 2026-08-26): capture-gated, counters-only, NO state
+// effect - inert unless armed by the SEAM-7 field capture (arm/clear driven from
+// coopApplyNextTurnUnitStates). Records rank-0 (next_turn snapshot) watermark REJECTIONS:
+// the rejected unit id + incoming next_turn stamp (side_seq, action_seq) vs the beating
+// recorded watermark (side_seq, action_seq, rank).
+namespace {
+	bool g_coopWmDbgArmed = false;
+	std::vector<std::array<std::uint32_t, 6> > g_coopWmDbgRejects; // {unitId, inSide, inSeq, recSide, recSeq, recRank}
+}
+void coopWmDbgArm(bool on) { g_coopWmDbgArmed = on; }
+void coopWmDbgClear() { g_coopWmDbgRejects.clear(); }
+const std::vector<std::array<std::uint32_t, 6> >& coopWmDbgRejects() { return g_coopWmDbgRejects; }
+
+bool BattleUnit::coopStateAccept(uint32_t side, uint32_t seq, uint8_t rank)
+{
+	if (std::tie(side, seq, rank) >= std::tie(_coopStateSideSeq, _coopStateActionSeq, _coopStateRank))
+	{
+		_coopStateSideSeq = side;
+		_coopStateActionSeq = seq;
+		_coopStateRank = rank;
+		return true;
+	}
+	if (g_coopWmDbgArmed && rank == 0 && g_coopWmDbgRejects.size() < 128)
+	{
+		std::array<std::uint32_t, 6> rec = { static_cast<std::uint32_t>(getId()), side, seq,
+			_coopStateSideSeq, _coopStateActionSeq, static_cast<std::uint32_t>(_coopStateRank) };
+		g_coopWmDbgRejects.push_back(rec);
+	}
+	return false;
+}
+
 /**
  * Spend time units if it can. Return false if it can't.
  * @param tu
@@ -2815,7 +2871,13 @@ void BattleUnit::prepareHealth(int health)
 	health -= getFatalWounds();
 
 	// suffer from fire
-	if (!_hitByFire && _fire > 0)
+	// coop (PRD-I3 straddle): fire regen damage is an RNG draw the host owns; its
+	// result (health + the unit `fire` counter) is re-shipped on `next_turn`. On a
+	// PARALLEL client the local draw would diverge from the host's, so defer it -
+	// the deterministic fatal-wound subtraction above still runs on both machines.
+	// Classic/option-off: parallelTurnActive() false, byte-identical.
+	const bool coopClientDefer = connectionTCP::parallelTurnActive() && !connectionTCP::getHost();
+	if (!coopClientDefer && !_hitByFire && _fire > 0)
 	{
 		health -= reduceByResistance(RNG::generate(Mod::FIRE_DAMAGE_RANGE[0], Mod::FIRE_DAMAGE_RANGE[1]), DT_IN);
 		_fire--;
@@ -2865,7 +2927,14 @@ void BattleUnit::prepareMorale(int morale)
 	{
 		moraleChange(morale);
 		int chance = 100 - (2 * getMorale());
-		if (RNG::percent(chance))
+		// coop (PRD-I3 straddle): the panic/berserk decision is an RNG draw the host
+		// owns; its outcome (the unit `status`) is re-shipped on `next_turn` (and the
+		// resolved panic on `panic_action`). A PARALLEL client must not roll it
+		// locally or the two RNG streams diverge - it takes the deterministic
+		// no-panic path instead, so the bravery-exp increment below still runs and a
+		// no-panic turn keeps expBravery synced. Classic/option-off: byte-identical.
+		const bool coopClientDefer = connectionTCP::parallelTurnActive() && !connectionTCP::getHost();
+		if (!coopClientDefer && RNG::percent(chance))
 		{
 			int berserkChance = _unitRules ? _unitRules->getBerserkChance() : -1; // -1 represents true 1/3 (33.33333...%)
 			bool berserk = false;
@@ -2950,6 +3019,39 @@ void BattleUnit::prepareNewTurn(bool fullProcess)
 	updateUnitStats(false, true);
 }
 
+/**
+ * coop (PRD-I3 Option D-lite): the DETERMINISTIC per-unit terms of prepareNewTurn
+ * that `next_turn` does NOT re-ship, run at the deferred neutral->player apply point
+ * on the parallel client (whose whitelisted `endTurn` no longer runs the turn machine
+ * for that transition). It is the strict subset of prepareNewTurn(true) left over
+ * once next_turn's bulk apply has authored the re-shipped stats (tu/energy/health/
+ * stun/morale/mana/fire/fatalWounds/status/position/motionPoints) and once the RNG
+ * regen terms (prepareHealth fire draw, prepareMorale panic/berserk) are gated off on
+ * the client (the SEAM-2 straddle fix). What is left is exactly the audit's set:
+ * turnsSinceStunned (kept in saveBlob), dontReselect and meleeAttackedBy - plus the
+ * unhashed housekeeping resets prepareNewTurn also makes here so the client's live
+ * state matches. Called for PLAYER-faction units only, mirroring endTurn()'s
+ * `bu->getFaction() == _side` at neutral->player; isOut() is checked exactly as
+ * incTurnsSinceStunned's own guard does, so a soldier who fell during the alien side
+ * is skipped on both machines (it is already out when the host reaches player-start).
+ */
+void BattleUnit::coopApplyDeferredTurnStart()
+{
+	if (isIgnored())
+	{
+		return;
+	}
+	_isSurrendering = false;
+	_unitsSpottedThisTurn.clear();
+	_meleeAttackedBy.clear();
+	_hitByFire = false;
+	_dontReselect = false;
+	if (!isOut())
+	{
+		incTurnsSinceStunned();
+	}
+}
+
 /**
  * Update stats of unit.
  * @param tuAndEnergy
@@ -3101,6 +3203,10 @@ void BattleUnit::setFire(int fire)
 
 		Json::Value root;
 		root["state"] = "unit_fire";
+		// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+		// holds this outcome for its own chain's opener instead of contaminating
+		// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(root);
 
 		root["unit_id"] = _id;
 		root["fire"] = _fire;
diff --git a/src/Savegame/BattleUnit.h b/src/Savegame/BattleUnit.h
index 0b8073120..3c8fdb136 100644
--- a/src/Savegame/BattleUnit.h
+++ b/src/Savegame/BattleUnit.h
@@ -20,6 +20,8 @@
 #include <vector>
 #include <string>
 #include <unordered_set>
+#include <cstdint>
+#include <tuple>
 #include "../Battlescape/Position.h"
 #include "../Mod/Armor.h"
 #include "../Mod/RuleItem.h"
@@ -227,6 +229,34 @@ class BattleUnit
 	void setHealth(int health);
 	int _coopDamage = 0;
 	int _coopHealth = 0;
+	// coop: per-unit state watermark (plan v3 Phase 1) - stamped writes only apply if >= recorded stamp
+	uint32_t _coopStateSideSeq = 0;
+	uint32_t _coopStateActionSeq = 0;
+	uint8_t _coopStateRank = 0;
+	/// Accepts a stamped coop state write if it is >= the recorded watermark; records and returns true on accept.
+	bool coopStateAccept(uint32_t side, uint32_t seq, uint8_t rank);
+	// coop (parallel battlescape Phase 2c - death ghost): PRESENTATION-ONLY display
+	// overrides driven by the client-side death ghost (UnitDieBState ghost mode). The
+	// unit's real _status/_direction/_fallPhase are ALREADY the host's final values
+	// after coopApplyCasualty ran (dead + tile-unlinked); the ghost replays the vanilla
+	// collapse animation on these override fields so the sprite still shows the unit
+	// falling while the world state stays final underneath. NEVER serialized
+	// (BattleUnit::save untouched), never hashed, read ONLY by UnitSprite (via the
+	// display*() accessors) and Map (the ghost draw). Zero cost when the override is off
+	// - display*() returns the real getter, so every non-ghost draw is byte-identical.
+	bool _coopDisplayOverride = false;
+	UnitStatus _coopDisplayStatus = STATUS_STANDING;
+	int _coopDisplayDir = 0;
+	int _coopDisplayFallPhase = 0;
+	void setCoopDisplayOverride(bool on) { _coopDisplayOverride = on; }
+	void clearCoopDisplayOverride() { _coopDisplayOverride = false; }
+	void setCoopDisplayStatus(UnitStatus s) { _coopDisplayStatus = s; }
+	void setCoopDisplayDir(int d) { _coopDisplayDir = d; }
+	void setCoopDisplayFallPhase(int p) { _coopDisplayFallPhase = p; }
+	bool coopDisplayOverride() const { return _coopDisplayOverride; }
+	UnitStatus displayStatus() const { return _coopDisplayOverride ? _coopDisplayStatus : getStatus(); }
+	int displayDirection() const { return _coopDisplayOverride ? _coopDisplayDir : getDirection(); }
+	int displayFallingPhase() const { return _coopDisplayOverride ? _coopDisplayFallPhase : getFallingPhase(); }
 	static const int MAX_SOLDIER_ID = 1000000;
 	static const int BUBBLES_FIRST_FRAME = 3;
 	static const int BUBBLES_LAST_FRAME = BUBBLES_FIRST_FRAME + 15;
@@ -328,6 +358,10 @@ class BattleUnit
 	bool isKneeled() const;
 	/// Is floating?
 	bool isFloating() const;
+	/// coop (PRD-I3 z-gravity close): clear/set the floating bit when the peer applies
+	/// the host's landed fall position (the vanished floor left the thin client's copy
+	/// floating; setTile refreshes _haveNoFloorBelow but never touches _floating).
+	void setFloatingCoop(bool floating) { _floating = floating; }
 	/// Have unit floor below?
 	bool haveNoFloorBelow() const { return _haveNoFloorBelow; }
 
@@ -599,6 +633,11 @@ class BattleUnit
 	std::string getName(Language *lang, bool debugAppendId = false) const;
 	/// Gets the unit's gained experience points.
 	const UnitStats* getExpStats() const { return &_exp; }
+	// coop
+	/// Sets the unit's gained experience points (E5a GAP-XP: parallel thin
+	/// client apply of the host's post-award absolutes shipped on hit_unit -
+	/// see TileEngine.cpp hitUnit send + connectionTCP.cpp hit_unit handler).
+	void setExpStatsCoop(const UnitStats& e) { _exp = e; }
 	/// Gets the unit's stats.
 	UnitStats *getBaseStats();
 	/// Gets the unit's stats.
@@ -737,6 +776,10 @@ class BattleUnit
 	void incTurnsSinceStunned() { _turnsSinceStunned = std::min(255, _turnsSinceStunned + 1); }
 	/// Return how many turns passed since stunned last time.
 	int getTurnsSinceStunned() const { return _turnsSinceStunned; }
+	/// coop (PRD-I3 Option D-lite): run only the DETERMINISTIC per-unit terms that
+	/// prepareNewTurn advances and next_turn does NOT re-ship, at the deferred
+	/// neutral->player apply point on the parallel client.
+	void coopApplyDeferredTurnStart();
 
 	/// Get this unit's original faction
 	UnitFaction getOriginalFaction() const;
diff --git a/src/Savegame/SavedBattleGame.cpp b/src/Savegame/SavedBattleGame.cpp
index 7fbb8aa1c..3f60500af 100644
--- a/src/Savegame/SavedBattleGame.cpp
+++ b/src/Savegame/SavedBattleGame.cpp
@@ -55,9 +55,16 @@
 #include "../fmath.h"
 #include "../Engine/Language.h"
 #include "../CoopMod/connectionTCP.h"
+#include "../CoopMod/SharedEcon.h" // coop (PRD-P4): Tier-A spawn id-manifest
 
 namespace OpenXcom
 {
+// coop (explosion ordered-replay E0, LEAK-OBJ): file-scope in connectionTCP.cpp;
+// extern-declared here so addDestroyedObjective() can gate on them without a
+// connectionTCP.h class-layout change.
+extern std::atomic<uint32_t> g_objectiveLeakBlocked;
+extern std::atomic<bool> g_objectiveGateDisable;
+
 /**
  * Initializes a brand new battlescape saved game.
  */
@@ -1299,6 +1306,28 @@ void SavedBattleGame::newTurnUpdateScripts()
 		return;
 	}
 
+	// coop (PRD-P3 GAP-10, mods first-class): the mod newTurnUnit/newTurnItem script
+	// hooks below can draw randomChance/randomRange from the GLOBAL RNG stream, and
+	// BOTH machines run this loop - the parallel client reaches it via
+	// BattlescapeGame::endTurn -> _save->endTurn on every side close (empirically
+	// proven: with a per-turn newTurnUnit script every unit's rolled tag diverged
+	// host vs client). The two machines' streams diverge, so without help every
+	// per-turn script roll differs. Seed-replay fix (the spawn_units B2 pattern
+	// applied to the whole loop): reseed the global RNG to the side-boundary seed the
+	// host stamps on `endTurn` and the client adopts, so both draw the SAME sequence
+	// over the SAME units/items in the SAME order - a balanced-by-construction relay
+	// (no FIFO to unbalance, unlike GAP-7). Save+restore leaves every other RNG
+	// consumer byte-identical, and is a strict no-op when no script draws (vanilla and
+	// non-scripted mods, so the existing parallel battles are unchanged). Parallel
+	// only; classic ships its seed on a different packet and is out of the parallel
+	// merge scope (recorded finding).
+	const bool coopScriptRng = connectionTCP::parallelTurnActive();
+	const uint64_t savedRngSeed = RNG::getSeed();
+	if (coopScriptRng)
+	{
+		RNG::setSeed(connectionTCP::_scriptRngSeed);
+	}
+
 	for (auto* bu : _units)
 	{
 		if (bu->isIgnored())
@@ -1319,6 +1348,11 @@ void SavedBattleGame::newTurnUpdateScripts()
 		ModScript::scriptCallback<ModScript::NewTurnItem>(item->getRules(), item, this, this->getTurn(), _side);
 	}
 
+	if (coopScriptRng)
+	{
+		RNG::setSeed(savedRngSeed);
+	}
+
 	reviveUnconsciousUnits(false);
 
 	getBattleGame()->convertInfected();
@@ -1567,7 +1601,18 @@ void SavedBattleGame::endTurn()
 	}
 	else if (_side == FACTION_NEUTRAL)
 	{
+		// coop (PRD-I3 SEAM-2 HALF 2): this is the ONE hazard-decay boundary of the
+		// turn cycle (the sole SavedBattleGame::prepareNewTurn caller). Mark it so the
+		// host's set_smoke_tile/set_fire_tile decay sends carry `bnd:true`; the client
+		// then applies them through the ORDERED gate (in FIFO after the ai-chain
+		// replay, before next_turn) instead of the always-consume whitelist, so its
+		// ai-seq hazard hashes sample PRE-decay state matching the host's pre-decay
+		// ring entries. Set/clear tightly around the call (prepareNewTurn does not
+		// throw); harmless on the non-host machine, where the call early-returns and
+		// the tile setters are host-gated no-ops.
+		connectionTCP::coopSetBoundaryDecay(true);
 		prepareNewTurn();
+		connectionTCP::coopSetBoundaryDecay(false);
 		_turn++;
 		_side = FACTION_PLAYER;
 		if (_lastSelectedUnit && _lastSelectedUnit->isSelectable(FACTION_PLAYER, false, false))
@@ -1957,6 +2002,9 @@ void SavedBattleGame::removeItem(BattleItem *item)
 	{
 		return;
 	}
+	// coop (three-class RCA DIAGNOSTIC, items): tag the actual removal, capture-gated.
+	coopDiagS("item.remove cid=" + std::to_string(item->getCoopID())
+		+ " t=" + (item->getRules() ? item->getRules()->getType() : std::string("?")));
 
 	// due to strange design, the item has to be removed from the tile it is on too (if it is on a tile)
 	item->moveToOwner(nullptr);
@@ -2103,6 +2151,9 @@ BattleItem *SavedBattleGame::createItemForUnit(const RuleItem *rule, BattleUnit
 	else
 	{
 		_items.push_back(item);
+		// coop (PRD-P4): only after the item is actually KEPT - an item the unit
+		// refused never existed, so it must not consume a host id either.
+		SharedEcon::noteMintedItem(item);
 		initItem(item, unit);
 	}
 	return item;
@@ -2122,6 +2173,7 @@ BattleItem *SavedBattleGame::createItemForUnitSpecialBuiltin(const RuleItem *rul
 	item->setOwner(unit);
 	item->setSlot(nullptr);
 	_items.push_back(item);
+	SharedEcon::noteMintedItem(item); // coop (PRD-P4)
 	initItem(item, unit);
 	return item;
 }
@@ -2150,6 +2202,11 @@ BattleItem *SavedBattleGame::createItemForTile(const RuleItem *rule, Tile *tile,
 	}
 	item->setUnit(corpseFor);
 	_items.push_back(item);
+	SharedEcon::noteMintedItem(item); // coop (PRD-P4)
+	// coop (three-class RCA DIAGNOSTIC, items): tag the mint, capture-gated.
+	coopDiagS("item.mint cid=" + std::to_string(item->getCoopID())
+		+ " t=" + (rule ? rule->getType() : std::string("?"))
+		+ (corpseFor ? " corpse" : ""));
 	initItem(item);
 	return item;
 }
@@ -2161,7 +2218,9 @@ BattleItem *SavedBattleGame::createItemForTile(const RuleItem *rule, Tile *tile,
  */
 BattleItem *SavedBattleGame::createTempItem(const RuleItem *rule)
 {
-	return new BattleItem(rule, getCurrentItemId());
+	BattleItem *item = new BattleItem(rule, getCurrentItemId());
+	SharedEcon::noteMintedItem(item); // coop (PRD-P4)
+	return item;
 }
 
 /**
@@ -2259,7 +2318,15 @@ BattleUnit *SavedBattleGame::convertUnit(BattleUnit *unit)
 	newUnit->setPosition(unit->getPosition());
 	newUnit->setDirection(unit->getDirection());
 	getUnits()->push_back(newUnit);
-	initUnit(newUnit);
+	{
+		// coop (PRD-P4): Tier-A spawn. initUnit() mints the respawn's fixed built-in
+		// weapons - a set fixed by getSpawnUnit()'s rules, so both machines create
+		// the same items and only the ids can drift. Keyed on the DYING unit's id,
+		// which is what the `convertUnit` packet carries.
+		SharedEcon::CoopSpawnRecord coopRec("convert", unit->getId());
+		SharedEcon::CoopSubjectGuard coopGuard(this, "convert", unit->getId());
+		initUnit(newUnit);
+	}
 
 	getTileEngine()->calculateFOV(newUnit->getPosition());  //happens fairly rarely, so do a full recalc for units in range to handle the potential unit visible cache issues.
 	getTileEngine()->applyGravity(newUnit->getTile());
@@ -2292,20 +2359,17 @@ BattleUnit *SavedBattleGame::convertUnit(BattleUnit *unit)
 		else if (connectionTCP::getCoopGamemode() == 4)
 		{
 
-			if (connectionTCP::_isActivePlayerSync == true)
-			{
-				unit->setCoop(1);
-				newUnit->setCoop(1);
-			}
-			else
-			{
-				unit->setCoop(0);
-				newUnit->setCoop(0);
-			}
+			// coop (PRD-P3, AUDIT-guards top break): this used to read
+			// _isActivePlayerSync and the host branch below assigned the OPPOSITE
+			// value, so the pair only agreed while exactly one machine held the flag.
+			// The respawn now inherits the DYING unit's owner - a value both machines
+			// already hold and compute identically, with no dependence on whose turn
+			// it is.
+			newUnit->setCoop(unit->getCoop());
 
 			unit->convertToFaction(FACTION_PLAYER);
 			unit->setOriginalFaction(FACTION_PLAYER);
-	
+
 			newUnit->convertToFaction(FACTION_PLAYER);
 			newUnit->setOriginalFaction(FACTION_PLAYER);
 
@@ -2319,11 +2383,17 @@ BattleUnit *SavedBattleGame::convertUnit(BattleUnit *unit)
 
 		Json::Value root;
 		root["state"] = "convertUnit";
+		// coop (PHASE D.1 chain-atomicity): stamp the open chain's seq+side so the
+		// client's action_end apply-barrier waits for this respawn/convert before
+		// sampling the chain's post-N sync-check hash (no-op off the parallel host).
+		connectionTCP::coopStampChainSeq(root);
 
 		root["unit_id"] = unit->getId();
 		root["respawn"] = unit->getRespawn();
 		root["spawn_unit_faction"] = (int)unit->getSpawnUnitFaction();
 		root["spawn_unit_type"] = unit->getSpawnUnit()->getType();
+		// coop (PRD-P4): the ids initUnit() just minted for the respawn's built-ins.
+		SharedEcon::flushSpawnRecord(root, "convert", unit->getId());
 
 		connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
 
@@ -2351,16 +2421,10 @@ BattleUnit *SavedBattleGame::convertUnit(BattleUnit *unit)
 		else if (connectionTCP::getCoopGamemode() == 4)
 		{
 
-			if (connectionTCP::_isActivePlayerSync == true)
-			{
-				unit->setCoop(0);
-				newUnit->setCoop(0);
-			}
-			else
-			{
-				unit->setCoop(1);
-				newUnit->setCoop(1);
-			}
+			// coop (PRD-P3): same seat-deterministic rule as the client branch above
+			// - the respawn inherits the dying unit's owner, so both machines reach
+			// the same answer without consulting _isActivePlayerSync.
+			newUnit->setCoop(unit->getCoop());
 
 			unit->convertToFaction(FACTION_PLAYER);
 			unit->setOriginalFaction(FACTION_PLAYER);
@@ -2426,6 +2490,19 @@ void SavedBattleGame::setObjectiveCount(int counter)
  */
 void SavedBattleGame::addDestroyedObjective()
 {
+	// coop (explosion ordered-replay E0, LEAK-OBJ): the client (parallel AND classic)
+	// inflates _objectivesDestroyed via the neutered explode()/Tile::destroy `return true`
+	// stubs -> it must NOT count objective destruction or drive autoEndBattle/missionComplete.
+	// Host is authoritative; it ships the count on next_turn. Classic idiom on purpose
+	// (owner Q4 = fix classic too). TEST lever objective_gate_disable reverts it (same-build red).
+	if (getBattleGame()
+		&& getBattleGame()->getCoopMod()->getCoopStatic() == true
+		&& getBattleGame()->getCoopMod()->getHost() == false
+		&& !OpenXcom::g_objectiveGateDisable.load(std::memory_order_relaxed))
+	{
+		++OpenXcom::g_objectiveLeakBlocked;
+		return;
+	}
 	if (!allObjectivesDestroyed())
 	{
 		_objectivesDestroyed++;
@@ -2461,6 +2538,18 @@ int *SavedBattleGame::getCurrentItemId()
 	return &_itemId;
 }
 
+/**
+ * Gets the current item ID without handing out the counter itself.
+ * PRD-P2: the co-op drift tripwire stamps this on the wire. EVERY `new BattleItem`
+ * advances it (BattleItem's ctor post-increments), even a transient one that is
+ * never added to _items, so an uneven mint on one machine shows up here at once.
+ * @return Current item ID value.
+ */
+int SavedBattleGame::getCurrentItemIdValue() const
+{
+	return _itemId;
+}
+
 /**
  * Finds a fitting node where a unit can spawn.
  * @param nodeRank Rank of the node (this is not the rank of the alien!).
@@ -2590,6 +2679,21 @@ Node *SavedBattleGame::getPatrolNode(bool scout, BattleUnit *unit, Node *fromNod
  */
 void SavedBattleGame::prepareNewTurn()
 {
+	// coop (PRD-I3 SEAM-2 + straddle): in a PARALLEL player side the boundary-phase
+	// tile decay is host-authoritative and re-shipped wholesale on `next_turn`
+	// (connectionTCP.cpp resets every tile's fire/smoke/dangerous then re-applies the
+	// host's snapshot), so the non-host machine must NOT run its own decay. Left
+	// ungated, the client's smoke SPREADS (Tile::addSmoke) and AVERAGES
+	// (Tile::prepareNewTurn) while its DECREMENT (Tile::setSmoke/setFire) is a
+	// host-gated no-op - "spread-without-decrement" that mangles the client's smoke
+	// (SEAM-2), and calculateEnviDamage below rolls fire/smoke RNG the host owns
+	// (the straddle). Gating the whole call-site is cleaner than per-setter gates and
+	// covers calculateEnviDamage in one place. Classic and option-off paths are
+	// untouched (parallelTurnActive() is false), so classic stays byte-identical.
+	if (connectionTCP::parallelTurnActive() && !connectionTCP::getHost())
+	{
+		return;
+	}
 
 	std::vector<Tile*> tilesOnFire;
 	std::vector<Tile*> tilesOnSmoke;
@@ -4130,10 +4234,33 @@ void flashLongMessageVariadicScriptImpl(SavedBattleGame* sbg, ScriptText message
 
 
 
+/**
+ * coop (PRD-P3 GAP-10): the two mod-script RNG bindings below draw from the GLOBAL
+ * stream on whichever machine happens to run the script, and nothing captures or
+ * ships the result - so any modded battle behaviour built on them diverges silently
+ * between host and peer. Fixing that properly needs a host-decides channel for
+ * arbitrary script calls, which is out of scope here; V1 is to say so, once, so a
+ * modder who hits it can see it in the log instead of chasing a phantom desync.
+ */
+static void coopWarnScriptRng(const SavedBattleGame* sbg, const char* which)
+{
+	static bool warned = false;
+	if (warned || !connectionTCP::getCoopStatic())
+	{
+		return;
+	}
+	warned = true;
+	Log(LOG_WARNING) << "coop: mod script called " << which << " during a co-op battle. "
+					 << "Script RNG is UNSUPPORTED in co-op: each machine draws from its own "
+					 << "stream and the result is not replicated, so anything it decides can "
+					 << "differ between the two players (turn " << (sbg ? sbg->getTurn() : -1) << ").";
+}
+
 void randomChanceScript(SavedBattleGame* sbg, int& val)
 {
 	if (sbg)
 	{
+		coopWarnScriptRng(sbg, "randomChance");
 		val = RNG::percent(val);
 	}
 	else
@@ -4146,6 +4273,7 @@ void randomRangeScript(SavedBattleGame* sbg, int& val, int min, int max)
 {
 	if (sbg && max >= min)
 	{
+		coopWarnScriptRng(sbg, "randomRange");
 		val = RNG::generate(min, max);
 	}
 	else
diff --git a/src/Savegame/SavedBattleGame.h b/src/Savegame/SavedBattleGame.h
index 005d71b2b..c3f99d3c7 100644
--- a/src/Savegame/SavedBattleGame.h
+++ b/src/Savegame/SavedBattleGame.h
@@ -471,8 +471,18 @@ class SavedBattleGame
 	void addDestroyedObjective();
 	/// Checks if all the objectives are destroyed.
 	bool allObjectivesDestroyed() const;
+	/// coop (explosion ordered-replay E0): host->client parity readout for the
+	/// objective counter (LEAK-OBJ gates the client's own increment, so it
+	/// converges to the host's absolute instead - see NextTurnState/connectionTCP).
+	int getObjectivesDestroyed() const { return _objectivesDestroyed; }
+	/// coop (explosion ordered-replay E0): counterpart readout, for parity assertions.
+	int getObjectivesNeeded() const { return _objectivesNeeded; }
+	/// coop (explosion ordered-replay E0): client-side apply of the host's absolute.
+	void setObjectivesDestroyed(int n) { _objectivesDestroyed = n; }
 	/// Gets the current item ID.
 	int *getCurrentItemId();
+	/// Gets the current item ID value (const read; the co-op drift tripwire).
+	int getCurrentItemIdValue() const;
 	/// Gets a spawn node.
 	Node *getSpawnNode(int nodeRank, BattleUnit *unit);
 	/// Gets a patrol node.
diff --git a/src/Savegame/SavedGame.cpp b/src/Savegame/SavedGame.cpp
index 49caf9e3c..5868b4c61 100644
--- a/src/Savegame/SavedGame.cpp
+++ b/src/Savegame/SavedGame.cpp
@@ -348,6 +348,9 @@ void SavedGame::loadCoopSaveFromMemory(const std::string& filename, Mod* mod, La
 	reader.tryRead("saveID", connectionTCP::saveID);
 	reader.tryRead("coop_gamemode", connectionTCP::_coopGamemode);
 	reader.tryRead("coop_save_owner_player_id", connectionTCP::coop_save_owner_player_id);
+	// coop (PRD-P5): the parallel-turns session mode survives a save/load so a
+	// mid-battle resume comes back in the same mode it was played in.
+	reader.tryRead("coop_parallel_turns", connectionTCP::_enable_parallel_turns);
 	if (connectionTCP::isCoopBaseLoading == false && connectionTCP::getServerOwner() == false)
 	{
 		reader.tryRead("no_bases", connectionTCP::no_bases);
@@ -857,6 +860,9 @@ void SavedGame::load(const std::string &filename, Mod *mod, Language *lang)
 	reader.tryRead("saveID", connectionTCP::saveID);
 	reader.tryRead("coop_gamemode", connectionTCP::_coopGamemode);
 	reader.tryRead("coop_save_owner_player_id", connectionTCP::coop_save_owner_player_id);
+	// coop (PRD-P5): the parallel-turns session mode survives a save/load so a
+	// mid-battle resume comes back in the same mode it was played in.
+	reader.tryRead("coop_parallel_turns", connectionTCP::_enable_parallel_turns);
 	// Single-authority: a host save embeds every client-world blob captured
 	// at save time. Restore them as the served copies (memory only - the
 	// reconnect flow streams from these), so a rolled-back save rolls every
@@ -1324,6 +1330,8 @@ void SavedGame::saveCoopToMemory(const std::string& filename, Mod* mod, const st
 		writer.write("saveID", connectionTCP::saveID);
 	writer.write("coop_gamemode", connectionTCP::_coopGamemode);
 	writer.write("coop_save_owner_player_id", connectionTCP::coop_save_owner_player_id);
+	// coop (PRD-P5)
+	writer.write("coop_parallel_turns", connectionTCP::_enable_parallel_turns);
 	writer.write("no_bases", connectionTCP::no_bases);
 
 	writer.write("monthsPassed", _monthsPassed);
@@ -1802,6 +1810,8 @@ void SavedGame::save(const std::string &filename, Mod *mod) const
 		writer.write("saveID", connectionTCP::saveID);
 	writer.write("coop_gamemode", connectionTCP::_coopGamemode);
 	writer.write("coop_save_owner_player_id", connectionTCP::coop_save_owner_player_id);
+	// coop (PRD-P5)
+	writer.write("coop_parallel_turns", connectionTCP::_enable_parallel_turns);
 	writer.write("no_bases", connectionTCP::no_bases);
 	// Single-authority: embed the freshest client-world blob of EVERY client
 	// so this save captures all players' rosters atomically. Skip when this
diff --git a/src/Savegame/Tile.cpp b/src/Savegame/Tile.cpp
index 6c739ce30..ec9d6a24c 100644
--- a/src/Savegame/Tile.cpp
+++ b/src/Savegame/Tile.cpp
@@ -359,7 +359,7 @@ int Tile::getFootstepSound(Tile *tileBelow) const
  * @param rClick
  * @return a value: 0(normal door), 1(ufo door) or -1 if no door opened or 3 if ufo door(=animated) is still opening 4 if not enough TUs
  */
-int Tile::openDoor(TilePart part, BattleUnit *unit, BattleActionType reserve, bool rClick)
+int Tile::openDoor(TilePart part, BattleUnit *unit, BattleActionType reserve, bool rClick, bool costFree, bool replayNeutral)
 {
 	if (!_objects[part]) return -1;
 
@@ -378,17 +378,39 @@ int Tile::openDoor(TilePart part, BattleUnit *unit, BattleActionType reserve, bo
 
 	if (_objectsCache[part].isDoor)
 	{
+		// coop (SEAM-3 door B): the peer's REPLAY walk is door-state-neutral - it never
+		// swaps a hinged door. The executor records the doors it opened and ships them
+		// on abortPath, which the peer applies cost-free. This makes hinged-door state
+		// fully executor-authoritative in BOTH directions (the peer can neither miss a
+		// host open on a TU/reserve/re-path shortfall, nor open one the host never did).
+		if (replayNeutral)
+			return -1;
 		if (unit && unit->isBigUnit()) // don't allow double-wide units to open swinging doors due to engine limitations
 			return -1;
-		if (unit && cost.Time && !cost.haveTU())
+		// coop (SEAM-3 door): a co-op REPLAY of a host walk (costFree) must not bail on
+		// the replaying unit's transient local TU/reserve - the host already validated
+		// the open; the peer mirrors it. Without this the peer keeps a door the host
+		// walked through CLOSED, permanently (nothing re-opens a hinged door).
+		if (unit && cost.Time && !cost.haveTU() && !costFree)
 			return 4;
-		if (_unit && _unit != unit && _unit->getPosition() != getPosition())
+		if (_unit && _unit != unit && _unit->getPosition() != getPosition() && !costFree)
 			return -1;
 		setMapData(_objects[part]->getDataset()->getObject(_objects[part]->getAltMCD()), _objects[part]->getAltMCD(), _mapData->SetID[part],
 				   _objects[part]->getDataset()->getObject(_objects[part]->getAltMCD())->getObjectType());
 		setMapData(0, -1, -1, part);
 		return 0;
 	}
+	// coop (UFO-door authority): the peer's REPLAY walk is door-state-neutral for UFO
+	// doors too, matching the hinged branch above. The peer re-pathfinds each replayed
+	// walk independently (BattlescapeGame::abortCoopPath -> Pathfinding::calculate), so a
+	// route that crosses a UFO door the host's route never touched used to open it locally;
+	// nothing closes a UFO door until the side boundary, so isUfoDoorOpen diverged (host
+	// closed, peer open) for the rest of the turn. The EXECUTOR now records the UFO doors
+	// it opens (UnitWalkBState) and ships them on the abortPath closer (doors_opened),
+	// applied on the peer with adjacency - so UFO-door state is host-authoritative in both
+	// directions, exactly like hinged doors. replayNeutral is set only by the replay walk.
+	if (replayNeutral && _objectsCache[part].isUfoDoor)
+		return -1;
 	if (_objectsCache[part].isUfoDoor && _objectsCache[part].currentFrame == 0) // ufo door part 0 - door is closed
 	{
 		if (unit && cost.Time && !cost.haveTU())
@@ -546,27 +568,10 @@ bool Tile::destroy(TilePart part, SpecialTileType type)
 		return true;
 	}
 
-	// coop
-	if (connectionTCP::getCoopStatic() == true && connectionTCP::getHost() == true)
-	{
-
-		Json::Value root;
-		root["state"] = "destroy_tile";
-
-		root["tile_pos_x"] = _pos.x;
-		root["tile_pos_y"] = _pos.y;
-		root["tile_pos_z"] = _pos.z;
-
-		root["tile_part"] = (int)part;
-		root["special_tile_type"] = (int)type;
-
-		root["explosive"] = _explosive;
-		root["explosive_type"] = _explosiveType;
-		
-
-		connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
-
-	}
+	// coop (SEAM-3 b): the destroy_tile packet is built and SENT below, AFTER the
+	// destruction has run, so root["explosive"]/["explosive_type"] carry the
+	// POST-destroy state (the die-MCD explosive property the client must mirror)
+	// instead of the stale pre-destroy value.
 
 	bool _objective = false;
 	if (_objects[part])
@@ -593,6 +598,33 @@ bool Tile::destroy(TilePart part, SpecialTileType type)
 		/* replace with scorched earth */
 		setMapData(MapDataSet::getScorchedEarthTile(), 1, 0, O_FLOOR);
 	}
+
+	// coop (SEAM-3 b): ship destroy_tile AFTER destruction so _explosive/_explosiveType
+	// reflect the POST-destroy state. Emission order is unchanged: nothing between the
+	// old send site and here emits a coop packet (setMapData/setExplosive do not send),
+	// and coopStampChainSeq reads the open-chain seq, which the destruction does not touch.
+	if (connectionTCP::getCoopStatic() == true && connectionTCP::getHost() == true)
+	{
+		Json::Value root;
+		root["state"] = "destroy_tile";
+		// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+		// holds this outcome for its own chain's opener instead of contaminating
+		// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(root);
+
+		root["tile_pos_x"] = _pos.x;
+		root["tile_pos_y"] = _pos.y;
+		root["tile_pos_z"] = _pos.z;
+
+		root["tile_part"] = (int)part;
+		root["special_tile_type"] = (int)type;
+
+		root["explosive"] = _explosive;
+		root["explosive_type"] = _explosiveType;
+
+		connectionTCP::sendTCPPacketStaticData2(root.toStyledString());
+	}
+
 	return _objective;
 }
 
@@ -731,6 +763,17 @@ int Tile::getFuel(TilePart part) const
  */
 void Tile::ignite(int power)
 {
+	// coop (PRD-P3 GAP-3): tile fire and smoke are host-authoritative - setFire()
+	// and setSmoke() have carried that guard (and the packet that goes with it) for
+	// a long time, but ignite() wrote _fire/_smoke DIRECTLY, so a burning-floor unit
+	// or a melee attack lit fires on the peer off its own RNG::percent() roll and
+	// told nobody. Same guard, and the writes now go through the two setters so
+	// set_fire_tile / set_smoke_tile carry them.
+	if (connectionTCP::getCoopStatic() == true && connectionTCP::getHost() == false)
+	{
+		return;
+	}
+
 	if (getFlammability() != 255)
 	{
 		power = power - (getFlammability() / 10) + 15;
@@ -742,10 +785,10 @@ void Tile::ignite(int power)
 		{
 			if (_fire == 0)
 			{
-				_smoke = 15 - Clamp(getFlammability() / 10, 1, 12);
+				// set BEFORE setSmoke: the smoke packet ships _overlaps.
 				_overlaps = 1;
-				_fire = getFuel() + 1;
-				_animationOffset = RNG::generate(0,3);
+				setSmoke(15 - Clamp(getFlammability() / 10, 1, 12));
+				setFire(getFuel() + 1);
 			}
 		}
 	}
@@ -839,6 +882,15 @@ void Tile::setFire(int fire)
 
 		Json::Value root;
 		root["state"] = "set_fire_tile";
+		// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+		// holds this outcome for its own chain's opener instead of contaminating
+		// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(root);
+		// coop (PRD-I3 SEAM-2 HALF 2): if this send is the neutral->player boundary
+		// decay, tag `bnd:true` so the client rides it on the ordered gate rather than
+		// the whitelist (no-op outside the decay scope; mid-side explosion fire stays
+		// unflagged and whitelisted).
+		connectionTCP::coopStampBoundaryOrigin(root);
 
 		root["tile_pos_x"] = _pos.x;
 		root["tile_pos_y"] = _pos.y;
@@ -911,6 +963,15 @@ void Tile::setSmoke(int smoke)
 
 		Json::Value root;
 		root["state"] = "set_smoke_tile";
+		// coop (PRD-I1): tag with the open chain's seq+side so a lagging client
+		// holds this outcome for its own chain's opener instead of contaminating
+		// post-N sync-check state (no-op off the parallel host, _openChainSeq==0).
+		connectionTCP::coopStampChainSeq(root);
+		// coop (PRD-I3 SEAM-2 HALF 2): if this send is the neutral->player boundary
+		// decay, tag `bnd:true` so the client rides it on the ordered gate rather than
+		// the whitelist (no-op outside the decay scope; mid-side explosion smoke stays
+		// unflagged and whitelisted).
+		connectionTCP::coopStampBoundaryOrigin(root);
 
 		root["tile_pos_x"] = _pos.x;
 		root["tile_pos_y"] = _pos.y;
diff --git a/src/Savegame/Tile.h b/src/Savegame/Tile.h
index 15a242f5c..6c956c857 100644
--- a/src/Savegame/Tile.h
+++ b/src/Savegame/Tile.h
@@ -235,7 +235,7 @@ class Tile
 	/// Gets the floor object footstep sound.
 	int getFootstepSound(Tile *tileBelow) const;
 	/// Open a door, returns the ID, 0(normal), 1(ufo) or -1 if no door opened.
-	int openDoor(TilePart part, BattleUnit *unit = 0, BattleActionType reserve = BA_NONE, bool rClick = false);
+	int openDoor(TilePart part, BattleUnit *unit = 0, BattleActionType reserve = BA_NONE, bool rClick = false, bool costFree = false, bool replayNeutral = false);
 
 	/**
 	 * Check if the ufo door is open or opening. Used for visibility/light blocking checks.
diff --git a/tools/ci/run_coop_suite.ps1 b/tools/ci/run_coop_suite.ps1
index 57454e7b8..310c7de86 100644
--- a/tools/ci/run_coop_suite.ps1
+++ b/tools/ci/run_coop_suite.ps1
@@ -63,7 +63,10 @@ if ($ListOnly) { $tests; exit 0 }   # to stdout, so callers can diff the shard s
 # Known-broken on main (real failures, not flakes) - run but do not gate.
 # Add entries here if a test regresses; remove them as they are fixed so they gate
 # again. Empty = the whole suite gates (all green as of 2026-07-15).
-$quarantine = @()
+$quarantine = @(
+  "test_pvp_campaign_month",  # issue #171: month-roll geoscape assert can't drain MissionDetectedState/SaveGameState
+  "test_crash_reporter"       # issue #172: marker-bundle 60s timeout, intermittent
+)
 
 # --- Per-test time budgets ------------------------------------------------------
 # There is no shard wall-clock timeout any more (the CI step used to cap the whole
diff --git a/tools/ci/test_weights.json b/tools/ci/test_weights.json
index 998ce0aba..08f2e920a 100644
--- a/tools/ci/test_weights.json
+++ b/tools/ci/test_weights.json
@@ -1,9 +1,13 @@
 {
   "boot_check": 11.8,
+  "test_battle_tripwire": 24.6,
   "test_bug_fixes": 7.8,
   "test_client_zero_disk": 15.5,
   "test_coop_base_equip_visibility": 8.8,
+  "test_coop_debrief_sync": 530.0,
   "test_coop_guest_craft_seat": 17.5,
+  "test_coop_id_manifest": 122.0,
+  "test_coop_outcome_gaps": 230.0,
   "test_coop_peer_equip_screens": 10.1,
   "test_coop_quarters_accounting": 10.2,
   "test_coop_transfer_equipment_counts": 16.6,
@@ -19,6 +23,34 @@
   "test_lobby_gating": 19.9,
   "test_lobby_polish": 19.5,
   "test_new_campaign_flow": 6.1,
+  "test_parallel_alien_death_decouple": 179.4,
+  "test_parallel_atomic_death": 80.0,
+  "test_parallel_boundary_barrier": 45.0,
+  "test_parallel_chain_order": 35.8,
+  "test_parallel_corpse_mint": 204.5,
+  "test_parallel_death_ghost": 45.0,
+  "test_parallel_endturn": 420.0,
+  "test_parallel_explosion_cluster": 22.6,
+  "test_parallel_explosion_thin": 46.1,
+  "test_parallel_explosive_carrier": 54.4,
+  "test_parallel_floor_drain": 268.5,
+  "test_parallel_floor_gravity": 83.5,
+  "test_parallel_intents": 300.0,
+  "test_parallel_introspection": 18.8,
+  "test_parallel_loose_death": 208.3,
+  "test_parallel_no_reroll": 211.5,
+  "test_parallel_objective_leak": 55.9,
+  "test_parallel_pacing_escape": 21.7,
+  "test_parallel_peer_liveness": 27.7,
+  "test_parallel_replay_decouple": 75.0,
+  "test_parallel_resume": 104.0,
+  "test_parallel_sharedturn": 87.5,
+  "test_parallel_skip": 300.0,
+  "test_parallel_soak": 345.0,
+  "test_parallel_speed_skew": 240.0,
+  "test_parallel_state_watermark": 30.0,
+  "test_parallel_terrain_pacing": 29.2,
+  "test_parallel_xp_module": 74.0,
   "test_purchase_sync_repro": 5.2,
   "test_rejoin_flow": 8.4,
   "test_resume_flow": 14.3,
diff --git a/tools/coop_test/README.md b/tools/coop_test/README.md
index 412d346bc..4cc253074 100644
--- a/tools/coop_test/README.md
+++ b/tools/coop_test/README.md
@@ -54,6 +54,11 @@ resolves data (`UFO`/`TFTD`/`standard`/`common`) from the exe's own directory.
 No local config is read and no save is needed: the tests bootstrap a brand-new
 campaign each run.
 
+`make_user_dir(..., options={...})` splices extra keys into that `options:`
+block, PER INSTANCE, so a test can start the host with `battleXcomSpeed: 1` and
+the client with `40` from the very first frame. Use the `set_option` command
+for mid-test flips instead.
+
 ## Tests
 
 - `boot_check.py` - single-instance install smoke test.
@@ -243,17 +248,17 @@ campaign each run.
   upgraded save loads through the menu -> resume lobby and a fresh client rejoins
   with the exact name and is served its world (roster intact, zero-disk).
 
-### JOINT campaign tests (PRD-J01..J11)
+### SHARED campaign tests (PRD-J01..J11)
 
-A JOINT campaign is ONE host-authoritative world shared by both players (bases,
+A SHARED campaign is ONE host-authoritative world shared by both players (bases,
 funds, research, manufacture, crafts), each player keeping control of their own
 soldiers in battle. SEPARATE (the classic two-mirrored-economies mode) is
 unchanged and is what every test above still exercises.
 
-**Use `joint_fixture.py`** - do not hand-roll the bring-up:
+**Use `shared_fixture.py`** - do not hand-roll the bring-up:
 
 ```python
-js = joint_fixture.bring_up("jbuy", (48670, 48671, 47970))  # host/client/coop ports
+js = shared_fixture.bring_up("jbuy", (48670, 48671, 47970))  # host/client/coop ports
 host, client = js.host, js.client
 try:
     ...
@@ -262,39 +267,39 @@ finally:
     js.shutdown()
 ```
 
-- `bring_up(tag, ports)` - host creates a JOINT campaign, client joins, the host
+- `bring_up(tag, ports)` - host creates a SHARED campaign, client joins, the host
   streams the authoritative world, both settle on the geoscape. Cleans up its own
   processes if bring-up throws.
-- `assert_world_equal(host, client, tag)` - **the JOINT promise, asserted**: a
+- `assert_world_equal(host, client, tag)` - **the SHARED promise, asserted**: a
   deep compare of both machines' introspection dumps (funds, tech, and per base
   in INDEX order: coords/coopBaseId/facilities/stores/transfers/research/
   productions/craft identity+status/free personnel/roster with `ownerPlayerId`).
-  Wired into every JOINT test's final state. Polls, because an in-flight
-  `joint_apply` is a legitimate transient skew. Known-volatile fields are excluded
+  Wired into every SHARED test's final state. Polls, because an in-flight
+  `shared_apply` is a legitimate transient skew. Known-volatile fields are excluded
   **with reasons** - see the module docstring before adding to it.
 
 | test | proves |
 |---|---|
-| `test_joint_flag.py` | campaignType JOINT end-to-end + save YAML round-trip |
-| `test_joint_bootstrap.py` | the client adopts the streamed replica; no mirror bases; replica saves refused |
-| `test_joint_resume.py` | save -> reload -> rejoin re-streams the world |
-| `test_joint_purchase.py` | the `joint_cmd`/`joint_apply` protocol + funds authority |
-| `test_joint_sim.py` | host-only simulation; the replica's sim is frozen; month-end sync |
-| `test_joint_commerce.py` | sell / hire / cross-base transfer / containment |
-| `test_joint_research.py`, `test_joint_manufacture.py` | research + manufacture start/allocate/cancel, incl. the two-players-one-project race |
-| `test_joint_facilities.py`, `test_joint_newbase.py` | facilities, dismantle, sack; atomic new-base creation + base-index lock-step |
-| `test_joint_craft.py` | shared craft command + interception; the host sims the dogfight, both machines spectate the same fight |
-| `test_joint_deploy.py`, `test_joint_battle.py` | mixed-owner squads: control split follows soldier ownership; post-battle worlds identical |
-| `test_joint_landing.py` | the landing broker asks the seat that gave the order |
-| `test_joint_refresh.py`, `test_joint_resync.py` | live screen refresh on apply; desync detect -> auto-repair |
+| `test_shared_flag.py` | campaignType SHARED end-to-end + save YAML round-trip |
+| `test_shared_bootstrap.py` | the client adopts the streamed replica; no mirror bases; replica saves refused |
+| `test_shared_resume.py` | save -> reload -> rejoin re-streams the world |
+| `test_shared_purchase.py` | the `shared_cmd`/`shared_apply` protocol + funds authority |
+| `test_shared_sim.py` | host-only simulation; the replica's sim is frozen; month-end sync |
+| `test_shared_commerce.py` | sell / hire / cross-base transfer / containment |
+| `test_shared_research.py`, `test_shared_manufacture.py` | research + manufacture start/allocate/cancel, incl. the two-players-one-project race |
+| `test_shared_facilities.py`, `test_shared_newbase.py` | facilities, dismantle, sack; atomic new-base creation + base-index lock-step |
+| `test_shared_craft.py` | shared craft command + interception; the host sims the dogfight, both machines spectate the same fight |
+| `test_shared_deploy.py`, `test_shared_battle.py` | mixed-owner squads: control split follows soldier ownership; post-battle worlds identical |
+| `test_shared_landing.py` | the landing broker asks the seat that gave the order |
+| `test_shared_refresh.py`, `test_shared_resync.py` | live screen refresh on apply; desync detect -> auto-repair |
 | `test_shared_equip_transfer.py` | equipping + moving soldiers around a SHARED world: real drag-drop equipping, both equip screens agree, a craft seat sticks when cleared, a second base built, then an intra-world `transfer` shared_cmd - the soldier arrives at the right base **unassigned from any craft**, with its layout intact and its **owner unchanged** (only a gift changes ownership), identically on both machines |
-| `test_joint_world_equal.py` | the equality helper itself, **including a negative control** |
-| `test_joint_disconnect.py` | client killed with a command in flight -> no half-apply; rejoin restores one world |
-| `test_joint_month_run.py` | the long run: 2 month ends + a battle in one campaign |
+| `test_shared_world_equal.py` | the equality helper itself, **including a negative control** |
+| `test_shared_disconnect.py` | client killed with a command in flight -> no half-apply; rejoin restores one world |
+| `test_shared_month_run.py` | the long run: 2 month ends + a battle in one campaign |
 
-#### Shared / replicated JOINT dogfights (PRD-DF01..DF03)
+#### Replicated SHARED dogfights (PRD-DF01..DF03)
 
-The host simulates EVERY JOINT dogfight and streams a per-tick state frame
+The host simulates EVERY SHARED dogfight and streams a per-tick state frame
 (`df_state`); every player opens a render-only `DogfightState` and can issue
 stance / weapon / disengage commands (`df_cmd`, arbitrated host-side in
 receive-order). Membership rides `df_open` with a monotonic `membershipEpoch`
@@ -305,15 +310,15 @@ early-returns before any sim/award code).
 
 | test | proves |
 |---|---|
-| `test_joint_hk_dogfight.py` | GAP-2: an HK attack on a client-commanded craft opens the SAME fight on both machines (no host-only routing); outcome mirrored |
-| `test_joint_intercept_spectate.py` | a regular (non-HK) intercept is spectated on both machines; ONE authoritative crash (status + crashId), world-equal |
-| `test_joint_dogfight_control.py` | any player commands a shared fight: stance/weapon/disengage via `df_cmd`, host arbitrates receive-order (last-received-wins); synced UFO-stance marker; client-local minimize |
-| `test_joint_dogfight_present.py` | presentation policy: a host-commanded fight opens FULL on the host / a minimized icon on the client, and a minimized client still commands the host |
-| `test_joint_dogfight_xp.py` | GAP-7: pilot dogfight XP is host-authoritative - EQUAL on both machines, lands on the host `Soldier`, rides the roster stream; a replica is refused the award and never accrues XP locally |
-| `test_joint_dogfight_dest.py` | GAP-8: after a dogfight ends in auto-return, the replica craft's `_dest`/status match the host - no lag, no orphan waypoint to the downed UFO (the replica never sets `_dest` locally) |
-| `test_joint_dogfight_concurrent.py` | up to 4 concurrent interceptions hold ONE membership set on both machines; an HK interrupt-all-and-restart converges both to the new set atomically (epoch lock-step, no stale window, no old-epoch `df_state`); exercises per-(craft,ufo) command targeting |
+| `test_shared_hk_dogfight.py` | GAP-2: an HK attack on a client-commanded craft opens the SAME fight on both machines (no host-only routing); outcome mirrored |
+| `test_shared_intercept_spectate.py` | a regular (non-HK) intercept is spectated on both machines; ONE authoritative crash (status + crashId), world-equal |
+| `test_shared_dogfight_control.py` | any player commands a shared fight: stance/weapon/disengage via `df_cmd`, host arbitrates receive-order (last-received-wins); synced UFO-stance marker; client-local minimize |
+| `test_shared_dogfight_present.py` | presentation policy: a host-commanded fight opens FULL on the host / a minimized icon on the client, and a minimized client still commands the host |
+| `test_shared_dogfight_xp.py` | GAP-7: pilot dogfight XP is host-authoritative - EQUAL on both machines, lands on the host `Soldier`, rides the roster stream; a replica is refused the award and never accrues XP locally |
+| `test_shared_dogfight_dest.py` | GAP-8: after a dogfight ends in auto-return, the replica craft's `_dest`/status match the host - no lag, no orphan waypoint to the downed UFO (the replica never sets `_dest` locally) |
+| `test_shared_dogfight_concurrent.py` | up to 4 concurrent interceptions hold ONE membership set on both machines; an HK interrupt-all-and-restart converges both to the new set atomically (epoch lock-step, no stale window, no old-epoch `df_state`); exercises per-(craft,ufo) command targeting |
 
-Traps worth knowing before you write a JOINT test:
+Traps worth knowing before you write a SHARED test:
 
 - Per-machine scaffolding (`give_items`, `add_base`, `spawn_craft`,
   `set_soldier_owner`, `discover_research`, `set_funds`) must be called on **both**
@@ -335,8 +340,9 @@ Traps worth knowing before you write a JOINT test:
   hourly step can fire inside the setup window - then let the next `skip_*`
   re-apply the fast speed. Asserting the host/client baseline is equal before you
   wait on a delta turns any residual straddle into an instant, readable failure.
-- New TestServer hooks go in `TestServer::executeJoint10`; the old `execute`
-  if/else chain is at MSVC's 128-block nesting limit (C1061).
+- New TestServer hooks go in the newest `TestServer::executeSharedNN` split
+  (currently `executeShared11`); the old `execute` if/else chain is at MSVC's
+  128-block nesting limit (C1061).
 
 Traps worth knowing before you write a BATTLESCAPE test:
 
@@ -356,17 +362,23 @@ Traps worth knowing before you write a BATTLESCAPE test:
   `activeSync == true`. Driving a unit from the passive side proves nothing -
   the coop battle states (`UnitWalkBState`, `ProjectileFlyBState`,
   `MeleeAttackBState`, `PsiAttackBState`, ...) gate their packet send on it.
-  It is not simply "the host": read `activeSync` and drive from that side.
+  It is not simply "the host". Ask **`session.can_drive(battle_state)`** rather
+  than reading `activeSync` yourself (PRD-P0): under parallel turns (PRD-P5+)
+  `activeSync` becomes the executor invariant - host true / client false,
+  permanently - and a client-side action is forwarded to the host as an intent
+  instead of executed locally, so both machines may drive. `can_drive()` is
+  exactly `activeSync` until then. A test that asserts *exactly one machine
+  owns the simulation* is asking about `activeSync` itself and keeps reading it.
 - Prefer a walk over a shot when asserting replication: a shot can legitimately
   miss, so an unchanged victim is ambiguous, while a position is not.
 
 Full suite (serial) is ~20 min; no test exceeds ~2 min. Known flakes, retry once:
-`test_ufo_notice`, `test_joint_manufacture`, `test_joint_commerce`,
-`test_joint_disconnect`, `test_joint_resync`.
+`test_ufo_notice`, `test_shared_manufacture`, `test_shared_commerce`,
+`test_shared_disconnect`, `test_shared_resync`.
 
 `session.py` is the shared campaign dance (`new_campaign` / `resume_campaign`
-/ `assert_client_zero_disk`) used by every test; `joint_fixture.py` builds the
-JOINT bring-up + world equality on top of it.
+/ `assert_client_zero_disk`) used by every test; `shared_fixture.py` builds the
+SHARED bring-up + world equality on top of it.
 
 `harness.py` is the shared library (not a test). Set `OXC_TEST_EXE` to point the
 whole suite at another build - e.g. `bin/x64/Release-nofix/OpenXcom.exe` - to
@@ -376,7 +388,10 @@ its own staged data (`tools/worktree_bootstrap.ps1`).
 ## Command catalog (TestServer::execute)
 
 - Introspection: `ping`, `get_state`, `get_coop`, `get_soldiers`,
-  `get_mirror_soldiers`, `has_coop_file`, `coop_stats`, `set_option`.
+  `get_mirror_soldiers`, `has_coop_file`, `coop_stats`, `set_option`
+  (the four PRD-P0 additions - `battleXcomSpeed`, `battleAlienSpeed`,
+  `EnableCoopParallelTurns`, `coopParallelDebugClientInput` - echo the applied
+  value back as `value`), `parallel_state` (battlescape only).
 - Session flow: `load_save`, `load_save_menu` (real LoadGameState routing),
   `save_game`, `save_game_ui` (through the real SaveGameState funnel: `type` =
   `quick` | `auto_geoscape`), `open_new_game` (`mode`: `solo` | `coop`),
@@ -410,7 +425,7 @@ its own staged data (`tools/worktree_bootstrap.ps1`).
   `get_palettes`.
 - Geoscape: `geo_state`, `geo_set_speed`, `dismiss_popup`, `craft_dispatch`,
   `confirm_landing`, `craft_order` (`target`/`return`/`patrol`), `intercept_list`.
-- Dogfights (shared JOINT): `dogfight_state` (per-open-fight introspection on each
+- Dogfights (SHARED): `dogfight_state` (per-open-fight introspection on each
   machine: `craftId/ufoId/currentDist/targetDist/mode/ufoIsAttacking/minimized/
   ended/isReplicaView/epoch/ufoStance/weaponEnabled[]/projectileCount`, plus the
   machine's membership `epoch`), `dogfight_action` (drive a fight's stance / weapon
@@ -453,6 +468,16 @@ its own staged data (`tools/worktree_bootstrap.ps1`).
   coop-init gate field by field too - `battleInit`, `coopSession`, `coopStatic`,
   `coopCampaign`, `isBusy`, `panicHandled`, `isPreview`, `clientPanicHandle`,
   `side` - plus `coopTurn`, `playerTurn`, `waitBC`/`waitBH`.
+
+  PRD-P0 adds the RECEIVE GATE to `battle_state`, and a cheaper
+  `parallel_state` (battlescape only) carrying the same fields without the unit
+  dump: `taskCompleted` (`_coop_task_completed`), `pathLock`, `coopWalkInit`,
+  `coopInitDeath`, `coopEnd`, plus `rxHold` / `rxRotates` / `rxHoldMax` - the
+  depth, rotate count and high-water mark of `updateCoopTask()`'s hold queue.
+  A peer that "does not react" is usually a packet parked behind that gate, not
+  a dropped one; the two `rx*` counters are process-monotonic (never reset).
+  Both commands also carry `parallelActive`, false until PRD-P5 lands the
+  parallel-turns mode.
 - Lobby: `lobby_set_team` (host-only; puts lobby row <row> on `XCOM`/`Alien`
   through the real `LobbyMenu::setPlayerTeam`, which is what selects the co-op
   game mode - both XCOM = PVE (1), client Alien = PVP (2), host Alien = PVP2 (3),
diff --git a/tools/coop_test/harness.py b/tools/coop_test/harness.py
index a6035cf64..02ee12544 100644
--- a/tools/coop_test/harness.py
+++ b/tools/coop_test/harness.py
@@ -31,11 +31,58 @@
 TEMP_ROOT = os.environ.get("TEMP") or os.environ.get("TMPDIR") or tempfile.gettempdir()
 TEST_ROOT = os.path.join(TEMP_ROOT, "oxc-coop-test")
 
-# Machine-wide harness lock: suites are stateful (fixed TCP ports per test,
-# shared TEST_ROOT under %TEMP%), so concurrent runs — e.g. from two git
-# worktrees — would collide. First spawn in a process takes the lock; the OS
-# releases it when the process exits (including on crash).
-_LOCK_PATH = os.path.join(TEMP_ROOT, "oxc-coop-harness.lock")
+# --- Ephemeral-port model (both socket kinds are OS-assigned) ----------------
+# There are NO fixed ports any more. Two socket kinds, both ephemeral:
+#
+#   1. TestServer control socket. The game is always spawned with
+#      OXC_TEST_PORT=0, so it binds an OS-assigned port and writes the actual
+#      value to <user_dir>/testserver_port.txt (atomic write+rename). connect()
+#      polls that file, then dials the reported port - it never guesses. The
+#      integer still passed positionally to GameClient(name, N, dir) is now just
+#      a label; it does NOT bind (see GameClient.__init__). A GameClient built
+#      with user_dir=None keeps the old fixed-port behaviour so a repro tool can
+#      attach to a pre-spawned instance on a known port.
+#
+#   2. Coop game-to-game sockets (TCP + UDP). The host binds ephemeral and the
+#      EXISTING TestServer responses report the actual bound port; cmd() below
+#      does this transparently: a host_tcp/host_udp/host_menu_host is rewritten
+#      to ask for port "0", and the actual port from the response is stashed
+#      under the ORIGINAL port value the test passed (which the paired
+#      join_tcp/join_udp reuses as a rendezvous KEY, not a socket). So every
+#      caller - session.new_campaign, the module-global PORT constants, the
+#      pvp/shared/skirmish fixtures - migrates to ephemeral with no per-test
+#      edits: the literal they pass is only an in-process key linking a host to
+#      its client. UDP `localport` is forced to "0" too (OS-assigned client bind).
+#
+# This kills the fixed-port collision/linger class outright (CI 31999655291:
+# "test server not reachable on :49900" was a prior scenario's instance still
+# holding the port). The lane machinery below keeps only what still names
+# shared state: the per-slot machine lock and the s{slot}_ user-dir prefix. No
+# port bands, so K is no longer capped by the 65535 ceiling.
+HARNESS_SLOT = int(os.environ.get("OXC_HARNESS_SLOT", "0"))
+
+# Coop bring-up commands whose response carries the host's actual (ephemeral)
+# bound port, and the join commands that must reuse it. cmd() bridges the two,
+# keyed on the (now inert) port literal the test passes to both sides.
+_COOP_HOST_CMDS = frozenset(("host_tcp", "host_udp", "host_menu_host"))
+_COOP_JOIN_CMDS = frozenset(("join_tcp", "join_udp"))
+# {rendezvous_key -> actual ephemeral coop port}. Process-global: a test's host
+# and client GameClients share it; run_parallel gives each test its own process,
+# so keys never cross runs. Distinct live pairs must use distinct keys (the same
+# invariant the old per-port model relied on).
+_EPHEMERAL_COOP_PORTS = {}
+PORT_FILE_NAME = "testserver_port.txt"
+
+# Per-slot harness lock: suites are stateful (shared TEST_ROOT under %TEMP%, one
+# game instance per s{slot}_ user dir), so two runs on the SAME slot would
+# collide on those user dirs even though ports are now ephemeral. First
+# spawn in a process takes its slot's lock; the OS releases it when the process
+# exits (including on crash). Slot 0 keeps the historical lock name so it still
+# serialises against a non-slotted / old-harness run — e.g. two git worktrees.
+_LOCK_PATH = os.path.join(
+    TEMP_ROOT,
+    "oxc-coop-harness.lock" if HARNESS_SLOT == 0
+    else "oxc-coop-harness.slot%d.lock" % HARNESS_SLOT)
 _lock_handle = None
 
 
@@ -54,7 +101,7 @@ def _acquire_machine_lock(timeout=3600):
                 fcntl.flock(h.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
             _lock_handle = h  # held for process lifetime
             if waited:
-                print("[harness] machine lock acquired")
+                print("[harness] slot-%d lock acquired" % HARNESS_SLOT)
             return
         except OSError as exc:
             if os.name != "nt" and exc.errno not in (errno.EACCES, errno.EAGAIN):
@@ -65,8 +112,8 @@ def _acquire_machine_lock(timeout=3600):
                 raise TimeoutError(
                     "another coop harness run holds " + _LOCK_PATH)
             if not waited:
-                print("[harness] waiting for machine-wide harness lock "
-                      "(another suite is running)...")
+                print("[harness] waiting for slot-%d harness lock "
+                      "(another run holds it)..." % HARNESS_SLOT)
                 waited = True
             time.sleep(5)
 
@@ -99,18 +146,54 @@ def _acquire_machine_lock(timeout=3600):
 class GameClient:
     """One running game instance + its command socket."""
 
-    def __init__(self, name, port, user_dir):
+    def __init__(self, name, port=None, user_dir=None):
         self.name = name
-        self.port = port
         self.user_dir = user_dir
+        # Control socket is OS-assigned ephemeral: the game binds port 0 and
+        # writes the actual port to <user_dir>/PORT_FILE_NAME, which connect()
+        # reads back. The positional `port` is now only a label and does NOT
+        # bind - EXCEPT for the attach-to-a-running-instance case (user_dir is
+        # None), where there is no file to read so the caller's port is used
+        # directly (repro tooling). self.port is the resolved port, filled in by
+        # connect().
+        self._fixed_port = int(port) if (user_dir is None and port) else None
+        self.port = self._fixed_port
         self.proc = None
         self.sock = None
         self.buf = b""
 
+    @property
+    def _port_file(self):
+        return os.path.join(self.user_dir, PORT_FILE_NAME) if self.user_dir else None
+
     def spawn(self, extra_args=()):
         _acquire_machine_lock()
         env = os.environ.copy()
-        env["OXC_TEST_PORT"] = str(self.port)
+        # Ephemeral by default (OXC_TEST_PORT=0 -> the game picks a free control
+        # port and reports it via PORT_FILE_NAME). Remove any stale port file
+        # first so connect() cannot read a value from a previous spawn. A
+        # fixed-port GameClient (user_dir=None) keeps its explicit port.
+        if self._fixed_port is None:
+            env["OXC_TEST_PORT"] = "0"
+            if self._port_file and os.path.exists(self._port_file):
+                try:
+                    os.remove(self._port_file)
+                except OSError:
+                    pass
+        else:
+            env["OXC_TEST_PORT"] = str(self._fixed_port)
+        # Headless under the parallel runner (any lane sets OXC_HARNESS_SLOT) or
+        # on demand (OXC_HARNESS_HEADLESS): no on-screen window, so no vsync cap,
+        # window-focus fights or audio-device contention between K concurrent
+        # game processes. OXC_HARNESS_WINDOWED=1 forces the window back for
+        # interactive debugging even under the runner; a caller that already
+        # exported an SDL driver wins (setdefault). A plain single-test dev run
+        # (no slot, no headless flag) keeps its window, unchanged.
+        if ((os.environ.get("OXC_HARNESS_SLOT") is not None
+             or os.environ.get("OXC_HARNESS_HEADLESS"))
+                and not os.environ.get("OXC_HARNESS_WINDOWED")):
+            env.setdefault("SDL_VIDEODRIVER", "dummy")
+            env.setdefault("SDL_AUDIODRIVER", "dummy")
         # tuck the window into a corner (host left, client right of it)
         env["SDL_VIDEO_WINDOW_POS"] = "0,40" if "host" in self.name else "660,40"
         exe_dir = os.path.dirname(EXE) or "."
@@ -131,8 +214,34 @@ def spawn(self, extra_args=()):
         self.proc = subprocess.Popen(
             args, env=env, cwd=exe_dir, **popen_kwargs)
 
+    def _resolve_port(self, deadline):
+        """The control port to dial: the fixed one, or the ephemeral port the
+        game reported by writing PORT_FILE_NAME. Polls the file within the same
+        boot budget (no port-guessing)."""
+        if self._fixed_port is not None:
+            return self._fixed_port
+        while time.time() < deadline:
+            if self.proc and self.proc.poll() is not None:
+                raise RuntimeError(f"{self.name}: game exited early rc={self.proc.returncode}")
+            try:
+                with open(self._port_file, encoding="utf-8") as f:
+                    txt = f.read().strip()
+                if txt:
+                    p = int(txt)
+                    if p > 0:
+                        return p
+            except (FileNotFoundError, ValueError):
+                pass
+            time.sleep(0.2)
+        raise TimeoutError(
+            f"{self.name}: game never reported its test-server port "
+            f"(no {self._port_file})")
+
     def connect(self, timeout=60):
         deadline = time.time() + timeout
+        # Boot budget is now spent purely on the game coming up and reporting its
+        # port, then on the socket accepting - never on guessing a port.
+        self.port = self._resolve_port(deadline)
         while time.time() < deadline:
             if self.proc and self.proc.poll() is not None:
                 raise RuntimeError(f"{self.name}: game exited early rc={self.proc.returncode}")
@@ -141,13 +250,26 @@ def connect(self, timeout=60):
                 self.sock.settimeout(30)
                 if self.cmd({"cmd": "ping"}).get("pong"):
                     print(f"[{self.name}] connected on :{self.port}")
+                    # Wire-order lever matrix hook (boundary epoch-reset ruling
+                    # 2026-08-26): OXC_WIRE_ORDER=1 engages the wire_order_state
+                    # lever on EVERY instance the harness boots, so the whole
+                    # targeted suite runs lever-on unmodified (the Phase 5/6
+                    # both-lever matrix). Unset/0 = lever-off default, untouched.
+                    if os.environ.get("OXC_WIRE_ORDER", "").lower() in ("1", "true"):
+                        self.cmd({"cmd": "parallel_state", "wire_order_state": True})
+                        got = self.cmd({"cmd": "parallel_state"}).get("wireOrderState")
+                        if got is not True:
+                            raise RuntimeError(
+                                f"{self.name}: OXC_WIRE_ORDER=1 but wire_order_state "
+                                f"lever did not engage (readback={got!r})")
+                        print(f"[{self.name}] wire_order_state lever ON (OXC_WIRE_ORDER)")
                     return
             except (ConnectionRefusedError, socket.timeout, OSError):
                 self.sock = None
                 time.sleep(1)
         raise TimeoutError(f"{self.name}: test server not reachable on :{self.port}")
 
-    def cmd(self, obj):
+    def _send(self, obj):
         self.sock.sendall((json.dumps(obj) + "\n").encode())
         while b"\n" not in self.buf:
             chunk = self.sock.recv(65536)
@@ -157,6 +279,35 @@ def cmd(self, obj):
         line, self.buf = self.buf.split(b"\n", 1)
         return json.loads(line)
 
+    def cmd(self, obj):
+        # Ephemeral coop ports (see the module header). A coop HOST command is
+        # rewritten to ask for an OS-assigned port ("0"); the actual port from
+        # the response is stashed under the ORIGINAL literal so the paired JOIN
+        # command (given the same literal by the test) dials the real one. The
+        # literal is thus an in-process rendezvous key, never a bound port. A
+        # COPY is rewritten so a caller reusing the dict in a retry loop is
+        # unaffected.
+        name = obj.get("cmd")
+        if name in _COOP_HOST_CMDS and str(obj.get("port", "")) != "":
+            key = str(obj["port"])
+            obj = dict(obj)
+            obj["port"] = "0"
+            if "localport" in obj:
+                obj["localport"] = "0"
+            resp = self._send(obj)
+            actual = resp.get("port")
+            if actual:
+                _EPHEMERAL_COOP_PORTS[key] = str(actual)
+            return resp
+        if name in _COOP_JOIN_CMDS and str(obj.get("port", "")) != "":
+            key = str(obj["port"])
+            obj = dict(obj)
+            obj["port"] = _EPHEMERAL_COOP_PORTS.get(key, obj["port"])
+            if "localport" in obj:
+                obj["localport"] = "0"
+            return self._send(obj)
+        return self._send(obj)
+
     def ok(self, obj):
         r = self.cmd(obj)
         if not r.get("ok"):
@@ -186,7 +337,7 @@ def shutdown(self):
                 self.proc.kill()
 
 
-def make_user_dir(name, saves=(), mods=()):
+def make_user_dir(name, saves=(), mods=(), options=None):
     """Hermetic, isolated user folder: a freshly written options.cfg pinning
     the stock `xcom1` master (see HERMETIC_OPTIONS) with no external mods and
     no dependence on the machine's real config. `saves` are copied into the
@@ -196,11 +347,32 @@ def make_user_dir(name, saves=(), mods=()):
     copied into <userdir>/mods/ - the user mod location; note that the shipped
     standard/ directory is a protected allowlist and silently rejects anything
     else ("Invalid standard mod '<name>', skipping."). Both machines in a co-op
-    pair must get the SAME mods or their rulesets diverge."""
+    pair must get the SAME mods or their rulesets diverge.
+
+    `options` is a dict of extra options.cfg keys spliced into HERMETIC_OPTIONS'
+    `options:` block, e.g. {"battleXcomSpeed": 1}. Unlike the set_option command
+    (which flips a value mid-test) these are in force from the instance's very
+    first frame, and they are PER INSTANCE - a test can start the host slow and
+    the client fast. Booleans are written as YAML true/false."""
+    # Lane prefix: two runs on different slots must never share a user dir, since
+    # this rmtree's `d` on entry (accidental concurrency would silently destroy
+    # the other lane's run). Slot 0 is prefixed s0_ too, so every live instance
+    # is tagged by lane in %TEMP%\oxc-coop-test — the marker the parallel runner
+    # uses to identify its own processes and never touch a foreign session's.
+    name = "s%d_%s" % (HARNESS_SLOT, name)
     d = os.path.join(TEST_ROOT, name)
     if os.path.exists(d):
         shutil.rmtree(d)
     os.makedirs(os.path.join(d, "xcom1"))
+    # OXC_TEST_EXTRA_MOD (mod-loaded regression, GAP-10): a path - or an os.pathsep-
+    # joined list of paths - to mod folder(s) appended to EVERY instance's mod set,
+    # so any existing test can be run with an extra mod active without editing it.
+    # The env is process-wide, so both machines in a pair get the same mods (their
+    # rulesets must match). Used to prove the promoted battle-hash buckets do not
+    # false-alarm when a battle script is loaded.
+    env_mod = os.environ.get("OXC_TEST_EXTRA_MOD")
+    if env_mod:
+        mods = list(mods) + [p for p in env_mod.split(os.pathsep) if p]
     extra = ""
     for src in mods:
         mod_id = os.path.basename(os.path.normpath(src))
@@ -209,6 +381,13 @@ def make_user_dir(name, saves=(), mods=()):
     opts = HERMETIC_OPTIONS
     if extra:
         opts = opts.replace("options:\n", extra + "options:\n", 1)
+    if options:
+        extra_opts = ""
+        for key, value in options.items():
+            if isinstance(value, bool):
+                value = "true" if value else "false"
+            extra_opts += "  %s: %s\n" % (key, value)
+        opts = opts.replace("options:\n", "options:\n" + extra_opts, 1)
     with open(os.path.join(d, "options.cfg"), "w", encoding="utf-8") as f:
         f.write(opts)
     for save in saves:
diff --git a/tools/coop_test/manual_session.py b/tools/coop_test/manual_session.py
index 4e131280e..96d3a88af 100644
--- a/tools/coop_test/manual_session.py
+++ b/tools/coop_test/manual_session.py
@@ -43,7 +43,9 @@
 def spawn_visible(gc, window_pos):
     """Like GameClient.spawn, but visible, detached, and without the lock."""
     env = os.environ.copy()
-    env["OXC_TEST_PORT"] = str(gc.port)
+    # Ephemeral control port (the game reports it via the port file; connect()
+    # reads it back). --host-port/--client-port are now only user-dir labels.
+    env["OXC_TEST_PORT"] = "0"
     env["SDL_VIDEO_WINDOW_POS"] = window_pos
     gc.proc = subprocess.Popen(
         [harness.EXE, "-user", gc.user_dir],
@@ -84,9 +86,9 @@ def main():
 
     print()
     print(f"READY - {args.mode.upper()} campaign, both players live on the geoscape.")
-    print(f"  host    pid {host.proc.pid:<6} test port {args.host_port}  {host.user_dir}")
-    print(f"  client  pid {client.proc.pid:<6} test port {args.client_port}  {client.user_dir}")
-    print(f"  coop session port {args.coop_port}")
+    print(f"  host    pid {host.proc.pid:<6} test port {host.port}  {host.user_dir}")
+    print(f"  client  pid {client.proc.pid:<6} test port {client.port}  {client.user_dir}")
+    print(f"  coop session (ephemeral; --coop-port {args.coop_port} is only a key)")
 
 
 if __name__ == "__main__":
diff --git a/tools/coop_test/mods/Coop_ScriptRng_Test/Ruleset/script_rng.rul b/tools/coop_test/mods/Coop_ScriptRng_Test/Ruleset/script_rng.rul
new file mode 100644
index 000000000..a15553ebe
--- /dev/null
+++ b/tools/coop_test/mods/Coop_ScriptRng_Test/Ruleset/script_rng.rul
@@ -0,0 +1,27 @@
+# Test-only mod for PRD-P3 GAP-10 (script RNG). The newTurnUnit hook fires on
+# EVERY unit at every side close, on BOTH machines in a parallel co-op battle
+# (SavedBattleGame::newTurnUpdateScripts, reached via BattlescapeGame::endTurn ->
+# _save->endTurn). It draws both script-RNG bindings from the global RNG stream
+# and stores the results in per-unit scriptTags:
+#   COOP_RNG_R  <- battle_game.randomRange  (randomRangeScript)
+#   COOP_RNG_C  <- battle_game.randomChance (randomChanceScript)
+# next_turn does NOT re-ship scriptTags, so any divergence in the drawn values
+# persists and shows up in the save_blob dump - the direct probe the test reads.
+# All var declarations must precede the first operation (OXCE y-script rule).
+extended:
+  tags:
+    BattleUnit:
+      COOP_RNG_R: int
+      COOP_RNG_C: int
+  scripts:
+    newTurnUnit:
+      - offset: 1
+        code: |
+          var int r;
+          var int c;
+          battle_game.randomRange r 0 1000000;
+          unit.setTag Tag.COOP_RNG_R r;
+          set c 50;
+          battle_game.randomChance c;
+          unit.setTag Tag.COOP_RNG_C c;
+          return;
diff --git a/tools/coop_test/mods/Coop_ScriptRng_Test/metadata.yml b/tools/coop_test/mods/Coop_ScriptRng_Test/metadata.yml
new file mode 100644
index 000000000..11bd5fe95
--- /dev/null
+++ b/tools/coop_test/mods/Coop_ScriptRng_Test/metadata.yml
@@ -0,0 +1,11 @@
+name: "Coop script-RNG probe"
+version: 1.0
+description: "Test-only fixture for PRD-P3 GAP-10: a battle script that rolls both
+  script-RNG bindings (randomChance/randomRange) on the newTurnUnit hook and writes
+  the results into per-unit scriptTags. Used by test_coop_script_rng.py to prove the
+  parallel client's per-turn script draws match the host (seed-replay), and, when
+  activated over an existing test via OXC_TEST_EXTRA_MOD, to prove the promoted
+  battle-hash buckets do not false-alarm with a battle script loaded."
+author: coop harness
+
+master: xcom1
diff --git a/tools/coop_test/mods/Coop_Surrender_Test/Ruleset/surrender.rul b/tools/coop_test/mods/Coop_Surrender_Test/Ruleset/surrender.rul
new file mode 100644
index 000000000..73431133b
--- /dev/null
+++ b/tools/coop_test/mods/Coop_Surrender_Test/Ruleset/surrender.rul
@@ -0,0 +1,24 @@
+# Test-only mod for SESSION D (battle-end host authority + wantsToSurrender
+# disposition). surrenderMode: 2 activates the mod-gated reader
+# BattlescapeGame::isSurrendering (surrenderMode>=2 reads wantsToSurrender), which
+# feeds tally.liveAliens -> the battle-complete decision. wantsToSurrender is set
+# on the panic path (BattleUnit::prepareNewTurn) which the PARALLEL client DEFERS,
+# so a panicked surrendering alien is host=surrendering / client=still-fighting.
+# canSurrender: true on the Sectoid types makes them eligible so the reader is
+# reachable in a stock NEW BATTLE > COOP skirmish (default race STR_SECTOID). With
+# battle end host-authoritative (NextTurnState gate) the client never ends on this
+# divergent local tally - it follows the host's "DebriefingState" packet.
+surrenderMode: 2
+units:
+  - type: STR_SECTOID_SOLDIER
+    canSurrender: true
+  - type: STR_SECTOID_NAVIGATOR
+    canSurrender: true
+  - type: STR_SECTOID_MEDIC
+    canSurrender: true
+  - type: STR_SECTOID_ENGINEER
+    canSurrender: true
+  - type: STR_SECTOID_LEADER
+    canSurrender: true
+  - type: STR_SECTOID_COMMANDER
+    canSurrender: true
diff --git a/tools/coop_test/mods/Coop_Surrender_Test/metadata.yml b/tools/coop_test/mods/Coop_Surrender_Test/metadata.yml
new file mode 100644
index 000000000..04fa37bf1
--- /dev/null
+++ b/tools/coop_test/mods/Coop_Surrender_Test/metadata.yml
@@ -0,0 +1,13 @@
+name: "Coop surrender probe"
+version: 1.0
+description: "Test-only fixture for SESSION D (battle-end host authority). Sets the
+  mod ruleset key surrenderMode: 2 (the reader endTurn->tallyUnits->isSurrendering
+  gate that reads the panic wantsToSurrender the parallel client DEFERS) and marks
+  the vanilla Sectoid alien types canSurrender: true, so a panicked Sectoid on the
+  host reduces tally.liveAliens while the parallel client keeps counting it. Used
+  to prove the promoted battle-hash buckets do not false-alarm with the surrender
+  reader active, and that battle end stays host-authoritative (no hang, no state
+  divergence) when a surrender-capable alien is on the map."
+author: coop harness
+
+master: xcom1
diff --git a/tools/coop_test/repro74_probe.py b/tools/coop_test/repro74_probe.py
index d3fff4196..0b97b9c05 100644
--- a/tools/coop_test/repro74_probe.py
+++ b/tools/coop_test/repro74_probe.py
@@ -28,6 +28,7 @@
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from harness import GameClient
+import session
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 STATE_PATH = os.path.join(HERE, "repro74_state.json")
@@ -102,7 +103,7 @@ def cmd_state(state, host, client):
 def cmd_fire(state, host, client):
     shooter = None
     for gc, tag in ((host, "host"), (client, "client")):
-        if gc.cmd({"cmd": "battle_state"}).get("activeSync"):
+        if session.can_drive(gc.cmd({"cmd": "battle_state"})):
             shooter, shooter_tag = gc, tag
     if not shooter:
         sys.exit("neither machine owns the simulation right now (activeSync false on "
diff --git a/tools/coop_test/repro74_setup.py b/tools/coop_test/repro74_setup.py
index 8294be415..d160781db 100644
--- a/tools/coop_test/repro74_setup.py
+++ b/tools/coop_test/repro74_setup.py
@@ -34,6 +34,7 @@
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import harness
+import session
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 STATE_PATH = os.path.join(HERE, "repro74_state.json")
@@ -102,7 +103,7 @@ def main():
 
     owner = None
     for gc, tag in ((host, "host"), (client, "client")):
-        if T.battle(gc).get("activeSync"):
+        if session.can_drive(T.battle(gc)):
             owner = tag
     census = {"host": T.census(host), "client": T.census(client)}
     diff = T.diff_census(census["host"], census["client"])
diff --git a/tools/coop_test/repro_boundary_death.py b/tools/coop_test/repro_boundary_death.py
new file mode 100644
index 000000000..10a9ee2c5
--- /dev/null
+++ b/tools/coop_test/repro_boundary_death.py
@@ -0,0 +1,174 @@
+"""SESSION F: boundary-death corpse-mint COVERAGE regression test (#74).
+
+Proves the PRODUCT boundary-death corpse mint is COVERED by the after_unit_death
+P4 id-manifest and stays in perfect lockstep across the two machines - isolated
+from the battle_give harness confound. Units are given a lethal condition with
+the mint-FREE set_stat lever (health/fire/fatalWounds - NO BattleItem created),
+then a full turn is closed so they bleed/burn to death in prepareNewTurn at a
+boundary; each corpse is the SOLE mint in flight.
+
+Asserts, after the boundary:
+  - host and client hold IDENTICAL corpse (id, type) censuses
+  - their SavedBattleGame::_itemId counters are EQUAL
+  - NO items/itemIdCtr straddle was recorded in the host's sync-check ring
+
+Session F finding: this is CLEAN across player/alien, single/multi, bleed/fire,
+and a lagging slow client. The residual items/itemIdCtr drift the soak sees is
+the ALIEN-side display window (ai/expl), not this boundary path.
+
+OVERKILL NOTE: set_stat/fatalWounds wounds EVERY body part, so `--wounds 6` = 36
+total bleed, which drives health past -stats.health*armor.getOverKill() (~-15 for
+a rookie) -> UnitDieBState._overKill -> NO corpse minted (the assertions would go
+vacuous). Use a GENTLE dose (`--wounds 1` = 6 total) for a corpse-producing death.
+
+Run:  python tools/coop_test/repro_boundary_death.py [--seed N] [--faction 0|1]
+                 [--victims N] [--fire N] [--slow-client MS]
+Exit 0 = covered (pass); 2 = a boundary-death drift (fail).
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47991"
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+def snap(tag, host, client):
+    h = session.battle_checksum(host)
+    c = session.battle_checksum(client)
+    print(f"  [{tag}] itemIdCtr host={h[0]} client={c[0]}"
+          f"{'  <-- DRIFT' if h[0] != c[0] else ''}")
+    print(f"  [{tag}] census   host={h[1]} client={c[1]}"
+          f"{'  <-- DRIFT' if h[1] != c[1] else ''}")
+    print(f"  [{tag}] corpses host  ={corpses(host)}")
+    print(f"  [{tag}] corpses client={corpses(client)}")
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=424242)
+    ap.add_argument("--wounds", type=int, default=1)
+    ap.add_argument("--victims", type=int, default=4)
+    ap.add_argument("--faction", type=int, default=0, help="0=soldiers, 1=aliens")
+    ap.add_argument("--fire", type=int, default=0, help="set fire N (burn-out death) instead of wounds")
+    ap.add_argument("--slow-client", type=int, default=0,
+                    help="ms/frame on the client so its death replay lags past sidestart")
+    args = ap.parse_args()
+
+    cspeed = args.slow_client or SOAK.FAST_SPEED
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": cspeed, "battleAlienSpeed": cspeed,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48880, make_user_dir("bnd_host", options=host_opts))
+    client = GameClient("client", 48881, make_user_dir("bnd_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT; PE.PORT = PORT
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False
+
+        # pick N live units of the target faction (all about to die at a boundary)
+        pool = [u for u in bstate(host)["units"]
+                if u.get("faction") == args.faction and not u.get("isOut")]
+        keep = 0 if args.faction == 1 else 1  # keep >=1 soldier alive so battle survives
+        victims = pool[:max(1, min(args.victims, len(pool) - keep))]
+        print(f"victims: {[v['id'] for v in victims]} (faction {args.faction}, of {len(pool)})")
+        print("\n== BEFORE (both machines synced?) ==")
+        snap("before", host, client)
+
+        # mint-free lethal condition on BOTH machines, all victims
+        for victim in victims:
+            req = {"cmd": "battle_action", "action": "set_stat", "unit": victim["id"], "health": 1}
+            if args.fire:
+                req["fire"] = args.fire
+            else:
+                req["fatalWounds"] = args.wounds
+            for gc, tag in ((host, "host"), (client, "client")):
+                r = gc.ok(dict(req))
+            print(f"    victim {victim['id']}: health=1 "
+                  f"{'fire=%d' % args.fire if args.fire else 'wounds=%d' % r.get('fatalWounds')}")
+        victim = victims[0]
+
+        turn0 = bstate(host)["turn"]
+        print(f"\n== closing turn {turn0} (soldier bleeds out at neutral->player) ==")
+        SOAK.close_side(host, client, 0, 1, turn0)
+        # let the (possibly slow) client drain its death replay + report the sidestart hash
+        sc = session.sync_check(host)
+        deadline = time.time() + (40 if args.slow_client else 6)
+        while time.time() < deadline:
+            sc = session.sync_check(host)
+            if any(m["bucket"] in ("items", "itemIdCtr") for m in sc.get("mismatches", [])):
+                break
+            time.sleep(1.0)
+        print("\n== AFTER the boundary ==")
+        snap("after", host, client)
+        v = next((u for u in bstate(host)["units"] if u["id"] == victim["id"]), None)
+        print(f"  victim isOut host={v.get('isOut') if v else '?'} "
+              f"health={v.get('health') if v else '?'}")
+
+        print("\n== host sync-check mismatch ring ==")
+        ms = sc.get("mismatches", [])
+        for m in ms:
+            print(f"    seq={m['seq']}{' boundary' if m.get('boundary') else ''} "
+                  f"kind={m['kind']} bucket={m['bucket']}")
+        buckets = sc["buckets"]
+        for b in ("items", "itemIdCtr", "saveBlob"):
+            if b in buckets:
+                print(f"  bucket {b}: mismatchCount={buckets[b]['mismatchCount']} "
+                      f"compares={buckets[b].get('compares')}")
+        straddle = [m for m in ms if m["bucket"] in ("items", "itemIdCtr")]
+
+        h, c = session.battle_checksum(host), session.battle_checksum(client)
+        hcorp, ccorp = corpses(host), corpses(client)
+        fails = []
+        if not hcorp:
+            fails.append("no corpse minted (overkill? use a gentler --wounds) - test vacuous")
+        if hcorp != ccorp:
+            fails.append(f"corpse censuses differ: host {hcorp} vs client {ccorp}")
+        if h[0] != c[0]:
+            fails.append(f"item-id counters differ: host {h[0]} vs client {c[0]}")
+        if straddle:
+            fails.append(f"items/itemIdCtr straddled at "
+                         f"{[(m['kind'], m.get('boundary')) for m in straddle]}")
+        print("\n== VERDICT ==")
+        if fails:
+            for f in fails:
+                print(f"  FAIL {f}")
+            rc = 2
+        else:
+            print("  PASS: boundary-death corpse mint COVERED - corpse ids + counter "
+                  "identical on both machines, no items/itemIdCtr straddle")
+            rc = 0
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+    sys.exit(rc)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/run_matrix.py b/tools/coop_test/run_matrix.py
new file mode 100644
index 000000000..43f2eda6f
--- /dev/null
+++ b/tools/coop_test/run_matrix.py
@@ -0,0 +1,331 @@
+"""VALIDATION L2/L3 burn-in matrix runner + per-bucket promotion scoreboard.
+
+Drives `test_parallel_soak.py --profile <p>` repeatedly (optionally K lanes at
+once, one per OXC_HARNESS_SLOT, same shift model as run_parallel.py) and scores
+the result against the L3 promotion program:
+
+  A bucket promotes when, ON ONE UNCHANGED BUILD: 10 consecutive clean baseline
+  soaks + 2 clean runs of every other profile + 0 report-only hits across all of
+  it. Any hit resets that bucket's streak.
+
+This runner does NOT flip any BATTLE_HASH_ALARM row (that is a product code change
+done separately, after the pass). It measures and reports.
+
+Buckets scored: the 9 in the compile-time BATTLE_HASH_ALARM table plus saveBlob
+(terrain, fire, smoke, items, unitsCore, unitsStats, itemIdCtr, unitsCombat,
+unitsRegen, saveBlob).
+
+Usage:
+  python tools/coop_test/run_matrix.py --ab                 # soak-at-K A/B
+  python tools/coop_test/run_matrix.py --full [-k K]        # 10 baseline + 2x each
+  python tools/coop_test/run_matrix.py --jobs baseline:3,psi:2 [-k K]
+  python tools/coop_test/run_matrix.py --resume             # continue the persisted board
+
+State persists to a JSON scoreboard so the (multi-hour) pass can run in bounded
+foreground chunks; --resume picks up where it left off.
+"""
+
+import argparse
+import ast
+import json
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+SOAK = os.path.join(HERE, "test_parallel_soak.py")
+
+BUCKETS = ["terrain", "fire", "smoke", "items", "unitsCore", "unitsStats",
+           "itemIdCtr", "unitsCombat", "unitsRegen", "saveBlob"]
+
+SKIRMISH = ["baseline", "speed-skew", "backlog", "incendiary", "psi",
+            "spawn-blast", "gifting"]
+OTHER = ["speed-skew", "backlog", "incendiary", "psi", "spawn-blast", "gifting",
+         "campaign", "resume"]
+ALL_PROFILES = ["baseline"] + OTHER
+
+NOTE_RE = re.compile(r"report-only sync-check buckets differ:\s*(\{[^}]*\})")
+CLEAN_RE = re.compile(r"ALL PARALLEL SOAK TESTS PASSED")
+FAIL_RE = re.compile(r"^\[FAIL\]\s*(.*)$", re.M)
+
+# Known-residual ledger (VALIDATION / HANDOFF). A report-only hit that matches one
+# of these is a KNOWN signature: logged, does NOT stop the pass, but per L3 still
+# resets the affected bucket's streak. Anything else is a NEW seam -> STOP.
+KNOWN_SIGNATURES = {
+    "unitsCombat": "SEAM-7/8 casualty combat-state straddle at blast/casualty seqs",
+    "unitsRegen": "SEAM-7/8 deferred-regen straddle (ai-seq/endturn boundary-allowed)",
+    "smoke": "SEAM-3 smoke_ai ~1/10 mid-side explosion class",
+    "saveBlob": "PRD-I2 whole-save superset: subsumes any report-only bucket at a boundary",
+    "terrain": "SEAM-3 destroy_tile delivery straddle (heals by sidestart)",
+    "items": "SEAM-7/8 casualty item-drop straddle at blast seqs",
+    "unitsCore": "SEAM-7/8 casualty liveness/position straddle at blast seqs",
+    "itemIdCtr": "SEAM-3/7 blast item-id counter straddle at blast seqs",
+}
+
+
+def parse_run(out):
+    """Extract (clean, fail_reason, buckethits) from one soak's stdout."""
+    clean = bool(CLEAN_RE.search(out))
+    fm = FAIL_RE.search(out)
+    fail = fm.group(1).strip() if fm else None
+    hits = {}
+    for m in NOTE_RE.finditer(out):
+        try:
+            d = ast.literal_eval(m.group(1))
+        except Exception:
+            continue
+        for k, v in d.items():
+            hits[k] = max(hits.get(k, 0), int(v))
+    return clean, fail, hits
+
+
+def run_one(profile, slot, turns, actions, seed):
+    env = dict(os.environ)
+    env["OXC_HARNESS_SLOT"] = str(slot)
+    cmd = [sys.executable, SOAK, "--profile", profile]
+    if turns:
+        cmd += ["--turns", str(turns)]
+    if actions:
+        cmd += ["--actions", str(actions)]
+    if seed is not None:
+        cmd += ["--seed", str(seed)]
+    t0 = time.time()
+    p = subprocess.run(cmd, env=env, stdout=subprocess.PIPE,
+                       stderr=subprocess.STDOUT, universal_newlines=True)
+    dt = time.time() - t0
+    clean, fail, hits = parse_run(p.stdout or "")
+    # a non-zero exit with no [FAIL] line is a crash/harness drop, not a divergence
+    if not clean and not fail and p.returncode != 0:
+        fail = "no ALL-PASSED and no [FAIL] (rc=%d) - crash/harness drop" % p.returncode
+    return {"profile": profile, "slot": slot, "clean": clean, "fail": fail,
+            "hits": hits, "rc": p.returncode, "secs": round(dt, 1),
+            "tail": "\n".join((p.stdout or "").splitlines()[-25:])}
+
+
+def run_batch(jobs, k, turns, actions, seed, slot_base=0, seed_vary=False):
+    """jobs = list of profile names; run up to k concurrently across
+    slots slot_base..slot_base+k-1 (slot_base lets a chunk dodge a busy slot).
+
+    seed_vary (needs seed set): each job gets a DISTINCT seed = seed + its global
+    index in this batch, so 4-wide lanes are INDEPENDENT samples rather than the
+    deterministic-identical clones same-seed lanes produce (the MATRIX-PREP A/B
+    caveat). Use it only for baseline; the psi/spawn-blast profiles pin their own
+    fixture seed, so leave --seed unset for those and this flag off."""
+    results = []
+    i = 0
+    while i < len(jobs):
+        chunk = jobs[i:i + k]
+        procs = []
+        for off, profile in enumerate(chunk):
+            slot = slot_base + off
+            env = dict(os.environ)
+            env["OXC_HARNESS_SLOT"] = str(slot)
+            cmd = [sys.executable, SOAK, "--profile", profile]
+            if turns:
+                cmd += ["--turns", str(turns)]
+            if actions:
+                cmd += ["--actions", str(actions)]
+            job_seed = (seed + i + off) if (seed_vary and seed is not None) else seed
+            if job_seed is not None:
+                cmd += ["--seed", str(job_seed)]
+            t0 = time.time()
+            p = subprocess.Popen(cmd, env=env, stdout=subprocess.PIPE,
+                                 stderr=subprocess.STDOUT, universal_newlines=True)
+            procs.append((profile, slot, p, t0, job_seed))
+        for profile, slot, p, t0, job_seed in procs:
+            out, _ = p.communicate()
+            dt = time.time() - t0
+            clean, fail, hits = parse_run(out or "")
+            if not clean and not fail and p.returncode != 0:
+                fail = "no ALL-PASSED and no [FAIL] (rc=%d)" % p.returncode
+            r = {"profile": profile, "slot": slot, "clean": clean, "fail": fail,
+                 "hits": hits, "rc": p.returncode, "secs": round(dt, 1),
+                 "seed": job_seed,
+                 "tail": "\n".join((out or "").splitlines()[-25:])}
+            results.append(r)
+            flag = "CLEAN" if clean else "FAIL "
+            print(f"  [{flag}] {profile:12s} slot{slot} seed={job_seed} {dt:5.0f}s "
+                  f"hits={r['hits'] or '-'}"
+                  + (f"  FAIL: {fail[:80]}" if fail else ""))
+        i += k
+    return results
+
+
+def classify(hits):
+    """Split a run's report-only bucket hits into (known, unknown)."""
+    known, unknown = {}, {}
+    for b, c in hits.items():
+        if b in KNOWN_SIGNATURES:
+            known[b] = c
+        else:
+            unknown[b] = c
+    return known, unknown
+
+
+def scoreboard(runs):
+    """Build the per-bucket promotion scoreboard from a flat list of run dicts."""
+    board = {b: {"baseline_streak": 0, "streak_broken_by": None,
+                 "profile_clean": {}, "report_hits": []} for b in BUCKETS}
+    # baseline consecutive-clean streak per bucket
+    baseline_runs = [r for r in runs if r["profile"] == "baseline"]
+    for b in BUCKETS:
+        streak = 0
+        broke = None
+        for idx, r in enumerate(baseline_runs):
+            hit = r["hits"].get(b, 0) > 0
+            if r["clean"] and not hit:
+                streak += 1
+            else:
+                if streak >= 0:
+                    broke = ("run#%d " % (idx + 1)) + (
+                        "FAIL:%s" % r["fail"] if not r["clean"]
+                        else "report-only hit %d" % r["hits"].get(b, 0))
+                streak = 0
+        board[b]["baseline_streak"] = streak
+        board[b]["streak_broken_by"] = broke
+    # per-profile clean-run counts (clean run with NO hit for that bucket)
+    for b in BUCKETS:
+        for prof in ALL_PROFILES:
+            pruns = [r for r in runs if r["profile"] == prof]
+            good = sum(1 for r in pruns if r["clean"] and r["hits"].get(b, 0) == 0)
+            board[b]["profile_clean"][prof] = "%d/%d" % (good, len(pruns))
+    # every report-only hit, with classification
+    for r in runs:
+        known, unknown = classify(r["hits"])
+        for b, c in r["hits"].items():
+            board[b]["report_hits"].append({
+                "profile": r["profile"], "count": c,
+                "signature": KNOWN_SIGNATURES.get(b, "*** UNKNOWN (NEW SEAM) ***")})
+    return board
+
+
+def promotion_ready(board, runs):
+    """L3: 10 consecutive clean baseline + >=2 clean of every other profile + 0
+    report-only hits for that bucket across ALL of it."""
+    ready = {}
+    for b in BUCKETS:
+        base_ok = board[b]["baseline_streak"] >= 10
+        others_ok = all(int(board[b]["profile_clean"][p].split("/")[0]) >= 2
+                        for p in OTHER)
+        no_hits = all(r["hits"].get(b, 0) == 0 for r in runs)
+        ready[b] = base_ok and others_ok and no_hits
+    return ready
+
+
+def save_board(path, runs, board, ready, build_sha):
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump({"build_sha": build_sha, "runs": runs, "board": board,
+                   "ready": ready, "ts": time.time()}, f, indent=2)
+
+
+def print_board(board, ready, runs):
+    print("\n=== PER-BUCKET PROMOTION SCOREBOARD "
+          "(baseline consecutive-clean streak, per-profile clean, hits) ===")
+    for b in BUCKETS:
+        pc = board[b]["profile_clean"]
+        hits = board[b]["report_hits"]
+        nunknown = sum(1 for h in hits if h["signature"].startswith("***"))
+        print(f"\n{b}:")
+        print(f"  baseline streak: {board[b]['baseline_streak']}/10"
+              + (f"  (broken by {board[b]['streak_broken_by']})"
+                 if board[b]["streak_broken_by"] else ""))
+        print("  profile clean: " + " ".join(f"{p}={pc[p]}" for p in ALL_PROFILES))
+        if hits:
+            print(f"  report-only hits: {len(hits)}"
+                  + (f"  *** {nunknown} UNKNOWN-SIGNATURE ***" if nunknown else ""))
+        print(f"  PROMOTION READY: {'YES' if ready[b] else 'no'}")
+    print("\n=== SUMMARY ===")
+    print("  PROMOTE:", [b for b in BUCKETS if ready[b]] or "(none)")
+    total = len(runs)
+    clean = sum(1 for r in runs if r["clean"])
+    print(f"  runs: {total}  clean: {clean}  failed: {total - clean}")
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--ab", action="store_true", help="soak-at-K A/B (item 3)")
+    ap.add_argument("--ab-k4", type=int, default=1,
+                    help="number of 4-lane K=4 batches in the A/B (default 1 = 4 runs)")
+    ap.add_argument("--full", action="store_true",
+                    help="the full L3 program: 10 baseline + 2x each other profile")
+    ap.add_argument("--jobs", help='"profile:count,profile:count,..."')
+    ap.add_argument("-k", type=int, default=1, help="concurrent lanes (<=4)")
+    ap.add_argument("--turns", type=int, default=None)
+    ap.add_argument("--actions", type=int, default=None)
+    ap.add_argument("--seed", type=int, default=None)
+    ap.add_argument("--seed-vary", action="store_true",
+                    help="per-run distinct seed = seed + global run index (4-wide "
+                         "INDEPENDENT baseline samples; the MATRIX-PREP A/B caveat). "
+                         "Use for baseline only; leave --seed unset for psi/spawn-blast.")
+    ap.add_argument("--board", default=os.path.join(tempfile.gettempdir(),
+                    "coop_matrix_scoreboard.json"),
+                    help="scoreboard JSON path (persisted across chunks; default = temp)")
+    ap.add_argument("--resume", action="store_true",
+                    help="append to the persisted board instead of starting fresh")
+    args = ap.parse_args()
+
+    try:
+        sha = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=HERE,
+                                      universal_newlines=True).strip()
+    except Exception:
+        sha = "unknown"
+
+    prior = []
+    if args.resume and os.path.exists(args.board):
+        with open(args.board, encoding="utf-8") as f:
+            saved = json.load(f)
+        prior = saved.get("runs", [])
+        if saved.get("build_sha") not in (sha, "unknown"):
+            print(f"WARNING: persisted board is build {saved.get('build_sha')} "
+                  f"but HEAD is {sha} - L3 wants ONE unchanged build")
+
+    if args.ab:
+        # Bounded A/B: baseline K=1 x3 (serial) vs K=4 x1 batch (4 concurrent lanes).
+        # --ab-k4 batches widens the K=4 sample. The parallel soak's ~40% casualty-
+        # straddle census flake (a pre-existing SEAM-7/8 residual) is the dominant
+        # noise, so this measures whether 4-wide CONTENTION worsens the rate, not the
+        # absolute rate (which needs a quiet-build seam fix to stabilise).
+        nb = args.ab_k4 * 4
+        print(f"== SOAK-AT-K A/B: baseline K=1 x3 vs K=4 x{args.ab_k4} batch(es) ==")
+        print("-- K=1 (serial) x3 --")
+        k1 = run_batch(["baseline"] * 3, 1, args.turns, args.actions, args.seed)
+        print(f"-- K=4 ({nb} runs in {args.ab_k4} batch(es) of 4 concurrent lanes) --")
+        k4 = run_batch(["baseline"] * nb, 4, args.turns, args.actions, args.seed)
+        def rate(rs):
+            return sum(1 for r in rs if r["clean"]), len(rs)
+        c1, n1 = rate(k1)
+        c4, n4 = rate(k4)
+        print(f"\nA/B RESULT: K=1 clean {c1}/{n1} (avg {sum(r['secs'] for r in k1)/max(1,n1):.0f}s) "
+              f"| K=4 clean {c4}/{n4} (avg {sum(r['secs'] for r in k4)/max(1,n4):.0f}s)")
+        allruns = prior + k1 + k4
+        board = scoreboard(allruns)
+        ready = promotion_ready(board, allruns)
+        save_board(args.board, allruns, board, ready, sha)
+        print_board(board, ready, allruns)
+        return
+
+    if args.full:
+        jobs = ["baseline"] * 10 + [p for p in OTHER for _ in range(2)]
+    elif args.jobs:
+        jobs = []
+        for tok in args.jobs.split(","):
+            name, _, cnt = tok.partition(":")
+            jobs += [name.strip()] * int(cnt or 1)
+    else:
+        ap.error("one of --ab / --full / --jobs is required")
+
+    print(f"== matrix batch: {len(jobs)} runs, K={args.k}, build {sha[:9]}"
+          f"{' seed-vary from %d' % args.seed if args.seed_vary else ''} ==")
+    runs = prior + run_batch(jobs, args.k, args.turns, args.actions, args.seed,
+                             seed_vary=args.seed_vary)
+    board = scoreboard(runs)
+    ready = promotion_ready(board, runs)
+    save_board(args.board, runs, board, ready, sha)
+    print_board(board, ready, runs)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/run_parallel.py b/tools/coop_test/run_parallel.py
new file mode 100644
index 000000000..c7a164057
--- /dev/null
+++ b/tools/coop_test/run_parallel.py
@@ -0,0 +1,352 @@
+#!/usr/bin/env python3
+"""Run the coop test suite across K non-colliding harness lanes at once.
+
+Each lane is a slot (OXC_HARNESS_SLOT=k) that harness.py isolates: a per-slot
+machine lock and s{slot}_-prefixed user dirs (see harness.py). Ports are now
+OS-assigned ephemeral for every instance, so lanes no longer need disjoint port
+bands - the isolation is purely the lock + user dirs. This runner owns all K
+slots for the duration of a run; another session on the same machine can still
+run its own lane(s) because a different slot never shares user dirs or lock with
+this one, and slot 0 keeps the legacy lock so it serialises against a
+non-slotted / old-harness run.
+
+    python tools/coop_test/run_parallel.py                 # whole suite, K=4
+    python tools/coop_test/run_parallel.py -k 4 test_shared_battle test_geoscape_sync
+    python tools/coop_test/run_parallel.py --file batch.txt --json out.json
+    python tools/coop_test/run_parallel.py --list-only      # print the plan
+
+Assignment: timing-sensitive families (PINNED, below) are locked to slot 0 - the
+serial lane - so contention from the other lanes never perturbs a clock- or
+dogfight-timing assertion. Everything else is greedy-LPT bin-packed across all K
+lanes by measured weight (tools/ci/test_weights.json, same table the CI shard
+planner uses). Each lane runs its queue serially as subprocesses; a nonzero exit
+is retried once (flake tolerance, matching tools/ci/run_coop_suite.ps1) and only
+the last attempt's duration is reported. Exit 0 iff every test ended PASS.
+
+Headless is forced on every lane (SDL_VIDEODRIVER/AUDIODRIVER=dummy) unless
+OXC_HARNESS_WINDOWED=1 is exported for interactive debugging.
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import threading
+import time
+
+TESTDIR = os.path.dirname(os.path.abspath(__file__))
+REPO = os.path.dirname(os.path.dirname(TESTDIR))
+WEIGHTS_FILE = os.path.join(REPO, "tools", "ci", "test_weights.json")
+BUDGET_FILE = os.path.join(TESTDIR, "slow_test_exceptions.json")
+
+# Per-test time budgets (seconds), the same ones tools/ci/run_coop_suite.ps1 enforces
+# in CI (both read slow_test_exceptions.json). A test that FINISHES over its budget
+# fails even if it passed; a test still running at hard-kill x its budget is killed
+# (with its game subtree) and failed, so a hang is always bounded. These are the
+# fallbacks if the JSON is missing.
+DEFAULT_BUDGET = 180.0
+HARD_KILL_MULT = 2.0
+MAX_BUDGET = 900.0
+
+# --- PINNED: timing-sensitive families locked to slot 0 (the serial lane) ----
+# These either deliberately measure timing (speed_skew), drive a real-time
+# minigame that both machines animate in lockstep (the heavy dogfights), lean on
+# the geoscape clock (month_run), or carry a documented clock-race flake
+# (ufo_notice, manufacture, commerce). Run concurrently with the parallel lanes
+# their assertions go soft under CPU contention, so they run one-at-a-time on
+# slot 0 instead. The A/B flake-parity validation (see the session report) is
+# what promotes a family here: any test that flakes only at K>1 gets added.
+#
+# NOTE the two "joint_*" families named in the original audit were renamed
+# SHARED long ago (see MEMORY: joint->shared 2026-07-21); the live tests are
+# test_shared_disconnect / test_shared_resync.
+#
+# NOT pinned wholesale: ~21 tests import geo.skip_realtime (mostly short
+# geoscape/dogfight checks that skip only a few seconds and tolerate contention).
+# Pinning all of them would make slot 0 the long pole and gut the speedup. The
+# A/B batch measures parity and promotes the ones that actually need it; the
+# candidate list (skip_realtime users) is recorded in the session report.
+PINNED = frozenset((
+    "test_parallel_soak",
+    "test_parallel_speed_skew",
+    "test_sync_check",
+    "test_shared_month_run",
+    "test_shared_intercept_spectate",
+    "test_shared_hk_dogfight",
+    "test_shared_dogfight_concurrent",
+    "test_ufo_notice",
+    "test_shared_manufacture",
+    "test_shared_commerce",
+    "test_shared_disconnect",   # audit's test_joint_disconnect (renamed)
+    "test_shared_resync",       # audit's test_joint_resync (renamed)
+))
+
+# Ports are ephemeral now, so there is no port-band ceiling on K. The default
+# cap stays 4 as a machine-resource guard: each lane runs a live host+client
+# game pair, so K lanes = 2K game processes contending for CPU. Raise it if the
+# host has the cores/RAM to spare.
+MAX_SAFE_SLOTS = 4
+
+
+def discover():
+    """boot_check + every test_*.py, by basename, sorted. Same discovery as
+    tools/ci/run_coop_suite.ps1 so the two runners can never disagree."""
+    names = []
+    boot = os.path.join(TESTDIR, "boot_check.py")
+    if os.path.exists(boot):
+        names.append("boot_check")
+    for fn in sorted(os.listdir(TESTDIR)):
+        if fn.startswith("test_") and fn.endswith(".py"):
+            names.append(fn[:-3])
+    return names
+
+
+def load_weights():
+    try:
+        with open(WEIGHTS_FILE, encoding="utf-8") as f:
+            return {k: float(v) for k, v in json.load(f).items()}
+    except (OSError, ValueError):
+        return {}
+
+
+def load_budget():
+    """Read slow_test_exceptions.json -> (default_budget, hard_kill_mult, {test: budget}).
+    Shared verbatim with tools/ci/run_coop_suite.ps1. Errors out if any exception
+    exceeds max_budget_s - there are no unlimited budgets."""
+    default_budget, hard_mult, max_budget = DEFAULT_BUDGET, HARD_KILL_MULT, MAX_BUDGET
+    exceptions = {}
+    try:
+        with open(BUDGET_FILE, encoding="utf-8") as f:
+            cfg = json.load(f)
+    except (OSError, ValueError):
+        return default_budget, hard_mult, exceptions
+    default_budget = float(cfg.get("default_budget_s", default_budget))
+    hard_mult = float(cfg.get("hard_kill_multiplier", hard_mult))
+    max_budget = float(cfg.get("max_budget_s", max_budget))
+    for name, spec in (cfg.get("exceptions") or {}).items():
+        b = float(spec["budget_s"])
+        if b > max_budget:
+            raise SystemExit("slow_test_exceptions.json: %s budget %gs exceeds "
+                             "max_budget_s %gs (no unlimited budgets)" % (name, b, max_budget))
+        exceptions[name] = b
+    return default_budget, hard_mult, exceptions
+
+
+def assign(tests, slots, weights):
+    """Pinned tests -> slot 0 (serial lane); the rest greedy-LPT across all K
+    lanes by weight. Returns a list of K queues (each a list of test names)."""
+    median = 10.0
+    known = sorted(weights[t] for t in tests if t in weights)
+    if known:
+        median = known[len(known) // 2]
+    wt = lambda t: weights.get(t, median)
+
+    queues = [[] for _ in range(slots)]
+    load = [0.0] * slots
+
+    pinned = sorted((t for t in tests if t in PINNED), key=wt, reverse=True)
+    for t in pinned:
+        queues[0].append(t)
+        load[0] += wt(t)
+
+    rest = sorted((t for t in tests if t not in PINNED), key=wt, reverse=True)
+    for t in rest:
+        i = min(range(slots), key=lambda k: load[k])   # lightest lane
+        queues[i].append(t)
+        load[i] += wt(t)
+    return queues, load, median
+
+
+def _kill_tree(proc):
+    """Kill the timed-out test process AND the game subtree it spawned - only
+    this runner's own descendants, never a foreign session's."""
+    try:
+        if os.name == "nt":
+            subprocess.run(["taskkill", "/F", "/T", "/PID", str(proc.pid)],
+                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        else:
+            proc.terminate()
+    except Exception:
+        pass
+    try:
+        proc.wait(timeout=15)
+    except Exception:
+        proc.kill()
+
+
+def _run_once(name, slot, base_env, hard_timeout):
+    path = os.path.join(TESTDIR, name + ".py")
+    env = dict(base_env)
+    env["OXC_HARNESS_SLOT"] = str(slot)
+    t0 = time.time()
+    proc = subprocess.Popen([sys.executable, path], env=env)
+    try:
+        rc = proc.wait(timeout=hard_timeout)
+        timed_out = False
+    except subprocess.TimeoutExpired:
+        _kill_tree(proc)
+        rc = 124
+        timed_out = True
+    return rc, round(time.time() - t0, 1), timed_out
+
+
+def _run_lane(slot, queue, base_env, results, lock, run_start, quiet, budget_cfg):
+    default_budget, hard_mult, exceptions = budget_cfg
+    for name in queue:
+        budget = exceptions.get(name, default_budget)
+        hard = max(1.0, budget * hard_mult)
+        s0 = round(time.time() - run_start, 1)
+        rc, secs, timed_out = _run_once(name, slot, base_env, hard)
+        attempts = 1
+        if rc != 0 and not timed_out:   # retry a real failure once; never retry a hang
+            rc, secs, timed_out = _run_once(name, slot, base_env, hard)
+            attempts = 2
+        e0 = round(time.time() - run_start, 1)
+        over_budget = (rc == 0 and not timed_out and secs > budget)
+        status = "FAIL" if (timed_out or rc != 0 or over_budget) else "PASS"
+        reason = None
+        if timed_out:
+            reason = ("BUDGET HARD-KILL: %s still running after %.1fs (%gx its %gs "
+                      "budget) - killed as a hung test"
+                      % (name, budget * hard_mult, hard_mult, budget))
+        elif over_budget:
+            reason = ("BUDGET EXCEEDED: %s took %.1fs > %gs budget - re-engineer the "
+                      "test or add a justified exception" % (name, secs, budget))
+        rec = {"test": name, "slot": slot, "status": status, "seconds": secs,
+               "attempts": attempts, "rc": rc, "timed_out": timed_out,
+               "budget": budget, "over_budget": over_budget, "reason": reason,
+               "start": s0, "end": e0}
+        with lock:
+            results.append(rec)
+            if not quiet:
+                note = []
+                if attempts > 1:
+                    note.append("retried")
+                if timed_out:
+                    note.append("HANG rc=124")
+                elif rc != 0:
+                    note.append("rc=%d" % rc)
+                elif over_budget:
+                    note.append("over %gs budget" % budget)
+                suffix = " (%s)" % ", ".join(note) if note else ""
+                print("[slot %d] %-11s %8.1fs  %s%s"
+                      % (slot, status, secs, name, suffix), flush=True)
+                if reason:
+                    print("  !! %s" % reason, flush=True)
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__,
+                                 formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("tests", nargs="*", help="test names/paths; default = whole suite")
+    ap.add_argument("-k", "--slots", type=int, default=MAX_SAFE_SLOTS,
+                    help="number of lanes (default %d; >%d is CPU-bound, not "
+                         "port-bound)" % (MAX_SAFE_SLOTS, MAX_SAFE_SLOTS))
+    ap.add_argument("--file", help="read test names from this file, one per line")
+    ap.add_argument("--json", help="write machine-readable results here")
+    ap.add_argument("--list-only", action="store_true", help="print the plan and exit")
+    ap.add_argument("--quiet", action="store_true", help="suppress the per-test lines")
+    args = ap.parse_args()
+
+    if args.slots < 1:
+        ap.error("--slots must be >= 1")
+    if args.slots > MAX_SAFE_SLOTS:
+        print("WARNING: K=%d exceeds the default %d lanes; ports are ephemeral so "
+              "this is a CPU/RAM concern (2K game processes), not a port limit - "
+              "proceeding as asked." % (args.slots, MAX_SAFE_SLOTS),
+              file=sys.stderr)
+
+    names = []
+    if args.file:
+        with open(args.file, encoding="utf-8") as f:
+            names += [ln.strip() for ln in f if ln.strip() and not ln.startswith("#")]
+    names += list(args.tests)
+    names = [n[:-3] if n.endswith(".py") else os.path.basename(n) for n in names]
+    if not names:
+        names = discover()
+    # de-dup, keep order
+    seen = set()
+    tests = [n for n in names if not (n in seen or seen.add(n))]
+
+    missing = [t for t in tests if not os.path.exists(os.path.join(TESTDIR, t + ".py"))]
+    if missing:
+        ap.error("no such test(s): %s" % ", ".join(missing))
+
+    weights = load_weights()
+    budget_cfg = load_budget()
+    default_budget, hard_mult, exceptions = budget_cfg
+    queues, load, median = assign(tests, args.slots, weights)
+
+    print("plan: %d test(s) -> %d lane(s), weights from %s (median %.0fs)"
+          % (len(tests), args.slots,
+             os.path.relpath(WEIGHTS_FILE, REPO) if weights else "none", median))
+    print("budgets: default %gs, hard-kill %gx, %d exception(s) from %s"
+          % (default_budget, hard_mult, len(exceptions),
+             os.path.relpath(BUDGET_FILE, REPO) if exceptions else "defaults"))
+    for k in range(args.slots):
+        pinned_here = sum(1 for t in queues[k] if t in PINNED)
+        print("  slot %d: %2d test(s), ~%6.0fs%s"
+              % (k, len(queues[k]), load[k],
+                 "  (%d pinned)" % pinned_here if pinned_here else ""))
+    if args.list_only:
+        for k in range(args.slots):
+            print("--- slot %d ---" % k)
+            for t in queues[k]:
+                print("  %s%s" % (t, "  [PIN]" if t in PINNED else ""))
+        return 0
+
+    base_env = os.environ.copy()
+    if not base_env.get("OXC_HARNESS_WINDOWED"):
+        base_env["SDL_VIDEODRIVER"] = "dummy"
+        base_env["SDL_AUDIODRIVER"] = "dummy"
+
+    results = []
+    lock = threading.Lock()
+    run_start = time.time()
+    threads = [threading.Thread(target=_run_lane,
+                                args=(k, queues[k], base_env, results, lock,
+                                      run_start, args.quiet, budget_cfg))
+               for k in range(args.slots) if queues[k]]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+    wall = round(time.time() - run_start, 1)
+
+    results.sort(key=lambda r: r["seconds"], reverse=True)
+    fails = [r for r in results if r["status"] != "PASS"]
+    serial = round(sum(r["seconds"] for r in results), 1)
+    lane_busy = [round(sum(r["seconds"] for r in results if r["slot"] == k), 1)
+                 for k in range(args.slots)]
+
+    print("\n%-30s %-6s %8s %8s %4s %s"
+          % ("TEST", "VERD", "SECS", "BUDGET", "ATT", "SLOT"))
+    for r in results:
+        print("%-30s %-6s %8.1f %8g %4d   %d%s"
+              % (r["test"], r["status"], r["seconds"], r["budget"], r["attempts"],
+                 r["slot"], "  <-- FAIL" if r["status"] != "PASS" else ""))
+
+    print("\n%d test(s): %d passed, %d failed" % (len(results),
+          len(results) - len(fails), len(fails)))
+    print("wall-clock %.1fs | serial-sum %.1fs | speedup %.2fx | lanes %s"
+          % (wall, serial, (serial / wall if wall else 0),
+             "/".join("%.0f" % b for b in lane_busy)))
+    if fails:
+        print("FAILED: %s" % ", ".join(r["test"] for r in fails))
+        for r in fails:
+            if r.get("reason"):
+                print("  !! %s" % r["reason"])
+
+    if args.json:
+        with open(args.json, "w", encoding="utf-8") as f:
+            json.dump({"slots": args.slots, "wall": wall, "serial": serial,
+                       "speedup": round(serial / wall, 3) if wall else 0,
+                       "lane_busy": lane_busy, "results": results}, f, indent=2)
+        print("wrote %s" % args.json)
+
+    return 1 if fails else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/coop_test/session.py b/tools/coop_test/session.py
index d20bcfb09..c7ecbec5f 100644
--- a/tools/coop_test/session.py
+++ b/tools/coop_test/session.py
@@ -43,6 +43,31 @@ def has_state(gc, name):
 _has_state = has_state
 
 
+def can_drive(state):
+    """May THIS machine drive a battlescape action? `state` is a battle_state
+    (or parallel_state) response dict.
+
+    Classic co-op: only the machine that owns the simulation may drive, and
+    `activeSync` (connectionTCP::_isActivePlayerSync) is that flag - every coop
+    battle state gates its packet send on it, so an action driven from the
+    passive side runs locally and never reaches the peer.
+
+    Parallel turns (PRD-P5+): `activeSync` stops being the driver predicate and
+    becomes the EXECUTOR invariant (`_isActivePlayerSync == getHost()`, so host
+    true / client false, permanently). A client-side action is forwarded to the
+    host as an intent (PRD-P6) rather than executed locally, so BOTH machines
+    may drive. `parallelActive` says whether that mode is live.
+
+    `parallelActive` is false until P5 lands, so this is exactly `activeSync`
+    today - use it instead of reading `activeSync` directly wherever the
+    question is "which machine should I drive this action from".
+
+    NOT for invariant assertions: a test that asserts exactly one machine owns
+    the simulation is asking about `activeSync` itself and must keep reading it.
+    """
+    return bool(state.get("activeSync") or state.get("parallelActive", False))
+
+
 def start_campaign_via_button(host):
     """Press the REAL START CAMPAIGN button the way a player does: btnCancelClick
     (which opens ConfirmStartCampaignState) then the dialog's OK
@@ -267,6 +292,274 @@ def _detail(gc):
         f"  client: {_detail(client)}")
 
 
+# ---- PRD-P2: the battlescape drift terms -----------------------------------
+
+def battle_checksum(gc):
+    """One machine's three battle drift terms, read off `battle_state`.
+
+    Returns (itemIdCounter, battleCensus, battleUnitsChecksum) - exactly what
+    SharedEcon stamps on the per-turn `next_turn` packet as chkBattleItemId /
+    chkBattleCensus / chkBattleUnits:
+
+      itemIdCounter  SavedBattleGame::_itemId, the next id this machine will mint.
+                     EVERY `new BattleItem` advances it, so a mint that happens on
+                     one machine only shows up here immediately.
+      battleCensus   an order-independent sum over getItems() of the item identity
+                     the wire protocol matches on (id + type + owner unit id).
+      battleUnits    the same shape over getUnits(): id + faction + LIVENESS
+                     (on its feet / dead / unconscious - not the raw animation
+                     status, which legitimately differs frame to frame) +
+                     position. Deliberately carries no TU, energy, health, stun,
+                     wounds, morale or mana; see SharedEcon::battleChecksumTerms
+                     for why each of those would be a permanent red rather than a
+                     detector.
+
+    All three are -1 when no battle is live.
+    """
+    b = gc.cmd({"cmd": "battle_state"})
+    for key in ("itemIdCounter", "battleCensus", "battleUnitsChecksum"):
+        assert key in b, (
+            f"battle_state carries no {key!r} - PRD-P2's harness exposure is "
+            f"missing, so this assertion would be vacuous: {sorted(b)}")
+    return b["itemIdCounter"], b["battleCensus"], b["battleUnitsChecksum"]
+
+
+def assert_battle_synced(host, client, what=""):
+    """PRD-P2's invariant: after every replicated action the two machines hold the
+    same item-id counter and the same item census.
+
+    This is the harness-side reading of the terms the in-game tripwire compares on
+    `next_turn` - direct, so a test can check it after a single action instead of
+    waiting for a turn to roll over. Returns the (agreed) triple.
+
+    The UNIT term is READ and REPORTED here, never asserted, and the difference is
+    deliberate rather than timid:
+
+    * The two ITEM terms are permanent facts. An id minted on one machine only, or
+      an item that exists on one machine only, never heals - so wherever a test
+      calls this, an inequality is a bug.
+    * The UNIT term is a SETTLING quantity. It hashes where every unit is and
+      whether it is down, and the peer is a display that lags the executor by
+      whatever is still in flight. Worse, some of its inputs differ LEGITIMATELY
+      for a whole side: `test_coop_outcome_gaps` documents (and deliberately does
+      not assert) a spawned unit sitting a z-level apart after a blast, because
+      gravity follows host-authoritative terrain destruction and `next_turn` is
+      what repairs it.
+
+    So the unit term is asserted where it IS an invariant - by the in-game tripwire
+    at the turn boundary (SharedEcon::verifyBattleChecksum, which also skips itself
+    when the receive pump applied that stamp out of order), and by
+    test_parallel_soak's own per-unit census, which is taken only after both
+    machines are provably quiescent. Here it is a signal, printed with the term
+    named so a failure elsewhere has a breadcrumb.
+    """
+    h = battle_checksum(host)
+    c = battle_checksum(client)
+    tag = f" {what}" if what else ""
+    assert h[0] >= 0 and c[0] >= 0, (
+        f"battle drift terms{tag}: no live battle to compare "
+        f"(host={h}, client={c})")
+    assert h[:2] == c[:2], (
+        f"BATTLE DRIFT{tag}: the two machines no longer agree.\n"
+        f"    itemIdCounter host={h[0]} client={c[0]}"
+        f"{'  <-- an item was minted on one machine only' if h[0] != c[0] else ''}\n"
+        f"    battleCensus  host={h[1]} client={c[1]}"
+        f"{'  <-- the (id, type, owner) item sets differ' if h[1] != c[1] else ''}\n"
+        f"    battleUnits   host={h[2]} client={c[2]}\n"
+        f"  `battle_items` / `battle_state` units on both machines shows which.")
+    if h[2] != c[2]:
+        print(f"    NOTE{tag}: battleUnits differs (host={h[2]} client={c[2]}) - a "
+              f"unit is in a different place, faction or liveness state. Reported, "
+              f"not asserted; see assert_battle_synced.__doc__.")
+    return h
+
+
+# ---- PRD-I0: the per-action sync-check -------------------------------------
+
+def sync_check(gc):
+    """One machine's PRD-I0 `syncCheck` block, read off `battle_state`.
+
+    Keys: lastSeq / lastComparedSeq (the ACTION namespace, which restarts at 0 at
+    every side boundary), lastBoundarySeq / lastComparedBoundarySeq (the boundary
+    pseudo-seq namespace, monotonic for the whole battle), ringDepth, compares,
+    staleReports, dropped, sweepUs, buckets {name: {alarm, mismatchCount}} and the
+    last 32 mismatches as {seq, boundary, kind, bucket}.
+
+    Only the EXECUTOR compares (the client ships hashes on `action_done` and the
+    host looks them up in its ring), so on a client every counter here stays 0.
+
+    OPT-IN on the wire (`"sync": true`): the block costs a full-map hash sweep,
+    and `battle_state` is the harness' hot poll. Without the flag the response is
+    byte-for-byte what it was before PRD-I0.
+    """
+    b = gc.cmd({"cmd": "battle_state", "sync": True})
+    sc = b.get("syncCheck")
+    assert sc is not None, (
+        f"battle_state carries no 'syncCheck' - PRD-I0's introspection is missing, "
+        f"so this assertion would be vacuous: {sorted(b)}")
+    return sc
+
+
+def sync_buckets(gc):
+    """This machine's RAW bucket values right now (`battle_state.battleHashes`).
+
+    The deferred comparison is what the game does; this is what a test uses to
+    prove a lever moved the bucket it was supposed to move, without waiting a
+    round trip for a report that may never come."""
+    b = gc.cmd({"cmd": "battle_state", "sync": True})
+    h = b.get("battleHashes")
+    assert h is not None, (
+        f"battle_state carries no 'battleHashes' - PRD-I0's bucket sweep is not "
+        f"exposed: {sorted(b)}")
+    return h
+
+
+def wait_sync_loop_closed(host, timeout=20, interval=0.2):
+    """Block until the EXECUTOR's per-action sync-check loop has caught up: every
+    action seq (and boundary seq) it recorded has been answered by the peer.
+
+    Why a harness helper for this: the sync-check samples the client's per-action
+    hash LATE - at the moment the client consumes that chain's gated `action_end`
+    marker (coopEmitActionDone), which lags the executor by whatever display is
+    still in flight. A harness lever that mints an item OUT OF BAND (battle_give is
+    an immediate TestServer RPC, NOT a chain that flows through the marker pipeline)
+    bumps BOTH machines' `_itemId`, but if the client still has an earlier chain's
+    marker parked, that earlier chain's DEFERRED sample now reads the post-give
+    counter while the executor's ring snapshot for the same seq was taken pre-give -
+    a transient items/itemIdCtr divergence with no product cause (the ids the give
+    minted are identical on both machines; only the sample INSTANTS straddle the
+    mint). Draining the loop before the give closes that straddle: with no parked
+    marker, the give cannot bleed into a prior chain's report.
+
+    Bounded and BEST-EFFORT: returns True if the loop closed, False on timeout (the
+    caller proceeds either way - a persistent open loop is a real fault the later
+    assert_sync_clean will catch, this only waits out the transient). Tolerant of a
+    machine with no live sync ring (classic mode, pre-battle): returns True at once.
+    """
+    deadline = time.time() + timeout
+    while True:
+        try:
+            sc = sync_check(host)
+        except Exception:
+            return True  # no live sync ring to wait on
+        if (sc["lastComparedSeq"] >= sc["lastSeq"]
+                and sc["lastComparedBoundarySeq"] >= sc["lastBoundarySeq"]):
+            return True
+        if time.time() >= deadline:
+            return False
+        time.sleep(interval)
+
+
+def assert_sync_clean(host, client, what="", strict=False, allow=(), timeout=30,
+                      interval=0.5, quiet=False, latch_aware=False):
+    """PRD-I0's invariant, read off the EXECUTOR: every action seq the host
+    recorded has been answered by the peer, and no bucket disagreed.
+
+    Two halves, and the difference between them is the whole onboarding
+    programme:
+
+    * THE LOOP CLOSES. `lastComparedSeq` must catch `lastSeq` (and the boundary
+      pair likewise), `dropped` must stay 0, and the ring must not have run away.
+      This is asserted unconditionally - it says the detector is alive. A silent
+      detector is worse than no detector, and the only way to tell the two apart
+      is to watch the reports come back.
+    * THE BUCKETS AGREE. Asserted for every bucket the build has PROMOTED to
+      ALARM (`buckets[name].alarm`), and only reported for the rest. At I0 birth
+      every bucket is report-only (SharedEcon.cpp BATTLE_HASH_ALARM says why), so
+      by default this prints the counts and asserts nothing about them. Pass
+      strict=True where the caller genuinely expects a clean battle - which is
+      exactly the burn-in evidence PRD-I3 promotes a bucket on - and name the
+      buckets that are NOT clean yet in `allow`, so the exception is written down
+      instead of hidden behind a blanket non-strict call.
+
+    `client` is accepted (and its own block sanity-checked) so callers read as the
+    cross-machine assertion they are, and so a future two-way comparison does not
+    change every call site.
+    """
+    tag = f" {what}" if what else ""
+    peer = sync_check(client)
+    assert peer["compares"] == 0, (
+        f"the CLIENT compared {peer['compares']} report(s){tag} - only the executor "
+        f"holds a ring, so a client that compares is comparing against nothing")
+
+    def closed(sc):
+        return (sc["lastComparedSeq"] >= sc["lastSeq"]
+                and sc["lastComparedBoundarySeq"] >= sc["lastBoundarySeq"])
+
+    sc = sync_check(host)
+    deadline = time.time() + timeout
+    while not closed(sc) and time.time() < deadline:
+        time.sleep(interval)
+        sc = sync_check(host)
+
+    assert closed(sc), (
+        f"SYNC-CHECK LOOP OPEN{tag}: the host recorded up to action seq "
+        f"{sc['lastSeq']} / boundary seq {sc['lastBoundarySeq']} but the peer has "
+        f"only answered {sc['lastComparedSeq']} / {sc['lastComparedBoundarySeq']} "
+        f"after {timeout}s. The peer has stopped attaching hashes to its "
+        f"`action_done` reports, so every bucket assertion below is vacuous. "
+        f"ringDepth={sc['ringDepth']} compares={sc['compares']} "
+        f"stale={sc['staleReports']} dropped={sc['dropped']}")
+    assert sc["dropped"] == 0, (
+        f"SYNC-CHECK RING OVERFLOW{tag}: {sc['dropped']} uncompared entries were "
+        f"evicted (ring is 64 deep, the display backlog cap is 2) - the peer is "
+        f"not reporting: {sc}")
+
+    buckets = sc["buckets"]
+    bad = {n: b["mismatchCount"] for n, b in buckets.items() if b["mismatchCount"]}
+    if latch_aware:
+        # coop (harness alignment, owner ruling 2026-08-30): in the wire-order/latch-aware
+        # path the persistence latch (Increment 8 + the alarm-unmask) is the detector of
+        # record - a boundary bucket mismatch PENDS on first sight and only promotes to an
+        # alarm on persistence. So here the alarm condition is the LATCH state (desyncSeen OR
+        # syncBoundaryPersistAlarms>0), NOT the lifetime cumulative `mismatchCount`
+        # (g_syncBucketMismatches, SharedEcon.cpp:6569, increment-only), which flags every
+        # pend-and-heal transient forever. The cumulative alarm-bucket counts and any still-
+        # pending latch entries are REPORTED for diagnostics, never asserted. Classic/lever-off
+        # callers keep the cumulative semantics below untouched (other suites depend on them).
+        ps = host.cmd({"cmd": "parallel_state"})
+        persist_alarms = int(ps.get("syncBoundaryPersistAlarms") or 0)
+        pending = int(ps.get("syncBoundaryPending") or 0)
+        desync = bool(host.cmd({"cmd": "battle_state"}).get("desyncSeen"))
+        alarmed = {n: c for n, c in bad.items() if buckets[n]["alarm"]}
+        if (alarmed or pending) and not quiet:
+            print(f"    NOTE{tag}: latch-aware sync-clean (report-only) - cumulative "
+                  f"alarm-bucket mismatches {alarmed}; still-pending latch entries={pending}; "
+                  f"persistAlarms={persist_alarms} desyncSeen={desync}\n"
+                  f"    {_sync_mismatch_lines(sc)}")
+        assert not (desync or persist_alarms > 0), (
+            f"SYNC-CHECK ALARM{tag} (latch): the persistence latch promoted a boundary "
+            f"divergence - desyncSeen={desync} syncBoundaryPersistAlarms={persist_alarms} "
+            f"(cumulative alarm-bucket mismatches {alarmed}, still-pending {pending}).\n"
+            f"    {_sync_mismatch_lines(sc)}")
+        return sc
+    alarmed = {n: c for n, c in bad.items() if buckets[n]["alarm"]}
+    assert not alarmed, (
+        f"SYNC-CHECK ALARM{tag}: promoted bucket(s) {alarmed} disagreed.\n"
+        f"    {_sync_mismatch_lines(sc)}")
+    if strict:
+        hard = {n: c for n, c in bad.items() if n not in allow}
+        assert not hard, (
+            f"SYNC-CHECK MISMATCH{tag}: bucket(s) {hard} disagreed (strict, "
+            f"allowing {list(allow)}).\n    {_sync_mismatch_lines(sc)}")
+        if bad and not quiet:
+            print(f"    NOTE{tag}: allowed report-only buckets differ: "
+                  f"{ {n: c for n, c in bad.items() if n in allow} }")
+    elif bad and not quiet:
+        print(f"    NOTE{tag}: report-only sync-check buckets differ: {bad}\n"
+              f"    {_sync_mismatch_lines(sc)}")
+    return sc
+
+
+def _sync_mismatch_lines(sc, limit=6):
+    ms = sc.get("mismatches", [])
+    if not ms:
+        return "(no per-seq detail retained)"
+    out = [f"seq={m['seq']}{' boundary' if m.get('boundary') else ''} "
+           f"kind={m['kind']} bucket={m['bucket']}" for m in ms[-limit:]]
+    return "\n    ".join(out)
+
+
 # ---- ending a co-op battle ------------------------------------------------
 #
 # dismiss_popup closes the popup types it knows about and GENERICALLY pops
diff --git a/tools/coop_test/shared_fixture.py b/tools/coop_test/shared_fixture.py
index 3ce03b43d..2212ac488 100644
--- a/tools/coop_test/shared_fixture.py
+++ b/tools/coop_test/shared_fixture.py
@@ -200,13 +200,19 @@ def assert_world_equal(host, client, tag="", timeout=45, interval=1.0):
 class SharedSession:
     """A live SHARED campaign: host + client, world streamed, both on geoscape."""
 
-    def __init__(self, tag, ports, mods=(), transport="tcp"):
+    def __init__(self, tag, ports, mods=(), transport="tcp",
+                 host_options=None, client_options=None):
         self.tag = tag
         self.host_port, self.client_port, self.coop_port = ports
         self.transport = transport
         # Both machines get the SAME mods, or their rulesets diverge.
-        self.host_dir = make_user_dir(f"{tag}_host", mods=mods)
-        self.client_dir = make_user_dir(f"{tag}_client", mods=mods)
+        # host_options/client_options are per-instance options.cfg keys (in force
+        # from the very first frame), so a SHARED test can bring the campaign up
+        # with the host on a feature the client must not set itself - e.g.
+        # EnableCoopParallelTurns, whose host option decides the mode for both
+        # (test_shared_parallel_campaign). Both default None = the old behaviour.
+        self.host_dir = make_user_dir(f"{tag}_host", mods=mods, options=host_options)
+        self.client_dir = make_user_dir(f"{tag}_client", mods=mods, options=client_options)
         self.host = GameClient("host", self.host_port, self.host_dir)
         self.client = GameClient("client", self.client_port, self.client_dir)
 
@@ -247,7 +253,7 @@ def __exit__(self, *exc):
 
 def bring_up(tag, ports, wait_ready=True,
              host_base="HostBase", client_base="ClientBase", mods=(),
-             transport="tcp"):
+             transport="tcp", host_options=None, client_options=None):
     """Stand up a SHARED campaign: host creates it, client joins, the host streams
     the authoritative world, both settle on the geoscape.
 
@@ -256,11 +262,14 @@ def bring_up(tag, ports, wait_ready=True,
     transport - "tcp" (default) or "udp". UDP runs the real direct-LAN
                 connectionUDP transport on 127.0.0.1 (host binds coop_port, client
                 binds coop_port+1); opt in only for a repro that needs it.
+    host_options / client_options - per-instance options.cfg overrides (dict), in
+                force from the first frame. Default None = the old behaviour.
 
     Cleans up its own processes if bring-up fails, so the caller's try/finally
     only has to cover the body.
     """
-    js = SharedSession(tag, ports, mods=mods, transport=transport)
+    js = SharedSession(tag, ports, mods=mods, transport=transport,
+                       host_options=host_options, client_options=client_options)
     try:
         js._start(wait_ready, host_base, client_base)
     except BaseException:
diff --git a/tools/coop_test/slow_test_exceptions.json b/tools/coop_test/slow_test_exceptions.json
index 47d9b3a79..1ffa8e870 100644
--- a/tools/coop_test/slow_test_exceptions.json
+++ b/tools/coop_test/slow_test_exceptions.json
@@ -29,8 +29,8 @@
       "reason": "CI 529.8s (run 31999655291, shard 2) -- heaviest test; full both-machine debrief handshake. Not in test_weights.json (new), so the shard planner under-weighted it and its shard hit the 25min wall."
     },
     "test_parallel_soak": {
-      "budget_s": 450,
-      "reason": "CI 305.8s (run 31999655291, shard 4, retried) -- long multi-turn parallel soak by design. Local weight 345s."
+      "budget_s": 750,
+      "reason": "CI 305.8s normal but 683.2s observed on a ~6x-slow runner window (run 32086393722, shard 2 retry) -- 5-turn parallel battle cycle; headroom for runner jitter until re-engineered under issue #169."
     },
     "test_parallel_endturn": {
       "budget_s": 540,
@@ -51,6 +51,30 @@
     "test_parallel_speed_skew": {
       "budget_s": 300,
       "reason": "CI 31.0s (run 31999655291, shard 1) but local weight 240s -- deliberately paces two game clocks against each other (pinned to the serial lane locally). Provisioned to the local weight."
+    },
+    "test_sync_check": {
+      "budget_s": 360,
+      "reason": "CI 222.9s single attempt (run 32062804444, shard 2); ~207s local contended. Full ten-bucket sync-check scenario battery. Tracked for re-engineering under issue #169."
+    },
+    "test_parallel_corpse_mint": {
+      "budget_s": 300,
+      "reason": "CI 204.5s (run 32593562429, shard 3) -- strict per-seq burn-in across 4 alien turns; functionally PASS. Tracked for re-engineering under issue #169."
+    },
+    "test_parallel_no_reroll": {
+      "budget_s": 420,
+      "reason": "CI 328.0s BUDGET EXCEEDED > 300s (run 32724667370, shard 3) -- test PASSES functionally but the strict per-seq burn-in across 4 alien turns overran the 300s budget on a slow/contended runner (other runs pass ~90s: high variance). Bumped to 420 for headroom (matches test_parallel_floor_drain; legal under max_budget_s=900). Do not re-engineer -- pure budget bump. Tracked under issue #169."
+    },
+    "test_parallel_loose_death": {
+      "budget_s": 300,
+      "reason": "CI 208.3s passing attempt (run 32593562429, shard 2; attempt range 144-208s) -- loose-death stamp + side-barrier fixture w/ liveness scenario. Tracked under issue #169."
+    },
+    "test_parallel_floor_drain": {
+      "budget_s": 420,
+      "reason": "CI 268.5s passing attempt (run 32593562429, shard 4; attempt-1 ~198s, high variance) -- forced-floor red/green + liveness across 5 casualty-heavy alien sides. Tracked under issue #169."
+    },
+    "test_parallel_alien_death_decouple": {
+      "budget_s": 300,
+      "reason": "CI 179.4s (run 32593562429, shard 2) -- 0.6s under the 180s default; death-chain decoupling fixture under backlog. Tracked under issue #169."
     }
   }
 }
diff --git a/tools/coop_test/test_battle_tripwire.py b/tools/coop_test/test_battle_tripwire.py
new file mode 100644
index 000000000..5dc63f263
--- /dev/null
+++ b/tools/coop_test/test_battle_tripwire.py
@@ -0,0 +1,999 @@
+"""PRD-P2: the battlescape drift tripwire.
+
+INV being instrumented: after every replicated action host and peer hold identical
+(id -> BattleItem) maps AND equal SavedBattleGame::_itemId counters. It is true at
+generation (both machines generate the same battle deterministically) and it is the
+first thing to drift once they simulate independently - a peer-side `new BattleItem`,
+an un-scoped transient mint, a lost item.
+
+A THIRD term watches the units: `chkBattleUnits`, an order-independent sum over
+getUnits() of id + faction + LIVENESS (on its feet / dead / unconscious) +
+position. Neither item term can see a unit that is dead on one machine and
+standing on the other until a corpse is minted, which is a whole side too late -
+and "dead here, standing there" is the single most reported co-op battle drift.
+
+P2 makes that invariant OBSERVABLE, two ways:
+
+  3a  SharedEcon::attachWorldChecksum stamps chkBattleItemId / chkBattleCensus /
+      chkBattleUnits whenever a battle is live, so the harness' `shared_checksum`
+      hook and `battle_state` expose all three terms (session.battle_checksum /
+      session.assert_battle_synced).
+  3b  The host stamps the same three terms on the per-turn `next_turn` packet and
+      the client compares them. A mismatch logs, notifies once per
+      RESYNC_DEBOUNCE_MS through the in-battle warning banner, and raises
+      `desyncSeen` - and does NOTHING else. It must never trigger the world
+      restream: that replaces the whole state stack, which mid-battle means
+      destroying the running battle.
+
+What this test asserts:
+
+  1. The terms exist, are non-negative and AGREE the moment the battle is up - on
+     `battle_state` AND on the `shared_checksum` hook (3a), where they must appear
+     only because a battle is live.
+  2. Scripted actions keep them agreeing. Walks only, deliberately: an attack can
+     legitimately mint items (a kill converts the unit and creates a corpse -
+     Tier-A id-manifest work, PRD-P4), so a shot here would test P4's gaps, not
+     P2's detector.
+  3. Across a full turn cycle - the only thing that makes a `next_turn` packet
+     cross - the tripwire agrees with ground truth: silent while the two term
+     pairs are equal (the no-false-positive criterion), and if the battle drifted
+     on its own during the alien turn (a real pre-existing engine gap, not
+     something this test injected) then it must have FIRED. Asserting agreement
+     with ground truth instead of blind silence is what keeps this test honest
+     without making it flaky.
+  4. Forced divergence: an uneven `battle_give` - one machine only - moves both
+     terms apart. Within one turn the client's tripwire fires, and the battle is
+     still live, still on the battlescape, and still playable (a walk driven after
+     the fire still replicates), with no resync request sent.
+  4b. The UNIT term, red and green (section 5). A one-sided status write - the
+     `battle_intent` `status` lever, a bare local assignment nothing in the
+     protocol replicates - moves `battleUnitsChecksum` on ONE machine and leaves
+     both item terms untouched, which is the exclusivity proof: only the new term
+     can see this class of divergence. The in-game tripwire then fires on it and
+     its log line NAMES `units` and dumps this machine's per-unit state - and the
+     divergence is REPAIRED by the same `next_turn` that detected it, which is
+     only possible because the compare runs ahead of the bulk overwrite.
+  5. The auto-report bundle (PRD-P2 rider). When the tripwire fires, BOTH machines
+     write <userdir>/desync-reports/desync-*.zip - the detector because it
+     detected, its peer because the detector shipped it a `desync_report`. One
+     side of a disagreement proves nothing, so a missing peer bundle is a failure,
+     not a detail. Each zip must hold the log, a forced mid-battle save and a
+     desync-info.json that parses with this battle's turn and both machines'
+     checksum terms; exactly one of the two must say it detected locally and the
+     other that it was told. The notice dialog must have been raised on both. And
+     a SECOND forced divergence in the same battle must add NO second bundle -
+     the latch is what stops a battle that stays desynced from filling the disk.
+
+The divergence lever is a TEST-ONLY use of an existing harness command; no
+divergence mechanism ships in the game.
+
+Battle fixture: the skirmish flow (NEW BATTLE > COOP), same path as
+test_parallel_replay_decouple.py / test_skirmish_battle_turn_control.py.
+
+Run:  python tools/coop_test/test_battle_tripwire.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import json
+import os
+import sys
+import time
+import zipfile
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_skirmish_flow as SK
+
+PORT = "47979"
+
+# ---- the fixture pin -------------------------------------------------------
+#
+# The skirmish bring-up walks the NEW BATTLE screen (BATTLE SETTINGS ->
+# newbattle_ok), which reads `<userdir>/xcom1/battle.cfg` on the way up
+# (NewBattleState::load). With no file it takes the built-in defaults, and
+# mission index 0 is STR_SMALL_SCOUT - ONE hostile on a tiny map. A lone alien
+# is routinely cut down by X-Com reaction fire within the first 2-4 alien turns,
+# ending the mission into DebriefingState before the later sections can cross a
+# `next_turn` - the ~40% "battle ends early" flake. Index 1 is STR_MEDIUM_SCOUT:
+# >= MIN_HOSTILES on the same 40x40 footprint, so a handful survive the few
+# turns this test drives. One integer, written by the test into its own hermetic
+# user dir; deliberately NO `base` key, so NewBattleState keeps its normal
+# initSave() path. Same lever the PRD-P9 soak uses (29d5d4cb2).
+MISSION_MEDIUM_SCOUT = 1
+MIN_HOSTILES = 3
+FIXTURE_TRIES = 4
+
+
+def write_battle_fixture(user_dir, mission=MISSION_MEDIUM_SCOUT):
+    """Pin the NEW BATTLE mission for one instance's hermetic user dir. Written
+    to BOTH machines: the client walks the same NEW BATTLE screen on its way to
+    the server browser, so leaving the two setup screens on different missions
+    costs nothing to avoid."""
+    path = os.path.join(user_dir, "xcom1", "battle.cfg")
+    with open(path, "w", encoding="utf-8") as f:
+        f.write("mission: %d\n" % mission)
+    return path
+
+
+# Every state name either machine was seen sitting on while a turn was cycled.
+# The desync notice is a modal that cycle_turn dismisses within a poll or two, so
+# "did the dialog appear" cannot be answered by a check made afterwards - it has
+# to be recorded as the turn runs.
+SEEN_STATES = {"host": set(), "client": set()}
+
+
+def states(gc):
+    return [s.replace("class OpenXcom::", "") for s in session.states(gc)]
+
+
+def has(gc, name):
+    return any(name in s for s in states(gc))
+
+
+def top(gc):
+    return states(gc)[-1].split("::")[-1]
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def unit(b, uid):
+    for u in b.get("units", []):
+        if u["id"] == uid:
+            return u
+    return None
+
+
+def pos(b, uid):
+    u = unit(b, uid)
+    return (u["x"], u["y"], u["z"]) if u else None
+
+
+def terms(gc):
+    return session.battle_checksum(gc)
+
+
+def desync_seen(gc):
+    b = battle(gc)
+    assert "desyncSeen" in b, (
+        f"battle_state carries no 'desyncSeen' - PRD-P2's tripwire flag is missing, "
+        f"every assertion below would be vacuous: {sorted(b)}")
+    return b["desyncSeen"]
+
+
+def wait_until(fn, timeout, interval=0.4):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if fn():
+            return True
+        time.sleep(interval)
+    return False
+
+
+# ---- the log ---------------------------------------------------------------
+# The tripwire's whole output is a log line, so its CONTENT is an assertion
+# target: which term moved, and the per-unit dump. Options::getUserFolder() is
+# exactly the -user directory the harness handed this instance
+# (Options.cpp: setLogFileName(getUserFolder() + "openxcom.log")), so the two
+# machines can never write into the same file. Read from a MARK taken before the
+# turn under test, or an earlier episode's line would satisfy the assertion.
+
+def log_path(gc):
+    return os.path.join(gc.user_dir, "openxcom.log")
+
+
+def log_size(gc):
+    try:
+        return os.path.getsize(log_path(gc))
+    except OSError:
+        return 0
+
+
+def read_log(gc, mark=0):
+    try:
+        with open(log_path(gc), "rb") as f:
+            f.seek(mark)
+            return f.read().decode("utf-8", "replace")
+    except OSError:
+        return ""
+# ---- the auto-report bundle ------------------------------------------------
+
+def reports_dir(gc):
+    """<userdir>/desync-reports - Options::getUserFolder() is exactly the -user
+    directory the harness handed this instance, so the two machines can never
+    write into the same folder."""
+    return os.path.join(gc.user_dir, "desync-reports")
+
+
+def report_zips(gc):
+    d = reports_dir(gc)
+    if not os.path.isdir(d):
+        return []
+    return sorted(f for f in os.listdir(d) if f.endswith(".zip"))
+
+
+def read_report(gc, name):
+    """(namelist, parsed desync-info.json) for one bundle."""
+    path = os.path.join(reports_dir(gc), name)
+    with zipfile.ZipFile(path) as z:
+        bad = z.testzip()
+        assert bad is None, f"{path} is a corrupt archive (bad member {bad})"
+        names = z.namelist()
+        assert "desync-info.json" in names, \
+            f"{path} carries no desync-info.json: {names}"
+        info = json.loads(z.read("desync-info.json").decode("utf-8"))
+        sizes = {n: z.getinfo(n).file_size for n in names}
+    return names, info, sizes
+
+
+# ---- fixture ---------------------------------------------------------------
+
+def drain_to_tactical(host, client, rounds=12):
+    for _ in range(rounds):
+        moved = False
+        for gc in (host, client):
+            state = top(gc)
+            # Same reason as in cycle_turn: record before dismissing, because the
+            # desync notice is exactly the kind of modal this loop clears.
+            SEEN_STATES["host" if gc is host else "client"].add(state)
+            if state != "BattlescapeState":
+                gc.cmd({"cmd": "dismiss_popup"})
+                moved = True
+        time.sleep(1.0)
+        if not moved and all(top(gc) == "BattlescapeState" for gc in (host, client)):
+            return
+
+
+def bring_up_battle(host, client, seed=None):
+    """Drive NEW BATTLE > COOP to a live tactical map on both machines. Pass
+    `seed` to pin RNG::setSeed right before the host generates the map
+    (newbattle_ok), so the fixture - the map, the alien deployment and the
+    soldiers' rolled stats - is reproducible run to run rather than a fresh random
+    battle every time (a test whose outcome hinges on the fixture, e.g. a rocket
+    not landing on its own squad, needs that determinism to be reliable).
+
+    The host gets `seed` (it is the only machine that generates the battle - the
+    client receives the host's world blob), and the client gets a DIFFERENT seed
+    (`seed + 1`). Both are pinned, so both machines are reproducible; but they roll
+    from DIFFERENT streams, so an outcome-shipping regression that makes the client
+    roll its own result cannot coincidentally match the host's and slip past a
+    same-seed comparison - the GAP tests exist precisely to catch that."""
+    SK.skirmish_host(host, PORT)
+    SK.skirmish_client_at_browser(client)
+    client.ok({"cmd": "join_tcp", "ip": "127.0.0.1", "port": PORT,
+               "player": "ClientPlayer"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} join popup",
+                    lambda gc=gc: session.has_state(gc, "Profile") or None, timeout=60)
+        gc.ok({"cmd": "profile_ok"})
+    host.wait_for("BATTLE SETTINGS offered",
+                  lambda: SK.lobby(host).get("buttonVisible") or None, timeout=60)
+    host.ok({"cmd": "lobby_action"})
+    host.wait_for("host at battle settings",
+                  lambda: (not session.has_state(host, "LobbyMenu")) or None, timeout=60)
+    if seed is not None:
+        host.ok({"cmd": "set_seed", "seed": seed})
+        client.ok({"cmd": "set_seed", "seed": seed + 1})
+    host.ok({"cmd": "newbattle_ok"})
+
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} in battle",
+                    lambda gc=gc: battle(gc).get("inBattle") or None,
+                    timeout=180, interval=1.0)
+    for gc in (host, client):
+        if has(gc, "BriefingState"):
+            gc.cmd({"cmd": "close_briefing"})
+    for gc in (host, client):
+        if has(gc, "InventoryState"):
+            gc.cmd({"cmd": "battle_inventory", "action": "ok"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} tactical map",
+                    lambda gc=gc: has(gc, "BattlescapeState") or None,
+                    timeout=120, interval=0.5)
+    drain_to_tactical(host, client)
+    # nothing replicates at all until the co-op turn-init handshake has run
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} co-op battle init",
+                    lambda gc=gc: battle(gc).get("battleInit") or None,
+                    timeout=90, interval=1.0)
+    time.sleep(3)
+
+
+# ---- driving ---------------------------------------------------------------
+
+def drive_walk(driver, watcher, mover_id):
+    """Walk `mover_id` one tile on the driver and wait for the WATCHER to mirror
+    it, so the action provably crossed. Returns (origin, landed).
+
+    An ACCEPTED step can still stall - a walk interrupted the instant it starts
+    (e.g. the unit is spotted mid-step by a reaction-capable alien, likelier on
+    the medium-scout fixture) never moves the unit at all - so fall through to
+    the next adjacent tile rather than fail the whole test on one stalled step.
+    Any real movement counts as the step having crossed; only NO movement on
+    EVERY adjacent tile is a dead driver. Replication is still required."""
+    origin = pos(battle(driver), mover_id)
+    driver.cmd({"cmd": "battle_action", "action": "select", "unit": mover_id})
+    landed = None
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        here = pos(battle(driver), mover_id)
+        want = (here[0] + dx, here[1] + dy, here[2])
+        r = driver.cmd({"cmd": "battle_action", "action": "move", "unit": mover_id,
+                        "x": want[0], "y": want[1], "z": want[2]})
+        if not r.get("ok"):
+            continue
+        if wait_until(lambda h=here: pos(battle(driver), mover_id) != h, 45):
+            landed = pos(battle(driver), mover_id)
+            break
+        # accepted but the unit never stepped: a stalled/interrupted walk, not a
+        # replication result - try another direction (the unit may have spent TU).
+    assert landed is not None, (
+        f"unit {mover_id} accepted a step but never moved on any adjacent tile - "
+        f"the DRIVER stalled (started at {origin})")
+    assert wait_until(lambda: pos(battle(watcher), mover_id) == landed, 45), \
+        (f"the walk never replicated: driver has {mover_id} at {landed}, watcher at "
+         f"{pos(battle(watcher), mover_id)}")
+    return origin, landed
+
+
+def pick_driver(host, client):
+    hb, cb = battle(host), battle(client)
+    if session.can_drive(hb):
+        return host, client, "host", "client", hb
+    return client, host, "client", "host", cb
+
+
+def movers(state, own_coop):
+    return [u for u in state["units"]
+            if u.get("faction") == 0 and u.get("selectable") and not u.get("isOut")
+            and u.get("coop") == own_coop and u.get("tu", 0) > 20]
+
+
+def pick_grounded_victim(gc):
+    """A LIVE unit whose tile exists, for the one-sided `battle_give` GROUND mint.
+    Blindly taking units[0] can pick a soldier that DIED in the alien turn just
+    cycled - a unit with no tile, on which createItemForTile fails ("unit has no
+    tile"). The medium-scout fixture takes casualties (esp. with 5 aliens), so
+    filter to a unit still on its feet; prefer a player unit (always on a client
+    tile), fall back to any live unit."""
+    units = battle(gc)["units"]
+    for u in units:
+        if u.get("faction") == 0 and not u.get("isOut"):
+            return u["id"]
+    for u in units:
+        if not u.get("isOut"):
+            return u["id"]
+    return None
+
+
+def cycle_turn(host, client, timeout=300):
+    """Run the battle forward by one FULL turn - the only event that makes the host
+    ship a `next_turn` packet (NextTurnState::close, host + FACTION_PLAYER).
+
+    Co-op splits the player side: whoever is active presses END TURN, which hands
+    over (PlayerTurnYour) rather than ending the game turn; only after BOTH players
+    have passed does the alien side run and the turn number advance.
+    """
+    start = battle(host).get("turn")
+    deadline = time.time() + timeout
+    stalled = {}
+    while time.time() < deadline:
+        for gc in (host, client):
+            b = battle(gc)
+            if not b.get("inBattle"):
+                return None  # battle ended under us
+            state = top(gc)
+            # Record before any dismissal: this poll is the only chance to see a
+            # modal the very next branch may pop (see SEEN_STATES).
+            SEEN_STATES["host" if gc is host else "client"].add(state)
+            # The HOST's NextTurnState must close ITSELF. `dismiss_popup`
+            # generic-pops it (TestServer: "just pop it to reach the tactical
+            # map"), which skips NextTurnState::close() - and close() is where the
+            # host BUILDS AND SENDS the `next_turn` packet the tripwire rides on.
+            # skipNextTurnScreen (host only, see main()) closes it through the real
+            # path after NEXT_TURN_DELAY.
+            if state == "NextTurnState":
+                if gc is host:
+                    first = stalled.setdefault(id(gc), time.time())
+                    if time.time() - first > 25:
+                        print("NOTE: the host's NextTurnState did not self-close in "
+                              "25s (a turn message suppresses the auto-close timer); "
+                              "popping it, so THIS turn ships no `next_turn` stamp")
+                        gc.cmd({"cmd": "dismiss_popup"})
+                        stalled.pop(id(gc), None)
+                    continue
+                # The CLIENT pops it the way every other test does. Its own close()
+                # ships nothing, and letting its auto-close timer run would race the
+                # host's `click_close` (which also calls close(), from think()) -
+                # two closes, two popState()s, one shredded battle stack.
+                gc.cmd({"cmd": "dismiss_popup"})
+                continue
+            stalled.pop(id(gc), None)
+            # BattlescapeState::think() drives the co-op turn handshake and only
+            # ticks while the battlescape is the TOP state, so drain the infobox
+            # popups the end-turn puts up. Never dismiss the battlescape itself
+            # (session.NO_DISMISS_STATES).
+            if state != "BattlescapeState":
+                gc.cmd({"cmd": "dismiss_popup"})
+                continue
+            if b.get("coopTurn") == 2 and session.can_drive(b):
+                gc.cmd({"cmd": "battle_action", "action": "end_turn_button"})
+        now = battle(host).get("turn")
+        if now is not None and start is not None and now > start:
+            return now
+        time.sleep(1.0)
+    return False
+
+
+def report(host, client, what):
+    h, c = terms(host), terms(client)
+    print(f"    {what}: host itemId={h[0]} census={h[1]} units={h[2]} | "
+          f"client itemId={c[0]} census={c[1]} units={c[2]} | "
+          f"desyncSeen host={desync_seen(host)} client={desync_seen(client)}")
+    return h, c
+
+
+def wait_units_settled(host, client, samples=3, max_wait=60, interval=1.0):
+    """Both machines hold the SAME unit term and neither is still moving.
+
+    A precondition for the one-sided lever below, not a nicety. The lever writes
+    a unit's status on the client and reads the term back a round-trip later; a
+    replay chain still DRAINING on the client rewrites unit position and status
+    as each packet lands, so a write made into that window is silently undone
+    between the two reads and the section reports a dead lever. Waiting for the
+    term to be equal AND unchanged across consecutive samples is what says the
+    display has caught up with the executor.
+    """
+    seen = []
+    deadline = time.time() + max_wait
+    while time.time() < deadline:
+        pair = (terms(host)[2], terms(client)[2])
+        seen.append(pair)
+        if len(seen) >= samples and pair[0] == pair[1] \
+                and all(s == pair for s in seen[-samples:]):
+            return True
+        time.sleep(interval)
+    return False
+
+
+def wait_client_items_settled(client, samples=3, max_wait=45, interval=1.0):
+    """The CLIENT's item terms (itemId + census) are UNCHANGED across consecutive
+    samples - i.e. no item packet is still draining into them.
+
+    wait_units_settled quiesces the UNIT term, but a casualty's dropped kit from
+    the turn just cycled keeps landing in the item census afterwards (more so on
+    the medium-scout fixture). If that drain overlaps the exclusivity window
+    below, the census moves for a reason that is NOT the unit lever and the
+    unit-only proof reports a false "moved an item term too". Single-machine
+    STABILITY wait: the item terms are deliberately UNEQUAL between machines after
+    the section-4/6 skews, so cross-machine equality is the wrong test here."""
+    seen = []
+    deadline = time.time() + max_wait
+    while time.time() < deadline:
+        cur = terms(client)[:2]
+        seen.append(cur)
+        if len(seen) >= samples and all(s == cur for s in seen[-samples:]):
+            return True
+        time.sleep(interval)
+    return False
+
+
+# The wire encoding of UnitStatus (connectionTCP::unitstatusToInt). Only the
+# "down" values matter here: everything a unit does while on its feet - walking,
+# turning, aiming - collapses to the same liveness class in the checksum, on
+# purpose, because the two machines are never on the same animation frame.
+#
+# DEAD, not UNCONSCIOUS: the engine revives its own unconscious units at every
+# turn boundary (SavedBattleGame::endTurn -> newTurnUpdateScripts ->
+# reviveUnconsciousUnits -> BattleUnit::abortTurn), so an UNCONSCIOUS skew is
+# undone by the very turn cycle that is supposed to stamp it - measured, and a
+# good reminder that this lever has to survive a full side to be worth anything.
+WIRE_STATUS_DEAD = 6
+
+
+def main():
+    # skipNextTurnScreen, HOST ONLY: the "Turn N" screen then closes through
+    # NextTurnState::close() on a 500 ms timer instead of waiting for a click, and
+    # close() is where the host builds and ships the `next_turn` packet carrying the
+    # tripwire stamp - without it this test could never fire 3b.
+    #
+    # NOT on the client: the client's hostile-side screen is already closed by the
+    # host's `click_close` packet (NextTurnState::think -> _onClickClose -> close()),
+    # and think() runs the auto-close timer straight afterwards, so a client with the
+    # option on can close the SAME state twice - two popState()s, the second taking
+    # the battlescape with it. That is a pre-existing co-op/option interaction, not
+    # something P2 touches; the test simply does not walk into it.
+    opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+    host = client = None
+    fail = None
+    try:
+        # --- the fixture, RE-ROLLED if the generator shorts it ----------------
+        # write_battle_fixture pins STR_MEDIUM_SCOUT so the battle survives the
+        # few turns this test drives (see the note by that helper). Some
+        # medium-scout aliens can still arrive dead-on-arrival (the same stock
+        # generator accident the PRD-P9 soak hit), so re-roll the whole battle
+        # until at least MIN_HOSTILES are LIVE rather than run a vacuous battle.
+        for attempt in range(1, FIXTURE_TRIES + 1):
+            host = GameClient("host", 48850,
+                              make_user_dir("p2_tripwire_host",
+                                            options=dict(opts, skipNextTurnScreen=True)))
+            client = GameClient("client", 48851,
+                                make_user_dir("p2_tripwire_client", options=opts))
+            for gc in (host, client):
+                write_battle_fixture(gc.user_dir)
+            host.spawn(); host.connect()
+            client.spawn(); client.connect()
+            bring_up_battle(host, client)
+            foes = [u["id"] for u in battle(host)["units"]
+                    if u.get("faction") == 1 and not u.get("isOut")]
+            if len(foes) >= MIN_HOSTILES:
+                print(f"battle up on both machines; fixture: {len(foes)} live "
+                      f"hostiles {foes}")
+                break
+            all_hostiles = [u["id"] for u in battle(host)["units"]
+                            if u.get("faction") == 1]
+            print(f"fixture short on attempt {attempt}: {len(foes)} live "
+                  f"hostile(s) of {len(all_hostiles)} generated {all_hostiles} - "
+                  f"re-rolling the battle")
+            assert attempt < FIXTURE_TRIES, (
+                f"{FIXTURE_TRIES} bring-ups in a row generated fewer than "
+                f"{MIN_HOSTILES} LIVE hostiles - battle.cfg (mission "
+                f"{MISSION_MEDIUM_SCOUT} = STR_MEDIUM_SCOUT) may not have taken. "
+                f"Units: {[(u['id'], u.get('faction')) for u in battle(host)['units']]}")
+            host.shutdown(); client.shutdown(); host = client = None
+
+        # --- 1. the terms exist, are real, and agree at generation -------------
+        base = session.assert_battle_synced(host, client, "at battle start")
+        assert base[0] > 0 and base[1] > 0 and base[2] > 0, (
+            f"the battle drift terms look empty at battle start: {base} - a "
+            f"generated battle always holds items, has minted ids and has units")
+        assert not desync_seen(host) and not desync_seen(client), \
+            "the tripwire is already latched before anything happened"
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert not report_zips(gc), (
+                f"{tag} already holds a desync bundle before anything happened: "
+                f"{report_zips(gc)} in {reports_dir(gc)}")
+            b = battle(gc)
+            assert "desyncReportWritten" in b, (
+                f"{tag}'s battle_state carries no 'desyncReportWritten' - the "
+                f"auto-report introspection is missing, every bundle assertion "
+                f"below would be vacuous: {sorted(b)}")
+            assert not b["desyncReportWritten"], \
+                f"{tag} reports a bundle already written at battle start"
+        print(f"PASS terms: itemIdCounter={base[0]} battleCensus={base[1]} "
+              f"battleUnits={base[2]} agree on both machines, tripwire clear, "
+              f"no bundles on disk")
+
+        # 3a: the same three terms must ride the world checksum whenever a battle is
+        # live, which is what puts them on the `shared_checksum` hook for free.
+        for gc, tag in ((host, "host"), (client, "client")):
+            chk = gc.cmd({"cmd": "shared_checksum"})
+            for key in ("chkBattleItemId", "chkBattleCensus", "chkBattleUnits"):
+                assert key in chk, (
+                    f"{tag}'s shared_checksum carries no {key!r} while a battle is "
+                    f"live - PRD-P2 3a did not reach attachWorldChecksum: "
+                    f"{sorted(chk)}")
+            assert (chk["chkBattleItemId"], chk["chkBattleCensus"],
+                    chk["chkBattleUnits"]) == base, (
+                f"{tag}'s shared_checksum battle terms "
+                f"({chk['chkBattleItemId']}, {chk['chkBattleCensus']}, "
+                f"{chk['chkBattleUnits']}) disagree with its own battle_state "
+                f"{base} - two readings of one battle")
+        print("PASS 3a: both machines stamp chkBattleItemId / chkBattleCensus / "
+              "chkBattleUnits on the world checksum while a battle is live")
+
+        # --- 2. scripted actions keep the two machines in agreement -----------
+        driver, watcher, dtag, wtag, db = pick_driver(host, client)
+        print(f"simulation owner = {dtag}")
+        own_coop = 0 if db["host"] else 1
+        mine = movers(battle(driver), own_coop)
+        assert mine, (f"{dtag} commands no unit with TU to spend: "
+                      f"{[(u['id'], u.get('coop'), u.get('selectable'), u.get('tu')) for u in db['units']]}")
+        mover_id = mine[0]["id"]
+        for step in (1, 2, 3):
+            before, landed = drive_walk(driver, watcher, mover_id)
+            session.assert_battle_synced(host, client, f"after walk #{step}")
+            print(f"PASS walk #{step}: {dtag} moved {mover_id} {before} -> {landed}, "
+                  f"terms still equal")
+        assert not desync_seen(host) and not desync_seen(client), \
+            "the tripwire fired although the two machines still agree"
+
+        # --- 3. a full turn: the tripwire agrees with ground truth -------------
+        turn = cycle_turn(host, client)
+        assert turn, (f"the battle never reached a new turn (turn="
+                      f"{battle(host).get('turn')}, host top={top(host)}, "
+                      f"client top={top(client)}) - no `next_turn` packet crossed, "
+                      f"so the tripwire was never exercised")
+        print(f"turn cycled to {turn}: the host shipped a `next_turn` stamp")
+        h, c = report(host, client, "after the turn")
+        clean_turn = (h == c)
+        if clean_turn:
+            assert not desync_seen(client) and not desync_seen(host), (
+                "FALSE POSITIVE: the tripwire fired on a `next_turn` although both "
+                f"machines carry identical terms ({h})")
+            print("PASS silence: a clean battle crossed a full turn with the "
+                  "tripwire quiet")
+        else:
+            # Not something this test injected: the battle drifted on its own during
+            # the alien turn (a known engine gap - PRD-P3/P4 is what fixes those).
+            # The tripwire's job is to CATCH that, so assert it did.
+            assert wait_until(lambda: desync_seen(client), 30), (
+                f"MISSED: the two machines drifted during the turn (host={h}, "
+                f"client={c}) and the tripwire stayed silent 30s later")
+            print(f"NOTE: the battle drifted on its own during the turn "
+                  f"(host={h}, client={c}) - not injected by this test. The "
+                  f"tripwire CAUGHT it, which is the assertion that matters; the "
+                  f"silence criterion was covered by the walk steps above.")
+
+        # --- 4. forced divergence: one-sided mint, detected within one turn ----
+        # The lever is a test-only use of `battle_give` (nothing in the co-op
+        # protocol replicates a mid-battle item spawn). No divergence mechanism
+        # ships in the game.
+        already = desync_seen(client)
+        pre = terms(client)
+        victim = pick_grounded_victim(client)
+        assert victim is not None, (
+            "no live client unit with a tile to inject the one-sided mint on - the "
+            "fixture took too many casualties before section 4")
+        # slot=ground: createItemForTile mints an id off the SHARED counter and adds
+        # the item to _items, so both terms move - and nothing in a unit's inventory
+        # is disturbed.
+        skew = client.cmd({"cmd": "battle_give", "unit": victim,
+                           "item": "STR_STUN_ROD", "slot": "ground"})
+        assert skew.get("ok"), f"could not skew the client: {skew}"
+        hs, cs = terms(host), terms(client)
+        assert cs != pre, (
+            f"the injected mint did not move the client's own terms ({pre} -> {cs}) "
+            f"- the lever is dead, so the detection assertion below would be vacuous")
+        assert hs != cs, (
+            f"the injected skew left the two machines in agreement ({hs} vs {cs})")
+        print(f"injected a one-sided mint on the client (item id "
+              f"{skew.get('weaponId')}): host={hs} client={cs}")
+
+        before_stats = client.cmd({"cmd": "shared_resync_stats"})
+        turn2 = cycle_turn(host, client)
+        assert turn2, (f"the battle never reached another turn (turn="
+                       f"{battle(host).get('turn')}) - the skew was never stamped")
+        print(f"turn cycled to {turn2} with the skew in place")
+
+        assert wait_until(lambda: desync_seen(client), 30), (
+            f"TRIPWIRE MISSED the injected divergence: host={terms(host)} "
+            f"client={terms(client)}, desyncSeen still False 30s after turn {turn2}")
+        if already:
+            print("PASS detection: the client's tripwire is set (it had already "
+                  "fired on the earlier self-inflicted drift)")
+        else:
+            print("PASS detection: the client's tripwire fired within one turn of "
+                  "the injected divergence")
+
+        # ... and NOTHING else happened.
+        after_stats = client.cmd({"cmd": "shared_resync_stats"})
+        assert after_stats.get("requests") == before_stats.get("requests"), (
+            f"the battle tripwire asked for a world resync - a mid-battle restream "
+            f"destroys the running battle: {before_stats} -> {after_stats}")
+        assert not after_stats.get("pending"), \
+            f"a resync is in flight after a battle desync: {after_stats}"
+        for gc, tag in ((host, "host"), (client, "client")):
+            b = battle(gc)
+            assert b.get("inBattle"), \
+                f"{tag} lost the battle after the tripwire fired: top={top(gc)}"
+            assert has(gc, "BattlescapeState"), \
+                f"{tag}'s battlescape left the state stack: {states(gc)[-4:]}"
+        print("PASS no repair: no resync requested, both battles still live")
+
+        # The auto-report raises a click-to-dismiss notice, which - like any modal
+        # over the battlescape - stops BattlescapeState::think() and with it the
+        # co-op turn handshake until someone clears it. cycle_turn() returns as
+        # soon as the turn number moves, so the notice can still be sitting there;
+        # clear it before driving anything. (This drain is why the dialog check in
+        # section 5 reads SEEN_STATES instead of the live stack.)
+        drain_to_tactical(host, client)
+
+        # ... and the battle is still playable.
+        driver, watcher, dtag, wtag, db = pick_driver(host, client)
+        mine = movers(battle(driver), 0 if db["host"] else 1)
+        assert mine, (f"{dtag} commands no unit able to act after the tripwire "
+                      f"fired: {[(u['id'], u.get('coop'), u.get('tu')) for u in db['units']]}")
+        before, landed = drive_walk(driver, watcher, mine[0]["id"])
+        print(f"PASS playable: {dtag} still walked {mine[0]['id']} {before} -> "
+              f"{landed} and {wtag} still mirrored it after the desync report")
+
+        # --- 5. the auto-report bundle ---------------------------------------
+        # BOTH machines, always: the detector because it detected, its peer
+        # because the detector shipped it a `desync_report`. A bundle from one
+        # side alone shows one half of a disagreement and cannot be diffed.
+        bundles = {}
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert wait_until(lambda gc=gc: report_zips(gc), 30), (
+                f"{tag} wrote NO desync bundle after the tripwire fired - "
+                f"{reports_dir(gc)} is empty. The detector is the client; the host "
+                f"gets there through the `desync_report` packet, so an empty host "
+                f"folder means the packet never crossed or never wrote.")
+            names = report_zips(gc)
+            assert len(names) == 1, \
+                f"{tag} wrote {len(names)} bundles for one battle: {names}"
+            bundles[tag] = names[0]
+            assert names[0].startswith("desync-") and names[0].endswith(".zip"), \
+                f"{tag}'s bundle is not named desync-<stamp>.zip: {names[0]}"
+        print(f"bundles written: host={bundles['host']} client={bundles['client']}")
+
+        detected = {}
+        for gc, tag in ((host, "host"), (client, "client")):
+            names, info, sizes = read_report(gc, bundles[tag])
+            for member in ("desync-info.json", "openxcom.log", "desync-battle.sav"):
+                assert member in names, \
+                    f"{tag}'s bundle is missing {member}: {names}"
+                assert sizes[member] > 0, \
+                    f"{tag}'s bundle carries an EMPTY {member} - a zero-byte log or "\
+                    f"save reproduces nothing"
+            # The forced mid-battle save is the sim-state dump; prove it really is
+            # a save of THIS battle rather than an empty/geoscape one.
+            with zipfile.ZipFile(os.path.join(reports_dir(gc), bundles[tag])) as z:
+                sav = z.read("desync-battle.sav").decode("utf-8", "replace")
+            assert "battleGame" in sav, (
+                f"{tag}'s desync-battle.sav holds no battleGame section - the forced "
+                f"save did not capture the running battle")
+            assert info.get("context") == "next_turn", \
+                f"{tag}'s desync-info.json names the wrong packet: {info.get('context')}"
+            assert info["battle"]["live"], \
+                f"{tag}'s desync-info.json says no battle was live"
+            live_turn = battle(gc).get("turn")
+            assert 1 <= info["battle"]["turn"] <= live_turn, (
+                f"{tag}'s desync-info.json records turn {info['battle']['turn']}, "
+                f"which is not a turn this battle has reached (live turn "
+                f"{live_turn}, skew stamped on {turn2})")
+            chk = info["checksum"]
+            assert chk["local_itemId"] >= 0 and chk["local_census"] >= 0, \
+                f"{tag}'s bundle carries unstamped local terms: {chk}"
+            assert chk["peer_itemId"] != chk["local_itemId"] \
+                or chk["peer_census"] != chk["local_census"], (
+                f"{tag}'s bundle records the two machines AGREEING ({chk}) - it is "
+                f"reporting a desync that its own numbers deny")
+            assert info["mods"], f"{tag}'s desync-info.json lists no active mods"
+            assert info["build"]["version"], f"{tag}'s desync-info.json has no version"
+            assert "seat" in info["session"] and "gamemode" in info["session"], \
+                f"{tag}'s desync-info.json is missing session context: {info['session']}"
+            # PRD-I4: sync-check attribution. In this classic-coop fixture the
+            # per-action sync-check is inert (parallelTurnActive() false), so the
+            # attribution falls back to the diverged P2 terms - source "terms",
+            # naming the itemId/census family the battle_give skew moved. The object
+            # must be present regardless, and the sync_check/sync_ring backstops too.
+            attr = info.get("attribution")
+            assert isinstance(attr, dict), \
+                f"{tag}'s desync-info.json carries no attribution object: {sorted(info)}"
+            for k in ("source", "seq", "kind", "bucket", "headline"):
+                assert k in attr, f"{tag}'s attribution is missing {k!r}: {attr}"
+            assert attr["headline"], f"{tag}'s attribution has an empty headline: {attr}"
+            assert attr["bucket"], f"{tag}'s attribution names no bucket/term: {attr}"
+            assert ("itemId" in attr["bucket"] or "census" in attr["bucket"]
+                    or attr["source"] == "sync_check"), (
+                f"{tag}'s attribution bucket {attr['bucket']!r} does not name the "
+                f"itemId/census family the skew moved (source={attr['source']})")
+            sc = info.get("sync_check")
+            assert isinstance(sc, dict) and "buckets" in sc and "mismatches" in sc, (
+                f"{tag}'s desync-info.json has no usable sync_check block: {sc}")
+            assert isinstance(info.get("sync_ring"), list), \
+                f"{tag}'s desync-info.json has no sync_ring list: {sorted(info)}"
+            detected[tag] = info.get("detected")
+            print(f"    {tag}: {sorted(names)} turn={info['battle']['turn']} "
+                  f"detected={detected[tag]} checksum={chk}")
+        assert sorted(detected.values()) == ["local_compare", "peer_report"], (
+            f"exactly one machine must have detected locally and the other been told "
+            f"by `desync_report`, got {detected}")
+        print("PASS bundle: both machines hold a log + forced save + parsable "
+              "desync-info.json, one detector and one peer-report")
+
+        # The path the game reports and the file on disk must be the same object,
+        # or the dialog sends the player looking for something that is not there.
+        for gc, tag in ((host, "host"), (client, "client")):
+            b = battle(gc)
+            assert b.get("desyncReportWritten"), \
+                f"{tag} has a bundle on disk but reports desyncReportWritten false"
+            reported = b.get("desyncReportPath") or ""
+            assert os.path.basename(reported.replace("\\", "/")) == bundles[tag], (
+                f"{tag} reports its bundle at {reported!r}, but the file on disk is "
+                f"{bundles[tag]}")
+            assert "CoopDesyncNoticeState" in SEEN_STATES[tag], (
+                f"{tag} never raised the desync notice dialog - states seen while "
+                f"cycling turns: {sorted(SEEN_STATES[tag])}")
+            # PRD-I4: the REPORT-ON-GITHUB url and OPEN-FOLDER target the notice
+            # would open are recorded in statics that survive the modal's dismissal,
+            # so read them here (the live dialog was already cleared by the drain).
+            dlg = gc.cmd({"cmd": "desync_dialog"})
+            last = dlg.get("last", {})
+            assert last.get("raiseCount", 0) >= 1, \
+                f"{tag}'s desync_dialog reports no notice was ever raised: {dlg}"
+            assert last.get("headline"), \
+                f"{tag}'s last notice has an empty attribution headline: {last}"
+            url = last.get("reportUrl", "")
+            assert url.startswith(
+                "https://github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues/new"), \
+                f"{tag}'s REPORT ON GITHUB url is not the prefilled new-issue url: {url!r}"
+            assert "title=" in url and "body=" in url, \
+                f"{tag}'s report url is missing the prefilled title/body: {url!r}"
+            target = last.get("openFolderTarget", "").replace("\\", "/")
+            assert target.endswith("desync-reports"), \
+                f"{tag}'s OPEN FOLDER target is not the reports dir: {target!r}"
+        print("PASS notice: both machines raised CoopDesyncNoticeState and report "
+              "the path of the file they actually wrote")
+
+        # --- 5b. the one-click UX buttons (probe) -----------------------------
+        # The real fire's notice is dismissed by the turn cycle within a poll or two,
+        # so its buttons cannot be caught live. Push a probe notice (test-only,
+        # sentinel content, launches nothing) and assert the widget layout + getters
+        # through the established dialog-introspection levers (no pixel coords).
+        probe = host.cmd({"cmd": "desync_probe_dialog"})
+        assert probe.get("ok"), f"desync_probe_dialog failed: {probe}"
+        assert wait_until(lambda: top(host) == "CoopDesyncNoticeState", 15), \
+            f"the probe notice never became top: {states(host)[-3:]}"
+        wid = host.cmd({"cmd": "list_widgets"})
+        labels = [w.get("text", "") for w in wid.get("widgets", []) if "text" in w]
+        for want in ("OK", "OPEN FOLDER", "REPORT ON GITHUB"):
+            hits = [w for w in wid.get("widgets", []) if w.get("text") == want]
+            assert hits, f"the desync notice has no {want!r} button - labels seen: {labels}"
+            b = hits[0]
+            assert b.get("visible") and b.get("interactive"), \
+                f"the {want!r} button is not visible+interactive: {b}"
+        dd = host.cmd({"cmd": "desync_dialog"})
+        assert dd.get("live"), f"desync_dialog does not see the probe notice: {dd}"
+        assert dd.get("reportUrl", "").startswith(
+            "https://github.com/OpenXcom-Coop/OpenXcom-Coop-Mod/issues/new"), \
+            f"the live notice's REPORT url is wrong: {dd.get('reportUrl')!r}"
+        assert dd.get("openFolderTarget"), f"the live notice has no OPEN FOLDER target: {dd}"
+        assert dd.get("headline"), f"the live notice has no headline: {dd}"
+        host.cmd({"cmd": "dismiss_popup"})
+        assert wait_until(lambda: top(host) != "CoopDesyncNoticeState", 15), \
+            f"the probe notice would not dismiss: {states(host)[-3:]}"
+        print("PASS buttons: the notice offers OK / OPEN FOLDER / REPORT ON GITHUB, "
+              "and reports the folder + prefilled GitHub url they would open")
+
+        # --- 6. the latch: a SECOND divergence adds no second bundle -----------
+        # A fresh live unit: the section-4 victim may have died in a turn cycled
+        # since, and the latch only needs SOME second one-sided mint.
+        victim2 = pick_grounded_victim(client)
+        assert victim2 is not None, (
+            "no live client unit with a tile for the second mint - the fixture took "
+            "too many casualties before the latch section")
+        skew2 = client.cmd({"cmd": "battle_give", "unit": victim2,
+                            "item": "STR_STUN_ROD", "slot": "ground"})
+        assert skew2.get("ok"), f"could not skew the client a second time: {skew2}"
+        turn3 = cycle_turn(host, client)
+        assert turn3, (f"the battle never reached a third turn (turn="
+                       f"{battle(host).get('turn')}) - the second skew was never "
+                       f"stamped, so the latch was never re-tested")
+        print(f"turn cycled to {turn3} with a second one-sided mint in place")
+        for gc, tag in ((host, "host"), (client, "client")):
+            now = report_zips(gc)
+            assert now == [bundles[tag]], (
+                f"{tag} wrote a SECOND bundle for the same battle ({now}) - the "
+                f"latch is broken, and a battle that stays desynced would write one "
+                f"multi-megabyte zip per turn for the rest of the mission")
+        print("PASS latch: a second forced divergence in the same battle produced "
+              "no second bundle on either machine")
+
+        # --- 7. the UNIT term, red and green ----------------------------------
+        # Everything above moved an ITEM term. This section moves a term neither
+        # item term can see: a unit that is DOWN on one machine and on its feet on
+        # the other. That is the classic co-op battle drift - PRD-P10 fixed three
+        # separate paths that produced exactly it - and no item census notices it
+        # until a corpse is minted, which is a whole side too late.
+        #
+        # The lever is a TEST-ONLY use of `battle_intent`'s `status` setter: a bare
+        # local assignment, on the CLIENT only (the host is the machine that ships
+        # `next_turn`, so the client is the machine that compares). Nothing in the
+        # co-op protocol replicates a bare status write. No divergence mechanism
+        # ships in the game.
+        assert wait_units_settled(host, client), (
+            f"the two machines never settled on a common unit state before the "
+            f"lever (host={terms(host)[2]} client={terms(client)[2]}) - a replay "
+            f"still draining on the client would undo the one-sided write")
+        alive = [u for u in battle(client)["units"]
+                 if not u["isOut"] and u.get("faction") == 0]
+        assert len(alive) >= 2, (
+            f"the fixture has fewer than two live player units to skew: "
+            f"{[(u['id'], u.get('faction'), u['isOut']) for u in battle(client)['units']]}")
+        down_id = alive[-1]["id"]
+        assert wait_client_items_settled(client), (
+            f"the client's item terms never stopped draining before the unit-only "
+            f"lever (itemId/census {terms(client)[:2]}) - a casualty's kit still "
+            f"landing would move the census inside the exclusivity window below")
+        h_pre, c_pre = terms(host), terms(client)
+        lever = client.cmd({"cmd": "battle_intent", "unit": down_id, "action": "turn",
+                            "status": WIRE_STATUS_DEAD, "dry": True})
+        assert lever.get("ok") and lever.get("status") == WIRE_STATUS_DEAD, (
+            f"the status lever did not take on unit {down_id}: {lever} - every "
+            f"assertion below would be vacuous")
+        # One round-trip of tolerance: the write is applied on the client's own
+        # frame, and `terms` is a separate command.
+        wait_until(lambda: terms(client)[2] != c_pre[2], 10)
+        h_post, c_post = terms(host), terms(client)
+
+        # EXCLUSIVITY - the red/green that matters. One unit went down on one
+        # machine: the unit term MUST move, and the two item terms MUST NOT (they
+        # are what a pre-P2-unit-term build had, and they are blind to this).
+        assert c_post[2] != c_pre[2], (
+            f"the one-sided status write did not move the client's unit term "
+            f"({c_pre[2]} -> {c_post[2]}) - the lever is dead")
+        assert c_post[:2] == c_pre[:2], (
+            f"the status write moved an ITEM term as well ({c_pre[:2]} -> "
+            f"{c_post[:2]}); the exclusivity proof needs a unit-only lever")
+        assert h_post == h_pre, (
+            f"the client-side lever moved the HOST's terms ({h_pre} -> {h_post}) "
+            f"- it replicated, so there is no divergence to detect")
+        assert h_post[2] != c_post[2], (
+            f"the two machines still agree on the unit term after the skew "
+            f"(host={h_post[2]} client={c_post[2]})")
+        print(f"PASS unit-term exclusivity: unit {down_id} put down on the client "
+              f"alone moved battleUnits {c_pre[2]} -> {c_post[2]} and left "
+              f"itemId/census at {c_pre[:2]}")
+
+        # ... and the in-game tripwire catches it. The flag is cleared by
+        # `shared_reset_resync_stats` (SharedEcon::resetResyncStats ->
+        # resetBattleDesyncSeen), so this is a FRESH detection, not the latched one
+        # from section 4. The ITEM skew injected earlier is still in place, so the
+        # log line will name `census` as well - which is why exclusivity is proved
+        # above, at the term level, rather than from the log.
+        for gc in (host, client):
+            gc.ok({"cmd": "shared_reset_resync_stats"})
+        assert not desync_seen(client) and not desync_seen(host), \
+            "shared_reset_resync_stats did not clear the tripwire flag"
+        # Mark the log BEFORE the turn that carries the skew, so the line asserted
+        # below can only be the one this section provoked.
+        mark = log_size(client)
+        turn3 = cycle_turn(host, client)
+        assert turn3, (f"the battle never reached a third turn (turn="
+                       f"{battle(host).get('turn')}) - the unit skew was never "
+                       f"stamped")
+        print(f"turn cycled to {turn3} with the unit skew in place")
+        assert wait_until(lambda: desync_seen(client), 30), (
+            f"TRIPWIRE MISSED the unit divergence: host={terms(host)} "
+            f"client={terms(client)} 30s after turn {turn3}")
+
+        # WHICH term diverged has to be in the log line: the three watch different
+        # families of bug, and a bare "BATTLE DESYNC" points a reader nowhere.
+        assert wait_until(
+            lambda: "BATTLE DESYNC on next_turn" in read_log(client, mark), 30), (
+            f"the client's log carries no BATTLE DESYNC line for the `next_turn` "
+            f"that detected the unit skew ({log_path(client)})")
+        tail = read_log(client, mark)
+        named = tail[tail.rfind("BATTLE DESYNC on next_turn"):][:400]
+        assert "units" in named.split("- itemId")[0], (
+            f"the desync log line does not NAME the unit term as diverging: "
+            f"{named.splitlines()[0]!r}")
+        # ... and the per-unit dump, which is the only thing that turns "the unit
+        # sets differ" into "unit N differs" - a sum never names the unit.
+        assert "BATTLE DESYNC units here" in tail, (
+            f"the unit term fired but dumped no per-unit state, so the two "
+            f"machines' logs cannot be diffed to the unit that drifted")
+        print(f"PASS unit-term detection: the tripwire fired, the log names the "
+              f"term ({named.splitlines()[0].split('DESYNC on ')[-1][:80]!r}) and "
+              f"dumps this machine's units")
+
+        # ... and the SAME `next_turn` repaired it. That can only be true if the
+        # compare runs AHEAD of the packet's bulk unit overwrite - a compare made
+        # after it would find the two machines agreeing every time and this whole
+        # section would be untestable.
+        assert wait_until(lambda: terms(client)[2] == terms(host)[2], 30), (
+            f"`next_turn` detected the unit divergence but did not repair it "
+            f"(host={terms(host)[2]} client={terms(client)[2]}) - the compare and "
+            f"the bulk overwrite are in the wrong order, or the overwrite is gone")
+        print("PASS unit-term repair: the same next_turn that detected the skew "
+              "overwrote it, so the compare provably ran before the repair")
+
+
+        print("ALL BATTLE-TRIPWIRE TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        if host is not None:
+            host.shutdown()
+        if client is not None:
+            client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_coop_alien_launcher_item_loss.py b/tools/coop_test/test_coop_alien_launcher_item_loss.py
index 1a817384d..b8aff56d0 100644
--- a/tools/coop_test/test_coop_alien_launcher_item_loss.py
+++ b/tools/coop_test/test_coop_alien_launcher_item_loss.py
@@ -28,6 +28,13 @@
 Scenarios: the alien's launcher sits in the hand the packet claims
 (`right_hand`) and in the other one (`left_hand`, the AI case).
 
+PRD-P4 keeps the census assertion strict and adds the two drift-tripwire terms
+to it: the blast kills the firing alien, and its CORPSES are a Tier-A spawn
+whose ids the host now names on `after_unit_death`. A corpse id that differs
+between the machines is a real divergence, so it is asserted rather than
+filtered; the item-id counter is asserted too, because a census comparison
+cannot see it.
+
 Run:  python tools/coop_test/test_coop_alien_launcher_item_loss.py
 Exit 0 = pass; 2 = failure.
 """
@@ -37,6 +44,7 @@
 import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import session
 import shared_fixture
 import test_shared_battle as B
 
@@ -201,12 +209,14 @@ def run_scenario(label, alien_slot, ports, fails):
             f"censuses diverged BEFORE the shot: {diff_census(pre_h, pre_c)}"
         print(f"PASS pre-shot: {len(pre_h)} item instances, identical on both machines")
 
-        # The shot must be driven from the machine that owns the simulation: the
-        # coop battle states only emit their packet when _isActivePlayerSync is
-        # true, so firing from the passive side would never reach the peer.
+        # The shot must be driven from a machine that may drive it: in classic
+        # coop the battle states only emit their packet when _isActivePlayerSync
+        # is true, so firing from the passive side would never reach the peer.
+        # session.can_drive() also covers parallel turns (PRD-P5+), where both
+        # machines may drive.
         def _sim_owner():
             for gc, tag in ((host, "host"), (client, "client")):
-                if battle(gc).get("activeSync"):
+                if session.can_drive(battle(gc)):
                     return (gc, tag)
             return None
 
@@ -230,6 +240,21 @@ def _sim_owner():
             for line in d:
                 print(f"  [DIVERGE] {line}")
             fails.append(f"{label}: host/client item census diverged ({len(d)} items)")
+        # PRD-P4: the census stays STRICT - no per-type filter and no "ignore the
+        # corpses" escape hatch. The blast kills the firing alien, and a corpse is a
+        # Tier-A spawn (a deterministic set each machine creates for itself), so a
+        # corpse whose id differs between the two machines is precisely the drift the
+        # id-manifest removes - not noise to filter out. The two tripwire terms go
+        # with it: the item-id COUNTER is invisible to a census comparison, and two
+        # machines can hold identical item sets while one is primed to mint the next
+        # id differently.
+        try:
+            session.assert_battle_synced(host, client, f"after the {label} shot")
+        except AssertionError as e:
+            fails.append(f"{label}: {e}")
+        for gc, tag in ((host, "host"), (client, "client")):
+            if battle(gc).get("desyncSeen"):
+                fails.append(f"{label}: the PRD-P2 drift tripwire fired on the {tag}")
         for tag, cen in (("host", h), ("client", c)):
             if soldier_launcher not in cen:
                 fails.append(f"{label}/{tag}: the soldier's blaster launcher (item "
diff --git a/tools/coop_test/test_coop_blast_item_damage.py b/tools/coop_test/test_coop_blast_item_damage.py
index 3c86ea253..155ed025b 100644
--- a/tools/coop_test/test_coop_blast_item_damage.py
+++ b/tools/coop_test/test_coop_blast_item_damage.py
@@ -40,6 +40,7 @@
 import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import session
 import shared_fixture
 import test_coop_alien_launcher_item_loss as I74
 
@@ -134,7 +135,7 @@ def _pos(gc):
 
         def _sim_owner():
             for gc, tag in ((host, "host"), (client, "client")):
-                if I74.battle(gc).get("activeSync"):
+                if session.can_drive(I74.battle(gc)):
                     return (gc, tag)
             return None
 
diff --git a/tools/coop_test/test_coop_debrief_sync.py b/tools/coop_test/test_coop_debrief_sync.py
new file mode 100644
index 000000000..e444f5594
--- /dev/null
+++ b/tools/coop_test/test_coop_debrief_sync.py
@@ -0,0 +1,480 @@
+"""The debriefing must score the SAME battle the same way on both machines.
+
+THE BUG (reported from manual parallel-turns play, skirmish + ABORT): the two
+players' debriefings disagreed - the host counted 2 alien kills, the client 1.
+
+WHY. DebriefingState::prepareDebriefing() runs on BOTH machines and builds the
+score page from the LOCAL save; the host's debriefing packet only carries the
+soldier-stats and diary pages. Its alien-kill row is
+
+    oldFaction == FACTION_HOSTILE && bunit->killedBy() == FACTION_PLAYER
+
+and `killedBy` (with `murdererId`) was the one part of a death that never
+crossed the wire: each machine derived it in its own
+BattlescapeGame::checkForCasualties. The peer gets the same answer whenever it
+runs that pass over the same victim - which it does for a death caused by an
+action it is replaying - so ordinary shot kills agreed and the gap hid. It does
+NOT run it for a death it never replays as a local attack chain, and the
+everyday case of that is a REACTION-FIRE kill during the ALIEN side: there the
+alien keeps the BattleUnit constructor default `_killedBy = its own faction`,
+the peer scores it as no kill at all, and the two players see different counts
+AND different mission scores. `killedBy` is also saved, so it is a persisted
+divergence, not a display one.
+
+THE FIX. `unit_death` and `after_unit_death` carry `killedBy`/`murdererId`, and
+the peer adopts them instead of deriving anything (additive; absent = older peer
+= keep the local derivation).
+
+WHAT THIS TEST DRIVES, in one battle, for each of two endings (ABORT and WIN):
+
+  1. a host-executed kill        (battle_fire on the host)
+  2. a client-intent kill        (battle_intent -> the host executes)
+  3. at least one ALIEN-SIDE kill - the reaction fire the aliens walk into when
+     the turn is handed over. This is the flavour that was actually broken; the
+     test fails rather than passes vacuously if the fixture never produces one.
+  4. the ending, and then `debrief_state` on BOTH machines: every score row, its
+     quantity and its points, and the total, must be identical.
+
+Attribution is asserted per unit as well as through the debriefing, so a failure
+says WHICH alien lost its killer and not merely that a number was wrong.
+
+FIXTURE NOTE. Stock STR_SMALL_SCOUT holds exactly ONE alien, which is not enough
+to make two kills and still have a battle left to abort, so the test generates a
+throwaway ruleset that raises the count (the pattern test_coop_outcome_gaps.py
+uses) and puts them all outside the UFO, where the squad meets them.
+
+Run:  python tools/coop_test/test_coop_debrief_sync.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+NALIENS = 5
+
+# Pin the fixture (outcome_gaps recipe): a fresh-random battle made both mid-battle
+# levers below flake ~2/3 - the mop-up needs a reachable killable alien and the
+# alien-side reaction kill needs an alien to walk into the armed squad's line of
+# fire. The host generates + ships the world, so its seed fixes the map, deployment
+# and stats; the client gets seed+1 (a DIFFERENT stream, so an attribution-ship
+# regression still diverges). Overridable for a seed search.
+SEED = int(os.environ.get("DEBRIEF_SEED", "424242"))
+
+# STATUS_DEAD / FACTION_PLAYER as battle_state reports them.
+STATUS_DEAD = 6
+FACTION_PLAYER = 0
+FACTION_HOSTILE = 1
+
+METADATA = """\
+name: "Coop debriefing sync test"
+version: 1.0
+description: "Test-only: a skirmish scout with enough aliens to kill several."
+author: coop harness
+
+master: xcom1
+"""
+
+RULESET = """\
+alienDeployments:
+  - type: STR_SMALL_SCOUT
+    data:
+      - alienRank: 5
+        lowQty: %d
+        highQty: %d
+        dQty: 0
+        percentageOutsideUfo: 100
+        itemSets:
+          -
+            - STR_PLASMA_PISTOL
+            - STR_PLASMA_PISTOL_CLIP
+          -
+            - STR_PLASMA_PISTOL
+            - STR_PLASMA_PISTOL_CLIP
+          -
+            - STR_PLASMA_PISTOL
+            - STR_PLASMA_PISTOL_CLIP
+    width: 40
+    length: 40
+    height: 4
+""" % (NALIENS, NALIENS)
+
+
+def make_mod(root):
+    mod = os.path.join(root, "Coop_Debrief_Sync_Test")
+    if os.path.isdir(mod):
+        return mod
+    os.makedirs(os.path.join(mod, "Ruleset"))
+    with open(os.path.join(mod, "metadata.yml"), "w", encoding="utf-8") as f:
+        f.write(METADATA)
+    with open(os.path.join(mod, "Ruleset", "debrief_sync.rul"), "w", encoding="utf-8") as f:
+        f.write(RULESET)
+    return mod
+
+
+# ---- reading the two machines ----------------------------------------------
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def all_units(gc):
+    """battle_state's unit list, or [] once the battle is over (the mission can
+    end under any of these readouts - the last kill auto-ends it)."""
+    return battle(gc).get("units", [])
+
+
+def units(gc):
+    return {u["id"]: u for u in all_units(gc)}
+
+
+def live_aliens(gc):
+    return [u for u in all_units(gc)
+            if u.get("faction") == FACTION_HOSTILE and not u.get("isOut")]
+
+
+def live_player_units(gc):
+    return [u for u in all_units(gc)
+            if u.get("faction") == FACTION_PLAYER and not u.get("isOut")
+            and u.get("tu") is not None]
+
+
+def attribution(gc):
+    """{alien id: (status, killedBy, murdererId)} for every hostile-born unit.
+
+    This is what DebriefingState reads; comparing it directly is what makes a
+    failure point at the death that lost its killer."""
+    return {u["id"]: (u["status"], u.get("killedBy"), u.get("murdererId"))
+            for u in all_units(gc) if u.get("faction") == FACTION_HOSTILE}
+
+
+def killed_here(gc):
+    """The alien ids THIS machine would put in the STR_ALIENS_KILLED row."""
+    return sorted(uid for uid, (st, kb, _m) in attribution(gc).items()
+                  if st == STATUS_DEAD and kb == FACTION_PLAYER)
+
+
+def assert_attribution_agrees(host, client, what):
+    ah, ac = attribution(host), attribution(client)
+    bad = {uid: (ah.get(uid), ac.get(uid)) for uid in set(ah) | set(ac)
+           if ah.get(uid) != ac.get(uid)}
+    assert not bad, (
+        f"kill attribution diverged {what} - (status, killedBy, murdererId) per "
+        f"alien, host vs client: {bad}. killedBy is what DebriefingState counts "
+        f"STR_ALIENS_KILLED with, and it is host-authoritative: the death "
+        f"packets carry it and the peer must not re-derive it.")
+    kh, kc = killed_here(host), killed_here(client)
+    assert kh == kc, (
+        f"the two machines would tally different alien kills {what}: "
+        f"host {kh} client {kc}")
+    return kh
+
+
+# ---- driving ---------------------------------------------------------------
+
+def give_both(host, client, uid, item, ammo=None):
+    wid = None
+    for gc in (host, client):
+        req = {"cmd": "battle_give", "unit": uid, "item": item,
+               "slot": "right", "clear_hands": True}
+        if ammo:
+            req["ammo"] = ammo
+        wid = gc.ok(req)["weaponId"]
+    time.sleep(2)
+    return wid
+
+
+def down(gc, uid):
+    """True once `uid` is out of the fight - or once the battle itself is over."""
+    u = units(gc).get(uid)
+    return True if u is None else bool(u["isOut"])
+
+
+def arm_and_kill(host, client, shooter, target, how, tries=6):
+    """Shoot `target` dead. how='host' executes locally on the host (the raw
+    lever); how='client' ships an `action_intent` the host executes."""
+    for _ in range(tries):
+        if down(host, target):
+            return True
+        wid = give_both(host, client, shooter, "STR_HEAVY_PLASMA",
+                        "STR_HEAVY_PLASMA_CLIP")
+        PI.top_up(host, client, shooter, 200)
+        if how == "host":
+            r = host.cmd({"cmd": "battle_fire", "unit": shooter, "mode": "aimed",
+                          "weapon_id": wid, "tu": 200, "target": target})
+        else:
+            r = client.cmd({"cmd": "battle_intent", "action": "shoot",
+                            "unit": shooter, "mode": "aimed",
+                            "weapon_id": wid, "target": target})
+            assert r.get("routed") is not False, (
+                f"the client EXECUTED the shot locally instead of shipping an "
+                f"intent ({r}) - in parallel mode the client is never the executor")
+        if not r.get("ok"):
+            return down(host, target)
+        PI.wait_until(lambda: PI.parallel(host).get("canAdmit") is True, 90)
+        PI.settle(host, client, seconds=5)
+    return down(host, target)
+
+
+def kill_one(host, client, shooter, how, tag):
+    """Place `shooter` next to a live alien and kill it. Returns the alien id."""
+    for alien in live_aliens(host):
+        spot = PI.place_adjacent(host, client, shooter,
+                                 (alien["x"], alien["y"], alien["z"]))
+        if not spot:
+            continue
+        if arm_and_kill(host, client, shooter, alien["id"], how):
+            print(f"    {tag}: alien {alien['id']} killed by unit {shooter}")
+            return alien["id"]
+    raise AssertionError(
+        f"{tag}: no live alien could be killed - the mixed-attribution part of "
+        f"this test never ran")
+
+
+def rearm_squad(host, client, seat_units, tu=200):
+    """Reaction fire needs a weapon AND spare TU at the START of the alien side."""
+    for uid in seat_units:
+        give_both(host, client, uid, "STR_HEAVY_PLASMA", "STR_HEAVY_PLASMA_CLIP")
+        PI.top_up(host, client, uid, tu)
+
+
+def force_alien_side_kill(host, client, known, turns=15):
+    """Hand the turn over until an alien dies during the ALIEN side.
+
+    This is the flavour the bug lived in: the peer never replays an alien-side
+    reaction shot as a local attack chain, so before the fix it derived no
+    attribution at all for the victim. Nothing scripts an alien into reaction
+    fire - the aliens choose to walk - so the turn is cycled up to `turns` times
+    and the test FAILS if none of them ever died, rather than passing vacuously.
+    """
+    shooters = [u["id"] for u in battle(host)["units"]
+                if u.get("faction") == FACTION_PLAYER and not u.get("isOut")][:6]
+    for n in range(turns):
+        rearm_squad(host, client, shooters)
+        turn = TW.cycle_turn(host, client)
+        if turn is None:
+            print("    the battle ended during the turn cycle")
+            return None
+        PI.settle(host, client, seconds=6)
+        fresh = [uid for uid in killed_here(host) if uid not in known]
+        print(f"    turn {turn}: alien-side casualties so far {fresh}")
+        if fresh:
+            return fresh
+    return []
+
+
+# ---- the debriefing --------------------------------------------------------
+
+def debrief(gc):
+    return gc.cmd({"cmd": "debrief_state"})
+
+
+def wait_debrief(gc, tag, timeout=180):
+    try:
+        return gc.wait_for(
+            f"{tag} debriefing score page",
+            lambda: (lambda r: r if r.get("ok") else None)(debrief(gc)),
+            timeout=timeout, interval=0.5)
+    except TimeoutError:
+        raise AssertionError(
+            f"{tag}: no DebriefingState after {timeout}s - the mission never "
+            f"finished. states={session.states(gc)[-4:]} "
+            f"battle={battle(gc).get('inBattle')}")
+
+
+def compare_debriefs(host, client, min_kills):
+    dh = wait_debrief(host, "host")
+    dc = wait_debrief(client, "client")
+    print(f"    host   rows={dh['rows']} total={dh['total']}")
+    print(f"    client rows={dc['rows']} total={dc['total']}")
+
+    hk = dh["rows"].get("STR_ALIENS_KILLED", 0)
+    ck = dc["rows"].get("STR_ALIENS_KILLED", 0)
+    assert hk == ck, (
+        f"THE BUG: the debriefings disagree about alien kills - host {hk}, "
+        f"client {ck} (at least {min_kills} were killed). Each machine counts "
+        f"`oldFaction == HOSTILE && killedBy() == PLAYER` over its own save, so "
+        f"a killedBy that never crossed is a different score for the same battle.")
+    # Floor, not equality: an alien can also die to its own side's blast, which
+    # this test does not track. A tally BELOW what was provably killed means the
+    # comparison above is comparing two equally-wrong numbers.
+    assert hk >= min_kills, (
+        f"both machines agree on {hk} alien kills but {min_kills} aliens were "
+        f"provably killed - the tally lost a death on BOTH machines")
+    assert dh["rows"] == dc["rows"], (
+        f"the debriefing score rows differ: host {dh['rows']} client {dc['rows']}")
+    assert dh["scores"] == dc["scores"], (
+        f"the debriefing points differ: host {dh['scores']} client {dc['scores']}")
+    assert dh["total"] == dc["total"], (
+        f"the mission TOTAL differs: host {dh['total']} client {dc['total']}")
+    print(f"PASS debriefing: identical on both machines - "
+          f"{hk} alien kills, total {dh['total']}")
+
+
+def vote_abort_to_debriefing(host, client):
+    """session.coop_abort_battle's vote half, stopping AT the debriefing.
+
+    The shipped helper drains all the way to the geoscape, which dismisses the
+    very screen this test has to read."""
+    host.ok({"cmd": "battle_action", "action": "abort"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        v = gc.wait_for(f"{tag} abandon-mission vote",
+                        lambda gc=gc: (lambda s: s if (s.get("active") and s.get("menuOpen"))
+                                       else None)(gc.ok({"cmd": "vote_state"})),
+                        timeout=30, interval=0.25)
+        assert v["action"] == "abandon_mission", f"{tag}: wrong vote: {v}"
+    cast = client.ok({"cmd": "vote_cast", "yes": True})
+    assert cast.get("accepted"), f"client vote_cast was rejected: {cast}"
+    for gc, tag in ((host, "host"), (client, "client")):
+        v = gc.wait_for(f"{tag} vote result",
+                        lambda gc=gc: (lambda s: s if s.get("finished") else None)(
+                            gc.ok({"cmd": "vote_state"})),
+                        timeout=30, interval=0.25)
+        assert v.get("passed"), f"{tag}: the abandon-mission vote did not pass: {v}"
+
+
+def kill_the_rest(host, client):
+    """Finish every remaining alien so the mission ends in a WIN (autoEndBattle).
+
+    A fresh shooter is picked each time: the squad takes casualties, and the one
+    that made the scripted kills is often among them."""
+    killed = []
+    for _ in range(NALIENS + 2):
+        if not battle(host).get("inBattle") or not live_aliens(host):
+            break
+        alive = len(live_aliens(host))
+        shooters = live_player_units(host)
+        assert shooters, "the squad is wiped out - no mission win to debrief"
+        killed.append(kill_one(host, client, shooters[0]["id"], "host", "mop-up"))
+        assert not battle(host).get("inBattle") or len(live_aliens(host)) < alive, \
+            "the mop-up shot killed nobody"
+    # `battleAutoEnd` is off by default, so a battle with no aliens left does not
+    # end by itself - it ends the way a player ends it, by handing the turn over.
+    # BattlescapeGame::endTurn then sees liveAliens == 0 and finishes the mission.
+    if battle(host).get("inBattle"):
+        print("    all aliens down - ending the turn to finish the mission")
+        TW.cycle_turn(host, client, timeout=240)
+    return killed
+
+
+# ---- one battle ------------------------------------------------------------
+
+def run(ending, ports, tmp):
+    """One skirmish battle driven to `ending` ('abort' or 'win')."""
+    hport, cport, coop_port = ports
+    mod = make_mod(tmp)
+    opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+    host = GameClient("host", hport,
+                      make_user_dir(f"debrief_{ending}_host", mods=[mod],
+                                    options=dict(opts, skipNextTurnScreen=True,
+                                                 EnableCoopParallelTurns=True)))
+    client = GameClient("client", cport,
+                        make_user_dir(f"debrief_{ending}_client", mods=[mod],
+                                      options=dict(opts,
+                                                   EnableCoopParallelTurns=False)))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = str(coop_port)
+        PI.PORT = str(coop_port)
+        TW.bring_up_battle(host, client, seed=SEED)
+
+        for gc, tag in ((host, "host"), (client, "client")):
+            b = battle(gc)
+            assert b["parallelActive"] is True, f"{tag}: parallel mode is not live: {b}"
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, \
+            "the PRD-P5 executor invariant does not hold, so nothing below tests it"
+        seat = client.ok({"cmd": "get_coop"})["localSeat"]
+        alive = live_aliens(host)
+        assert len(alive) >= 3, (
+            f"the fixture came up with {len(alive)} alien(s); the test ruleset "
+            f"should have produced {NALIENS}")
+        print(f"[{ending}] battle up: client seat {seat}, "
+              f"{len(alive)} aliens {[u['id'] for u in alive]}")
+        assert_attribution_agrees(host, client, "at battle start")
+
+        host_mover = PI.pick_driver(host, client, 0, "host")
+        client_mover = PI.pick_driver(host, client, seat, "client")
+
+        # ---- 1 + 2: the two mixed-attribution kills -----------------------
+        print(f"-- [{ending}] 1: a HOST-executed kill --")
+        a1 = kill_one(host, client, host_mover, "host", "host kill")
+        assert_attribution_agrees(host, client, "after the host's kill")
+
+        print(f"-- [{ending}] 2: a CLIENT-INTENT kill (the host executes) --")
+        a2 = kill_one(host, client, client_mover, "client", "client-intent kill")
+        killed = assert_attribution_agrees(host, client, "after the client's kill")
+        assert a1 in killed and a2 in killed, (
+            f"one of the two kills is not in the tally: killed {killed}, "
+            f"expected {a1} and {a2}")
+        print(f"PASS kills: {a1} (host action) and {a2} (client intent) are "
+              f"attributed identically on both machines")
+
+        # ---- 3: the alien-side kill, the flavour that was broken ----------
+        print(f"-- [{ending}] 3: an ALIEN-SIDE (reaction fire) kill --")
+        fresh = force_alien_side_kill(host, client, set(killed))
+        assert fresh, (
+            "no alien died during an alien side over the whole turn budget - "
+            "the flavour this test exists for never ran, so everything below "
+            "would pass vacuously. Re-check the fixture: the squad must be "
+            "armed, in TU and in sight of the aliens when the turn is handed over.")
+        killed = assert_attribution_agrees(host, client, "after the alien side")
+        print(f"PASS alien side: {fresh} died to reaction fire and BOTH machines "
+              f"credit the same killer")
+
+        # ---- 4: the ending, then the debriefing ---------------------------
+        if ending == "abort":
+            print(f"-- [{ending}] 4: ABANDON MISSION vote -> debriefing --")
+            expected = len(killed)
+            vote_abort_to_debriefing(host, client)
+        else:
+            print(f"-- [{ending}] 4: kill the rest -> the mission ends in a WIN --")
+            rest = kill_the_rest(host, client)
+            print(f"    mopped up {rest}")
+            expected = len(set(killed) | set(rest))
+        compare_debriefs(host, client, expected)
+
+        # The battle is over on both machines, and the debriefing is left where
+        # it is: a SKIRMISH debriefing returns to the MAIN MENU, not a geoscape,
+        # so draining past it would pop the menu and take the process with it.
+        for gc, tag in ((host, "host"), (client, "client")):
+            st = session.states(gc)
+            assert not any("BattlescapeState" in s for s in st), \
+                f"{tag}: the battle is still on the stack after the debriefing: {st}"
+        print(f"PASS [{ending}]: both machines left the battle and hold a debriefing")
+    finally:
+        host.shutdown(); client.shutdown()
+
+
+def main():
+    # The WIN variant is the same tally through the other exit: it costs one
+    # extra fixture but it is the only way to see the recovery rows (which
+    # prepareDebriefing also builds locally) line up too. A single variant can
+    # be run on its own during development: `... test_coop_debrief_sync.py win`.
+    wanted = sys.argv[1:] or ["abort", "win"]
+    tmp = tempfile.mkdtemp(prefix="coop_debrief_sync_")
+    fail = None
+    try:
+        if "abort" in wanted:
+            run("abort", (48892, 48893, 47992), tmp)
+        if "win" in wanted:
+            run("win", (48894, 48895, 47993), tmp)
+        print("ALL DEBRIEFING-SYNC TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_coop_door_sync.py b/tools/coop_test/test_coop_door_sync.py
index 6120b4594..98b4b198d 100644
--- a/tools/coop_test/test_coop_door_sync.py
+++ b/tools/coop_test/test_coop_door_sync.py
@@ -6,10 +6,12 @@
 the soldier already faces the door never changes direction, so `turned` is
 false and the packet is never sent. The client never learns the door opened.
 
-The test uses a SHARED campaign UFO crash-site battle (guaranteed UFO doors):
+The test uses a SHARED campaign alien-terror battle (STR_ALIEN_TERROR / a city
+map, whose buildings supply the doors - hinged, not UFO):
   1. Brings up a SHARED campaign.
-  2. Enters a UFO crash-site battle (real `confirm_landing` path).
-  3. Finds a UFO door tile and positions a soldier facing it.
+  2. Enters an alien-terror battle (real `confirm_landing` path).
+  3. Finds a door tile (a hinged building door here; `door_on_tile` handles a
+     UFO door too) and positions a soldier facing it.
   4. Opens the door via battle_action door (UnitTurnBState with BA_NONE).
   5. Asserts both machines see the door as open.
 
diff --git a/tools/coop_test/test_coop_id_manifest.py b/tools/coop_test/test_coop_id_manifest.py
new file mode 100644
index 000000000..aaaea5dd8
--- /dev/null
+++ b/tools/coop_test/test_coop_id_manifest.py
@@ -0,0 +1,412 @@
+"""PRD-P4: the Tier-A spawn id-manifest.
+
+A "Tier-A" spawn is a set of BattleItems both machines create for THEMSELVES from
+data that is identical on both (no RNG picks the set):
+
+  corpses            - the armor's corpse list, size^2 of them
+  death traps        - STR_DEATH_TRAP_<floorSpecialTileType>, pure map data
+  convertUnit built-ins - the fixed getSpawnUnit() type's built-in weapons
+
+The set matches; the IDS need not. Every id comes off the local counter
+SavedBattleGame::_itemId, so as soon as the two machines mint in a different order
+(or one of them mints something the other does not), id N denotes a DIFFERENT
+instance on the two machines - a transposition. From then on every id-keyed packet
+(moveCoopInventory, coopResolveWeapon, the ammo matches in the shooting states)
+lands on the wrong item. P4 has the host ship the ids it minted (`minted_ids` on
+the action's own carrier packet) and the peer adopt them.
+
+This test drives all three sites in ONE battle and asserts, after each, that:
+
+  * the two machines hold identical (id -> type/owner) item censuses,
+  * their `_itemId` counters are equal (session.assert_battle_synced), and
+  * the PRD-P2 drift tripwire has not fired on either machine.
+
+Levers, and why they need a throwaway ruleset (the pattern from
+test_coop_outcome_gaps.py - the mod is written into both isolated user dirs, so
+both machines load the SAME rules or they would diverge for a different reason):
+
+  death trap   stock xcom1 has none. `MCDPatches` marks the Skyranger's PLAIN
+               floor tiles (the ones with no specialType of their own - the
+               START_POINT floors the soldiers spawn on are deliberately left
+               alone, or nobody could be deployed) as specialType 200, and the
+               matching STR_DEATH_TRAP_200 item is defined harmless (power 1).
+  respawn      no stock unit reachable in this fixture converts on death, so
+               STR_SECTOID_SOLDIER gains `spawnUnit: STR_CHRYSSALID_TERRORIST`.
+  size-2 corpse the fixture is a SECTOID terror site, whose deployment ranks 6/7
+               are STR_CYBERDISC_TERRORIST - a 2x2 unit, so its death mints FOUR
+               corpse items and exercises the multi-tile remap.
+
+Both kills are STUN ROD knockouts (see stun_down): a blast aimed at a 2x2 unit's
+own tile is fired from inside that unit and often never leaves the muzzle, and a
+big blast OVERKILLS (health past -4x max), after which UnitDieBState mints no
+corpses and runs no respawn at all - the one outcome that would leave the
+assertions here vacuous. Blast-killed corpses are covered by the strict censuses
+in test_coop_alien_launcher_item_loss / test_coop_inventory_item_theft, whose
+blaster shot kills the firing alien.
+
+Run:  python tools/coop_test/test_coop_id_manifest.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import session
+import shared_fixture
+import test_coop_alien_launcher_item_loss as I74
+
+STUN_ROD = "STR_STUN_ROD"
+TRAP_TYPE = 200
+TRAP_ITEM = "STR_DEATH_TRAP_%d" % TRAP_TYPE
+RESPAWNER = "STR_SECTOID_SOLDIER"
+RESPAWNED = "STR_CHRYSSALID_TERRORIST"
+
+# MCD objects that are ORDINARY floors: Tile_Type 0 (floor), Target_Type 0 (no
+# specialType of their own) and a real floor (No_Floor 0). Anything that already
+# carries a specialType is left alone - PLANE index 2 is the START_POINT the
+# Skyranger deploys X-COM on, and patching it away would break deployment
+# outright. The four urban sets are the ground the terror site is built on, so
+# whichever tile the probe below reaches is trapped.
+PLAIN_FLOORS = {
+    "PLANE": [15, 17, 18, 19, 21, 22, 23, 24, 26, 27, 28, 29, 30, 31, 32,
+              33, 34, 35, 36, 37, 52, 53, 54, 55, 56, 60, 61],
+    "ROADS": list(range(0, 15)),
+    "URBITS": [16, 17, 21, 22],
+    "URBAN": [25, 26, 40, 41, 52, 53, 74, 75, 76, 77, 78],
+}
+
+METADATA = """\
+name: "Coop id-manifest test"
+version: 1.0
+description: "Test-only: a harmless death trap on the Skyranger floor and a respawning sectoid."
+author: coop harness
+
+master: xcom1
+"""
+
+
+def ruleset():
+    patches = ""
+    for dataset in sorted(PLAIN_FLOORS):
+        patches += "  - type: %s\n    data:\n" % dataset
+        patches += "".join("      - MCDIndex: %d\n        specialType: %d\n" % (i, TRAP_TYPE)
+                           for i in PLAIN_FLOORS[dataset])
+    return """\
+items:
+  - type: %s
+    size: 0.1
+    costBuy: 0
+    weight: 3
+    bigSprite: 21
+    floorSprite: 21
+    power: 1
+    damageType: 3
+    battleType: 5
+    blastRadius: 1
+    recover: false
+units:
+  - type: %s
+    spawnUnit: %s
+MCDPatches:
+%s""" % (TRAP_ITEM, RESPAWNER, RESPAWNED, patches)
+
+
+def make_mod(root):
+    mod = os.path.join(root, "Coop_Id_Manifest_Test")
+    os.makedirs(os.path.join(mod, "Ruleset"))
+    with open(os.path.join(mod, "metadata.yml"), "w", encoding="utf-8") as f:
+        f.write(METADATA)
+    with open(os.path.join(mod, "Ruleset", "id_manifest.rul"), "w", encoding="utf-8") as f:
+        f.write(ruleset())
+    return mod
+
+
+# ---- reading the two machines ----------------------------------------------
+
+def units(gc):
+    return {u["id"]: u for u in I74.battle(gc)["units"]}
+
+
+def corpses(gc):
+    """{id: type} for every BT_CORPSE-ish item. `battle_items` reports the OWNER
+    unit, which a corpse on the ground does not have, so the corpse's TYPE is what
+    identifies which unit it came from - and a 2x2 unit yields four of one type."""
+    return {i["id"]: i["type"] for i in gc.ok({"cmd": "battle_items"})["items"]
+            if "CORPSE" in i["type"].upper()}
+
+
+def desync_seen(gc):
+    b = I74.battle(gc)
+    assert "desyncSeen" in b, "battle_state carries no 'desyncSeen' (PRD-P2 missing)"
+    return b["desyncSeen"]
+
+
+def wait_quiesced(host, client, stable_samples=4, max_wait=90, settle=3.0):
+    """Both machines' censuses have to hold still before anything is compared -
+    a death runs over many frames and the two are not in step within one."""
+    time.sleep(settle)
+    prev, same = None, 0
+    deadline = time.time() + max_wait
+    while time.time() < deadline:
+        now = (I74.census(host), I74.census(client))
+        same = same + 1 if now == prev else 0
+        if same >= stable_samples:
+            return True
+        prev = now
+        time.sleep(1.0)
+    return False
+
+
+def check_synced(host, client, what, fails):
+    d = I74.diff_census(I74.census(host), I74.census(client))
+    if d:
+        for line in d:
+            print(f"  [DIVERGE] {line}")
+        fails.append(f"{what}: host/client item census diverged ({len(d)} items)")
+    try:
+        session.assert_battle_synced(host, client, what)
+    except AssertionError as e:
+        fails.append(str(e))
+        d = d or ["counter"]
+    for gc, tag in ((host, "host"), (client, "client")):
+        if desync_seen(gc):
+            fails.append(f"{what}: the PRD-P2 drift tripwire fired on the {tag}")
+    if not d:
+        print(f"PASS {what}: censuses and item-id counters identical, tripwire quiet")
+    return not d
+
+
+def sim_owner(host, client):
+    """The machine allowed to drive a battlescape action (classic co-op: the one
+    holding the simulation)."""
+    return host.wait_for(
+        "a machine to own the battle simulation",
+        lambda: next(((gc, tag) for gc, tag in ((host, "host"), (client, "client"))
+                      if session.can_drive(I74.battle(gc))), None),
+        timeout=90, interval=1.0)
+
+
+# ---- part 1: death trap -----------------------------------------------------
+
+def part_death_trap(host, client, fails):
+    """The host's checkForProximityGrenades creates STR_DEATH_TRAP_200 for the tile
+    and ships the packet; the peer's checkForProximityGrenadesCoop creates its own
+    copy. Consume-on-create (path a) is what carries the id across."""
+    print("\n-- part 1: death trap --")
+    soldier = next(u for u in I74.battle(host)["units"]
+                   if u["faction"] == 0 and not u["isOut"])
+    # The soldiers stand on the craft's START_POINT floors, which are deliberately
+    # NOT patched. The deck below them is ordinary PLANE floor, so it is - and
+    # `teleport` refuses anything that is not a valid position, which is what makes
+    # this a probe rather than an assumption.
+    spot = None
+    tried = landed = 0
+    offsets = sorted(((dx, dy) for dx in range(-6, 7) for dy in range(-10, 11)),
+                     key=lambda p: (abs(p[0]) + abs(p[1]), p))
+    for dz in (0, -1):
+        for dx, dy in offsets:
+            want = (soldier["x"] + dx, soldier["y"] + dy, soldier["z"] + dz)
+            if want == (soldier["x"], soldier["y"], soldier["z"]):
+                continue
+            tried += 1
+            res = [gc.cmd({"cmd": "battle_teleport", "unit": soldier["id"],
+                           "x": want[0], "y": want[1], "z": want[2]})
+                   for gc in (host, client)]
+            if not all(r.get("moved") for r in res):
+                continue
+            landed += 1
+            r = host.cmd({"cmd": "battle_prox", "unit": soldier["id"]})
+            if r.get("change") == 2:
+                spot = want
+                break
+        if spot:
+            break
+    print(f"       probed {tried} tiles around {(soldier['x'], soldier['y'], soldier['z'])}, "
+          f"{landed} of them reachable")
+    if not spot:
+        # Which half of the lever is dead? The item rule and the MCD patch come
+        # from the same throwaway ruleset, so say which one the game actually has.
+        probe = host.cmd({"cmd": "battle_give", "unit": soldier["id"],
+                          "item": TRAP_ITEM, "slot": "ground"})
+        have_rule = bool(probe.get("ok"))
+        if have_rule:  # keep the two machines symmetric after the diagnostic mint
+            client.cmd({"cmd": "battle_give", "unit": soldier["id"],
+                        "item": TRAP_ITEM, "slot": "ground"})
+        fails.append(f"no tile under/around the squad triggered a death trap "
+                     f"({TRAP_ITEM} rule loaded: {have_rule}) - the lever is dead, "
+                     f"so this part asserted nothing")
+        return
+    print(f"       soldier {soldier['id']} stepped onto a death trap at {spot}")
+    wait_quiesced(host, client)
+    check_synced(host, client, "after the death trap", fails)
+
+
+# ---- shared lever: a deterministic knockout ---------------------------------
+
+def place_adjacent(host, client, mover_id, tpos):
+    """Put `mover_id` on a free tile next to `tpos`, on BOTH machines."""
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        want = (tpos[0] + dx, tpos[1] + dy, tpos[2])
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": mover_id,
+                       "x": want[0], "y": want[1], "z": want[2]}) for gc in (host, client)]
+        if all(r.get("moved") for r in res):
+            return want
+    return None
+
+
+def stun_down(host, client, soldier_id, target, swings, fails, what):
+    """Beat `target` down with a stun rod until it is out, from whichever machine
+    owns the simulation.
+
+    A stun rod rather than a blast, for two independent reasons:
+      * DELIVERY - a blaster bomb aimed at a 2x2 unit's own tile is fired from
+        inside that unit and frequently never leaves the muzzle, so "the target
+        died" is not something a blast can be relied on to produce;
+      * OVERKILL - a big blast drives health past -4x max, and UnitDieBState then
+        mints NO corpses and runs NO respawn, which is the one outcome that would
+        make the assertions below vacuous. Stun damage cannot overkill.
+    Blast-killed corpses are covered elsewhere: the blaster shot in
+    test_coop_alien_launcher_item_loss / test_coop_inventory_item_theft kills its
+    firing alien, and both assert the census strictly.
+    """
+    spot = place_adjacent(host, client, soldier_id, (target["x"], target["y"], target["z"]))
+    if not spot:
+        fails.append(f"{what}: no free tile next to unit {target['id']} for the melee")
+        return False
+    shooter, _ = sim_owner(host, client)
+    for swing in range(1, swings + 1):
+        gave = {}
+        for gc, name in ((host, "host"), (client, "client")):
+            gave[name] = gc.ok({"cmd": "battle_give", "unit": soldier_id, "item": STUN_ROD,
+                                "slot": "right", "clear_hands": True})
+        time.sleep(1.5)
+        r = shooter.cmd({"cmd": "battle_fire", "unit": soldier_id, "mode": "hit",
+                         "weapon_id": gave["host" if shooter is host else "client"]["weaponId"],
+                         "tu": 100, "x": target["x"], "y": target["y"], "z": target["z"]})
+        if not r.get("ok"):
+            print(f"       swing {swing} refused ({r.get('error')})")
+        wait_quiesced(host, client)
+        if units(host)[target["id"]]["isOut"]:
+            print(f"       unit {target['id']} went down after {swing} swing(s)")
+            return True
+    fails.append(f"{what}: unit {target['id']} never went down in {swings} swings - "
+                 f"the lever is dead, so this part asserted nothing")
+    return False
+
+
+# ---- part 2: a size-2 unit's corpses ----------------------------------------
+
+def part_corpses(host, client, fails):
+    """A 2x2 unit mints FOUR corpse items in one pass of UnitDieBState's size^2
+    loop. All four must carry the host's ids on the peer. A Cyberdisc is
+    `capturable: false`, so a stun knockout instaKills it and the corpses follow."""
+    print("\n-- part 2: the corpses of a 2x2 unit --")
+    big = [u for u in I74.battle(host)["units"]
+           if u["faction"] == 1 and not u["isOut"] and "CYBERDISC" in u["name"].upper()]
+    if not big:
+        fails.append("this terror site deployed no Cyberdisc - the 2x2 corpse case "
+                     "was not exercised")
+        return
+    target = big[0]
+    soldier = next((u for u in I74.battle(host)["units"]
+                    if u["faction"] == 0 and not u["isOut"]), None)
+    if not soldier:
+        fails.append("no live soldier left to swing a stun rod")
+        return
+    before = set(corpses(host))
+    if not stun_down(host, client, soldier["id"], target, 10, fails, "2x2 corpses"):
+        return
+
+    hc, cc = corpses(host), corpses(client)
+    fresh_h = {i: t for i, t in hc.items() if i not in before}
+    fresh_c = {i: t for i, t in cc.items() if i not in before}
+    print(f"       host   new corpses {sorted(fresh_h.items())}")
+    print(f"       client new corpses {sorted(fresh_c.items())}")
+    if fresh_h != fresh_c:
+        fails.append(f"the corpse ids do not match: host {sorted(fresh_h.items())} vs "
+                     f"client {sorted(fresh_c.items())} - the id-manifest did not "
+                     f"re-stamp them")
+    quad = sum(1 for v in fresh_h.values() if "CYBERDISC" in v.upper())
+    if quad != 4:
+        fails.append(f"the 2x2 unit minted {quad} Cyberdisc corpse item(s), not 4 - "
+                     f"the multi-tile corpse loop was not exercised: "
+                     f"{sorted(fresh_h.items())}")
+    else:
+        print(f"PASS 2x2 corpses: all 4 corpse items of the Cyberdisc carry the same "
+              f"id on both machines")
+    check_synced(host, client, "after the 2x2 unit's death", fails)
+
+
+# ---- part 3: convertUnit ----------------------------------------------------
+
+def part_convert(host, client, fails):
+    """convertUnit's built-ins: the respawned unit's fixed weapons are minted by
+    initUnit() on BOTH machines. The kill is a stun rod - a blast overkills a
+    sectoid, and UnitDieBState skips the respawn entirely when _overKill is set."""
+    print("\n-- part 3: convertUnit respawn --")
+    hb = I74.battle(host)
+    victims = [u for u in hb["units"]
+               if u["faction"] == 1 and not u["isOut"] and "SECTOID" in u["name"].upper()
+               and "CYBERDISC" not in u["name"].upper()]
+    if not victims:
+        fails.append("no live sectoid left to convert")
+        return
+    victim = victims[0]
+    soldier = next((u for u in hb["units"] if u["faction"] == 0 and not u["isOut"]), None)
+    if not soldier:
+        fails.append("no live soldier left to swing a stun rod")
+        return
+
+    before_ids = set(units(host))
+    if not stun_down(host, client, soldier["id"], victim, 8, fails, "convertUnit"):
+        return
+
+    new_h = set(units(host)) - before_ids
+    new_c = set(units(client)) - before_ids
+    print(f"       host spawned {sorted(new_h)}, client spawned {sorted(new_c)}")
+    if new_h != new_c:
+        fails.append(f"the respawn did not replicate: host {sorted(new_h)} vs client "
+                     f"{sorted(new_c)}")
+    elif not new_h:
+        fails.append(f"sectoid {victim['id']} went down but nothing respawned - the "
+                     f"`spawnUnit` lever is dead, so this part asserted nothing")
+    else:
+        print(f"PASS convertUnit: both machines respawned unit(s) {sorted(new_h)}")
+    check_synced(host, client, "after the convertUnit respawn", fails)
+
+
+def main():
+    fails = []
+    root = tempfile.mkdtemp(prefix="coop_p4_mod_")
+    mod = make_mod(root)
+    js = shared_fixture.bring_up("p4idm", (48862, 48863, 48262), mods=(mod,))
+    host, client = js.host, js.client
+    try:
+        I74.enter_battle(js)
+        check_synced(host, client, "at battle start", fails)
+        part_death_trap(host, client, fails)
+        part_corpses(host, client, fails)
+        part_convert(host, client, fails)
+    except Exception as e:
+        print(f"[ERROR] {e}")
+        fails.append(str(e))
+    finally:
+        js.shutdown()
+        shutil.rmtree(root, ignore_errors=True)
+
+    print("\n==== PRD-P4 id-manifest summary ====")
+    if fails:
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print("  corpses, death traps and convertUnit respawns all leave the two machines "
+          "holding identical item ids and equal item-id counters")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_coop_inventory_item_theft.py b/tools/coop_test/test_coop_inventory_item_theft.py
index 9810c6a0f..c9dd24533 100644
--- a/tools/coop_test/test_coop_inventory_item_theft.py
+++ b/tools/coop_test/test_coop_inventory_item_theft.py
@@ -26,6 +26,13 @@
 inventory move, the victim soldier must still be holding the launcher instance
 it started with, on BOTH machines.
 
+PRD-P4 additionally makes the census assertion STRICT and un-filtered, at both
+the shot and the move: the blast kills the firing alien, and a corpse is a Tier-A
+spawn (a deterministic set each machine creates for itself), so a corpse id that
+differs between the two machines is exactly the drift the id-manifest removes -
+not noise to be filtered out. The fixed `time.sleep` that used to precede the
+comparison is a `wait_quiesced()` symmetric-poll barrier instead.
+
 Run:  python tools/coop_test/test_coop_inventory_item_theft.py
 Exit 0 = pass; 2 = failure.
 """
@@ -35,6 +42,7 @@
 import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import session
 import shared_fixture
 import test_shared_battle as B
 import test_coop_alien_launcher_item_loss as I74
@@ -65,6 +73,53 @@ def soldier_name(gc, unit_id):
     raise AssertionError(f"no unit {unit_id}")
 
 
+def wait_quiesced(host, client, stable_samples=4, max_wait=60, settle=2.0):
+    """Symmetric-poll barrier: block until BOTH machines' item censuses have held
+    still for `stable_samples` consecutive samples.
+
+    The assertions below compare REAL ids with no filtering, so they must not run
+    in the middle of a replay. The alien's blaster shot kills the firing alien, and
+    the death/corpse/drop sequence has pauses longer than one sample, so a fixed
+    `time.sleep` either flakes (too short - a corpse lands between the two reads)
+    or burns a minute on every run. Poll both sides and wait for quiet instead.
+    """
+    time.sleep(settle)
+    prev, same = None, 0
+    deadline = time.time() + max_wait
+    while time.time() < deadline:
+        now = (I74.census(host), I74.census(client))
+        same = same + 1 if now == prev else 0
+        if same >= stable_samples:
+            return True
+        prev = now
+        time.sleep(1.0)
+    return False
+
+
+def assert_census_strict(host, client, what, fails):
+    """PRD-P4: full-census equality on real ids - no per-type filter, no "ignore
+    the corpses" escape hatch. A corpse whose id differs between the two machines
+    IS the drift this PRD removes (the host now names the ids it minted on
+    `after_unit_death` and the peer re-stamps its own copies), so hiding it here
+    would hide the only symptom the pilot has.
+    """
+    d = I74.diff_census(I74.census(host), I74.census(client))
+    if d:
+        for line in d:
+            print(f"  [DIVERGE] {line}")
+        fails.append(f"host/client item census diverged {what} ({len(d)} items)")
+        return False
+    # ... and the counter, which a census comparison cannot see: two machines can
+    # hold identical item sets while one is primed to mint the next id differently.
+    try:
+        session.assert_battle_synced(host, client, what)
+    except AssertionError as e:
+        fails.append(str(e))
+        return False
+    print(f"       census + item-id counter identical {what}")
+    return True
+
+
 def main():
     fails = []
     js = shared_fixture.bring_up("i74t", (48800, 48801, 48200))
@@ -91,7 +146,7 @@ def main():
 
         def _sim_owner():
             for gc, tag in ((host, "host"), (client, "client")):
-                if I74.battle(gc).get("activeSync"):
+                if session.can_drive(I74.battle(gc)):
                     return (gc, tag)
             return None
 
@@ -103,6 +158,11 @@ def _sim_owner():
         print(f"       alien launches from the {shooter_tag} with its launcher in the "
               f"LEFT hand (the packet says 'right')")
         I74.settle(host, client)
+        # The blast kills the firing alien, so this is where its corpses are minted
+        # on each machine independently - PRD-P4's Tier-A case. Assert here as well
+        # as at the end, so a corpse-id drift is attributed to the shot rather than
+        # to the inventory move that follows.
+        assert_census_strict(host, client, "after the alien's shot", fails)
 
         # ---- step 2: two launchers, created in the same order on both -------
         # If step 1 drifted the id spaces, the SAME logical launcher now carries
@@ -147,7 +207,9 @@ def _sim_owner():
         print(f"       host DROPPED the MOVER's own launcher "
               f"(landed {moved.get('landedSlot')}, onUnit={moved.get('landedOnUnit')})")
         host.ok({"cmd": "battle_close_inventory"})
-        time.sleep(6)
+        if not wait_quiesced(host, client):
+            print("       NOTE: the two machines never went quiet within 60s; "
+                  "asserting on the last reading")
 
         # ---- the symptom ----------------------------------------------------
         for gc, tag, vid in ((host, "host", h_victim), (client, "client", c_victim)):
@@ -163,11 +225,7 @@ def _sim_owner():
                 fails.append(f"{tag}: the VICTIM soldier {victim['id']} should still hold "
                              f"launcher {vid}, but holds {got}")
 
-        d = I74.diff_census(I74.census(host), I74.census(client))
-        if d:
-            for line in d:
-                print(f"  [DIVERGE] {line}")
-            fails.append(f"host/client item census diverged ({len(d)} items)")
+        assert_census_strict(host, client, "after the inventory move", fails)
     except Exception as e:
         print(f"[ERROR] {e}")
         fails.append(str(e))
diff --git a/tools/coop_test/test_coop_outcome_gaps.py b/tools/coop_test/test_coop_outcome_gaps.py
new file mode 100644
index 000000000..08b0da91b
--- /dev/null
+++ b/tools/coop_test/test_coop_outcome_gaps.py
@@ -0,0 +1,602 @@
+"""PRD-P3: the RNG/outcome-shipping gaps (AUDIT-rng GAP-1..9).
+
+Every gap in that audit is the same shape: an RNG-dependent outcome that changes
+battle state was rolled INDEPENDENTLY on both machines instead of being decided by
+its authority and shipped. The fixes migrate each one to "host decides, peer
+replays". This test drives the paths that were fixed and asserts the two machines
+still describe the same battle afterwards.
+
+PART 1 (commit 1 - id drift)
+    Shotgun pellets (GAP-5): a pellet volley used to exhaust the shipped aim
+    pre-rolls after the first shot, so the peer rolled the rest itself - different
+    endpoints, a different NUMBER of TileEngine::hit() calls, and from there a
+    permanently mis-paired hit stream (GAP-4a). Fire one and assert the battle
+    still matches.
+    Mid-battle spawns (GAP-1): an item whose blast spawns a unit used to roll AND
+    create on both machines. Detonate one and assert both machines gained the SAME
+    new unit id, with the item-id counter still equal.
+
+PART 2 (commit 2 - resolution authority)
+    Psi in PVE (GAP-2), melee hit/miss (GAP-4b) and Tile::ignite (GAP-3): drive a
+    mind control and a melee attack, then assert the victim's faction/health and
+    the item census agree - the host's decision, on both machines.
+
+PART 3 (commit 3 - item existence)
+    Proximity sweeps (GAP-8) and end-of-turn fuses (GAP-9): loose non-grenade
+    items used to be swept away on each machine's own fuseProximityEvent() roll.
+    Trigger a sweep and cross a turn boundary, then compare the item censuses.
+
+Neither shotgun ammo nor a spawn-on-hit item exists in stock xcom1, so the test
+GENERATES a throwaway ruleset into the harness's isolated user dirs and activates
+it on both machines (same ruleset on both, or they would diverge for a different
+reason) - the pattern test_shared_missile_bombardment.py uses.
+
+Run:  python tools/coop_test/test_coop_outcome_gaps.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+
+LAUNCHER = "STR_ROCKET_LAUNCHER"
+SPAWNER = "STR_SMALL_ROCKET"   # gains spawnUnit below
+SPAWNED = "STR_SECTOID_SOLDIER"
+SHOTGUN_AMMO = "STR_RIFLE_CLIP"  # gains shotgunPellets below
+PELLETS = 4
+# A NON-grenade item with a fuse: it is removed rather than detonated, so a test can
+# make the fuse paths fire over and over without a blast killing units (a kill mints
+# a corpse, whose id is PRD-P4's gap, not this test's subject). specialChance 50 is
+# what makes the outcome an actual coin flip - at the default 100 both machines
+# "roll" RNG::percent(100) and trivially agree, which would make this vacuous.
+FUSED = "STR_ELECTRO_FLARE"
+FUSED_CHANCE = 50
+FUSED_COUNT = 8
+
+# Pin the fixture. The host generates and ships the map, so its seed fixes the
+# map, the alien deployment and the soldiers' stats; the client gets a different
+# seed (bring_up_battle), so a regressed outcome-ship still diverges. Without this
+# the battle is fresh-random every run and the flake was pure fixture roulette:
+# whether the part-1b rocket happened to land clear of the squad, whether a live
+# alien sat in psi range, whether the sweep had a valid tile.
+SEED = 424242
+
+METADATA = """\
+name: "Coop outcome-gap test"
+version: 1.0
+description: "Test-only: a spawn-on-blast grenade and shotgun rifle ammo."
+author: coop harness
+
+master: xcom1
+"""
+
+RULESET = f"""\
+items:
+  - type: {SPAWNER}
+    spawnUnit: {SPAWNED}
+    spawnUnitChance: 100
+    spawnUnitFaction: 1
+  - type: {SHOTGUN_AMMO}
+    shotgunPellets: {PELLETS}
+    shotgunSpread: 100
+    shotgunBehavior: 0
+  - type: {FUSED}
+    specialChance: {FUSED_CHANCE}
+    fuseTriggerEvents:
+      proximityTrigger: true
+      proximityExplode: true
+"""
+
+
+def make_mod(root):
+    mod = os.path.join(root, "Coop_Outcome_Gaps_Test")
+    os.makedirs(os.path.join(mod, "Ruleset"))
+    with open(os.path.join(mod, "metadata.yml"), "w", encoding="utf-8") as f:
+        f.write(METADATA)
+    with open(os.path.join(mod, "Ruleset", "outcome_gaps.rul"), "w", encoding="utf-8") as f:
+        f.write(RULESET)
+    return mod
+
+
+# ---- reading the two machines ---------------------------------------------
+
+def units(gc):
+    return {u["id"]: u for u in TW.battle(gc)["units"]}
+
+
+def unit_ids(gc):
+    return set(units(gc))
+
+
+def census(gc):
+    r = gc.cmd({"cmd": "battle_items"})
+    return {i["id"]: (i["type"], i["owner"]) for i in r["items"]}
+
+
+def wait_until(fn, timeout, interval=0.4):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if fn():
+            return True
+        time.sleep(interval)
+    return False
+
+
+def settle(host, client, seconds=10):
+    """Let both state machines drain. Never dismiss the battlescape itself."""
+    deadline = time.time() + seconds
+    while time.time() < deadline:
+        for gc in (host, client):
+            t = TW.top(gc)
+            if t != "BattlescapeState" and t not in ("NextTurnState",):
+                gc.cmd({"cmd": "dismiss_popup"})
+        time.sleep(0.5)
+
+
+def alive_enemy(gc, own_coop):
+    for u in TW.battle(gc)["units"]:
+        if u.get("faction") == 1 and not u.get("isOut"):
+            return u
+    return None
+
+
+def live_actor(driver, own_coop, fallback=None):
+    """A currently living, selectable, own-seat soldier with TU to spend. Re-picked
+    after a blast lever so a shooter caught in its own rocket's radius does not
+    strand the resolution-authority parts (psi/melee need a live attacker)."""
+    mine = TW.movers(TW.battle(driver), own_coop)
+    return mine[0]["id"] if mine else fallback
+
+
+def dist_to_squad(gc, tile):
+    """Chebyshev distance from `tile` to the NEAREST living player soldier - used
+    to keep the spawn-blast lever clear of the squad so it does not injure the
+    shooter (or diverge the two machines' unit lists) on its way to minting a unit."""
+    us = [u for u in TW.battle(gc)["units"]
+          if u.get("faction") == 0 and not u.get("isOut")]
+    return min((max(abs(tile[0]-u["x"]), abs(tile[1]-u["y"])) for u in us), default=99)
+
+
+def assert_hits_paired(gc, tag, what):
+    """GAP-4a: every host `hit_tile` must have found the attack THIS machine parked
+    for it. The receiver logs and drops an unmatched one rather than applying it to
+    the wrong attacker, so the log line is the direct evidence."""
+    log = os.path.join(gc.user_dir, "openxcom.log")
+    if not os.path.exists(log):
+        return
+    with open(log, "r", encoding="utf-8", errors="replace") as f:
+        bad = [ln.strip() for ln in f if "has no local attack" in ln]
+    assert not bad, (
+        f"{tag}: {len(bad)} host hit(s) could not be paired with a local attack "
+        f"{what} - the two machines produced a different number of hits:\n  "
+        + "\n  ".join(bad[:5]))
+
+
+def report(host, client, what):
+    h, c = TW.terms(host), TW.terms(client)
+    print(f"    {what}: host itemId={h[0]} census={h[1]} | client itemId={c[0]} census={c[1]}")
+    return h, c
+
+
+# ---- part 1 ----------------------------------------------------------------
+
+def part1_pellets(host, client, driver, watcher, dtag, shooter_id, target):
+    """GAP-5 + GAP-4a: a shotgun volley must leave the two machines identical."""
+    print(f"-- part 1a: shotgun volley ({PELLETS} pellets/shot) --")
+    before = session.assert_battle_synced(host, client, "before the volley")
+    driver.ok({"cmd": "battle_give", "unit": shooter_id, "item": "STR_RIFLE",
+               "ammo": SHOTGUN_AMMO, "slot": "right", "clear_hands": True})
+    watcher.ok({"cmd": "battle_give", "unit": shooter_id, "item": "STR_RIFLE",
+                "ammo": SHOTGUN_AMMO, "slot": "right", "clear_hands": True})
+    # battle_give mints on each machine separately, so re-sync the reading before
+    # the shot rather than asserting on a stale baseline.
+    time.sleep(2)
+    session.assert_battle_synced(host, client, "after arming both machines")
+
+    r = driver.cmd({"cmd": "battle_fire", "unit": shooter_id, "mode": "snap",
+                    "tu": 200, "target": target["id"]})
+    assert r.get("ok"), f"the {dtag} could not fire the shotgun: {r}"
+    settle(host, client, seconds=12)
+
+    after = session.assert_battle_synced(host, client, "after the shotgun volley")
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+        "the drift tripwire fired on a shotgun volley"
+    assert_hits_paired(watcher, "the watcher", "after the shotgun volley")
+    print(f"PASS pellets: {dtag} fired {PELLETS} pellets and both machines still "
+          f"agree ({before} -> {after})")
+
+
+def part1_spawn(host, client, driver, watcher, dtag, shooter_id):
+    """GAP-1: a spawn-on-blast item must mint the SAME unit on both machines.
+
+    A rocket into empty floor is the deterministic blast lever here: it detonates
+    on impact wherever it lands, and - unlike shooting a unit - it kills nobody,
+    so no corpse is minted (corpse ids are PRD-P4's gap, not this test's subject).
+    """
+    print("-- part 1b: mid-battle spawn --")
+    session.assert_battle_synced(host, client, "before the spawn blast")
+    shooter = units(driver)[shooter_id]
+    origin = (shooter["x"], shooter["y"], shooter["z"])
+
+    # Empty floor first (kills nobody). A rocket needs line of fire AND an impact
+    # whose two-steps-back tile can hold a unit, so several directions get tried,
+    # FARTHEST FROM THE SQUAD FIRST: a rocket that detonates on top of its own
+    # soldiers injures them and leaves the two machines' unit lists diverged (the
+    # blast's terrain/gravity is host-authoritative and repairs only at next_turn),
+    # and a dead/relocated shooter then strands the psi and melee parts below.
+    # The alien's own tile is the last resort, because it always detonates.
+    alien = alive_enemy(driver, None)
+    offsets = [(origin[0] + dx, origin[1] + dy, origin[2]) for dx, dy in
+               ((6, 0), (-6, 0), (0, 6), (0, -6), (5, 5), (-5, -5), (5, -5), (-5, 5),
+                (8, 0), (-8, 0), (0, 8), (0, -8), (4, 4), (-4, 4), (4, -4), (-4, -4))]
+    ordered = sorted(offsets, key=lambda t: dist_to_squad(driver, t), reverse=True)
+    if alien:
+        ordered.append((alien["x"], alien["y"], alien["z"]))
+    # Re-fire the whole sweep several times. Whether a rocket that REACHES a tile
+    # actually mints a unit depends on there being a free placement tile at the
+    # impact, and that hinges on where the aliens have wandered (timing-sensitive
+    # across the two machines) and on the snap shot's own accuracy spread - so a
+    # tile that produced nothing on one pass frequently does on the next. Firing
+    # each tile once made the lever a ~1/3 coin flip even with the fixture pinned;
+    # the shot returns the moment ANY tile mints a unit, so a lucky first pass
+    # still costs nothing.
+    candidates = ordered * 3
+
+    for tile in candidates:
+        before_h, before_c = unit_ids(host), unit_ids(client)
+        assert before_h == before_c, \
+            f"the two machines already hold different units: {before_h ^ before_c}"
+
+        for gc in (driver, watcher):
+            gc.ok({"cmd": "battle_give", "unit": shooter_id, "item": LAUNCHER,
+                   "ammo": SPAWNER, "slot": "right", "clear_hands": True})
+        time.sleep(2)
+
+        # The rocket is spent the moment the shot leaves the launcher, so a launcher
+        # that refused (no line of fire) shows up in a few seconds instead of costing
+        # the full settle. Sampled BEFORE the shot: the state can run before the
+        # command's reply is even read.
+        def rockets():
+            return sum(1 for t, _ in census(driver).values() if t == SPAWNER)
+
+        pre_rockets = rockets()
+        r = driver.cmd({"cmd": "battle_fire", "unit": shooter_id, "mode": "snap",
+                        "tu": 200, "x": tile[0], "y": tile[1], "z": tile[2]})
+        if not r.get("ok"):
+            print(f"    rocket at {tile} refused ({r.get('error')}), trying another tile")
+            continue
+        fired = wait_until(lambda: rockets() < pre_rockets, 8)
+        settle(host, client, seconds=14 if fired else 2)
+
+        new_h = unit_ids(host) - before_h
+        new_c = unit_ids(client) - before_c
+        print(f"    rocket at {tile}: fired={fired}; host spawned {sorted(new_h)}, "
+              f"client spawned {sorted(new_c)}")
+        if not new_h and not new_c:
+            continue  # the rocket found no valid spawn tile; try another direction
+        assert new_h == new_c, (
+            f"GAP-1: the spawn did not replicate - host minted {sorted(new_h)}, "
+            f"client minted {sorted(new_c)}. Either the peer rolled its own spawn "
+            f"or the manifest never crossed.")
+        for uid in new_h:
+            ht, ct = units(host)[uid], units(client)[uid]
+            # x/y is the spawn DECISION; z is applyGravity's answer to the floor the
+            # blast just destroyed. Both must match STRICTLY (PRD-I3 z-gravity close):
+            # the manifest's final_pos covers the SPAWN instant, and the `unit_fall`
+            # packet (UnitFallBState, host-only) now ships the landed tile when the
+            # ONGOING blast destroys the floor under the just-spawned unit and the host
+            # re-drops it a level - so the peer no longer floats its copy a level up
+            # until next_turn. unitsCore position is strict through the spawn/blast.
+            assert (ht["x"], ht["y"], ht["z"]) == (ct["x"], ct["y"], ct["z"]), (
+                f"z-gravity: spawned unit {uid} landed at "
+                f"{(ht['x'], ht['y'], ht['z'])} on the host and "
+                f"{(ct['x'], ct['y'], ct['z'])} on the client - the host's post-blast "
+                f"fall did not replicate (unit_fall). unitsCore position must be strict.")
+        session.assert_battle_synced(host, client, "after the spawn blast")
+        assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+            "the drift tripwire fired on a replicated spawn"
+        assert_hits_paired(watcher, "the watcher", "after the spawn blast")
+        print(f"PASS spawn: {dtag} detonated a spawn-on-blast item and BOTH machines "
+              f"minted unit(s) {sorted(new_h)} with matching positions and an equal "
+              f"item-id counter")
+        return True
+
+    raise AssertionError(
+        "no rocket produced a mid-battle spawn on either machine - the lever is "
+        "dead, so the replication assertion above never ran")
+
+
+def place_adjacent(driver, watcher, mover_id, tpos):
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        spot = (tpos[0] + dx, tpos[1] + dy, tpos[2])
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": mover_id,
+                       "x": spot[0], "y": spot[1], "z": spot[2]})
+               for gc in (driver, watcher)]
+        if all(r.get("moved") for r in res):
+            return spot
+    return None
+
+
+def part2_melee(host, client, driver, watcher, dtag, wtag, mover_id):
+    """GAP-4b + the melee TU double-charge: after a replayed melee the two machines
+    must agree on the attacker's TU and on how many hits the attack produced."""
+    print("-- part 2a: melee authority --")
+    aliens = [u for u in TW.battle(driver)["units"]
+              if u.get("faction") == 1 and not u.get("isOut")]
+    assert aliens, "no live hostile left to melee"
+    target = aliens[0]
+    tpos = (target["x"], target["y"], target["z"])
+    spot = place_adjacent(driver, watcher, mover_id, tpos)
+    assert spot, f"no free tile adjacent to hostile {target['id']}"
+
+    gave = [gc.cmd({"cmd": "battle_give", "unit": mover_id, "item": "STR_STUN_ROD",
+                    "slot": "right", "clear_hands": True}) for gc in (driver, watcher)]
+    assert all(g.get("ok") for g in gave), f"battle_give STR_STUN_ROD failed: {gave}"
+    time.sleep(2)
+
+    before = units(watcher)[mover_id]["tu"]
+    r = driver.cmd({"cmd": "battle_fire", "unit": mover_id, "mode": "hit",
+                    "weapon_id": gave[0]["weaponId"], "tu": 100,
+                    "x": tpos[0], "y": tpos[1], "z": tpos[2]})
+    assert r.get("ok"), f"the engine refused the melee: {r.get('error')}"
+    assert wait_until(lambda: units(watcher)[mover_id]["tu"] != before, 45), \
+        f"the melee never replicated to the {wtag} (TU still {before})"
+    settle(host, client, seconds=8)
+
+    dtu = units(driver)[mover_id]["tu"]
+    wtu = units(watcher)[mover_id]["tu"]
+    assert dtu == wtu, (
+        f"the melee replay charged the {wtag} twice: attacker {mover_id} has "
+        f"TU={dtu} on the {dtag} but {wtu} on the {wtag}. The packet writes the "
+        f"authoritative value and MeleeAttackBState::init must not spend on top.")
+    assert_hits_paired(watcher, f"the {wtag}", "after the melee")
+    session.assert_battle_synced(host, client, "after the melee")
+    print(f"PASS melee: attacker {mover_id} left with TU={dtu} on BOTH machines and "
+          f"every hit paired")
+
+
+def part2_psi(host, client, driver, watcher, dtag, wtag, mover_id, attempts=3):
+    """GAP-2: a psi outcome in a PVE co-op battle is the host's, and it must reach
+    the peer - `psi_result` used to be PVP-only, so a mind control that landed on
+    one machine and failed on the other was permanent (next_turn repairs stats and
+    tiles, never faction)."""
+    print("-- part 2b: psi in PVE --")
+    mode = TW.battle(host).get("coopGamemode")
+    assert mode not in (2, 3), \
+        f"this fixture is a PVP battle (gamemode {mode}); GAP-2 is about PVE"
+
+    gave = [gc.cmd({"cmd": "battle_give", "unit": mover_id, "item": "STR_PSI_AMP",
+                    "slot": "right", "clear_hands": True}) for gc in (driver, watcher)]
+    assert all(g.get("ok") for g in gave), f"battle_give STR_PSI_AMP failed: {gave}"
+    time.sleep(2)
+
+    tried = 0
+    for _ in range(attempts):
+        aliens = [u for u in TW.battle(driver)["units"]
+                  if u.get("faction") == 1 and not u.get("isOut")]
+        if not aliens:
+            break
+        target = aliens[0]
+        tpos = (target["x"], target["y"], target["z"])
+        # Stand next to the victim on BOTH machines: PsiAttackBState pops straight
+        # back out when the target is beyond the amp's maxRange, and the squad can
+        # start the battle a long way from the aliens.
+        if not place_adjacent(driver, watcher, mover_id, tpos):
+            print(f"    no free tile adjacent to hostile {target['id']}")
+            continue
+        r = driver.cmd({"cmd": "battle_fire", "unit": mover_id, "mode": "psi",
+                        "weapon_id": gave[0]["weaponId"], "tu": 100,
+                        "x": tpos[0], "y": tpos[1], "z": tpos[2]})
+        if not r.get("ok"):
+            print(f"    psi refused ({r.get('error')})")
+            continue
+        # The DRIVER spending the topped-up TU is what says the attack actually ran.
+        # Waiting on the watcher instead would miss an attempt whose replayed TU
+        # happens to land on the value it already had - and it is precisely a psi the
+        # host resolved but never shipped that this part has to catch.
+        topped = r.get("tuHave")
+        if not wait_until(lambda: units(driver)[mover_id]["tu"] != topped, 30):
+            print("    psi cost the actor nothing (the state never ran)")
+            continue
+        settle(host, client, seconds=5)
+        tried += 1
+
+        hv, cv = units(host).get(target["id"]), units(client).get(target["id"])
+        assert hv and cv, f"unit {target['id']} vanished from one machine"
+        print(f"    psi on {target['id']}: host faction={hv['faction']} coop={hv.get('coop')} "
+              f"| client faction={cv['faction']} coop={cv.get('coop')}")
+        assert hv["faction"] == cv["faction"], (
+            f"GAP-2: the psi outcome did not replicate - unit {target['id']} is "
+            f"faction {hv['faction']} on the host and {cv['faction']} on the client. "
+            f"Both machines resolved the attack for themselves.")
+        assert hv.get("coop") == cv.get("coop"), (
+            f"unit {target['id']} ended up owned by different players "
+            f"({hv.get('coop')} vs {cv.get('coop')})")
+        session.assert_battle_synced(host, client, "after the psi attack")
+        # One replicated psi outcome is all GAP-2 needs to verify. The `attempts`
+        # loop only exists to RETRY when an attempt cannot run (out of range, the
+        # target moved); stop the moment one runs, so a SUCCESSFUL mind control -
+        # which flips its victim to faction 0 - does not go on to convert every
+        # remaining alien and leave part2_melee below with no hostile to swing at
+        # (the roll's success is timing-sensitive, so this must not depend on it).
+        break
+
+    assert tried, ("no psi attack ever ran, so the replication assertion never "
+                   "executed")
+    print(f"PASS psi: {tried} mind-control attempt(s) left every victim's faction and "
+          f"owner identical on both machines")
+
+
+# ---- part 3 ----------------------------------------------------------------
+
+def flares(gc):
+    return {i["id"]: i["fuse"] for i in gc.cmd({"cmd": "battle_items"})["items"]
+            if i["type"] == FUSED}
+
+
+def drop_fused(host, client, x, y, z, count):
+    """Place `count` primed flares on one tile, on BOTH machines. No co-op packet
+    replicates a mid-battle item spawn, so both sides have to create the same items
+    in the same order for the ids to line up (the harness reports them back)."""
+    ids = [gc.ok({"cmd": "battle_drop", "x": x, "y": y, "z": z, "item": FUSED,
+                  "count": count, "prime": True, "fuse": 0})["ids"]
+           for gc in (host, client)]
+    assert ids[0] == ids[1], \
+        f"the two machines minted different ids for the litter: {ids[0]} vs {ids[1]}"
+    return ids[0]
+
+
+def part3_proximity(host, client, wtag, unit_id):
+    """GAP-8: a proximity sweep removes non-grenade items on the host's roll, and
+    the peer must delete exactly that set instead of running its own.
+
+    Driven on the HOST specifically: checkForProximityGrenades early-returns 0 on a
+    client, so a sweep driven from there would sweep nothing and the comparison
+    below would pass vacuously."""
+    print("-- part 3a: proximity sweep --")
+    u = units(host)[unit_id]
+    ids = drop_fused(host, client, u["x"], u["y"], u["z"], FUSED_COUNT)
+    time.sleep(2)
+    before_h, before_c = flares(host), flares(client)
+    assert set(before_h) == set(before_c), \
+        f"the litter differs before the sweep: {set(before_h) ^ set(before_c)}"
+    print(f"    littered {len(ids)} primed {FUSED}s on ({u['x']},{u['y']},{u['z']})")
+
+    r = host.cmd({"cmd": "battle_prox", "unit": unit_id})
+    assert r.get("ok"), f"the proximity sweep was refused: {r}"
+    settle(host, client, seconds=8)
+
+    after_h, after_c = flares(host), flares(client)
+    gone_h = sorted(set(before_h) - set(after_h))
+    gone_c = sorted(set(before_c) - set(after_c))
+    print(f"    after the sweep: host swept {gone_h}, client swept {gone_c}")
+    assert gone_h, (
+        f"the sweep removed nothing at all ({len(ids)} primed items with "
+        f"specialChance {FUSED_CHANCE}) - the lever is dead and the comparison "
+        f"below would be vacuous")
+    assert gone_h == gone_c, (
+        f"GAP-8: the sweep removed a different set on each machine - host swept "
+        f"{gone_h}, client swept {gone_c}")
+    session.assert_battle_synced(host, client, "after the proximity sweep")
+    print(f"PASS proximity: {len(gone_h)} item(s) swept, the SAME ones on both machines")
+
+
+def part3_fuse(host, client, wtag, unit_id):
+    """GAP-9: BattleItem::fuseTimeEvent() at the end of a side is per-machine. With
+    specialChance 50 each primed item is a coin flip, so a peer rolling for itself
+    disagrees with the host almost immediately - and then holds items the host no
+    longer has, forever (next_turn repairs stats and tiles, never item existence)."""
+    print("-- part 3b: end-of-turn fuses --")
+    u = units(host)[unit_id]
+    ids = drop_fused(host, client, u["x"], u["y"], u["z"], FUSED_COUNT)
+    time.sleep(2)
+    before_h, before_c = flares(host), flares(client)
+    assert set(before_h) == set(before_c), \
+        f"the litter differs before the turn: {set(before_h) ^ set(before_c)}"
+    print(f"    littered {len(ids)} primed {FUSED}s (specialChance {FUSED_CHANCE})")
+
+    turn = TW.cycle_turn(host, client)
+    assert turn, (f"the battle never reached a new turn (turn="
+                  f"{TW.battle(host).get('turn')}) - the end-of-turn fuse sweep "
+                  f"never ran, so the assertion below would be vacuous")
+
+    after_h, after_c = flares(host), flares(client)
+    gone_h = sorted(set(before_h) - set(after_h))
+    gone_c = sorted(set(before_c) - set(after_c))
+    print(f"    turn {turn}: host burned {gone_h}, client burned {gone_c}; "
+          f"survivors host={sorted(after_h.items())} client={sorted(after_c.items())}")
+    assert gone_h or any(t != 0 for t in after_h.values()), (
+        f"not one of the {len(ids)} primed items burned down or had its fuse "
+        f"changed - the lever is dead, so the comparison below would be vacuous")
+    assert gone_h == gone_c, (
+        f"GAP-9: the end-of-turn fuse fired on different items - host removed "
+        f"{gone_h}, client removed {gone_c}. Each machine rolled its own "
+        f"RNG::percent({FUSED_CHANCE}).")
+    assert after_h == after_c, (
+        f"the survivors' fuse timers disagree: host={sorted(after_h.items())} "
+        f"client={sorted(after_c.items())}")
+    session.assert_battle_synced(host, client, "after the fuse boundary")
+    assert_hits_paired(client, "the client", "after the fuse boundary")
+    print(f"PASS fuses: {len(gone_h)} of {len(ids)} burned down, identically on both "
+          f"machines, with the survivors' timers agreeing")
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="coop_outcome_gaps_")
+    fail = None
+    host = client = None
+    try:
+        mod = make_mod(tmp)
+        # battleInstantGrenade: a fuse-0 grenade detonates the moment it LANDS
+        # (BattleItem::fuseThrowEvent), which is the only deterministic way to make
+        # a blast happen on demand. Without it the grenade just lies there until
+        # the end-of-turn fuse sweep.
+        opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                "battleInstantGrenade": True}
+        # skipNextTurnScreen on the HOST only - the same reason as
+        # test_battle_tripwire: the "Turn N" screen then closes through the REAL
+        # NextTurnState::close() on a timer, which is where the host ships next_turn
+        # (and, before P3, where the hit-pairing counter re-bases). Never on the
+        # client: it double-closes there (a known co-op/option interaction).
+        host = GameClient("host", 48854,
+                          make_user_dir("p3_gaps_host", mods=[mod],
+                                        options=dict(opts, skipNextTurnScreen=True)))
+        client = GameClient("client", 48855,
+                            make_user_dir("p3_gaps_client", mods=[mod], options=opts))
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.bring_up_battle(host, client, seed=SEED)
+        print(f"battle up on both machines (with the test ruleset active, seed={SEED})")
+
+        # Part 3b runs FIRST because it is the one step that needs a TURN BOUNDARY,
+        # and the attacks in parts 1 and 2 (a rocket, a psi amp, a stun rod) tend to
+        # finish off the last alien - after which the next end-of-turn ENDS THE
+        # BATTLE instead of cycling it, and the fuse sweep never runs at all.
+        part3_fuse(host, client, "client",
+                   next(u["id"] for u in TW.battle(host)["units"] if u["faction"] == 0))
+
+        # The turn cycle hands the side over, so re-read who owns the simulation.
+        driver, watcher, dtag, wtag, db = TW.pick_driver(host, client)
+        print(f"simulation owner = {dtag}")
+        own_coop = 0 if db["host"] else 1
+        mine = TW.movers(TW.battle(driver), own_coop)
+        assert mine, (f"{dtag} commands no unit able to act: "
+                      f"{[(u['id'], u.get('coop'), u.get('tu')) for u in db['units']]}")
+        shooter_id = mine[0]["id"]
+        target = alive_enemy(driver, own_coop)
+        assert target, "the generated battle holds no live alien to shoot at"
+
+        part1_pellets(host, client, driver, watcher, dtag, shooter_id, target)
+        part1_spawn(host, client, driver, watcher, dtag, shooter_id)
+        # The spawn blast can still catch the shooter (or shuffle the squad); the
+        # resolution-authority parts need a LIVE attacker, so re-pick a survivor
+        # rather than assume the part-1 shooter is still standing.
+        settle(host, client, seconds=4)
+        shooter_id = live_actor(driver, own_coop, fallback=shooter_id)
+        # psi first: a stun rod tends to take the target out of the fight.
+        part2_psi(host, client, driver, watcher, dtag, wtag, shooter_id)
+        part2_melee(host, client, driver, watcher, dtag, wtag, shooter_id)
+        part3_proximity(host, client, wtag, shooter_id)
+
+        print("ALL PRD-P3 OUTCOME-GAP TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        for gc in (host, client):
+            if gc:
+                gc.shutdown()
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_coop_pvp_blaster.py b/tools/coop_test/test_coop_pvp_blaster.py
index af2ce3a92..79f549c3a 100644
--- a/tools/coop_test/test_coop_pvp_blaster.py
+++ b/tools/coop_test/test_coop_pvp_blaster.py
@@ -160,7 +160,7 @@ def _pos(gc):
 
         def _sim_owner():
             for gc, tag in ((host, "host"), (client, "client")):
-                if I74.battle(gc).get("activeSync"):
+                if session.can_drive(I74.battle(gc)):
                     return (gc, tag)
             return None
 
diff --git a/tools/coop_test/test_coop_script_rng.py b/tools/coop_test/test_coop_script_rng.py
new file mode 100644
index 000000000..a72844059
--- /dev/null
+++ b/tools/coop_test/test_coop_script_rng.py
@@ -0,0 +1,142 @@
+"""PRD-P3 GAP-10 - mod script RNG is seed-replayed in a parallel co-op battle.
+
+A mod battle script that draws the script-RNG bindings (randomChance / randomRange
+on the SavedBattleGame `battle_game` register) runs on BOTH machines: the parallel
+client reaches SavedBattleGame::newTurnUpdateScripts via BattlescapeGame::endTurn ->
+_save->endTurn at every side close, exactly like the host. Before the fix the two
+machines drew from their own diverged RNG streams, so every per-turn roll differed
+(empirically: all 19 units' rolled scriptTags diverged host vs client).
+
+The fix (SavedBattleGame::newTurnUpdateScripts) reseeds the global RNG to the
+side-boundary seed the host stamps on `endTurn` (and the client adopts) around the
+newTurnUnit/newTurnItem script loops, so both machines draw the SAME sequence over
+the SAME units in the SAME order (the spawn_units B2 seed-replay pattern applied to
+the whole loop; save+restore, a strict no-op when nothing draws).
+
+The Coop_ScriptRng_Test mod's newTurnUnit script writes each roll into a per-unit
+scriptTag (COOP_RNG_R / COOP_RNG_C). next_turn does NOT re-ship scriptTags, so a
+divergent roll persists and shows up in the save_blob dump - the probe this test
+reads. GREEN = every unit's tags match host vs client, and the whole save_blob hash
+is byte-equal, at every turn boundary.
+
+Run this file 5x for the post-fix stability check.
+"""
+import os, re, sys, time
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+
+MOD = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                   "mods", "Coop_ScriptRng_Test")
+SEED = int(os.environ.get("SCRIPT_RNG_SEED", "8031"))
+TURNS = int(os.environ.get("SCRIPT_RNG_TURNS", "2"))
+
+
+def blob(gc):
+    r = gc.cmd({"cmd": "save_blob", "text": True})
+    return r.get("hash"), r.get("text", "")
+
+
+def tags_of(text):
+    """{unit_id: (COOP_RNG_R, COOP_RNG_C)} from a save_blob text dump. The tag is
+    associated with the nearest preceding `id:` line (units serialize `id:` before
+    their `tags:` submap). A zero roll is omitted by ScriptValues::save (only
+    non-default tags serialize), so a None means 'rolled 0', still a value."""
+    out = {}
+    cur = None
+    for line in text.splitlines():
+        m = re.match(r"\s+id:\s*(\d+)\s*$", line)
+        if m:
+            cur = int(m.group(1))
+        mr = re.search(r"COOP_RNG_R:\s*(-?\d+)", line)
+        if mr and cur is not None:
+            out.setdefault(cur, [None, None])[0] = int(mr.group(1))
+        mc = re.search(r"COOP_RNG_C:\s*(-?\d+)", line)
+        if mc and cur is not None:
+            out.setdefault(cur, [None, None])[1] = int(mc.group(1))
+    return {k: tuple(v) for k, v in out.items()}
+
+
+def check(host, client, label):
+    hh, ht = blob(host)
+    ch, ct = blob(client)
+    htags, ctags = tags_of(ht), tags_of(ct)
+    keys = sorted(set(htags) | set(ctags))
+    diverged = [k for k in keys if htags.get(k) != ctags.get(k)]
+    n_tags = ht.count("COOP_RNG_R")
+    print(f"  {label}: tag-units={len(keys)} rawR={n_tags} "
+          f"saveBlobEqual={hh == ch} diverged={len(diverged)}")
+    for k in diverged[:5]:
+        print(f"      unit {k}: host={htags.get(k)} client={ctags.get(k)}")
+    assert n_tags > 0, (
+        f"{label}: the newTurnUnit script never ran (0 COOP_RNG_R tags) - the mod "
+        f"did not load or the hook did not fire; the check would be vacuous")
+    assert not diverged, (
+        f"{label}: {len(diverged)} unit script-RNG tag(s) DIVERGED host vs client - "
+        f"GAP-10 seed-replay is not holding: {diverged[:8]}")
+    assert hh == ch, (
+        f"{label}: save_blob hash differs (host={hh} client={ch}) though tags matched "
+        f"- a non-script divergence rode along; inspect the dump")
+    return len(keys)
+
+
+def main():
+    opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+    host = client = None
+    try:
+        for attempt in range(1, TW.FIXTURE_TRIES + 1):
+            host = GameClient("host", 48850, make_user_dir(
+                "scriptrng_host", mods=[MOD],
+                options=dict(opts, skipNextTurnScreen=True,
+                             EnableCoopParallelTurns=True)))
+            client = GameClient("client", 48851, make_user_dir(
+                "scriptrng_client", mods=[MOD],
+                options=dict(opts, EnableCoopParallelTurns=False)))
+            for gc in (host, client):
+                TW.write_battle_fixture(gc.user_dir)
+            host.spawn(); host.connect()
+            client.spawn(); client.connect()
+            TW.bring_up_battle(host, client, seed=SEED)
+            foes = [u["id"] for u in TW.battle(host)["units"]
+                    if u.get("faction") == 1 and not u.get("isOut")]
+            if len(foes) >= TW.MIN_HOSTILES:
+                print(f"battle up; {len(foes)} live hostiles; the mod's newTurnUnit "
+                      f"script is active on both machines")
+                break
+            print(f"attempt {attempt}: only {len(foes)} live hostiles, re-rolling")
+            for gc in (host, client):
+                gc.shutdown()
+            host = client = None
+        assert host is not None, "could not roll a viable fixture"
+
+        # Turn 1 is the host-generated, streamed world: the client copies the host's
+        # turn-1 tags, so it is a sanity check, not the fix under test.
+        check(host, client, "turn 1 (streamed)")
+
+        cycled = 0
+        for _ in range(TURNS):
+            t = TW.cycle_turn(host, client, timeout=300)
+            if not TW.battle(host).get("inBattle") \
+                    or not TW.battle(client).get("inBattle"):
+                print("battle ended; stopping (cycled %d turn(s))" % cycled)
+                break
+            time.sleep(3)
+            # A turn cycled on the CLIENT is a turn its newTurnUnit script ran
+            # independently - the exact draw the fix must align.
+            check(host, client, f"after turn {t}")
+            cycled += 1
+        assert cycled >= 1, ("no turn cycled - the client never ran an independent "
+                             "newTurnUnit pass, so nothing was proven")
+        print("PASS: script-RNG tags converge host==client across %d cycled turn(s)"
+              % cycled)
+    finally:
+        for gc in (host, client):
+            if gc is not None:
+                try:
+                    gc.shutdown()
+                except Exception:
+                    pass
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_coop_ufo_door_close.py b/tools/coop_test/test_coop_ufo_door_close.py
index dce78e684..5f426e330 100644
--- a/tools/coop_test/test_coop_ufo_door_close.py
+++ b/tools/coop_test/test_coop_ufo_door_close.py
@@ -1,20 +1,30 @@
-"""Test: UFO door-close sync at end of XCOM turn.
+"""Test: UFO door-close sync at end of XCOM turn + VERIFY-2 (UFO half).
 
-BattlescapeGame::endTurn() (line 1464) closes UFO doors via
-closeUfoDoors(), gated behind _triggerProcessed.tryRun(). On the host
-this runs during the real endTurn(). On the client, endTurnCoop() calls
-requestEndTurn(false), which eventually calls endTurn() in the think
-loop - but possibly after an alien already started moving past what the
-client still sees as a closed door.
+BattlescapeGame::endTurn() closes UFO doors via closeUfoDoors(), gated behind
+_triggerProcessed.tryRun(). On the host this runs during the real endTurn(). On
+the client, endTurnCoop() calls requestEndTurn(false), which eventually calls
+endTurn() in the think loop - but possibly after an alien already started moving
+past what the client still sees as a closed door.
 
-The test:
-  1. Opens a UFO door on the host.
-  2. Verifies it's open on both machines (door-sync fix).
-  3. Ends the XCOM turn.
-  4. Checks the door state on both machines immediately after end-turn
-     (before aliens move).
+This test needs a map that actually HAS UFO doors. A geoscape TERROR site (the
+old fixture) is a city map with only hinged doors, so the test SKIPPED. The NEW
+BATTLE skirmish fixture at mission index 3 generates STR_UFO_GROUND_ASSAULT - a
+UFO map that carries UFO doors (confirmed by probe_missions.py: idx 3/6 are the
+UFO-terrain missions). Point the fixture there (MISSION below) and the test runs.
 
-Run:  python tools/coop_test/test_coop_door_sync.py
+The test:
+  1. Brings up a CLASSIC-coop skirmish battle on a UFO map (mission 3).
+  2. Finds a UFO door, positions a host soldier, opens it.
+  3. Verifies it is open on BOTH machines (door-sync).
+  4. VERIFY-2 (UFO half): asserts the UFO-door open moved ONLY the diagnostic
+     door bitmask, NOT any terrain-bucket field (mapDataID / setID / explosive)
+     - i.e. a UFO-door open/close DIVERGENCE is invisible to the `terrain`
+     bucket and would show only in saveBlob (VERIFY-1: Tile.cpp only touches
+     _objectsCache[part].currentFrame; isUfoDoorOpen is frame-derived, no
+     map-data id change). tile_terrain_full is exactly the bucket's field set.
+  5. Ends the XCOM turn and checks the door-close state on both machines.
+
+Run:  python tools/coop_test/test_coop_ufo_door_close.py
 Exit 0 = pass; 2 = failure.
 """
 
@@ -23,31 +33,20 @@
 import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-import shared_fixture
-import test_shared_battle as B
-
-
-def _aboard(gc, cid):
-    return sorted(s["id"] for s in B._roster(gc) if s["craftId"] == cid)
+import test_sync_check as T
+import test_parallel_intents as PI
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+import session
+from harness import GameClient, make_user_dir
 
+# The NEW BATTLE mission index whose generator produces a UFO map (UFO doors).
+# idx 3 = STR_UFO_GROUND_ASSAULT; idx 6 is the other UFO-terrain mission
+# (probe_missions.py). Parameterised here so a generator change is a one-line fix.
+MISSION = 3
 
-def _top(gc):
-    return gc.cmd({"cmd": "get_state"})["states"][-1].split("::")[-1]
-
-
-def _drain_to_tactical(host, client, rounds=8):
-    for _ in range(rounds):
-        moved = False
-        for gc in (host, client):
-            if _top(gc) != "BattlescapeState":
-                gc.cmd({"cmd": "dismiss_popup"})
-                moved = True
-        time.sleep(1.0)
-        if not moved and all(_top(gc) == "BattlescapeState" for gc in (host, client)):
-            return
 
-
-def _bstate(gc):
+def battle(gc):
     return gc.cmd({"cmd": "battle_state"})
 
 
@@ -55,185 +54,164 @@ def tile_info(gc, x, y, z):
     return gc.cmd({"cmd": "tile_info", "x": x, "y": y, "z": z})
 
 
-def door_on_tile(ti):
-    if not ti.get("ok"):
-        return None
-    for pname in ("northwall", "westwall", "object"):
-        part = ti["parts"].get(pname, {})
-        if part.get("isDoor"):
-            return (pname, False)
-        if part.get("isUfoDoor"):
-            return (pname, True)
-    return None
-
-
 def door_is_open(ti, part_name, is_ufo):
     if not ti.get("ok"):
         return False
     part = ti["parts"].get(part_name, {})
     if is_ufo:
         return part.get("isUfoDoorOpen", False)
-    else:
-        return part.get("mapDataID", 0) < 0
+    return part.get("mapDataID", 0) < 0
 
 
-def find_ufo_door(driver):
-    """Sample tiles by index for a UFO door (isUfoDoor=true).
-    Returns (x,y,z,part,is_ufo) or (None,None,None,None,None) if none found."""
-    n = B._battle(driver).get("mapSizeXYZ", 0)
-    # Dense scan - UFO doors are small and easy to miss with sparse sampling
-    for i in range(0, n, max(1, n // 2000)):
-        ti = driver.cmd({"cmd": "tile_info", "index": i})
+def find_ufo_door(gc):
+    """Scan tiles by index for a UFO door (isUfoDoor). Dense step - UFO doors are
+    small. Returns (x, y, z, part, is_ufo, index) or (None,)*6."""
+    n = battle(gc).get("mapSizeXYZ", 0)
+    for i in range(0, n, max(1, n // 4000)):
+        ti = gc.cmd({"cmd": "tile_info", "index": i})
         if not ti.get("ok"):
             continue
         for pname in ("northwall", "westwall", "object"):
             part = ti["parts"].get(pname, {})
             if part.get("isUfoDoor"):
-                print(f"    found UFO door at ({ti['x']},{ti['y']},{ti['z']}) "
-                      f"part={pname}")
-                return (ti["x"], ti["y"], ti["z"], pname, True)
-    return (None, None, None, None, None)
+                print(f"    found UFO door at ({ti['x']},{ti['y']},{ti['z']}) part={pname}")
+                return (ti["x"], ti["y"], ti["z"], pname, True, i)
+    return (None, None, None, None, None, None)
+
+
+def tvec(gc, idx):
+    """The LIVE terrain-bucket vector for one tile (the exact field set the
+    `terrain` bucket hashes) plus the bucket-blind `door` bitmask."""
+    r = gc.cmd({"cmd": "tile_terrain_full", "index": idx})
+    tiles = r.get("tiles", [])
+    return tiles[0] if tiles else None
+
+
+def bucket_fields(t):
+    """The terrain-bucket subset of a tvec record - everything EXCEPT the
+    diagnostic `door` bitmask (which the bucket does not compare)."""
+    return {k: v for k, v in t.items() if k != "door"}
 
 
 def main():
-    js = shared_fixture.bring_up("ufoclose", (48994, 48995, 48194))
-    host, client = js.host, js.client
+    host = GameClient("host", 48994,
+                      make_user_dir("ufoclose_host",
+                                    options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": False}))
+    client = GameClient("client", 48995,
+                        make_user_dir("ufoclose_client",
+                                      options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    SOAK.write_battle_fixture(host.user_dir, mission=MISSION)
+    SOAK.write_battle_fixture(client.user_dir, mission=MISSION)
     try:
-        owner = {s["id"]: s["owner"] for s in B._roster(host)}
-        seat0 = sorted(sid for sid, o in owner.items() if o == 0)
-        assert len(seat0) >= 2, f"need >=2 host soldiers: {seat0}"
-        cid = B._skyranger(host)["id"]
-        for sid in owner:
-            host.ok({"cmd": "craft_assign", "craft_id": cid, "soldier_id": sid, "on": False})
-        squad = seat0[:2]
-        for sid in squad:
-            host.ok({"cmd": "craft_assign", "craft_id": cid, "soldier_id": sid, "on": True})
-        host.wait_for("squad aboard",
-                      lambda: (_aboard(host, cid) == sorted(squad)) or None,
-                      timeout=45, interval=0.5)
-
-        b0 = B._base0(host)
-        blon, blat = b0["lon"], b0["lat"]
-        site_id = host.ok({"cmd": "spawn_mission_site",
-                           "mission": "STR_ALIEN_TERROR",
-                           "deployment": "STR_TERROR_MISSION",
-                           "lon": blon + 0.35, "lat": blat + 0.10,
-                           "race": "STR_SECTOID", "hours": 240})["site_id"]
-        host.wait_for("site on host",
-                      lambda: any(s["id"] == site_id
-                                  for s in B._geo(host)["missionSites"]) or None,
-                      timeout=30)
-        host.ok({"cmd": "craft_force", "craft_id": cid, "status": "STR_OUT",
-                 "lon": blon + 0.34, "lat": blat + 0.10,
-                 "dest": f"site:{site_id}", "fuel": 999999, "lowFuel": False})
-
-        def _landing():
-            if B._has(host, "ConfirmLandingState"):
-                return True
-            host.cmd({"cmd": "geo_set_speed", "idx": 2})
-            return None
-        host.wait_for("landing prompt", _landing, timeout=90, interval=0.5)
-        host.ok({"cmd": "confirm_landing"})
-
-        for gc, tag in ((host, "host"), (client, "client")):
-            gc.wait_for(f"{tag} in battle",
-                        lambda gc=gc: B._battle(gc).get("inBattle") or None,
-                        timeout=180, interval=1.0)
-        for gc in (host, client):
-            gc.wait_for("briefing",
-                        lambda gc=gc: B._has(gc, "BriefingState") or None,
-                        timeout=30, interval=0.5)
-            gc.ok({"cmd": "close_briefing"})
-        for gc in (host, client):
-            gc.wait_for("inventory",
-                        lambda gc=gc: B._has(gc, "InventoryState") or None,
-                        timeout=30, interval=0.5)
-            gc.ok({"cmd": "battle_inventory", "action": "ok"})
-        _drain_to_tactical(host, client)
-
-        host.wait_for("host turn active",
-                      lambda: (B._battle(host).get("coopTurn") == 2) or None,
-                      timeout=30, interval=0.5)
-        time.sleep(2)
-
-        # Find a UFO door
-        dx, dy, dz, pname, is_ufo = find_ufo_door(host)
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        for mod in (T.TW, PI, PE, SOAK):
+            try:
+                mod.PORT = T.PORT
+            except Exception:
+                pass
+        T.TW.bring_up_battle(host, client)
+        b = battle(host)
+        print(f"battle up: missionType={b.get('missionType')} coopTurn={b.get('coopTurn')}")
+
+        dx, dy, dz, pname, is_ufo, idx = find_ufo_door(host)
         if dx is None:
-            print("no UFO doors on this map - cannot test close sync; skipping")
-            print("UFO-DOOR-CLOSE SYNC TEST SKIPPED (no UFO doors)")
-            return
+            raise AssertionError(
+                f"no UFO door on mission {MISSION} (missionType={b.get('missionType')}) - "
+                f"the fixture must point at a UFO-terrain mission (idx 3 or 6)")
 
-        # Pick a host-owned soldier with TUs
-        hb = B._battle(host)
+        hb = battle(host)
         soldiers = [u for u in hb["units"]
-                    if u.get("soldierId") in squad
-                    and not u.get("isOut") and u.get("tu", 0) > 10]
+                    if u.get("faction") == 0 and not u.get("isOut") and u.get("tu", 0) > 10]
         assert soldiers, "no host soldiers with TUs"
         sid = soldiers[0]["id"]
 
-        # Teleport onto the door tile
+        # --- capture the door tile's terrain-bucket vector BEFORE the open ---
+        before_h = tvec(host, idx)
+        assert before_h is not None, f"no terrain vector for door tile index {idx}"
+        print(f"door tile bucket (closed) = {bucket_fields(before_h)} door_bits={before_h.get('door')}")
+
+        # Teleport onto the door tile, verify closed on both
         host.cmd({"cmd": "battle_action", "action": "select", "unit": sid})
-        tres = host.cmd({"cmd": "battle_teleport", "unit": sid,
-                         "x": dx, "y": dy, "z": dz})
+        tres = host.cmd({"cmd": "battle_teleport", "unit": sid, "x": dx, "y": dy, "z": dz})
         assert tres.get("ok") and tres.get("moved"), f"teleport failed: {tres}"
+        ti_h0 = tile_info(host, dx, dy, dz)
+        ti_c0 = tile_info(client, dx, dy, dz)
+        assert not door_is_open(ti_h0, pname, is_ufo), f"door already open on host: {ti_h0}"
+        assert not door_is_open(ti_c0, pname, is_ufo), f"door already open on client: {ti_c0}"
 
-        # Compute target: one step in the door normal direction
+        # Open the door (one step into the door normal)
         if pname == "northwall":
             tx_t, ty_t = dx, dy - 1
         elif pname == "westwall":
             tx_t, ty_t = dx - 1, dy
         else:
             tx_t, ty_t = dx, dy
-
-        # Open the door
         res = host.cmd({"cmd": "battle_action", "action": "door", "unit": sid,
                         "x": tx_t, "y": ty_t, "z": dz})
         assert res.get("ok"), f"door action failed: {res}"
         time.sleep(3.0)
 
-        # Verify door is open on both machines
+        # --- verify OPEN on both machines (door-sync) ---
         ti_h = tile_info(host, dx, dy, dz)
         ti_c = tile_info(client, dx, dy, dz)
-        assert door_is_open(ti_h, pname, is_ufo), \
-            f"door not open on host: {ti_h}"
-        assert door_is_open(ti_c, pname, is_ufo), \
-            f"door not open on client: {ti_c}"
-        print("door opened on both machines")
-
-        # --- End the XCOM turn ---
+        assert door_is_open(ti_h, pname, is_ufo), f"door not open on host: {ti_h}"
+        assert door_is_open(ti_c, pname, is_ufo), f"door not open on client: {ti_c}"
+        print("UFO door opened on both machines")
+
+        # --- VERIFY-2 (UFO half): the open is invisible to the terrain bucket ---
+        after_h = tvec(host, idx)
+        assert after_h is not None, "no terrain vector after open"
+        assert bucket_fields(before_h) == bucket_fields(after_h), (
+            "VERIFY-2 FAILED: the UFO-door open moved a terrain-bucket field\n"
+            f"  before = {bucket_fields(before_h)}\n  after  = {bucket_fields(after_h)}")
+        assert before_h.get("door") != after_h.get("door"), (
+            "VERIFY-2 sanity: the door bitmask did not change on the open "
+            f"(before={before_h.get('door')} after={after_h.get('door')})")
+        sc = session.sync_check(host)
+        terr = [m for m in sc.get("mismatches", []) if m["bucket"] == "terrain"]
+        assert not terr, f"terrain bucket fired on a synced UFO-door open: {terr}"
+        print(f"VERIFY-2 UFO: terrain bucket UNCHANGED (door bits {before_h.get('door')}"
+              f"->{after_h.get('door')}); UFO-door divergence is saveBlob-only, "
+              f"terrain-blind (0 terrain mismatches)")
+
+        # --- end the XCOM turn, check the close state on both ---
         res = host.cmd({"cmd": "battle_action", "action": "end_turn"})
         assert res.get("ok"), f"end_turn failed: {res}"
         print("end turn dispatched")
-
-        # Wait for end-turn processing on BOTH machines
         time.sleep(4.0)
-        _drain_to_tactical(host, client, rounds=4)
+        for _ in range(4):
+            for gc in (host, client):
+                t = gc.cmd({"cmd": "get_state"})["states"][-1].split("::")[-1]
+                if t not in ("BattlescapeState", "NextTurnState", "DebriefingState"):
+                    gc.cmd({"cmd": "dismiss_popup"})
+            time.sleep(1.0)
 
-        # Check door state on both machines after end-turn
         ti_h2 = tile_info(host, dx, dy, dz)
         ti_c2 = tile_info(client, dx, dy, dz)
         host_open = door_is_open(ti_h2, pname, is_ufo)
         client_open = door_is_open(ti_c2, pname, is_ufo)
         print(f"after end-turn: host_open={host_open} client_open={client_open}")
 
-        if host_open and client_open:
-            print("PASS: UFO door closed on both machines after end-turn")
-        elif host_open and not client_open:
-            print("PASS: door already closed on client before end-turn (no bug)")
-        elif not host_open and client_open:
+        if not host_open and client_open:
             raise AssertionError(
-                f"ISSUE: host closed UFO door but client still sees it open\n"
+                f"ISSUE: host closed the UFO door but client still sees it open\n"
                 f"  host tile: {ti_h2}\n  client tile: {ti_c2}")
-        elif not host_open and not client_open:
-            print("PASS: UFO door closed on both machines after end-turn")
-        else:
-            raise AssertionError(
-                f"UNEXPECTED: host_open={host_open} client_open={client_open}")
-
+        # Every other combination is fine: both closed (normal close), both still
+        # open (an alien re-opened / turn did not process the close yet - matched),
+        # or host open + client already closed (no bug).
+        print("PASS: UFO door close state consistent across both machines")
         print("UFO-DOOR-CLOSE SYNC TEST PASSED")
 
     finally:
-        js.shutdown()
+        for gc in (host, client):
+            try:
+                gc.shutdown()
+            except Exception:
+                pass
 
     print("DONE")
 
diff --git a/tools/coop_test/test_coop_wait_banner.py b/tools/coop_test/test_coop_wait_banner.py
new file mode 100644
index 000000000..b36d5fae9
--- /dev/null
+++ b/tools/coop_test/test_coop_wait_banner.py
@@ -0,0 +1,244 @@
+"""coop (parallel turns): the persistent "Please wait for <player>'s action to
+finish" banner (BattlescapeState::updateCoopWaitBanner + getPrimaryBusyActor).
+Asserts:
+
+  1. SHOWS + owner: while the HOST executes a CLIENT's forwarded walk, the host is
+     busy with a unit it does NOT own, so the host's wait banner is non-empty
+     ("Please wait for ... action to finish").
+  2. CLEARS: once the host goes idle again the banner is empty.
+  3. SUPPRESSED for own action (host): while the host executes its OWN walk the
+     banner stays empty for the whole busy window - you are not waiting on anyone.
+  4. CLIENT SHOWS + latch stability: while the CLIENT replays the HOST's own walk,
+     the client's banner names the host and the owner never flips mid-window (the
+     per-window owner latch, item 1). This is the most common player-facing case.
+  5. CLIENT SUPPRESSED for own echoed action: while the client replays ITS OWN
+     action back at it, its banner stays empty (mirror of 3, client-side).
+
+Driven through the isBusy() path (a slowed, on-screen walk keeps the busy machine
+busy for a pollable window), NOT the transient click-sync ticks, so it is not
+frame-timing-sensitive.
+
+Run:  python tools/coop_test/test_coop_wait_banner.py
+Exit 0 = pass; 2 = failure.
+"""
+import os
+import re
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+PORT = "47991"
+
+
+def banner(gc):
+    return PI.parallel(gc).get("coopWaitBanner", "") or ""
+
+
+def busy(gc):
+    return bool(gc.cmd({"cmd": "battle_state"}).get("isBusy"))
+
+
+def owner_name(b):
+    m = re.search(r"for (.+)'s action to finish", b)
+    return m.group(1).strip() if m else None
+
+
+def slow(gc):
+    gc.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": 200})
+
+
+def long_walk_dest(gc, uid):
+    for radius in (8, 6, 4, 2):
+        d = PI.far_step(gc, uid, radius=radius)
+        if d:
+            return d
+    return None
+
+
+def scenario_shows_and_clears(host, client, client_mover):
+    print("-- 1+2: host executes CLIENT walk -> host banner names owner, then clears --")
+    assert PI.idle(host), "host not idle before the client walk"
+    slow(host)
+    host.cmd({"cmd": "battle_camera", "unit": client_mover, "visible": True})
+    PI.top_up(host, client, client_mover)
+    dest = long_walk_dest(host, client_mover)
+    assert dest, f"client soldier {client_mover} cannot walk anywhere"
+
+    r = PI.intent(client, action="move", unit=client_mover,
+                  x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+
+    # while the host runs the client's walk it is busy with a unit it does NOT own
+    got = PI.wait_until(lambda: "please wait" in banner(host).lower(), 30)
+    b = banner(host)
+    assert got, (
+        f"host wait banner never showed while executing the client's walk "
+        f"(banner={b!r}, host canAdmit={PI.parallel(host).get('canAdmit')}). "
+        f"getPrimaryBusyActor()/owner-seat resolution or the updateCoopWaitBanner "
+        f"guards are wrong.")
+    assert "action to finish" in b.lower(), f"unexpected banner wording: {b!r}"
+    # the owner NAME must be resolved (not blank) - seatName() is empty in a
+    # skirmish battle, so this guards the getCurrentClientName() fallback.
+    m = re.search(r"for (.+)'s action to finish", b)
+    assert m and m.group(1).strip(), f"banner has no player name: {b!r}"
+    print(f"PASS 1: host banner while executing the client's walk = {b!r}")
+
+    assert PI.idle(host, timeout=120), "host walk never finished"
+    PI.settle(host, client)
+    assert PI.wait_until(lambda: banner(host) == "", 15), (
+        f"host wait banner did not clear after going idle (still {banner(host)!r})")
+    print("PASS 2: banner cleared once the host went idle")
+
+
+def scenario_own_action_suppressed(host, client, host_mover):
+    print("-- 3: host's OWN walk -> banner suppressed the whole busy window --")
+    assert PI.idle(host), "host not idle before its own walk"
+    slow(host)
+    host.cmd({"cmd": "battle_camera", "unit": host_mover, "visible": True})
+    PI.top_up(host, client, host_mover)
+    dest = long_walk_dest(host, host_mover)
+    assert dest, f"host soldier {host_mover} cannot walk anywhere"
+
+    r = PI.intent(host, action="move", unit=host_mover, x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is False, (
+        f"the host did not execute its own walk locally (routed={r.get('routed')}); "
+        f"the executor must run its own action, not ship an intent")
+
+    busy_samples = 0
+    deadline = time.time() + 30
+    while time.time() < deadline:
+        ps = PI.parallel(host)
+        b = banner(host)
+        if ps.get("canAdmit") is False:
+            busy_samples += 1
+            assert b == "", (
+                f"host wait banner lit for the host's OWN action (banner={b!r}); "
+                f"owner==localSeat must be suppressed")
+        elif busy_samples > 0:
+            break
+        time.sleep(0.05)
+    assert busy_samples > 0, "never observed the host busy during its own walk (test vacuous)"
+    PI.settle(host, client)
+    print(f"PASS 3: banner stayed empty across {busy_samples} busy sample(s) of the host's own walk")
+
+
+def scenario_client_sees_host(host, client, host_mover):
+    print("-- 4: client replays HOST's own walk -> client banner names the host, latch stable --")
+    assert PI.idle(host), "host not idle before its own walk"
+    slow(client)  # slow the CLIENT so its replay of the host's walk is a pollable window
+    client.cmd({"cmd": "battle_camera", "unit": host_mover, "visible": True})
+    PI.top_up(host, client, host_mover)
+    dest = long_walk_dest(host, host_mover)
+    assert dest, f"host soldier {host_mover} cannot walk anywhere"
+
+    r = PI.intent(host, action="move", unit=host_mover, x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is False, (
+        f"the host did not execute its own walk locally (routed={r.get('routed')})")
+
+    # while the client REPLAYS the host's action it is busy with a unit it does NOT own
+    got = PI.wait_until(lambda: "please wait" in banner(client).lower(), 30)
+    b = banner(client)
+    assert got, (
+        f"client wait banner never showed while replaying the host's walk "
+        f"(banner={b!r}, client isBusy={busy(client)}). This is the common "
+        f"player-facing case - the client-side isBusy/owner path is broken.")
+    assert "action to finish" in b.lower(), f"unexpected banner wording: {b!r}"
+    first = owner_name(b)
+    assert first, f"client banner has no player name: {b!r}"
+
+    # item-1 latch: the owner must not flip mid-window (a consequence state pushed
+    # to the front must not re-attribute the banner). A kill-free walk pushes none,
+    # so this is a stability proxy, not a casualty test (deliberately - the review
+    # ruled a kill-based edge too flaky to assert).
+    names = {first}
+    while busy(client):
+        bn = banner(client)
+        if bn:
+            names.add(owner_name(bn))
+        time.sleep(0.05)
+    assert names == {first}, f"client banner owner changed mid-window (latch broken): {names}"
+    print(f"PASS 4: client banner while replaying the host's walk = {b!r} (owner stable)")
+
+    PI.wait_until(lambda: not busy(client), 120)
+    PI.settle(host, client)
+    assert PI.wait_until(lambda: banner(client) == "", 15), (
+        f"client wait banner did not clear after the replay ended (still {banner(client)!r})")
+    print("PASS 4b: client banner cleared once the replay ended")
+
+
+def scenario_client_own_suppressed(host, client, client_mover):
+    print("-- 5: client replays its OWN echoed action -> banner suppressed the whole window --")
+    assert PI.idle(host), "host not idle before the client walk"
+    slow(client)
+    client.cmd({"cmd": "battle_camera", "unit": client_mover, "visible": True})
+    PI.top_up(host, client, client_mover)
+    dest = long_walk_dest(host, client_mover)  # host-pathable: the host is the executor
+    assert dest, f"client soldier {client_mover} cannot walk anywhere"
+
+    r = PI.intent(client, action="move", unit=client_mover, x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+
+    busy_samples = 0
+    deadline = time.time() + 30
+    while time.time() < deadline:
+        b = banner(client)
+        if busy(client):
+            busy_samples += 1
+            assert b == "", (
+                f"client wait banner lit for its OWN echoed action (banner={b!r}); "
+                f"owner==localSeat must be suppressed")
+        elif busy_samples > 0:
+            break
+        time.sleep(0.05)
+    assert busy_samples > 0, "never observed the client busy replaying its own walk (test vacuous)"
+    PI.settle(host, client)
+    print(f"PASS 5: client banner stayed empty across {busy_samples} busy sample(s) of its own action")
+
+
+def main():
+    fail = None
+    host = GameClient("host", 48930, make_user_dir(
+        "waitbn_reg_host", options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                    "skipNextTurnScreen": True,
+                                    "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48931, make_user_dir(
+        "waitbn_reg_client", options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                      "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert PI.battle(gc)["parallelActive"] is True, f"{tag}: parallel not live"
+        assert PI.battle(host)["activeSync"] is True and PI.battle(client)["activeSync"] is False, \
+            "executor invariant broken - nothing below tests the intended path"
+
+        seat = client.ok({"cmd": "get_coop"})["localSeat"]
+        client_mover = PI.pick_driver(host, client, seat, "client")
+        host_mover = PI.pick_driver(host, client, 0, "host")
+
+        scenario_shows_and_clears(host, client, client_mover)
+        scenario_own_action_suppressed(host, client, host_mover)
+        scenario_client_sees_host(host, client, host_mover)
+        scenario_client_own_suppressed(host, client, client_mover)
+
+        print("ALL WAIT-BANNER TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_crash_reporter.py b/tools/coop_test/test_crash_reporter.py
new file mode 100644
index 000000000..a83724eb2
--- /dev/null
+++ b/tools/coop_test/test_crash_reporter.py
@@ -0,0 +1,256 @@
+"""PRD-I5: next-launch crash reporter (consent + bundle), dual-source discovery.
+
+Single instance at the main menu. Two crash sources are exercised, both driving the
+REAL boot hook (GoToMainMenuState::init -> SharedEcon::maybeReportPreviousCrash) and
+the consent dialog via the generic widget levers (list_widgets / click_widget - no
+new TestServer command, so the Session-F dispatch quirk never bites):
+
+  SOURCE 1 - the classic crashDump marker (<user>/crash-pending.json).
+  SOURCE 2 - an unseen issue-#124 VEH crashlog in <exe>/crashlogs (the robust
+             catch-all crashDump misses). Dedup via a per-user crash-seen.json.
+
+Asserts (each source): BUNDLE -> valid zip with all members + source marked seen /
+marker deleted; NOT NOW -> unseen (re-prompts); NEVER -> marked seen, no zip.
+
+Because <exe>/crashlogs is exe-global (shared by every instance) while the ledger is
+per-user, the crashlog scenarios pin their instance's ledger baseline to just-before
+the fabricated entry and pre-mark every OTHER existing crashlog seen, so ONLY the
+fabricated entry is offered. The seen-ledger's `seen[]` membership is the
+deterministic dedup proof (a concurrent force_crash could add a stray crashlog, but
+never touches this entry's ledger state)."""
+import os, sys, time, json, glob, zipfile
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir, EXE
+
+BASE_PORT = 45999  # single control port; GameClient applies the per-slot shift
+CRASHLOGS_DIR = os.path.join(os.path.dirname(EXE), "crashlogs")
+
+
+def top_state(g):
+    r = g.cmd({"cmd": "list_widgets"})
+    return r.get("state", ""), r.get("widgets", [])
+
+
+def wait_top(g, needle, timeout=180):
+    return g.wait_for("top state %r" % needle,
+                      lambda: (lambda s: s if needle in s[0] else None)(top_state(g)),
+                      timeout=timeout, interval=1.0)
+
+
+def assert_prompt_buttons(widgets):
+    labels = [w.get("text", "") for w in widgets if "text" in w]
+    for want in ("BUNDLE", "NOT NOW", "NEVER"):
+        hits = [w for w in widgets if w.get("text") == want]
+        assert hits, "consent dialog has no %r button - labels seen: %s" % (want, labels)
+        b = hits[0]
+        assert b.get("visible") and b.get("interactive"), \
+            "the %r button is not visible+interactive: %s" % (want, b)
+
+
+# ---------- SOURCE 1: the classic crashDump marker ----------
+
+def plant_marker(user_dir, ts, exc="0xC0000005"):
+    dump = os.path.join(user_dir, ts + ".dmp")
+    log = os.path.join(user_dir, "openxcom.log")
+    with open(dump, "wb") as f:
+        f.write(b"FAKE-MINIDUMP-CONTENT-FOR-I5-TEST\n" * 32)
+    if not os.path.exists(log):
+        with open(log, "w", encoding="utf-8") as f:
+            f.write("stub openxcom.log planted by test_crash_reporter\n")
+    marker = os.path.join(user_dir, "crash-pending.json")
+    with open(marker, "w", encoding="utf-8") as f:
+        json.dump({"timestamp": ts, "dump": dump, "log": log,
+                   "version": "Extended 8.4.2 (i5-test)", "exception": exc}, f, indent=2)
+    return marker
+
+
+def scenario_marker_bundle():
+    d = make_user_dir("crash_bundle")
+    ts = "15-08-2026_10-00-00"
+    marker = plant_marker(d, ts)
+    reports_dir = os.path.join(d, "crash-reports")
+    g = GameClient("crash-bundle", BASE_PORT, d)
+    g.spawn()
+    try:
+        g.connect(timeout=180)
+        st, widgets = wait_top(g, "CoopCrashPromptState")
+        assert_prompt_buttons(widgets)
+        g.ok({"cmd": "click_widget", "match": "bundle"})
+        def bundled():
+            zips = glob.glob(os.path.join(reports_dir, "crash-*.zip"))
+            return zips if (zips and not os.path.exists(marker)) else None
+        zips = g.wait_for("marker bundle written + marker deleted", bundled, timeout=60, interval=1.0)
+        assert len(zips) == 1, "expected one crash zip, got %s" % zips
+        with zipfile.ZipFile(zips[0]) as z:
+            names = set(z.namelist())
+            for m in ("crash-info.json", "crash.dmp", "openxcom.log"):
+                assert m in names, "marker zip missing %r; has %s" % (m, sorted(names))
+            info = json.loads(z.read("crash-info.json").decode("utf-8", "replace"))
+            assert info.get("source") == "crashdump-marker", "marker source wrong: %s" % info.get("source")
+            assert info.get("crash", {}).get("exception") == "0xC0000005"
+        dd = g.cmd({"cmd": "desync_dialog"}).get("last", {})
+        assert dd.get("raiseCount", 0) >= 1 and (dd.get("openFolderTarget") or "").replace("\\", "/").endswith("crash-reports")
+        print("PASS marker-bundle: valid zip (source=crashdump-marker), marker deleted, result notice")
+    finally:
+        time.sleep(0.5); g.shutdown()
+
+
+def scenario_marker_keep_or_delete(name, choice, expect_marker):
+    d = make_user_dir(name)
+    marker = plant_marker(d, "15-08-2026_11-00-00")
+    reports_dir = os.path.join(d, "crash-reports")
+    g = GameClient(name, BASE_PORT, d)
+    g.spawn()
+    try:
+        g.connect(timeout=180)
+        wait_top(g, "CoopCrashPromptState")
+        g.ok({"cmd": "click_widget", "match": choice})
+        wait_top(g, "MainMenuState", timeout=30)
+        time.sleep(1.0)
+        assert os.path.exists(marker) == expect_marker, \
+            "%s: marker present=%s expected=%s" % (name, os.path.exists(marker), expect_marker)
+        assert not glob.glob(os.path.join(reports_dir, "crash-*.zip")), "%s wrote a zip" % name
+        print("PASS %s: click %r -> marker %s, no zip"
+              % (name, choice, "kept" if expect_marker else "deleted"))
+    finally:
+        time.sleep(0.5); g.shutdown()
+
+
+# ---------- SOURCE 2: an unseen issue-#124 VEH crashlog ----------
+
+def existing_crashlog_dmps():
+    if not os.path.isdir(CRASHLOGS_DIR):
+        return []
+    return [n for n in os.listdir(CRASHLOGS_DIR) if n.startswith("crash_") and n.endswith(".dmp")]
+
+
+def write_ledger(user_dir, seen_list, baseline_offset=-60):
+    with open(os.path.join(user_dir, "crash-seen.json"), "w", encoding="utf-8") as f:
+        json.dump({"baseline": int(time.time()) + baseline_offset, "seen": seen_list}, f)
+
+
+def read_seen(user_dir):
+    p = os.path.join(user_dir, "crash-seen.json")
+    if not os.path.exists(p):
+        return []
+    with open(p, encoding="utf-8") as f:
+        return json.load(f).get("seen", [])
+
+
+def fab_crashlog(nonce):
+    os.makedirs(CRASHLOGS_DIR, exist_ok=True)
+    base = "crash_%s_123_%d" % (time.strftime("%Y%m%d_%H%M%S"), nonce)
+    dmp = os.path.join(CRASHLOGS_DIR, base + ".dmp")
+    log = os.path.join(CRASHLOGS_DIR, base + ".log")
+    with open(dmp, "wb") as f:
+        f.write(b"FAKE-VEH-MINIDUMP-%d\n" % nonce * 16)
+    with open(log, "w", encoding="utf-8") as f:
+        f.write("==== Crash/Log ====\nUNHANDLED SEH. Code = 0xC0000005 (fabricated VEH crashlog)\nMods: xcom1\n")
+    return base + ".dmp", dmp, log
+
+
+def prompt_shown(name, user_dir):
+    """Launch on user_dir; return True iff the consent prompt was shown (else it
+    settled on the main menu). Does not click anything."""
+    g = GameClient(name, BASE_PORT, user_dir); g.spawn()
+    try:
+        g.connect(timeout=180)
+        def settled():
+            st, _ = top_state(g)
+            if "CoopCrashPromptState" in st: return "prompt"
+            if "MainMenuState" in st: return "menu"
+            return None
+        return g.wait_for("prompt or menu", settled, timeout=180, interval=1.0) == "prompt"
+    finally:
+        time.sleep(0.5); g.shutdown()
+
+
+def scenario_crashlog_bundle():
+    d = make_user_dir("crashlog_bundle")
+    write_ledger(d, existing_crashlog_dmps())
+    dmp_base, dmp, log = fab_crashlog(99001)
+    reports_dir = os.path.join(d, "crash-reports")
+    g = GameClient("crashlog-bundle", BASE_PORT, d)
+    g.spawn()
+    try:
+        g.connect(timeout=180)
+        st, widgets = wait_top(g, "CoopCrashPromptState")
+        assert_prompt_buttons(widgets)
+        g.ok({"cmd": "click_widget", "match": "bundle"})
+        zips = g.wait_for("crashlog bundle",
+                          lambda: (lambda z: z if z else None)(glob.glob(os.path.join(reports_dir, "crash-*.zip"))),
+                          timeout=60, interval=1.0)
+        assert len(zips) == 1, "expected one crashlog zip, got %s" % zips
+        with zipfile.ZipFile(zips[0]) as z:
+            names = set(z.namelist())
+            for m in ("crash-info.json", "crash.dmp", "crash-log.txt", "openxcom.log"):
+                assert m in names, "crashlog zip missing %r; has %s" % (m, sorted(names))
+            info = json.loads(z.read("crash-info.json").decode("utf-8", "replace"))
+            assert info.get("source") == "veh-crashlog", "crashlog source wrong: %s" % info.get("source")
+        # deterministic dedup proof: the handled .dmp is now in the per-user seen ledger
+        assert dmp_base in read_seen(d), "BUNDLE did not mark the crashlog seen: %s" % read_seen(d)
+        print("PASS crashlog-bundle: valid zip (source=veh-crashlog, pair+log+info), marked seen")
+    finally:
+        time.sleep(0.5); g.shutdown()
+        for f in (dmp, log):
+            try: os.remove(f)
+            except OSError: pass
+
+
+def scenario_crashlog_keep_or_delete(name, choice, nonce, expect_seen):
+    d = make_user_dir(name)
+    write_ledger(d, existing_crashlog_dmps())
+    dmp_base, dmp, log = fab_crashlog(nonce)
+    reports_dir = os.path.join(d, "crash-reports")
+    g = GameClient(name, BASE_PORT, d)
+    g.spawn()
+    try:
+        g.connect(timeout=180)
+        wait_top(g, "CoopCrashPromptState")
+        g.ok({"cmd": "click_widget", "match": choice})
+        wait_top(g, "MainMenuState", timeout=30)
+        time.sleep(1.0)
+        assert not glob.glob(os.path.join(reports_dir, "crash-*.zip")), "%s wrote a zip" % name
+        seen = read_seen(d)
+        assert (dmp_base in seen) == expect_seen, \
+            "%s: seen=%s expected in_seen=%s" % (name, dmp_base in seen, expect_seen)
+        g.shutdown()
+        # integration: NOT NOW (unseen) re-prompts; NEVER (seen) does not (for THIS entry).
+        if choice == "not now":
+            assert prompt_shown(name + "-2", d), "NOT NOW did not re-prompt on relaunch"
+        print("PASS %s: click %r -> no zip, in_seen=%s" % (name, choice, dmp_base in seen))
+    finally:
+        time.sleep(0.5)
+        try: g.shutdown()
+        except Exception: pass
+        for f in (dmp, log):
+            try: os.remove(f)
+            except OSError: pass
+
+
+def scenario_no_marker():
+    d = make_user_dir("crash_nomarker")  # no marker, no fabricated crashlog
+    g = GameClient("crash-nomarker", BASE_PORT, d)
+    g.spawn()
+    try:
+        g.connect(timeout=180)
+        st, _ = wait_top(g, "MainMenuState")
+        assert "CoopCrashPromptState" not in st, "consent dialog appeared with nothing to report: %s" % st
+        print("PASS no-source: boot lands on MainMenuState, no prompt (fast path, ledger created)")
+    finally:
+        time.sleep(0.5); g.shutdown()
+
+
+def main():
+    scenario_no_marker()
+    scenario_marker_bundle()
+    scenario_marker_keep_or_delete("crash_notnow", "not now", expect_marker=True)
+    scenario_marker_keep_or_delete("crash_never", "never", expect_marker=False)
+    scenario_crashlog_bundle()
+    scenario_crashlog_keep_or_delete("crashlog_notnow", "not now", 99010, expect_seen=False)
+    scenario_crashlog_keep_or_delete("crashlog_never", "never", 99011, expect_seen=True)
+    print("ALL PASS: crash reporter dual-source (marker + VEH crashlog) consent + bundle")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_alien_death_decouple.py b/tools/coop_test/test_parallel_alien_death_decouple.py
new file mode 100644
index 000000000..5f4b5a7a9
--- /dev/null
+++ b/tools/coop_test/test_parallel_alien_death_decouple.py
@@ -0,0 +1,217 @@
+"""ITEM 5 (sub-part B): alien-side death-chain world-state DECOUPLING regression test.
+
+THE DEFECT (pre-item-5): during the ALIEN side the parallel replay client applied the
+death-chain victim carriers - hit_unit (damage/wounds), unit_death (status/pos) and
+after_unit_death (corpse mint) - only at coopTaskCompleted() (display-idle). A long
+alien side never idles: the display re-plays walk->shot->explosion->death continuously,
+those carriers pile up behind the receive gate, and once the pump has consumed nothing
+for the stall window it drops to the legacy floor (connectionTCP.cpp g_rxBlockedStallTicks),
+which DISABLES the I1 seq-gate AND the D.1 apply barrier. Ordering then breaks: later
+deaths' carriers apply out of order / in a burst, and the client's per-action sync-check
+hash straddles - the DOMINANT within-side four-bucket residual (unitsCore liveness/pos,
+unitsCombat wounds, items + itemIdCtr corpse mint), healing only at sidestart.
+
+THE FIX (item 5 B, alien-replay decoupling): those three carriers are pure host absolutes
+whose display state is presentation-only on the parallel client (item 3/4). They are now
+seq-gated (coopIsChainOutcomePacket) AND allowed through gateAllows while the display is
+busy, on the parallel replay client only. So each applies at packet-apply, folded into the
+exact chain it belongs to, IN ORDER, independent of the display animation. The pump stays
+fed => the legacy floor never engages => the seq-gate + barrier ordering holds. Classic
+co-op / PvP / host / single player are byte-identical (parallel-gated; their carriers are
+seq-0 unstamped and take the legacy always-consume path unchanged).
+
+This test forces the stall-prone scenario the residual lives in: a SLOW client (its alien
+replay lags the host by many display frames) ambushed with several weakened soldiers PER
+side so the alien AI kills a cluster each turn (a long, casualty-heavy alien side). Under
+--strict-burnin (side-gates OFF, so the four buckets compare at EVERY seq) it asserts:
+
+  * unitsCore / unitsCombat / items / itemIdCtr  alien-side mismatch == 0
+  * census identical, counters identical, tripwire silent
+
+Non-vacuity: it asserts the alien AI actually killed several ambushed soldiers (corpses
+grew) AND the client genuinely lagged the host (its display backlog opened), so the clean
+asserts are not trivially true.
+
+RED (pre-item-5, same-build introspection): the four buckets straddle at ai/expl seqs
+(measured on the seed-555 baseline soak: unitsCore 48, items 17, itemIdCtr 16 -> UNIT
+CENSUS DRIFT). GREEN (post-fix): <= a small transient, census equal.
+
+Run:  python tools/coop_test/test_parallel_alien_death_decouple.py [--seed N]
+                 [--slow-client MS] [--hp N] [--sides N] [--pairs N]
+Exit 0 = decoupling covered (pass); 2 = a straddle (fail).
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47993"
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+def adj_free(ax, ay, az, occupied):
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        p = (ax + dx, ay + dy, az)
+        if p not in occupied:
+            return p
+    return None
+
+
+def ambush(host, client, side_no, pairs, hp):
+    hb = bstate(host)
+    aliens = [u for u in hb["units"] if u.get("faction") == 1 and not u.get("isOut")]
+    soldiers = [u for u in hb["units"] if u.get("faction") == 0 and not u.get("isOut")]
+    occupied = {(u["x"], u["y"], u["z"]) for u in hb["units"] if not u.get("isOut")}
+    placed = 0
+    # keep one soldier untouched so the mission cannot end mid-run
+    for alien, sol in list(zip(aliens, soldiers[1:]))[:pairs]:
+        p = adj_free(alien["x"], alien["y"], alien["z"], occupied)
+        if not p:
+            continue
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": sol["id"],
+                       "x": p[0], "y": p[1], "z": p[2]}) for gc in (host, client)]
+        if not all(r.get("moved") for r in res):
+            continue
+        occupied.add(p)
+        for gc in (host, client):
+            gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": sol["id"],
+                   "health": hp, "visible": True})
+        placed += 1
+    return placed
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=999983)
+    ap.add_argument("--slow-client", type=int, default=350,
+                    help="ms/frame on the client so its alien replay lags the host far "
+                         "enough to have stalled the pump to the legacy floor pre-fix")
+    ap.add_argument("--hp", type=int, default=35)
+    ap.add_argument("--sides", type=int, default=5)
+    ap.add_argument("--pairs", type=int, default=3,
+                    help="soldiers ambushed per side. Capped at 3 like corpse_mint: a "
+                         "bigger cluster overwhelms the item 4-5 casualty-value replay "
+                         "(a DIFFERENT phase's residual) and swamps the decouple signal")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48884, make_user_dir("adecouple_host", options=host_opts))
+    client = GameClient("client", 48885, make_user_dir("adecouple_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    backlog_seen = 0
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+        # coop (Phase 2c): enable_strict_burnin disables the display-only death ghost by
+        # default so this STATE-decoupling test measures raw per-seq state without the
+        # ghost's display-lag confound (see enable_strict_burnin).
+        SOAK.enable_strict_burnin(host, client)
+
+        corpses0 = len(corpses(client))
+        for side in range(args.sides):
+            placed = ambush(host, client, side, args.pairs, args.hp)
+            turn0 = bstate(host)["turn"]
+            SOAK.close_side(host, client, 0, 1, turn0)
+            # sample the client's display backlog while the alien side replays (the lag
+            # the residual needed); the slow client should open it.
+            for _ in range(6):
+                pc = client.cmd({"cmd": "parallel_state"})
+                backlog_seen = max(backlog_seen, pc.get("displayBacklog", 0),
+                                   pc.get("rxHold", 0))
+                time.sleep(0.3)
+            time.sleep(2)
+            print(f"  side {side} (turn {turn0}): ambushed {placed}, "
+                  f"corpses host={len(corpses(host))} client={len(corpses(client))}, "
+                  f"peak backlog seen={backlog_seen}")
+
+        SOAK.settle_display(host, client)
+        time.sleep(2)
+
+        sc = session.sync_check(host)
+        buckets = sc["buckets"]
+        def mm(b):
+            return buckets.get(b, {}).get("mismatchCount", 0)
+        core = mm("unitsCore")
+        comb = mm("unitsCombat")
+        items = mm("items")
+        idctr = mm("itemIdCtr")
+        corpses_now = len(corpses(client))
+
+        print("\n== VERDICT ==")
+        print(f"  unitsCore mismatchCount   = {core}")
+        print(f"  unitsCombat mismatchCount = {comb}")
+        print(f"  items mismatchCount       = {items}")
+        print(f"  itemIdCtr mismatchCount   = {idctr}")
+        print(f"  corpses minted this run   = {corpses_now - corpses0}")
+        print(f"  peak client display lag   = {backlog_seen}")
+
+        assert sc.get("strictBurnIn") is True, "strict-burnin lever not engaged - run vacuous"
+
+        # NON-VACUITY: the alien AI actually killed a cluster on a lagging client - the
+        # decoupled carriers were exercised while the display was busy.
+        if corpses_now - corpses0 < 4:
+            fails.append(f"VACUOUS: only {corpses_now - corpses0} corpse(s) minted - the "
+                         f"alien AI did not kill enough ambushed soldiers (try --seed/--hp)")
+
+        # THE FIX: the decoupled victim carriers land at packet-apply in chain order, so the
+        # liveness/position (unit_death) and wounds (hit_unit) buckets are clean at the alien
+        # ai/expl seqs. items/itemIdCtr (the corpse mint via after_unit_death) is covered by
+        # test_parallel_corpse_mint; the casualty-VALUE replay (heavy-cluster census) is the
+        # separate item 4-5 residual and is deliberately not asserted here.
+        if core:
+            fails.append(f"unitsCore straddled the alien side ({core}): a unit's liveness/"
+                         f"position lagged - unit_death did not apply at packet-apply")
+        if comb:
+            fails.append(f"unitsCombat straddled the alien side ({comb}): a victim's wounds "
+                         f"lagged - hit_unit did not apply at packet-apply")
+        print(f"  (items={items} itemIdCtr={idctr} - corpse-mint bucket, see corpse_mint test)")
+    except Exception as e:
+        fails.append(f"[ERROR] {e}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    if fails:
+        print("\n==== ITEM 5 B alien-death decoupling: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print("\n  PASS: alien-death decoupling COVERED - the parallel client applied every "
+          "death-chain victim carrier (hit_unit / unit_death / after_unit_death) at "
+          "packet-apply in chain order despite a lagging display, and unitsCore / "
+          "unitsCombat / items / itemIdCtr were strict-clean through every alien-side death")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_atomic_death.py b/tools/coop_test/test_parallel_atomic_death.py
new file mode 100644
index 000000000..e0066de6f
--- /dev/null
+++ b/tools/coop_test/test_parallel_atomic_death.py
@@ -0,0 +1,498 @@
+"""Parallel battlescape "atomic unit death" rework, Phase 2b: the CLIENT atomic
+apply of `unit_casualty` + the pump wiring + the same-build RED lever.
+
+THE MECHANISM UNDER TEST. Phase 2a made the parallel HOST ship one
+`unit_casualty` packet per casualty (UnitDieBState::deinit) instead of the
+legacy `unit_death` (init) / `after_unit_death` (deinit) pair. Phase 2b makes
+the parallel CLIENT actually consume it:
+
+  * connectionTCP.cpp's `unit_casualty` handler: unit lookup, the rank-2
+    per-unit state watermark (BattleUnit::coopStateAccept), abortPathCoop, the
+    bystander-morale apply, then dispatches to...
+  * BattlescapeGame::coopApplyCasualty: the ordered, ATOMIC apply of every
+    field on the packet - stats, position, kill attribution, status, the
+    corpse/world mutation keyed on the host's corpse-mint mode (0=on-tile,
+    1=carried, 2=overKill, 3=none/respawn) - all in ONE pass on the bookkeeping
+    clock, so the previous "unit_death now, after_unit_death later" straddle
+    (the transient window a mid-chain census could catch the victim standing on
+    stale pre-hit stats or fully dead with no corpse yet) cannot happen. A
+    CoopDeathGhost STUB is queued at the end (Phase 2c wires the actual death
+    ANIMATION off it; here the corpse/kit simply appear complete at apply).
+
+  * The pump: `unit_casualty` joins the seq-gated chain-outcome whitelist
+    (coopIsChainOutcomePacket) and the alien/neutral-side decoupled world
+    carrier set (coopDecoupledWorldCarrier) exactly like its legacy
+    predecessors - so an ALIEN-side casualty applies at packet-apply despite a
+    busy display, while a PLAYER-side casualty waits for display idle (the
+    ordered gate) and applies after the client's own shot replay.
+
+  * The RED lever (`atomic_death_disable`, same build): the HOST falls back to
+    sending the legacy unit_death/after_unit_death trio, and the CLIENT's
+    legacy-handler early-returns stand down so it processes the trio again -
+    reproducing the pre-atomic transient straddle for comparison.
+
+SCENARIO. Explicit, single-target casualties are staged against SOLDIERS
+(never aliens) while it is still the FIRST PLAYER SIDE, so they exercise the
+ORDERED (non-decoupled) apply path and never compete with the alien-side
+ambush for the fixture's scarce (>=3) hostile population:
+
+  * a PLAYER-SIDE kill    - a weakened soldier shot dead by a squadmate
+                             (mode 0, on-tile corpse mint).
+  * an OVERKILL            - `kill_unit_real`'s +1000 raw damage on a soldier
+                             (mode 2, no corpse - the wire-level effect a
+                             blaster/heavy launcher produces is identical:
+                             `_overKill` true, no corpse minted. Substituted
+                             for a live blaster shot, which is fragile terrain-
+                             dependent staging orthogonal to what this phase
+                             tests - the atomic apply of the resulting
+                             packet, not blast mechanics).
+  * a KNOCKOUT              - a stun-rod melee hit (mode 0, corpse mint,
+                             STATUS_UNCONSCIOUS instead of DEAD).
+
+Then several ALIEN-side ambush kills (test_parallel_alien_death_decouple's
+`ambush` - weakened soldiers placed next to live aliens, killed by the alien
+AI during the alien turn) exercise the DECOUPLED apply path under
+--strict-burnin (the five buckets compare at EVERY seq, not just side-gated
+boundaries).
+
+DEBRIEF-IDENTICAL SUBSTITUTE. A full mission-ending DebriefingState compare
+(see test_coop_debrief_sync.py) needs a dedicated custom-ruleset battle and
+routinely costs well over a minute on its own - outside this phase's <180s /
+2-3-alien-turn budget, and orthogonal to what Phase 2b is responsible for
+(coopApplyCasualty applies obj["killedBy"]/["murdererId"] verbatim; it does
+not compute DebriefingState's score). DebriefingState's STR_ALIENS_KILLED tally
+is `oldFaction==HOSTILE && killedBy()==PLAYER` over each machine's own save, so
+identical per-unit (status, killedBy, murdererId) attribution on both machines
+for every casualty IS the invariant a debrief compare would be reading -
+that is what is asserted here instead.
+
+Asserts (same build, two separate invocations - "ONCE green, ONCE red"):
+  GREEN (default, atomic path ON):
+    - the five buckets (terrain/unitsCore/items/itemIdCtr/unitsCombat) stay 0
+      through the whole run (strict-burnin: every seq, not just boundaries)
+    - casualtiesApplied (client) >= midSideDeaths (host) - every MID-SIDE host
+      casualty produced an applied `unit_casualty` (midSideDeaths is a floor:
+      it deliberately excludes boundary-phase deaths, e.g. a fatally-wounded
+      ambush victim bleeding out at the side close, which also ship and must
+      apply their own `unit_casualty`) - and casualtiesRejected==0 (the rank-2
+      watermark never rejected a live casualty on this clean run)
+    - corpse (id, type) census + itemIdCounter/battleCensus identical
+    - corpseReplayArmed/corpseRemapArmed on the client are UNCHANGED from their
+      pre-battle value (0) - the atomic path never arms those legacy mint-at-
+      apply windows
+    - per-unit (status, killedBy, murdererId) attribution identical on both
+      machines for every casualty (the debrief-identical substitute)
+    - the three staged outcomes (player-kill DEAD/mode 0, overkill DEAD/mode 2
+      i.e. no corpse, knockout UNCONSCIOUS/mode 0) actually happened
+  RED (--red, `atomic_death_disable` on BOTH machines -> legacy trio):
+    - casualtiesApplied never moves past its pre-lever baseline (a battle-start
+      hidden-explosion casualty, if any, can legitimately apply before the
+      lever engages - see the baseline capture in main()) - the new handler
+      never runs for anything staged or ambushed after that point
+    - the five buckets show a non-zero straddle SOMEWHERE in the run (the
+      known pre-atomic transient - retry-tolerant: reported as a sum over the
+      whole run rather than asserted at a specific seq)
+
+Run:  python tools/coop_test/test_parallel_atomic_death.py [--seed N]
+                 [--slow-client MS] [--hp N] [--pairs N] [--sides N] [--red]
+Exit 0 = the expected verdict for the selected mode held; 2 = it did not.
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+import test_parallel_alien_death_decouple as AD
+
+PORT = "48008"
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+STATUS_DEAD = 6
+STATUS_UNCONSCIOUS = 7
+FACTION_PLAYER = 0
+FACTION_HOSTILE = 1
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+def units_by_id(gc):
+    return {u["id"]: u for u in bstate(gc)["units"]}
+
+
+def attribution(gc):
+    """{unit id: (status, killedBy, murdererId)} for every unit that isOut() -
+    the per-unit inputs DebriefingState's kill tally reads."""
+    return {u["id"]: (u["status"], u.get("killedBy"), u.get("murdererId"))
+            for u in bstate(gc)["units"] if u.get("isOut")}
+
+
+def live_soldiers(gc):
+    return [u for u in bstate(gc)["units"]
+            if u.get("faction") == FACTION_PLAYER and not u.get("isOut")]
+
+
+def find_adjacent_pair(units):
+    """Two units from `units` already standing next to each other (Chebyshev
+    distance 1, same z), or None. The starting squad is cramped around the
+    dropship, so a melee scenario is staged against an EXISTING neighbour
+    rather than by teleporting one in - trying to free up an adjacent tile in
+    that cluster routinely fails (every neighbour already occupied)."""
+    for i, a in enumerate(units):
+        for b in units[i + 1:]:
+            if a["z"] == b["z"] and max(abs(a["x"] - b["x"]), abs(a["y"] - b["y"])) == 1:
+                return a["id"], b["id"]
+    return None
+
+
+def give_both(host, client, uid, item, ammo=None):
+    wid = None
+    for gc in (host, client):
+        req = {"cmd": "battle_give", "unit": uid, "item": item,
+               "slot": "right", "clear_hands": True}
+        if ammo:
+            req["ammo"] = ammo
+        r = gc.ok(req)
+        wid = r["weaponId"]
+    return wid
+
+
+def poll(fn, timeout, interval=0.2):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        v = fn()
+        if v:
+            return v
+        time.sleep(interval)
+    return fn()
+
+
+# ---- the three explicit, single-target casualties (all against SOLDIERS, all
+# staged while it is still the FIRST PLAYER SIDE - see module docstring) ------
+
+def stage_player_kill(host, client, used, tries=3):
+    """A soldier shot dead by a squadmate: an ordinary death, applied on the
+    ORDERED (non-decoupled) gate because it happens while side==FACTION_PLAYER
+    (whether or not the shot happens to overkill does not matter here - the
+    overkill code path is exercised deterministically, and separately, by
+    stage_overkill). No teleport: the starting squad is clustered near the
+    dropship, well within a heavy plasma's range/LOS of itself; a single aimed
+    shot is decisive so no rapid re-fire into a chain still closing is needed
+    (each retry - only for a miss - waits for both machines to fully settle
+    first). `used` is a set of unit ids already claimed by another staged
+    scenario - never reused. Returns the victim's unit id, or None if the
+    fixture could not stage it."""
+    live = [u for u in live_soldiers(host) if u["id"] not in used]
+    if len(live) < 2:
+        return None
+    shooter, victim = live[0]["id"], live[1]["id"]
+    used.add(shooter); used.add(victim)
+    wid = give_both(host, client, shooter, "STR_HEAVY_PLASMA", "STR_HEAVY_PLASMA_CLIP")
+    for _ in range(tries):
+        vu = next((u for u in bstate(host)["units"] if u["id"] == victim), None)
+        if vu is None or vu.get("isOut"):
+            return victim
+        host.cmd({"cmd": "battle_action", "action": "set_stat", "unit": shooter,
+                  "stat": "tu", "value": 200})
+        r = host.cmd({"cmd": "battle_fire", "unit": shooter, "mode": "aimed",
+                      "weapon_id": wid, "tu": 200, "target": victim})
+        if not r.get("ok"):
+            print(f"  DEBUG player-kill: shot failed: {r.get('error')}")
+        SOAK.settle_display(host, client, timeout=30)
+    vu = next((u for u in bstate(host)["units"] if u["id"] == victim), None)
+    return victim if (vu and vu.get("isOut")) else None
+
+
+def stage_overkill(host, used):
+    """`kill_unit_real` on a soldier: +1000 raw AP damage always overkills
+    (mode 2, no corpse) - the wire-level effect a blaster/heavy launcher
+    produces on the victim's `unit_casualty` is identical; see module
+    docstring for why a live blast is not staged here. Returns the victim id,
+    or None."""
+    live = [u for u in live_soldiers(host) if u["id"] not in used]
+    if len(live) < 1:
+        return None
+    victim = live[0]["id"]
+    used.add(victim)
+    r = host.cmd({"cmd": "battle_action", "action": "kill_unit_real", "unit": victim})
+    if victim not in r.get("killed", []):
+        return None
+    return victim
+
+
+def stage_knockout(host, client, used, tries=5):
+    """A stun-rod melee hit against an EXISTING neighbour in the starting
+    cluster (see find_adjacent_pair): STR_STUN_ROD deals ~0 real damage, only
+    stun, so the victim goes UNCONSCIOUS (mode 0, corpse mint) rather than
+    DEAD. Returns the victim id, or None."""
+    pair = find_adjacent_pair([u for u in live_soldiers(host) if u["id"] not in used])
+    if not pair:
+        return None
+    striker, victim = pair
+    used.add(striker); used.add(victim)
+    wid = give_both(host, client, striker, "STR_STUN_ROD")
+    for _ in range(tries):
+        vu = next((u for u in bstate(host)["units"] if u["id"] == victim), None)
+        if vu is None or vu.get("isOut"):
+            break
+        host.cmd({"cmd": "battle_action", "action": "set_stat", "unit": striker,
+                  "stat": "tu", "value": 100})
+        r = host.cmd({"cmd": "battle_fire", "unit": striker, "mode": "hit",
+                      "weapon_id": wid, "tu": 100, "target": victim})
+        if not r.get("ok"):
+            print(f"  DEBUG knockout: hit failed: {r.get('error')}")
+            break
+        SOAK.settle_display(host, client, timeout=30)
+        vu2 = next((u for u in bstate(host)["units"] if u["id"] == victim), None)
+        if vu2 and vu2.get("isOut"):
+            return victim
+    return None
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=13371337)
+    ap.add_argument("--slow-client", type=int, default=300,
+                    help="ms/frame on the client so its alien replay lags the host far "
+                         "enough to exercise the decoupled apply while the display is busy. "
+                         "NOTE for --red: a bigger cluster (higher --pairs/--sides) or a "
+                         "slower client reproduces the pre-atomic straddle more reliably, but "
+                         "far enough over and it also opens the SEPARATE, already-documented "
+                         "'casualty-value replay under a heavy cluster' residual (see "
+                         "test_parallel_alien_death_decouple.py / test_parallel_corpse_mint.py) "
+                         "- a different, pre-existing defect this phase does not touch. The "
+                         "GREEN defaults below are chosen to stay clear of that residual; a RED "
+                         "run can safely turn the intensity up (e.g. --slow-client 900 --pairs "
+                         "3 --sides 3) since RED does not need bucket-clean, only non-vacuous.")
+    ap.add_argument("--hp", type=int, default=35,
+                    help="ambushed-soldier health (moderate: killed, not overkilled)")
+    ap.add_argument("--pairs", type=int, default=2,
+                    help="soldiers ambushed per alien side")
+    ap.add_argument("--sides", type=int, default=2,
+                    help="alien sides to run the ambush through")
+    ap.add_argument("--red", action="store_true",
+                    help="RED: set parallel_state {atomic_death_disable:true} on BOTH "
+                         "machines - the host falls back to unit_death/after_unit_death "
+                         "and the client processes the legacy trio again")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48940, make_user_dir("atomicdeath_host", options=host_opts))
+    client = GameClient("client", 48941, make_user_dir("atomicdeath_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    cas_applied = cas_rejected = 0
+    mid_deaths = 0
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+
+        # parallel_state must carry the Phase 2b fields or the exe predates this build.
+        pc = parallel(client)
+        for f in ("casualtiesApplied", "casualtiesRejected", "atomicDeathDisable"):
+            assert f in pc, (
+                f"parallel_state carries no `{f}` - bin/x64/Release/OpenXcom.exe predates "
+                f"the Phase 2b build; rebuild it (serial, MP=false). fields: {sorted(pc)}")
+
+        SOAK.enable_strict_burnin(host, client)
+
+        if args.red:
+            for gc, tag in ((host, "host"), (client, "client")):
+                gc.cmd({"cmd": "parallel_state", "atomic_death_disable": True})
+                r = parallel(gc)
+                assert r.get("atomicDeathDisable") is True, f"{tag}: lever did not engage: {r}"
+            print("== RED: atomic_death_disable ON on BOTH machines (legacy trio) ==")
+        else:
+            print("== GREEN: atomic unit_casualty path ON ==")
+
+        # Baseline AFTER the lever engages (RED) / at the same point (GREEN): a
+        # battle's ctor runs its own boundary-phase checkForCasualties pass for
+        # battle-start hidden explosions (UFO power source etc.) during bring-up,
+        # BEFORE the harness has a chance to touch the lever - so on a RED run that
+        # one casualty can legitimately apply via the (still default-on) atomic path.
+        # The RED assertion below reads the DELTA from this baseline, not the raw
+        # counter, so that harmless pre-existing casualty never pollutes it.
+        cas_baseline = parallel(client).get("casualtiesApplied", 0)
+
+        b0 = bstate(client)
+        corpse_arm0 = b0.get("corpseReplayArmed"), b0.get("corpseRemapArmed")
+        corp0 = len(corpses(client))
+        assert b0.get("corpseRemapArmed") is not None, \
+            "battle_state carries no corpseRemapArmed - the item-3 introspection is missing"
+
+        print("\n-- staging the three explicit player-side casualties (side==PLAYER) --")
+        used_soldiers = set()
+        pk_id = stage_player_kill(host, client, used_soldiers)
+        ok_id = stage_overkill(host, used_soldiers)
+        SOAK.settle_display(host, client, timeout=30)
+        ko_id = stage_knockout(host, client, used_soldiers)
+        print(f"  player-kill victim={pk_id} overkill victim={ok_id} knockout victim={ko_id}")
+
+        SOAK.settle_display(host, client, timeout=30)
+        time.sleep(2)
+        outcomes = {}
+        for tag, uid, want_status in (("player-kill", pk_id, STATUS_DEAD),
+                                       ("overkill", ok_id, STATUS_DEAD),
+                                       ("knockout", ko_id, STATUS_UNCONSCIOUS)):
+            if uid is None:
+                outcomes[tag] = None
+                continue
+            hu = units_by_id(host).get(uid, {})
+            cu = poll(lambda: units_by_id(client).get(uid) if
+                      units_by_id(client).get(uid, {}).get("isOut") else None, 30)
+            cu = cu or units_by_id(client).get(uid, {})
+            outcomes[tag] = (hu.get("status"), cu.get("status"))
+            print(f"  {tag}: unit {uid} status host={hu.get('status')} "
+                  f"client={cu.get('status')} (want {want_status})")
+
+        print("\n-- alien-side ambush (decoupled apply path) --")
+        for side in range(args.sides):
+            if not bstate(host).get("inBattle"):
+                print(f"  mission ended before side {side}"); break
+            placed = AD.ambush(host, client, side, args.pairs, args.hp)
+            turn0 = bstate(host)["turn"]
+            SOAK.close_side(host, client, 0, 1, turn0)
+            time.sleep(1)
+            print(f"  side {side} (turn {turn0}): ambushed {placed}, corpses "
+                  f"host={len(corpses(host))} client={len(corpses(client))}")
+
+        SOAK.settle_display(host, client)
+        time.sleep(2)
+
+        sc = session.sync_check(host)
+        buckets = {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+        total = sum(buckets.values())
+        ph = parallel(host)
+        pcl = parallel(client)
+        cas_applied = pcl.get("casualtiesApplied", 0)
+        cas_rejected = pcl.get("casualtiesRejected", 0)
+        mid_deaths = ph.get("midSideDeaths", 0)
+        cb = bstate(client)
+        corpse_arm1 = cb.get("corpseReplayArmed"), cb.get("corpseRemapArmed")
+        ah, ac = attribution(host), attribution(client)
+        attr_bad = {uid: (ah.get(uid), ac.get(uid)) for uid in set(ah) | set(ac)
+                    if ah.get(uid) != ac.get(uid)}
+
+        print("\n== VERDICT ==")
+        print(f"  five-bucket = {buckets} (sum {total})")
+        print(f"  casualtiesApplied={cas_applied} (pre-lever baseline={cas_baseline}) "
+              f"casualtiesRejected={cas_rejected} midSideDeaths(host)={mid_deaths}")
+        print(f"  corpseReplayArmed/RemapArmed: pre-battle={corpse_arm0} now={corpse_arm1}")
+        print(f"  corpses grown by {len(corpses(client)) - corp0}")
+        if attr_bad:
+            print(f"  attribution mismatches: {attr_bad}")
+
+        if args.red:
+            if total == 0:
+                fails.append("VACUOUS RED: the legacy-trio run produced ZERO five-bucket "
+                             "mismatches - the pre-atomic straddle was not reproduced "
+                             "(try a slower --slow-client / another --seed)")
+            else:
+                print(f"  RED straddle reproduced (sum {total}) over the whole run.")
+            if cas_applied != cas_baseline:
+                fails.append(f"RED: expected casualtiesApplied to stay at its pre-lever "
+                             f"baseline ({cas_baseline}) - the atomic handler must never run "
+                             f"under atomic_death_disable - got {cas_applied}")
+        else:
+            for tag, uid, want_status in (("player-kill", pk_id, STATUS_DEAD),
+                                           ("overkill", ok_id, STATUS_DEAD),
+                                           ("knockout", ko_id, STATUS_UNCONSCIOUS)):
+                if uid is None:
+                    fails.append(f"VACUOUS: could not stage the {tag} scenario "
+                                 f"(too few live soldiers in the fixture)")
+                    continue
+                hs, cs = outcomes[tag]
+                if hs != want_status or cs != want_status:
+                    fails.append(f"{tag}: expected status {want_status} on both machines, "
+                                 f"got host={hs} client={cs}")
+
+            if mid_deaths < 3:
+                fails.append(f"VACUOUS: only {mid_deaths} host death(s) - the ambush and/or "
+                             f"the staged casualties did not produce enough deaths to "
+                             f"exercise the atomic apply (try --seed/--hp/--pairs)")
+            # `midSideDeaths` is a FLOOR, not the total: it deliberately excludes
+            # boundary-phase deaths (a fatally-wounded ambush victim bleeding out at
+            # the side close, still seq-0/bnd:true - see UnitDieBState::init), and
+            # those ALSO ship (and must apply) a `unit_casualty`. So every mid-side
+            # death must have been applied, but casualtiesApplied can legitimately
+            # exceed midSideDeaths by however many boundary deaths this run had.
+            if cas_applied < mid_deaths:
+                fails.append(f"casualtiesApplied ({cas_applied}) < host mid-side death count "
+                             f"midSideDeaths ({mid_deaths}) - the client did not apply every "
+                             f"mid-side unit_casualty")
+            if cas_rejected:
+                fails.append(f"casualtiesRejected={cas_rejected} on the atomic path - the "
+                             f"rank-2 watermark rejected a live casualty (should be 0 on a "
+                             f"clean, non-duplicated run)")
+            bad = {b: v for b, v in buckets.items() if v > 0}
+            if bad:
+                fails.append(f"five-bucket mismatch {bad} FIRED on the atomic path.\n    "
+                             f"{session._sync_mismatch_lines(sc)}")
+            hc, cc = corpses(host), corpses(client)
+            if hc != cc:
+                fails.append(f"corpse censuses differ: host {hc} vs client {cc}")
+            h, c = session.battle_checksum(host), session.battle_checksum(client)
+            if h[0] != c[0]:
+                fails.append(f"item-id counters differ: host {h[0]} vs client {c[0]}")
+            if h[1] != c[1]:
+                fails.append(f"battle censuses differ: host {h[1]} vs client {c[1]}")
+            if corpse_arm1 != corpse_arm0:
+                fails.append(f"corpseReplayArmed/corpseRemapArmed moved from {corpse_arm0} "
+                             f"to {corpse_arm1} - the atomic path armed a legacy mint-at-"
+                             f"apply window it should never touch")
+            if attr_bad:
+                fails.append(f"kill attribution diverged (the debrief-identical substitute): "
+                             f"{attr_bad}")
+            for gc, tag in ((host, "host"), (client, "client")):
+                if TW.desync_seen(gc):
+                    fails.append(f"the PRD-P2 drift tripwire FIRED on the {tag}")
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    mode = "RED (atomic_death_disable)" if args.red else "GREEN (atomic path ON)"
+    if fails:
+        print(f"\n==== atomic unit death Phase 2b [{mode}]: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print(f"\n  PASS [{mode}]: casualtiesApplied={cas_applied} casualtiesRejected="
+          f"{cas_rejected} midSideDeaths={mid_deaths}")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_boundary_barrier.py b/tools/coop_test/test_parallel_boundary_barrier.py
new file mode 100644
index 000000000..d5491d1cd
--- /dev/null
+++ b/tools/coop_test/test_parallel_boundary_barrier.py
@@ -0,0 +1,348 @@
+"""Parallel battlescape "atomic unit death" rework, Phase 3 Sub-task C: the
+boundary APPLY-BARRIER wire-order proof for `bnd:true` casualties.
+
+THE QUESTION UNDER TEST. A boundary-phase casualty (a unit that bleeds/burns
+out exactly at a side close, inside SavedBattleGame::prepareNewTurn) ships its
+`unit_casualty` with `bnd:true` + `side_seq`, but deliberately carries NO
+`action_seq` (UnitDieBState::deinit - the boundary chain is unopened, so
+connectionTCP::coopStampChainSeq is a no-op there). The chain-atomicity apply
+barrier (connectionTCP.cpp's `barrierBlocked`, guarding the `action_end`
+marker) tracks `minDeferredChainSeqThisPass`, which is fed ONLY by packets
+carrying a non-zero `action_seq` (see the `if (pSeq != 0)` guard around the
+deferred-tracking code). A `bnd:true` casualty therefore does NOT feed that
+tracker - so IF it were ever deferred (held back a pass because the display
+was busy) at the exact moment the boundary `action_end`/`endTurn` marker that
+follows it on the wire is otherwise admissible, the barrier would not know to
+hold the marker for it, and the marker could apply first: a boundary hash
+sampled before its own casualty landed.
+
+The task plan's own analysis is that this likely already holds without a
+product change: a `bnd` casualty is admitted either by `coopDecoupledWorldCarrier`
+(alien/neutral-side close - unconditional, no idle wait) or by the ordinary
+`gateAllows` idle path (`coopTaskCompleted()`) on a player-side close, which is
+the SAME idle gate the boundary marker itself needs (neither has a dedicated
+whitelist entry), and the wire is FIFO - so as long as nothing lets the marker
+skip AHEAD of the casualty already sitting in front of it in the queue, order
+is preserved by construction, no seq needed. This fixture is the VERIFICATION:
+it reproduces a boundary bleed-out under an artificially slow (backlogged)
+client - the condition most likely to expose a reordering, if one exists - and
+reads connectionTCP's `rxTrace` (parallel_state {trace:true}), which records
+every packet in the exact order the client's pump actually consumed it
+(rxTraceRecord, right before onTCPMessage()). If the casualty's `unit_casualty`
+trace entry has a LOWER seq than the boundary marker's, order held. If not,
+Sub-task C's `barrierBlocked` extension is needed (see the module docstring
+note left in connectionTCP.cpp's chain-atomicity apply-barrier comment for
+where it would go - NOT applied by this file, which only asserts).
+
+SCENARIO. Mint-free lethal condition (`set_stat` health=1 + fatalWounds), like
+repro_boundary_death.py, staged on soldiers so the boundary is a PLAYER-side
+close (`coopDecoupledWorldCarrier` requires side != FACTION_PLAYER, so a
+soldier's own boundary casualty is the ordinary-gate case the barrier actually
+needs to cover - the alien/neutral case is unconditional and uninteresting
+here). A slow client widens the window in which the display could still be
+busy (backlogged) when the casualty and the marker both arrive, which is the
+only window in which a reordering could occur at all.
+
+Asserts, after the boundary settles:
+  - the boundary was non-vacuous (>=1 corpse minted, matching repro_boundary_death)
+  - the client's rxTrace shows >=1 `unit_casualty` entry for a staged victim
+  - the client's rxTrace shows >=1 `action_end`/`endTurn` entry after staging
+  - for every such marker, every staged victim's `unit_casualty` trace seq is
+    LOWER (applied first) - the wire-order proof
+  - Strand-B `sideBarrierHolds`/`sideBarrierReleases` still balance (no new
+    wedge: a release for every hold, same invariant test_parallel_soak reads)
+  - the five buckets stay clean at the boundary (same coverage repro_boundary_death
+    already asserts, kept here as a sanity floor)
+
+Run:  python tools/coop_test/test_parallel_boundary_barrier.py [--seed N]
+                 [--wounds N] [--victims N] [--slow-client MS]
+Exit 0 = wire order held (or the whole run was inconclusive-safe); 2 = a
+boundary-marker-ahead-of-casualty reorder was OBSERVED, or another failure.
+"""
+import argparse
+import os
+import sys
+import threading
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "48043"
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+class TracePoller:
+    """Background poll of the CLIENT's rxTrace (parallel_state {trace:true}),
+    accumulating every entry it has seen by `seq` (the ring buffer holds only
+    the last 256 - polling at a steady clip keeps the fixture's window well
+    under that between snapshots). One entry per packet the pump actually
+    handed to onTCPMessage(), in APPLICATION order - the exact thing this test
+    needs to read wire-apply order back."""
+
+    def __init__(self, client, interval=0.1):
+        self.client = client
+        self.interval = interval
+        self.entries = {}  # seq -> {"state":..., "unit":...}
+        self._stop = threading.Event()
+        self._thread = threading.Thread(target=self._run, daemon=True)
+
+    def _run(self):
+        while not self._stop.is_set():
+            try:
+                tr = self.client.cmd({"cmd": "parallel_state", "trace": True,
+                                       "traceLimit": 256}).get("rxTrace", [])
+                for e in tr:
+                    self.entries[e["seq"]] = e
+            except Exception:
+                pass
+            time.sleep(self.interval)
+
+    def start(self):
+        self._thread.start()
+
+    def stop(self, join_timeout=5):
+        self._stop.set()
+        self._thread.join(timeout=join_timeout)
+        # one final synchronous snapshot so the last few packets of the
+        # settle window (after the poll thread's last tick) are not missed
+        try:
+            tr = self.client.cmd({"cmd": "parallel_state", "trace": True,
+                                   "traceLimit": 256}).get("rxTrace", [])
+            for e in tr:
+                self.entries[e["seq"]] = e
+        except Exception:
+            pass
+
+    def ordered(self):
+        return [self.entries[s] for s in sorted(self.entries)]
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=91091091)
+    ap.add_argument("--wounds", type=int, default=1)
+    ap.add_argument("--victims", type=int, default=2)
+    ap.add_argument("--slow-client", type=int, default=700,
+                     help="ms/frame on the client - deliberately slow, to widen the "
+                          "window in which the display could still be busy when the "
+                          "casualty and the boundary marker both arrive (the only "
+                          "window a reordering could occur in at all)")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48960, make_user_dir("bndbarrier_host", options=host_opts))
+    client = GameClient("client", 48961, make_user_dir("bndbarrier_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    poller = None
+    # GameClient.cmd() is one blocking request/response round-trip on a single
+    # socket with no locking (harness.py's _send: sendall then read-until-\n).
+    # The background TracePoller below issues `client.cmd()` calls from a
+    # second thread while the main thread is ALSO driving `client` through
+    # SOAK.close_side/PE.wait_side - unguarded, that is two threads racing the
+    # same socket, and a poll's response can be read back as the main thread's
+    # answer to an unrelated command (observed: get_state's response body came
+    # back as the trace response, `KeyError: 'states'`). Wrap the instance
+    # method in a lock so every command against `client`, from either thread,
+    # is a complete request/response pair before the next one starts.
+    client_lock = threading.Lock()
+    _orig_client_cmd = client.cmd
+    def _locked_client_cmd(obj, _orig=_orig_client_cmd, _lock=client_lock):
+        with _lock:
+            return _orig(obj)
+    client.cmd = _locked_client_cmd
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False
+
+        pc = parallel(client)
+        for f in ("sideBarrierHolds", "sideBarrierReleases"):
+            assert f in pc, (
+                f"parallel_state carries no `{f}` - bin/x64/Release/OpenXcom.exe predates "
+                f"this build; rebuild it (serial, MP=false). fields: {sorted(pc)}")
+
+        sb0 = parallel(client)
+        holds0, releases0 = sb0.get("sideBarrierHolds", 0), sb0.get("sideBarrierReleases", 0)
+        hard0 = sb0.get("sideBarrierHardReleases", 0)
+
+        # PLAYER-side victims (coopDecoupledWorldCarrier requires side != PLAYER -
+        # a soldier's own boundary death is the ordinary-gate case, see docstring).
+        pool = [u for u in bstate(host)["units"]
+                if u.get("faction") == 0 and not u.get("isOut")]
+        keep = 1  # keep >=1 soldier alive so the battle survives
+        victims = pool[:max(1, min(args.victims, len(pool) - keep))]
+        victim_ids = [v["id"] for v in victims]
+        print(f"victims: {victim_ids} (of {len(pool)} live soldiers)")
+        assert victim_ids, "VACUOUS: no soldier victims available to stage"
+
+        poller = TracePoller(client, interval=0.1)
+        poller.start()
+        baseline_seq = max(poller.entries) if poller.entries else 0
+        time.sleep(0.3)
+        if poller.entries:
+            baseline_seq = max(baseline_seq, max(poller.entries))
+
+        # mint-free lethal condition on BOTH machines, all victims (set_stat is a
+        # direct local RPC lever on each machine, not a wire packet - see
+        # repro_boundary_death.py; the wire only carries the boundary's own
+        # unit_casualty/action_end traffic during the window this test reads).
+        for victim in victims:
+            req = {"cmd": "battle_action", "action": "set_stat", "unit": victim["id"],
+                   "health": 1, "fatalWounds": args.wounds}
+            for gc in (host, client):
+                gc.ok(dict(req))
+
+        turn0 = bstate(host)["turn"]
+        print(f"\n== closing turn {turn0} (soldier(s) bleed out at player-side close) ==")
+        SOAK.close_side(host, client, 0, 1, turn0)
+        # let the (slow) client's death replay drain and report the boundary hash
+        sc = session.sync_check(host)
+        deadline = time.time() + 60
+        while time.time() < deadline:
+            sc = session.sync_check(host)
+            v = next((u for u in bstate(host)["units"] if u["id"] == victim_ids[0]), None)
+            cv = next((u for u in bstate(client)["units"] if u["id"] == victim_ids[0]), None)
+            if v and v.get("isOut") and cv and cv.get("isOut"):
+                break
+            time.sleep(0.5)
+        time.sleep(2)
+
+        poller.stop()
+        trace = poller.ordered()
+        post = [e for e in trace if e["seq"] > baseline_seq]
+        print(f"\n== trace: {len(trace)} total entries, {len(post)} after baseline seq {baseline_seq} ==")
+        for e in post:
+            print(f"    seq={e['seq']:4d} state={e['state']:16s} unit={e['unit']:>9} "
+                  f"boundary={e.get('boundary')} kind={e.get('kind')!r}")
+
+        # `boundary` (added to rxTrace for this fixture) is the packet's own
+        # `boundary` key (action_end's true sync-check hash marker) OR'd with
+        # its `bnd` key (unit_casualty's boundary-phase flag) - the two never
+        # coexist on the same packet, so one field disambiguates both. Without
+        # it, "any action_end/endTurn after baseline" is the WRONG marker set:
+        # a side that has already cycled player->alien->neutral by the time
+        # this fixture reads the boundary bleed-out has several ordinary mid-
+        # side chain closers of the same state name in between (measured: 17
+        # of them on one run, none related to this boundary at all).
+        #
+        # `kind` (also added) further narrows it: connectionTCP::coopArmSyncBoundary
+        # has exactly two callers - "endturn" (the side-CLOSE phase group,
+        # BattlescapeGame.cpp) and "sidestart" (prepareNewTurn, NextTurnState.cpp).
+        # Fatal-wound bleed-out is computed IN prepareNewTurn, so a `bnd` casualty's
+        # own boundary hash point is the "sidestart" marker that follows it, never
+        # the "endturn" one - a full side cycle ships one of EACH kind, and the
+        # "endturn" one (which closes the PREVIOUS side, before prepareNewTurn even
+        # ran) legitimately precedes the casualty with no bearing on this proof
+        # (measured: an unrelated "endturn" 6 trace entries ahead of the casualty,
+        # on a run where "sidestart" - the one that actually matters - came after).
+        casualty_seq = {}
+        for e in post:
+            if (e["state"] == "unit_casualty" and e.get("boundary") and
+                    e["unit"] in victim_ids and e["unit"] not in casualty_seq):
+                casualty_seq[e["unit"]] = e["seq"]
+        marker_seqs = [e["seq"] for e in post
+                       if e["state"] in ("action_end", "endTurn") and e.get("boundary")
+                       and e.get("kind") == "sidestart"]
+
+        print(f"\n  bnd casualty trace seqs: {casualty_seq}")
+        print(f"  TRUE 'sidestart' boundary marker trace seqs: {marker_seqs}")
+
+        hcorp, ccorp = corpses(host), corpses(client)
+        h, c = session.battle_checksum(host), session.battle_checksum(client)
+        sb1 = parallel(client)
+        holds1, releases1 = sb1.get("sideBarrierHolds", 0), sb1.get("sideBarrierReleases", 0)
+        hard1 = sb1.get("sideBarrierHardReleases", 0)
+
+        reorder_evidence = []
+        if not casualty_seq:
+            fails.append("VACUOUS: no unit_casualty trace entry seen for any staged "
+                          "victim after the baseline - the boundary death did not "
+                          "produce/apply a casualty packet (try --wounds/--seed)")
+        elif not marker_seqs:
+            fails.append("VACUOUS: no action_end/endTurn trace entry seen after the "
+                          "baseline - the side-close marker never applied "
+                          "(the fixture did not actually cross a boundary)")
+        else:
+            for uid, cseq in casualty_seq.items():
+                bad_markers = [m for m in marker_seqs if m < cseq]
+                if bad_markers:
+                    reorder_evidence.append(
+                        f"victim {uid}: unit_casualty applied at trace seq {cseq}, but "
+                        f"a boundary marker already applied EARLIER at seq {bad_markers} "
+                        f"- the marker jumped ahead of its own boundary casualty")
+            if len(casualty_seq) < len(victim_ids):
+                missing = set(victim_ids) - set(casualty_seq)
+                print(f"  NOTE: {missing} did not bleed out (non-fatal to the ordering "
+                      f"proof for the ones that did)")
+
+        if reorder_evidence:
+            fails.extend(reorder_evidence)
+
+        if hcorp != ccorp:
+            fails.append(f"corpse censuses differ: host {hcorp} vs client {ccorp}")
+        if h[0] != c[0]:
+            fails.append(f"item-id counters differ: host {h[0]} vs client {c[0]}")
+        if h[1] != c[1]:
+            fails.append(f"battle censuses differ: host {h[1]} vs client {c[1]}")
+        if (holds1 - holds0) != ((releases1 - releases0) + (hard1 - hard0)):
+            fails.append(f"Strand-B side barrier did not balance: holds +{holds1 - holds0} "
+                         f"vs releases +{releases1 - releases0} (+{hard1 - hard0} hard) "
+                         f"- a new wedge, not just an ordering question")
+
+        print("\n== VERDICT ==")
+        print(f"  sideBarrier: holds +{holds1 - holds0} releases +{releases1 - releases0} "
+              f"hard +{hard1 - hard0}")
+        print(f"  corpses: host={hcorp} client={ccorp}")
+
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        if poller is not None:
+            poller.stop()
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    if fails:
+        print(f"\n==== boundary apply-barrier (Sub-task C) wire-order proof: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print(f"\n  PASS: every staged boundary unit_casualty applied BEFORE the next "
+          f"action_end/endTurn marker in the client's actual apply order (rxTrace) - "
+          f"the apply barrier already covers bnd casualties without a product change")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_chain_order.py b/tools/coop_test/test_parallel_chain_order.py
new file mode 100644
index 000000000..9f702af37
--- /dev/null
+++ b/tools/coop_test/test_parallel_chain_order.py
@@ -0,0 +1,486 @@
+"""Explosion ordered-replay migration, Phase E2: host-ordered secondary
+detonations - the parallel CLIENT stops scanning/spawning chained secondaries
+locally and instead replays them from the host's `chain_detonation` stream, in
+the host's scan order.
+
+THE CHANGE. `ExplosionBState::explode()` member's chained-terrain block
+(`checkForTerrainExplosions()` + the `new ExplosionBState(...)` it spawns) used
+to run UNGATED on every machine, so a heavy cluster of already-charged
+secondaries (E0's `test_parallel_explosion_cluster.py` scaffold; 5C in
+`research_explosion_mutations.md`) could detonate in a DIFFERENT order on the
+host and the client - each machine's own whole-map scan is independent. E2
+wraps the whole block in `if (!_coopReplayDisplay)`: the parallel HOST still
+scans+spawns (and now ALSO ships one `chain_detonation {tile_pos_x/y/z,
+explosive, explosive_type}` per chained spawn, stamped via `coopStampChainSeq`
+- its successive scans ARE the order); the parallel CLIENT does neither and
+instead detonates secondaries from the ordered `chain_detonation` stream (new
+handler in connectionTCP.cpp, seq-gated via `coopIsChainOutcomePacket`, NOT
+whitelisted, NOT subject-keyed - same pump rules as `unit_casualty`). This also
+deletes the item-2 "stranded" hack (`coopChainedTerrainStranded`): it only ever
+fired on a parallel client's OWN scan re-finding its own tile, which can no
+longer happen once that scan never runs there.
+
+PROOF SHAPE. This is an ORDER bug, not a state bug - two machines that
+detonate the same 9 tiles in different orders can still finish with an
+identical final census (SOAK's assert_census would miss it), which is exactly
+why the E0 scaffold could only STAGE the cluster, not verify anything about the
+chain. `chain_detonation` is unsubjected (`coopPacketSubject` returns -1 for
+it, like `destroy_tile`), so the generic `rx_trace` ring carries no per-packet
+position - this phase adds a small position-carrying counterpart,
+`parallel_state.chainDetonationList` ([x,y,z] tuples, oldest-first,
+process-local): the parallel HOST appends to it at the `chain_detonation` SEND
+site (so its list IS its scan/send order) and the parallel CLIENT appends to it
+at the handler's APPLY site (so its list IS its receive/apply order). GREEN
+proof: the client's list, restricted to the entries the burst added, equals
+the host's list over the same window - not just same length, same POSITIONS in
+the same ORDER. `chainDetonationsSent`/`chainDetonationsApplied` (plain
+counters) are the cheap coverage check (nothing dropped or duplicated); the
+five-bucket sync-check under strict burn-in (E0/E1's own proof obligation)
+rides along for free once the client no longer runs its own casualty/terrain
+sim on this path.
+
+GREEN (E2 build, lever off): client `chainDetonationList` order == host
+`chainDetonationList` order for the burst window; `chainDetonationsApplied` ==
+`chainDetonationsSent` at side close; all five sync-check buckets
+(terrain/unitsCore/items/itemIdCtr/unitsCombat) stay at mismatchCount==0 under
+strict burn-in; the E0 heavy-cluster scenario (this fixture's own staging,
+lifted from `test_parallel_explosion_cluster.py`) is bucket-clean WITHOUT
+touching `explosion_replay_disable`.
+
+RED (same build, `explosion_replay_disable:true` on the CLIENT only): the
+lever is the SAME `_coopReplayDisplay` latch E1 wired, so it reverts BOTH the
+E1 gates (explode()/checkForCasualties) AND this phase's chain-scan gate at
+once - the client's own whole-map scan runs again, racing (not replacing) the
+still-arriving `chain_detonation` stream from the host, which keeps shipping
+regardless of the client's lever. Order/bucket divergence is reported
+statistically (same posture as E1's own RED section), not hard-asserted - a
+double-processed chain can converge on the SAME order by luck on a given
+seed/map, same as the pre-E1 racing sim could converge on the same final
+census by luck.
+
+Run:  python tools/coop_test/test_parallel_chain_order.py [--seed N]
+Exit 0 = pass; 2 = failure. Keeps well under 180 s (one bring-up, two bursts).
+"""
+
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_soak as SOAK
+
+PORT = "48042"
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+WEAPON = os.environ.get("E2_HE_WEAPON", "STR_AUTO_CANNON")
+AMMO = os.environ.get("E2_HE_AMMO", "STR_AC_HE_AMMO")
+
+# (2R+1)^2 block of armed tiles - identical staging to the E0 scaffold
+# (test_parallel_explosion_cluster.py), reused verbatim so this fixture proves
+# the SAME scenario E0 could only stage is now bucket-clean and order-provable.
+CLUSTER_R = 1
+EXPL_POWER = 20
+MIN_STAGED = 3      # E0's minimum: the cluster itself must stage >= 3 tiles
+MIN_CHAINED = 2      # need >= 2 chained events for "order" to mean anything
+
+CLIENT_SPEED = 250   # slow client (E1's default): widens the window a racing
+                      # scan would need to actually diverge from the host
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def tiles(gc):
+    return gc.ok({"cmd": "battle_tiles"})
+
+
+def bucket_snapshot(host):
+    sc = session.sync_check(host)
+    return {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+
+
+def expl_counters(client):
+    """E1's display-only-path counters - the DETERMINISTIC half of a RED
+    demonstration (test_parallel_explosion_thin.py's own pattern): under
+    explosion_replay_disable the client's _coopReplayDisplay computes false, so
+    these must stop climbing regardless of whether the order/bucket check
+    happens to also catch a straddle this run."""
+    pc = parallel(client)
+    return pc.get("explodeCallsSuppressed", 0), pc.get("explosionsDisplayOnly", 0)
+
+
+def chain_counters(gc):
+    pc = parallel(gc)
+    return pc.get("chainDetonationsSent", 0), pc.get("chainDetonationsApplied", 0)
+
+
+def chain_list(gc):
+    return [tuple(e) for e in parallel(gc).get("chainDetonationList", [])]
+
+
+def arm_cluster(gcs, cx, cy, cz, power, rad):
+    """Lifted verbatim from test_parallel_explosion_cluster.py (E0)/
+    test_parallel_explosive_carrier.py (chain-atomicity item-2): arm every tile
+    in a (2*rad+1)^2 block centred on (cx,cy,cz) on each of `gcs`, so BOTH
+    machines start the burst holding the SAME charged cluster."""
+    for gc in gcs:
+        for dx in range(-rad, rad + 1):
+            for dy in range(-rad, rad + 1):
+                gc.cmd({"cmd": "battle_tiles", "set_explosive": power,
+                        "explosiveType": 0, "x": cx + dx, "y": cy + dy, "z": cz})
+
+
+def find_shooter(host, client, hseat, tgt, exclude=()):
+    """A LIVE own unit (not in `exclude`) placeable adjacent to `tgt`, given a
+    fresh weapon+ammo. Returns (unit_id, weapon_id) or (None, None). Splash
+    from a heavy chain blast can knock out or kill whoever triggered it, so a
+    second burst must not blindly reuse the same shooter."""
+    for cand in PI.own_units(battle(client), hseat):
+        sid = cand["id"]
+        if sid in exclude:
+            continue
+        if cand.get("isOut") or cand.get("health", 1) <= 0:
+            continue
+        if PI.place_adjacent(host, client, sid, tgt):
+            PI.top_up(host, client, sid)
+            wid = PI.give_both(host, client, sid, WEAPON, AMMO)
+            return sid, wid
+    return None, None
+
+
+def fire_burst(host, client, shooter, wid, tgt):
+    """One HE shot at `tgt`, waited out to a quiescent, cross-machine-settled
+    state. Mirrors test_parallel_explosion_thin.py's case_he_blast /
+    test_parallel_explosion_cluster.py's burst-wait."""
+    assert PI.idle(host), "host still busy before the burst"
+    pre_t = tiles(host)["explosiveTiles"]
+    r = PI.intent(host, action="shoot", unit=shooter, mode="auto", weapon_id=wid,
+                  x=tgt[0], y=tgt[1], z=tgt[2])
+    assert r.get("ok"), f"the burst-triggering shot was refused: {r}"
+    assert PI.idle(host, 60), "host chain never ended after the burst"
+    SOAK.settle_display(host, client, timeout=45)
+    time.sleep(1.0)
+    print(f"    [diag] fire_burst at {tgt}: intent={r} explosiveTiles {pre_t}->"
+          f"{tiles(host)['explosiveTiles']}")
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=71717171)
+    args = ap.parse_args()
+
+    fails = []
+    notes = []
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": CLIENT_SPEED, "battleAlienSpeed": CLIENT_SPEED,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48952, make_user_dir("e2_chainorder_host", options=host_opts))
+    client = GameClient("client", 48953, make_user_dir("e2_chainorder_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client, seed=args.seed)
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"skirmish fixture came up gamemode {gm}; parallel turns only cover PVE "
+            f"(1) and PVE2 (4) - this fixture would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        print(f"battle up (seed {args.seed}, gm {gm}). weapon={WEAPON}/{AMMO}")
+
+        pc0 = parallel(client)
+        for field in ("chainDetonationsSent", "chainDetonationsApplied",
+                      "chainDetonationList", "explosionReplayDisable"):
+            assert field in pc0, (
+                f"parallel_state carries no `{field}` - bin/x64/Release/OpenXcom.exe "
+                f"predates the E2 chain_detonation instrumentation; rebuild it "
+                f"(serial, MP=false). fields: {sorted(pc0)}")
+        assert pc0["explosionReplayDisable"] is False, "replay lever not at its default (off)"
+
+        SOAK.enable_strict_burnin(host, client)
+
+        # ==================================================================
+        # GREEN: E2 build, lever off (the default)
+        # ==================================================================
+        print("\n== GREEN: chain_detonation ordered replay ==")
+        hseat = parallel(host)["localSeat"]
+        enemy = PI.alive_enemy(battle(host))
+        assert enemy, "the skirmish came up with no hostile to orient the cluster around"
+        cx, cy, cz = enemy["x"], enemy["y"], enemy["z"]
+
+        shooter = None
+        for cand in PI.own_units(battle(client), hseat):
+            sid = cand["id"]
+            if PI.place_adjacent(host, client, sid, (cx, cy, cz)):
+                PI.top_up(host, client, sid)
+                shooter = sid
+                break
+        assert shooter, "could not place a shooter near the cluster centre"
+        wid = PI.give_both(host, client, shooter, WEAPON, AMMO)
+
+        arm_cluster((host, client), cx, cy, cz, EXPL_POWER, CLUSTER_R)
+        th, tc = tiles(host), tiles(client)
+        staged = min(th["explosiveTiles"], tc["explosiveTiles"])
+        staged_match = th["explosiveHash"] == tc["explosiveHash"]
+        print(f"    cluster staged at ({cx},{cy},{cz}) r={CLUSTER_R}: "
+              f"host {th['explosiveTiles']}t client {tc['explosiveTiles']}t "
+              f"matched={staged_match}")
+        assert staged_match, (
+            f"the cluster did not arm IDENTICALLY on both machines - host hash "
+            f"{th['explosiveHash']} client {tc['explosiveHash']} - the fixture "
+            f"itself is not reproducible")
+        assert staged >= MIN_STAGED, (
+            f"only staged {staged} charged secondaries (need >= {MIN_STAGED}); "
+            f"SHORTFALL on this map/seed with CLUSTER_R={CLUSTER_R}")
+
+        buckets_pre = bucket_snapshot(host)
+        sent0, applied0 = chain_counters(host)[0], chain_counters(client)[1]
+        host_list0 = chain_list(host)
+        client_list0 = chain_list(client)
+
+        fire_burst(host, client, shooter, wid, (cx, cy, cz))
+
+        # a single blast may not chain the whole staged cluster in one go - keep
+        # aiming at the cluster centre (report-only diagnostic in E0; here it is
+        # the mechanism to build a long-enough proven sequence) until either the
+        # target chained-event count is reached or the cluster is exhausted.
+        tries = 1
+        while (chain_counters(host)[0] - sent0) < MIN_CHAINED and tries < 4 \
+                and tiles(host)["explosiveTiles"] > 0 \
+                and battle(host).get("inBattle"):
+            PI.top_up(host, client, shooter)
+            fire_burst(host, client, shooter, wid, (cx, cy, cz))
+            tries += 1
+
+        sent1, _ = chain_counters(host)
+        _, applied1 = chain_counters(client)
+        sent_delta = sent1 - sent0
+        applied_delta = applied1 - applied0
+        host_list1 = chain_list(host)
+        client_list1 = chain_list(client)
+        host_new = host_list1[len(host_list0):]
+        client_new = client_list1[len(client_list0):]
+
+        print(f"    after {tries} shot(s): chainDetonationsSent {sent0}->{sent1} "
+              f"(+{sent_delta})  chainDetonationsApplied {applied0}->{applied1} "
+              f"(+{applied_delta})")
+        print(f"    host   chain_detonation send order  ({len(host_new)}): {host_new}")
+        print(f"    client chain_detonation apply order ({len(client_new)}): {client_new}")
+
+        if sent_delta < MIN_CHAINED:
+            notes.append(
+                f"GREEN: only {sent_delta} chain_detonation(s) sent this run (wanted "
+                f">= {MIN_CHAINED}) - staging/adjacency shortfall on this map/seed, "
+                f"not a product result; the sent==applied and order checks below "
+                f"still run on whatever count was achieved")
+
+        if sent_delta == 0:
+            fails.append(
+                "GREEN: the cluster staged but NO chain_detonation was ever sent - "
+                "the burst never chained, so this run cannot prove anything about "
+                "order (staging shortfall, not a pump/host bug - rerun with a "
+                "different --seed)")
+        else:
+            if applied_delta != sent_delta:
+                fails.append(
+                    f"GREEN: chainDetonationsApplied ({applied_delta}) != "
+                    f"chainDetonationsSent ({sent_delta}) for this burst - a "
+                    f"chain_detonation was dropped or double-applied "
+                    f"(STOP-AND-REPORT: coverage bug)")
+            if client_new != host_new:
+                fails.append(
+                    f"GREEN: client chain_detonation apply order {client_new} != "
+                    f"host send order {host_new} - the client did not replay the "
+                    f"host's scan order (STOP-AND-REPORT: ordering bug)")
+            else:
+                print(f"    ORDER MATCH: client replayed the host's {len(host_new)}-"
+                      f"secondary scan order exactly")
+
+        sc = session.assert_sync_clean(host, client, "after the GREEN chain burst(s)",
+                                        strict=True, allow=())
+        buckets_post = {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+        bucket_delta = {k: buckets_post[k] - buckets_pre.get(k, 0) for k in FIVE}
+        print(f"    five-bucket delta (strict, cumulative): {bucket_delta}")
+        bad_buckets = {n: c for n, c in buckets_post.items() if c > 0}
+        if bad_buckets:
+            fails.append(f"GREEN: five-bucket mismatch {bad_buckets} under strict "
+                         f"burn-in.\n    {session._sync_mismatch_lines(sc)}")
+        for gc, tag in ((host, "host"), (client, "client")):
+            if TW.desync_seen(gc):
+                fails.append(f"the PRD-P2 drift tripwire FIRED on the {tag} during GREEN")
+
+        assert parallel(client)["explosionReplayDisable"] is False, (
+            "explosion_replay_disable drifted ON during GREEN - the run above did "
+            "not actually exercise the E2 enforcing path")
+        print("PASS (GREEN precondition): explosion_replay_disable stayed OFF the "
+              "whole run - the E0 heavy-cluster scenario is bucket-clean WITHOUT "
+              "needing its lever, unlike E0 itself which could only stage it")
+
+        # ==================================================================
+        # RED: same build, explosion_replay_disable:true on the CLIENT only
+        # ==================================================================
+        if not battle(host).get("inBattle"):
+            print("\n       SKIP RED: the mission ended during GREEN")
+        else:
+            print("\n== RED: explosion_replay_disable=true on the CLIENT (same build) ==")
+            client.cmd({"cmd": "parallel_state", "explosion_replay_disable": True})
+            pcr = parallel(client)
+            assert pcr.get("explosionReplayDisable") is True, \
+                f"explosion_replay_disable lever did not latch on the client: {pcr}"
+            hb_diag = battle(host)
+            hostiles = [u for u in hb_diag.get("units", [])
+                       if u.get("faction") == 1 and not u.get("isOut")]
+            shooter_u = next((u for u in hb_diag.get("units", [])
+                              if u["id"] == shooter), None)
+            print(f"    [diag] pre-RED: inBattle={hb_diag.get('inBattle')} "
+                  f"liveHostiles={len(hostiles)} shooter={shooter_u}")
+
+            # a fresh, never-yet-blasted cluster: GREEN's own spot is now rubble/
+            # craters, and a shot that lands short on the new terrain can miss
+            # the armed tiles entirely (observed: explosiveTiles unchanged after
+            # the shot). Try a few candidate offsets, each with a fresh
+            # shooter placement + a topped-up weapon, until one actually
+            # consumes at least one armed tile.
+            red_fired = False
+            red_used = {shooter}   # GREEN's shooter took its own blast's splash -
+                                    # a knocked-out/killed unit cannot fire again
+            for ox, oy in ((0, -4), (-4, 0), (0, 4), (4, 0)):
+                rx, ry, rz = cx + ox, cy + oy, cz
+                arm_cluster((host, client), rx, ry, rz, EXPL_POWER, CLUSTER_R)
+                thr, tcr = tiles(host), tiles(client)
+                red_staged = min(thr["explosiveTiles"], tcr["explosiveTiles"])
+                print(f"    RED candidate ({rx},{ry},{rz}): staged host "
+                      f"{thr['explosiveTiles']}t client {tcr['explosiveTiles']}t")
+                if red_staged < 1:
+                    continue
+                red_shooter, red_wid = find_shooter(host, client, hseat, (rx, ry, rz),
+                                                     exclude=red_used)
+                if red_shooter is None:
+                    notes.append(f"RED: candidate ({rx},{ry},{rz}): no live, "
+                                 f"placeable shooter left")
+                    continue
+                red_used.add(red_shooter)
+                buckets_red_pre = bucket_snapshot(host)
+                red_sent0, red_applied0 = chain_counters(host)[0], chain_counters(client)[1]
+                red_host_list0 = chain_list(host)
+                red_client_list0 = chain_list(client)
+                sup0, disp0 = expl_counters(client)
+                try:
+                    fire_burst(host, client, red_shooter, red_wid, (rx, ry, rz))
+                except AssertionError as e:
+                    notes.append(f"RED: candidate ({rx},{ry},{rz}) burst refused: {e}")
+                    continue
+                red_sent1, _ = chain_counters(host)
+                _, red_applied1 = chain_counters(client)
+                red_sent_delta = red_sent1 - red_sent0
+                if red_sent_delta == 0:
+                    notes.append(f"RED: candidate ({rx},{ry},{rz}) shot fired but "
+                                 f"chained nothing (missed the cluster) - trying "
+                                 f"another offset")
+                    continue
+                red_fired = True
+                red_applied_delta = red_applied1 - red_applied0
+                red_host_new = chain_list(host)[len(red_host_list0):]
+                red_client_new = chain_list(client)[len(red_client_list0):]
+                sc_red = session.sync_check(host)
+                buckets_red_post = {n: sc_red["buckets"].get(n, {}).get("mismatchCount", 0)
+                                    for n in FIVE}
+                delta_red = {k: buckets_red_post[k] - buckets_red_pre.get(k, 0) for k in FIVE}
+                straddle = sum(delta_red.values())
+                order_diverged = (red_client_new != red_host_new)
+                sup1, disp1 = expl_counters(client)
+
+                print(f"    RED: chainDetonationsSent +{red_sent_delta}  "
+                      f"chainDetonationsApplied +{red_applied_delta}")
+                print(f"    RED: host send order  {red_host_new}")
+                print(f"    RED: client apply order {red_client_new}  "
+                      f"(diverged={order_diverged})")
+                print(f"    RED: five-bucket delta since the lever flipped: "
+                      f"{delta_red} (sum {straddle})")
+                print(f"    RED: explodeCallsSuppressed {sup0}->{sup1}  "
+                      f"explosionsDisplayOnly {disp0}->{disp1}")
+
+                if sup1 > sup0 or disp1 > disp0:
+                    fails.append(
+                        f"RED: explodeCallsSuppressed/explosionsDisplayOnly kept "
+                        f"climbing under explosion_replay_disable ({sup0}->{sup1}, "
+                        f"{disp0}->{disp1}) - the lever did not actually re-route the "
+                        f"client back to the old racing chain-scan path")
+                else:
+                    print("  RED confirmed (deterministic half): the display-only "
+                          "counters stayed FLAT under the lever - the client is "
+                          "really running the old racing chain-scan again")
+
+                if order_diverged or straddle > 0 or red_applied_delta != red_sent_delta:
+                    print("  RED confirmed (statistical half): order/coverage/bucket "
+                          "divergence observed with the client's own racing scan "
+                          "re-enabled alongside the still-arriving chain_detonation "
+                          "stream")
+                else:
+                    notes.append(
+                        "RED: no order/bucket divergence observed this run (order "
+                        "matched, buckets clean, sent==applied) - statistical, "
+                        "retry-tolerant (see module docstring); the deterministic "
+                        "counter-flat proof above still shows the lever engaged the "
+                        "old code path, and the GREEN result already stands on its "
+                        "own")
+                break
+            if not red_fired:
+                notes.append("RED: no candidate offset both staged AND actually "
+                             "chained a burst - RED demonstration skipped this run, "
+                             "GREEN result stands (statistical, retry-tolerant)")
+
+            client.cmd({"cmd": "parallel_state", "explosion_replay_disable": False})
+            assert parallel(client).get("explosionReplayDisable") is False, \
+                "explosion_replay_disable lever did not revert on the client"
+
+        if notes:
+            print("\n== NOTES (not failures) ==")
+            for n in notes:
+                print(f"  NOTE {n}")
+
+        if not fails:
+            print("\nPASS: the parallel client replayed the host's chained-secondary "
+                  "detonations in the host's exact scan order (chainDetonationList "
+                  "match), chainDetonationsApplied == chainDetonationsSent, and the "
+                  "five-bucket sync-check stayed clean under strict burn-in without "
+                  "the explosion_replay_disable lever; the same build reproduced "
+                  "observable divergence with the lever forcing the client's old "
+                  "racing scan back on")
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    print("\n==== E2 chain-order summary ====")
+    if fails:
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_corpse_mint.py b/tools/coop_test/test_parallel_corpse_mint.py
new file mode 100644
index 000000000..8823a9a76
--- /dev/null
+++ b/tools/coop_test/test_parallel_corpse_mint.py
@@ -0,0 +1,268 @@
+"""ITEM 3 (chain-atomicity completion): corpse mint-at-apply regression test.
+
+THE DEFECT (pre-item-3): when a unit dies during the ALIEN side, the parallel
+replay client used to create that unit's corpse + spill its kit on its own death
+ANIMATION clock (UnitDieBState::convertUnitToCorpse), a beat out of step with the
+host's authoritative resolution. The P4 id-manifest then reconciled the ids "a beat
+late" at the after_unit_death apply. In that mid-flight window the client's item-id
+COUNTER was bumped at a different point than the host's, so a per-action sync-check
+hash that sampled the ai/expl chain straddled it - the alien-side items/itemIdCtr
+burn-in residual (seeds 8675309/555/999983, 2-12 per soak run).
+
+THE FIX (mint-at-apply): the parallel replay client now creates the corpse + spills
+the inventory + unlinks the tile at the after_unit_death PACKET APPLY (ordered
+bookkeeping clock), adopting the host's manifest ids AT CREATE. after_unit_death
+rides the ordered gate + the D.1 action_end apply barrier, so the corpse exists with
+the host's exact ids by the time the chain's action_end hash samples. The animation's
+convertUnitToCorpse is display-only on the parallel client. Non-parallel paths (host,
+classic co-op, PvP, single player) are byte-identical.
+
+This test forces DETERMINISTIC alien-side in-chain deaths: it ambushes disarmed,
+weakened soldiers onto tiles adjacent to the aliens, then closes the player side so
+the alien AI shoots them down DURING the alien turn (an `ai`/`expl` chain, not a
+boundary bleed-out). A slow client makes its replay lag past the host, which is what
+armed the drift window. Under the strict-burnin lever (side-gates + corpsePending
+skips OFF, so items/itemIdCtr compare at EVERY seq) it asserts, after the run:
+
+  * corpseReplayArmed == 0           (window 1 - the atomic apply adopts host ids AT
+                                      CREATE, so it never queues a corpse for legacy
+                                      replay. Phase 4: this is now an INVARIANT, not a
+                                      non-vacuity signal - see below)
+  * corpseRemapArmed == 0            (window 2 - the corpseRemapPending mint->reconcile
+                                      drift - NEVER arms on the new path: every corpse
+                                      adopted the host ids AT CREATE)
+  * items / itemIdCtr mismatch == 0  (no ai/expl straddle in the host's sync ring)
+  * corpse (id, type) census identical on both machines
+  * _itemId counters equal, full battle census equal
+
+Non-vacuity: it asserts the alien AI actually minted several CORPSES during the
+alien side (corpse count grew) - otherwise the clean asserts would be trivially true.
+(It does NOT gate on corpseReplayArmed growing: the Phase-2b atomic apply mints at
+apply without ever arming the legacy replay queue, so that counter stays 0 by design -
+that 0 is the invariant asserted above.)
+
+RED (pre-item-3, same build's introspection): corpseRemapArmed>0 and items/itemIdCtr
+mismatchCount>0 at kind ai/expl (measured: corpseRemapArmed=1, items=6, itemIdCtr=6).
+The `unitsCore` residual this test does NOT assert on is the separate casualty-value
+replay lag (chain-atomicity items 4-5), unaffected by mint-at-apply.
+
+Run:  python tools/coop_test/test_parallel_corpse_mint.py [--seed N] [--slow-client MS]
+                 [--hp N] [--sides N]
+Exit 0 = corpse mint-at-apply covered (pass); 2 = a mint drift (fail).
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47994"
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+def adj_free(ax, ay, az, occupied):
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        p = (ax + dx, ay + dy, az)
+        if p not in occupied:
+            return p
+    return None
+
+
+def ambush(host, client, side_no):
+    """Teleport a few weakened own-seat soldiers onto tiles adjacent to live aliens on
+    BOTH machines, so the alien AI shoots them down during the alien turn (an in-chain
+    `ai` death, not a boundary bleed-out). Capped at PAIRS per side: a mass ambush
+    overwhelms the client's per-action casualty-value replay (the item 4-5 unitsCore
+    residual) and latches the P2 tripwire on that, which is a DIFFERENT phase's defect;
+    a handful of kills a side keeps the corpse-mint (item 3) signal clean of it.
+    Returns the number of soldiers actually placed."""
+    hb = bstate(host)
+    aliens = [u for u in hb["units"] if u.get("faction") == 1 and not u.get("isOut")]
+    soldiers = [u for u in hb["units"] if u.get("faction") == 0 and not u.get("isOut")]
+    occupied = {(u["x"], u["y"], u["z"]) for u in hb["units"] if not u.get("isOut")}
+    placed = 0
+    # keep one soldier untouched so the mission cannot end mid-run
+    for alien, sol in list(zip(aliens, soldiers[1:]))[:PAIRS]:
+        p = adj_free(alien["x"], alien["y"], alien["z"], occupied)
+        if not p:
+            continue
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": sol["id"],
+                       "x": p[0], "y": p[1], "z": p[2]}) for gc in (host, client)]
+        if not all(r.get("moved") for r in res):
+            continue
+        occupied.add(p)
+        for gc in (host, client):
+            # HP moderate so a plasma hit KILLS but does not OVERKILL (an overkilled
+            # unit mints no corpse - the assertions would go vacuous). visible so the
+            # alien AI reliably engages it.
+            gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": sol["id"],
+                   "health": HP, "visible": True})
+        placed += 1
+    print(f"  side {side_no}: {len(aliens)} aliens, ambushed {placed} soldier(s)")
+    return placed
+
+
+HP = 35
+PAIRS = 3
+
+
+def main():
+    global HP, PAIRS
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=999983)
+    ap.add_argument("--slow-client", type=int, default=300,
+                    help="ms/frame on the client so its alien replay lags the host")
+    ap.add_argument("--hp", type=int, default=35,
+                    help="ambushed-soldier health (moderate: killed, not overkilled)")
+    ap.add_argument("--sides", type=int, default=4)
+    ap.add_argument("--pairs", type=int, default=3,
+                    help="soldiers ambushed per side (kept small so item 4-5 casualty "
+                         "noise does not swamp the item-3 corpse-mint signal)")
+    args = ap.parse_args()
+    HP = args.hp
+    PAIRS = args.pairs
+
+    cspeed = args.slow_client or SOAK.FAST_SPEED
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": cspeed, "battleAlienSpeed": cspeed,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48884, make_user_dir("cmint_host", options=host_opts))
+    client = GameClient("client", 48885, make_user_dir("cmint_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+        SOAK.enable_strict_burnin(host, client)
+
+        b0 = bstate(client)
+        remap0 = b0.get("corpseReplayArmed"), b0.get("corpseRemapArmed")
+        corpses0 = len(corpses(client))
+        assert b0.get("corpseRemapArmed") is not None, \
+            "battle_state carries no corpseRemapArmed - the item-3 introspection is missing"
+        print(f"  before: client corpseReplayArmed={remap0[0]} corpseRemapArmed={remap0[1]} "
+              f"corpses={corpses0}")
+
+        for side in range(args.sides):
+            ambush(host, client, side)
+            turn0 = bstate(host)["turn"]
+            SOAK.close_side(host, client, 0, 1, turn0)
+            time.sleep(3)
+            cb = bstate(client)
+            print(f"    -> after alien turn {turn0}: client corpseReplayArmed="
+                  f"{cb.get('corpseReplayArmed')} corpseRemapArmed={cb.get('corpseRemapArmed')} "
+                  f"corpses host={len(corpses(host))} client={len(corpses(client))}")
+
+        # let the slow client fully drain before the final compare
+        SOAK.settle_display(host, client)
+        time.sleep(2)
+
+        cb = bstate(client)
+        sc = session.sync_check(host)
+        buckets = sc["buckets"]
+        straddle = [(m["kind"], m["bucket"], m.get("boundary"))
+                    for m in sc.get("mismatches", []) if m["bucket"] in ("items", "itemIdCtr")]
+
+        replay_arm = cb.get("corpseReplayArmed", 0)
+        remap_arm = cb.get("corpseRemapArmed", 0)
+        corpses_now = len(corpses(client))
+        items_mm = buckets.get("items", {}).get("mismatchCount", 0)
+        idctr_mm = buckets.get("itemIdCtr", {}).get("mismatchCount", 0)
+        core_mm = buckets.get("unitsCore", {}).get("mismatchCount", 0)
+
+        print("\n== VERDICT ==")
+        print(f"  window-1 corpseReplayArmed = {replay_arm} (MUST be 0: atomic apply adopts at create, no replay queue)")
+        print(f"  window-2 corpseRemapArmed  = {remap_arm} (MUST be 0: mint adopts at create)")
+        print(f"  items mismatchCount        = {items_mm}")
+        print(f"  itemIdCtr mismatchCount    = {idctr_mm}")
+        print(f"  unitsCore mismatchCount    = {core_mm}  (item 4-5 residual, NOT asserted)")
+        print(f"  corpses minted this run    = {corpses_now - corpses0}")
+        if straddle:
+            print(f"  items/itemIdCtr STRADDLE   = {straddle}")
+
+        assert sc.get("strictBurnIn") is True, "strict-burnin lever not engaged - run vacuous"
+
+        # NON-VACUITY: the alien AI has to have actually minted corpses during the
+        # alien side, or the clean asserts below are trivially true. (Phase 4: the
+        # non-vacuity is CORPSES MINTED, not "deaths queued" - the Phase-2b atomic
+        # apply mints at apply and adopts the host ids AT CREATE, so it never arms the
+        # legacy corpse-replay QUEUE. corpseReplayArmed staying 0 is the atomic
+        # invariant asserted below, not a vacuity signal.)
+        if corpses_now - corpses0 < 3:
+            fails.append(f"VACUOUS: only {corpses_now - corpses0} corpse(s) minted - the "
+                         f"alien AI did not kill enough ambushed soldiers to exercise the "
+                         f"mint (try --seed / --hp)")
+
+        # THE FIX (atomic path): NEITHER corpse window arms - the atomic apply adopts
+        # the host's manifest ids at create, so it never queues a corpse replay (window
+        # 1) and never reconciles ids a beat late (window 2) - and there is no ai/expl
+        # straddle in the host's sync ring.
+        if replay_arm != 0:
+            fails.append(f"corpseReplayArmed={replay_arm} (expected 0 on the atomic path): "
+                         f"a corpse death was queued for legacy replay - mint-at-apply did "
+                         f"not run (the atomic apply must adopt ids at create, not queue)")
+        if remap_arm != 0:
+            fails.append(f"corpseRemapArmed={remap_arm} (expected 0): a corpse was minted "
+                         f"with LOCAL ids on the parallel client - mint-at-apply did not run")
+        if items_mm or idctr_mm:
+            fails.append(f"items/itemIdCtr straddled the alien-side chain "
+                         f"(items={items_mm}, itemIdCtr={idctr_mm}): {straddle}")
+
+        # corpse ids + counters + census identical across machines.
+        hc, cc = corpses(host), corpses(client)
+        if hc != cc:
+            fails.append(f"corpse censuses differ: host {hc} vs client {cc}")
+        h, c = session.battle_checksum(host), session.battle_checksum(client)
+        if h[0] != c[0]:
+            fails.append(f"item-id counters differ: host {h[0]} vs client {c[0]}")
+        if h[1] != c[1]:
+            fails.append(f"battle censuses differ: host {h[1]} vs client {c[1]}")
+        for gc, tag in ((host, "host"), (client, "client")):
+            if TW.desync_seen(gc):
+                fails.append(f"the PRD-P2 drift tripwire FIRED on the {tag}")
+    except Exception as e:
+        fails.append(f"[ERROR] {e}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    if fails:
+        print("\n==== ITEM 3 corpse mint-at-apply: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print("\n  PASS: corpse mint-at-apply COVERED - the parallel client minted every "
+          "alien-side corpse from the host manifest at the after_unit_death apply, the "
+          "corpseRemap drift window never armed, and items/itemIdCtr were strict-clean "
+          "through every death; corpse ids + counters + census identical on both machines")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_death_ghost.py b/tools/coop_test/test_parallel_death_ghost.py
new file mode 100644
index 000000000..f8cecf70a
--- /dev/null
+++ b/tools/coop_test/test_parallel_death_ghost.py
@@ -0,0 +1,421 @@
+"""Parallel battlescape "atomic unit death" Phase 2c: the CLIENT-side death GHOST.
+
+THE MECHANISM UNDER TEST. Phase 2a/2b made the parallel HOST ship one
+`unit_casualty` packet per casualty and the parallel CLIENT apply it ATOMICALLY
+(BattlescapeGame::coopApplyCasualty) on the bookkeeping clock - so by the instant
+the packet is applied the victim is already DEAD, tile-unlinked, and its corpse
+minted with the host's ids. Phase 2b left a STUB where the death ANIMATION used to
+be (the corpse simply appeared at apply). Phase 2c restores the animation as a
+DISPLAY-ONLY ghost that reproduces vanilla's collapse frame-for-frame while the
+real state stays final underneath:
+
+  * BattleUnit gains presentation-only display OVERRIDE fields (status/dir/fallPhase)
+    that only UnitSprite/Map read (never serialized, never hashed). coopQueueDeathGhost
+    seeds them to the pre-death STANDING pose at apply, so the unit keeps drawing
+    STANDING (via the Map ghost draw, since it is tile-unlinked) until its turn.
+  * BattlescapeGame::coopPollDeathGhosts (handleState, idle) starts the head ghost
+    once the state queue is idle AND the display has caught up to that death's chain
+    (`_clientDisplaySeq >= action_seq`, or a boundary/previous-side ghost) - so the
+    collapse never plays before the killing shot's animation.
+  * The ghost IS a UnitDieBState in a new GHOST mode (2nd ctor): pirouette->fall for a
+    DIRECT hit, instant final frame for an INDIRECT (blast) / already-unconscious one,
+    two extra frames, then it drops the override (revealing the real dead unit + the
+    now-unhidden corpse/kit) and pops. It writes NO world state, sends nothing.
+  * Map hides the ghost's minted corpse/kit ids (coopTopItemExcluding) until the
+    collapse ends, and draws the ghost unit on its (now tile-less) footprint.
+
+  * The RED lever (`death_ghost_disable`, same build, client): coopQueueDeathGhost
+    reverts to the 2b stub - completes the ghost immediately, no animation, corpse
+    visible at apply. deathGhosts stays EMPTY and no corpse is ever hidden.
+
+SCENARIO (slow client so each ghost frame lasts long enough to sample):
+  * a DIRECT-hit kill (heavy plasma, mode-0 corpse): the ghost pirouettes + falls;
+    its corpse is hidden until the last frame, then revealed.
+  * an INDIRECT kill (kill_unit_real with damage_type=DT_HE, FixRadius -1 ->
+    isDirect() false): the ghost jumps straight to the final frame (no COLLAPSING /
+    no pirouette).
+  * a KNOCKOUT (stun rod): the victim ends UNCONSCIOUS on both machines; a ghost runs.
+
+Asserts (same build, "ONCE green, ONCE red"):
+  GREEN (default, ghost animation ON):
+    - a death ghost was observed ACTIVE with status COLLAPSING (an animation ran)
+    - the DIRECT victim's collapse progressed (fallPhase advanced past 0)
+    - the INDIRECT victim's ghost carried direct==false and never showed COLLAPSING
+      (it took the instant-frame path)
+    - the direct victim's minted corpse was hidden from the draw set (battle_state
+      .hiddenItemIds) while its ghost animated, and revealed after it completed
+    - every ACTIVE ghost frame respected the start gate (displaySeq >= action_seq,
+      or boundary / previous-side)
+    - deathGhostsCompleted (client) == casualtiesApplied (client) at the end
+    - the five buckets stay 0 (the ghost touched no hashed state), corpse censuses
+      identical, the drift tripwire never fired
+  RED (--red, death_ghost_disable on the client -> 2b stub):
+    - deathGhosts stayed EMPTY the whole run and no corpse was ever hidden (the
+      animation never ran) - while deathGhostsCompleted still climbed with the kills
+
+Run:  python tools/coop_test/test_parallel_death_ghost.py [--seed N]
+                 [--slow-client MS] [--red]
+Exit 0 = the expected verdict for the selected mode held; 2 = it did not.
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+import test_parallel_atomic_death as AT
+
+PORT = "48012"
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+STATUS_COLLAPSING = 5
+STATUS_DEAD = 6
+STATUS_UNCONSCIOUS = 7
+DT_HE = 3  # high explosive: FixRadius -1 -> RuleDamageType::isDirect() == false
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def corpse_ids(gc):
+    return {i["id"] for i in gc.ok({"cmd": "battle_items"})["items"]
+            if "CORPSE" in i["type"].upper()}
+
+
+def units_by_id(gc):
+    return {u["id"]: u for u in bstate(gc)["units"]}
+
+
+def capture(client, victim_ids, timeout, interval=0.02):
+    """Rapidly sample the client while the death ghost(s) for `victim_ids` animate,
+    recording the distinct display frames per victim, the hidden-item snapshots seen
+    while any ghost was active, and the start-gate check per active frame.
+
+    Returns a dict keyed by unit id with:
+      frames            - ordered distinct {started,active,status,dir,fallPhase,direct,
+                          bnd,sideSeq,actionSeq,displaySeq} snapshots for that ghost
+      seen / gone       - the ghost appeared / then disappeared (completed)
+    plus module-level aggregates on the returned dict under key None:
+      hidden_ever       - any poll observed a non-empty battle_state.hiddenItemIds
+      hidden_ids_active - union of hidden ids observed while ANY ghost was active
+      ghost_ever        - any poll observed a non-empty deathGhosts list
+    """
+    per = {uid: {"frames": [], "seen": False, "gone": False} for uid in victim_ids}
+    agg = {"hidden_ever": False, "hidden_ids_active": set(), "ghost_ever": False}
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        ps = parallel(client)
+        bs = bstate(client)
+        hidden = set(bs.get("hiddenItemIds", []))
+        ghosts = {g["unit_id"]: g for g in ps.get("deathGhosts", [])}
+        dseq = ps.get("displaySeq")
+        cur_side = ps.get("sideSeq")
+        if ghosts:
+            agg["ghost_ever"] = True
+        if hidden:
+            agg["hidden_ever"] = True
+        any_active = any(g.get("active") for g in ghosts.values())
+        if any_active:
+            agg["hidden_ids_active"] |= hidden
+        for uid, st in per.items():
+            g = ghosts.get(uid)
+            if g:
+                st["seen"] = True
+                snap = {k: g.get(k) for k in
+                        ("started", "active", "status", "dir", "fallPhase",
+                         "direct", "bnd", "sideSeq", "actionSeq")}
+                snap["displaySeq"] = dseq
+                snap["curSide"] = cur_side
+                if not st["frames"] or st["frames"][-1] != snap:
+                    st["frames"].append(snap)
+            elif st["seen"]:
+                st["gone"] = True
+        seen_any = any(st["seen"] for st in per.values())
+        if seen_any and all(st["gone"] for st in per.values() if st["seen"]):
+            break
+        time.sleep(interval)
+    per[None] = agg
+    return per
+
+
+def start_gate_ok(frame):
+    """The ghost may only be ACTIVE once the display caught up to its chain (or it is
+    a boundary / previous-side ghost)."""
+    if not frame.get("active"):
+        return True
+    if frame.get("bnd"):
+        return True
+    if frame.get("sideSeq") != frame.get("curSide"):
+        return True
+    ds, aseq = frame.get("displaySeq"), frame.get("actionSeq")
+    return ds is not None and aseq is not None and ds >= aseq
+
+
+DT_AP = 1  # armor-piercing: FixRadius 0 -> isDirect() true (the pirouette+fall path)
+
+
+def stage_kill(host, used, damage_type):
+    """kill_unit_real on a live soldier with an explicit damage type - DETERMINISTIC
+    (raw damage, no to-hit roll, no display settle here) so the caller can capture the
+    CLIENT ghost as it applies and animates. DT_AP is direct (pirouette+fall, mode-0
+    corpse - AP IgnoreOverKill floors health at 0, so no overkill); DT_HE is indirect
+    (instant final frame). Returns the victim id, or None."""
+    live = [u for u in AT.live_soldiers(host) if u["id"] not in used]
+    if not live:
+        return None
+    victim = live[0]["id"]
+    used.add(victim)
+    r = host.cmd({"cmd": "battle_action", "action": "kill_unit_real",
+                  "unit": victim, "damage_type": damage_type})
+    if victim not in r.get("killed", []):
+        return None
+    return victim
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=20260824)
+    ap.add_argument("--slow-client", type=int, default=300,
+                    help="ms/frame on the client so each ghost frame lasts long enough "
+                         "to sample the collapse sequence (default 300)")
+    ap.add_argument("--red", action="store_true",
+                    help="RED: set parallel_state {death_ghost_disable:true} on the "
+                         "CLIENT - coopQueueDeathGhost reverts to the 2b stub (no "
+                         "animation, corpse visible at apply)")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48944, make_user_dir("deathghost_host", options=host_opts))
+    client = GameClient("client", 48945, make_user_dir("deathghost_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+
+        # the exe must carry the Phase 2c introspection or it predates this build.
+        pc = parallel(client)
+        for f in ("deathGhosts", "deathGhostsPending", "deathGhostsCompleted",
+                  "deathGhostDisable"):
+            assert f in pc, (
+                f"parallel_state carries no `{f}` - bin/x64/Release/OpenXcom.exe predates "
+                f"the Phase 2c build; rebuild it (serial, MP=false). fields: {sorted(pc)}")
+        assert "hiddenItemIds" in bstate(client), \
+            "battle_state carries no hiddenItemIds - the Phase 2c introspection is missing"
+
+        # disable_ghost=False: THIS test measures the ghost, so it must stay ON. (Other
+        # strict-burnin tests are state-focused and disable it - see enable_strict_burnin.)
+        SOAK.enable_strict_burnin(host, client, disable_ghost=False)
+
+        if args.red:
+            client.cmd({"cmd": "parallel_state", "death_ghost_disable": True})
+            assert parallel(client).get("deathGhostDisable") is True, \
+                "the death_ghost_disable lever did not engage on the client"
+            print("== RED: death_ghost_disable ON (client) - 2b stub, no animation ==")
+        else:
+            print("== GREEN: death-ghost animation ON ==")
+
+        used = set()
+        completed0 = parallel(client).get("deathGhostsCompleted", 0)
+
+        # ---- DIRECT kill: pirouette + fall + corpse hide/reveal ----
+        # Fire DETERMINISTICALLY on the (fast) host and DO NOT settle - capture the
+        # (slow) client's ghost live as the death applies and the collapse plays.
+        print("\n-- direct kill (DT_AP -> pirouette + fall, mode-0 corpse) --")
+        corp_before = corpse_ids(client)
+        pk_id = stage_kill(host, used, DT_AP)
+        direct_cap = capture(client, [pk_id] if pk_id else [], timeout=30) if pk_id else {}
+        corp_after = corpse_ids(client)
+        new_corpse = corp_after - corp_before
+        print(f"  victim={pk_id} new corpse id(s)={sorted(new_corpse)}")
+
+        SOAK.settle_display(host, client, timeout=30)
+
+        # ---- INDIRECT kill: instant final frame (no COLLAPSING) ----
+        print("\n-- indirect kill (DT_HE -> instant frame) --")
+        in_id = stage_kill(host, used, DT_HE)
+        indirect_cap = capture(client, [in_id] if in_id else [], timeout=30) if in_id else {}
+        print(f"  victim={in_id}")
+
+        SOAK.settle_display(host, client, timeout=30)
+
+        # ---- KNOCKOUT: ends UNCONSCIOUS ----
+        print("\n-- knockout (stun rod -> UNCONSCIOUS) --")
+        ko_id = AT.stage_knockout(host, client, used)
+        ko_cap = capture(client, [ko_id] if ko_id else [], timeout=20) if ko_id else {}
+        print(f"  victim={ko_id}")
+
+        SOAK.settle_display(host, client, timeout=60)
+        time.sleep(2)
+
+        # ---- gather final state ----
+        pcl = parallel(client)
+        cas_applied = pcl.get("casualtiesApplied", 0)
+        completed = pcl.get("deathGhostsCompleted", 0)
+        pending_end = pcl.get("deathGhostsPending", 0)
+        hidden_end = set(bstate(client).get("hiddenItemIds", []))
+        sc = session.sync_check(host)
+        buckets = {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+        total = sum(buckets.values())
+        hc = sorted((i["id"], i["type"]) for i in host.ok({"cmd": "battle_items"})["items"]
+                    if "CORPSE" in i["type"].upper())
+        cc = sorted((i["id"], i["type"]) for i in client.ok({"cmd": "battle_items"})["items"]
+                    if "CORPSE" in i["type"].upper())
+
+        # aggregate observations over the three captures
+        def agg_of(cap):
+            return cap.get(None, {"hidden_ever": False, "hidden_ids_active": set(),
+                                  "ghost_ever": False})
+        ghost_ever = any(agg_of(c)["ghost_ever"] for c in (direct_cap, indirect_cap, ko_cap))
+        # a ghost seen ACTIVE with status COLLAPSING anywhere (an animation ran)
+        collapsing_seen = False
+        gate_bad = []
+        for cap in (direct_cap, indirect_cap, ko_cap):
+            for uid, st in cap.items():
+                if uid is None:
+                    continue
+                for fr in st["frames"]:
+                    if fr.get("active") and fr.get("status") == STATUS_COLLAPSING:
+                        collapsing_seen = True
+                    if not start_gate_ok(fr):
+                        gate_bad.append((uid, fr))
+
+        print("\n== VERDICT ==")
+        print(f"  five-bucket={buckets} (sum {total})")
+        print(f"  casualtiesApplied={cas_applied} deathGhostsCompleted={completed} "
+              f"(baseline {completed0}) pending_end={pending_end}")
+        print(f"  ghost_ever={ghost_ever} collapsing_seen={collapsing_seen} "
+              f"hidden_end={sorted(hidden_end)}")
+
+        if args.red:
+            # the 2b stub: no ghost ever queued, no corpse ever hidden.
+            if ghost_ever:
+                fails.append("RED: deathGhosts was populated under death_ghost_disable "
+                             "- the stub must never queue an animating ghost")
+            if any(agg_of(c)["hidden_ever"] for c in (direct_cap, indirect_cap, ko_cap)):
+                fails.append("RED: a corpse/kit id was hidden under death_ghost_disable "
+                             "- the stub must leave items visible at apply")
+            if collapsing_seen:
+                fails.append("RED: a COLLAPSING ghost frame was observed under the stub")
+            if completed <= completed0:
+                fails.append(f"VACUOUS RED: deathGhostsCompleted did not climb "
+                             f"({completed0}->{completed}) - no casualty was applied, so "
+                             f"the stub path was never exercised")
+        else:
+            if pk_id is None:
+                fails.append("VACUOUS: could not stage the direct-hit kill")
+            if in_id is None:
+                fails.append("VACUOUS: could not stage the indirect kill")
+            if ko_id is None:
+                fails.append("VACUOUS: could not stage the knockout")
+            if not ghost_ever:
+                fails.append("no death ghost was ever observed in deathGhosts - the "
+                             "animation machinery never ran")
+            if not collapsing_seen:
+                fails.append("no ACTIVE ghost frame showed status COLLAPSING - no collapse "
+                             "animation played (only the instant stub?)")
+            # DIRECT victim: the fall must have progressed past phase 0.
+            if pk_id and direct_cap.get(pk_id):
+                frames = direct_cap[pk_id]["frames"]
+                active = [f for f in frames if f.get("active")]
+                if not active:
+                    fails.append(f"direct victim {pk_id}: no ACTIVE ghost frame captured")
+                else:
+                    maxphase = max((f.get("fallPhase", 0) for f in active), default=0)
+                    saw_collapse = any(f.get("status") == STATUS_COLLAPSING for f in active)
+                    if not (saw_collapse and maxphase > 0):
+                        fails.append(f"direct victim {pk_id}: collapse did not progress "
+                                     f"(saw_collapse={saw_collapse} maxFallPhase={maxphase}) "
+                                     f"frames={frames}")
+                # corpse hidden during, revealed after
+                if new_corpse:
+                    hid_active = agg_of(direct_cap)["hidden_ids_active"]
+                    if not (new_corpse & hid_active):
+                        fails.append(f"direct victim {pk_id}: its corpse {sorted(new_corpse)} "
+                                     f"was never hidden while the ghost animated "
+                                     f"(hidden-active={sorted(hid_active)})")
+                    if new_corpse & hidden_end:
+                        fails.append(f"direct victim {pk_id}: its corpse {sorted(new_corpse)} "
+                                     f"is STILL hidden after the ghost completed")
+            # INDIRECT victim: took the instant path (never COLLAPSING; direct==false).
+            if in_id and indirect_cap.get(in_id):
+                frames = indirect_cap[in_id]["frames"]
+                if any(f.get("status") == STATUS_COLLAPSING for f in frames):
+                    fails.append(f"indirect victim {in_id}: showed COLLAPSING - it should "
+                                 f"jump straight to the final frame; frames={frames}")
+                directs = {f.get("direct") for f in frames if f.get("active")}
+                if directs and directs != {False}:
+                    fails.append(f"indirect victim {in_id}: ghost.direct={directs}, expected "
+                                 f"only False for a DT_HE (indirect) death")
+            # KNOCKOUT victim: ends UNCONSCIOUS on BOTH machines.
+            if ko_id:
+                hu = units_by_id(host).get(ko_id, {})
+                cu = units_by_id(client).get(ko_id, {})
+                if hu.get("status") != STATUS_UNCONSCIOUS or cu.get("status") != STATUS_UNCONSCIOUS:
+                    fails.append(f"knockout victim {ko_id}: status host={hu.get('status')} "
+                                 f"client={cu.get('status')} (want {STATUS_UNCONSCIOUS})")
+            if gate_bad:
+                fails.append(f"start-gate violated: a ghost was ACTIVE before its chain was "
+                             f"displayed (displaySeq < action_seq): {gate_bad[:3]}")
+            if pending_end != 0:
+                fails.append(f"deathGhostsPending={pending_end} at end - a ghost never "
+                             f"finished animating")
+            if completed != cas_applied:
+                fails.append(f"deathGhostsCompleted ({completed}) != casualtiesApplied "
+                             f"({cas_applied}) - not every applied casualty produced+"
+                             f"completed a ghost")
+            if hidden_end:
+                fails.append(f"battle_state.hiddenItemIds not empty at end: {sorted(hidden_end)} "
+                             f"- a corpse stayed hidden after all ghosts completed")
+            bad = {b: v for b, v in buckets.items() if v > 0}
+            if bad:
+                fails.append(f"five-bucket mismatch {bad} FIRED - the ghost moved hashed "
+                             f"state.\n    {session._sync_mismatch_lines(sc)}")
+            if hc != cc:
+                fails.append(f"corpse censuses differ: host {hc} vs client {cc}")
+            for gc, tag in ((host, "host"), (client, "client")):
+                if TW.desync_seen(gc):
+                    fails.append(f"the PRD-P2 drift tripwire FIRED on the {tag}")
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    mode = "RED (death_ghost_disable)" if args.red else "GREEN (ghost animation ON)"
+    if fails:
+        print(f"\n==== death ghost Phase 2c [{mode}]: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print(f"\n  PASS [{mode}]")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_endturn.py b/tools/coop_test/test_parallel_endturn.py
new file mode 100644
index 000000000..4f3cc83ee
--- /dev/null
+++ b/tools/coop_test/test_parallel_endturn.py
@@ -0,0 +1,895 @@
+"""PRD-P8: the end-turn readiness gate, its tally UI and reserve localization.
+
+A parallel side has no owner. PRD-P5 let the HOST close it unilaterally, which
+was fine while the client could not act at all; from PRD-P6 on the client is
+playing, so one player's END TURN press must not cut the other one off
+mid-thought. P8 replaces the press with a latching READINESS toggle:
+
+    both machines press END TURN  ->  `end_turn_ready {seat, ready, side_seq}`
+                                  <-  `end_turn_tally {ready_seats, auto_seats}`
+    executor tick: every seat ready
+                   AND canAdmitAction()          (no chain, gate open)
+                   AND peer display backlog 0    (`action_done` drained)
+                   -> the P5 side close, exactly once
+
+and a seat that commands nothing live is AUTO-ready, so a wiped-out player never
+has to keep pressing a button to let the other one play.
+
+What this test asserts (PRD-P8 acceptance, in order):
+
+  1. Toggle both directions from BOTH machines; the tally is identical on both.
+  2. Auto-clear: a ready client ships a walk intent -> the host clears that
+     seat's ready and the echo reaches the client.
+  7. Reserve localization: `TU_COOP` / `kneel_reserved` stop crossing, so the two
+     machines hold DIFFERENT reserve modes at the same time; the client's mode
+     rides its intent and the host's own setting is unchanged afterwards.
+  6. Drain barrier: a client that has DISPLAYED a chain but is holding its
+     `action_done` back holds the commit off (`commitBlocked ==
+     "display_backlog"`) until the report lands - only then does the side
+     close. Held on demand with the `hold_action_done` lever rather than by
+     trying to make the client slow, which cannot work (see hold_done).
+  4. Commit: both ready -> the side ends EXACTLY once, `sideSeq` bumps, and the
+     next player side comes back with both machines on `coopTurn == 2`.
+  5. E14: intent vs commit, BOTH orders, each forced rather than raced -
+     intent-first clears the acting seat's ready so the commit is not owed, and
+     commit-first refuses the intent `turn_over` with nothing executed.
+  3. Auto-ready: strip the client's seat down to its last unit and knock it out
+     -> the seat goes auto-ready; gift one back -> auto clears.
+  8. E16 coexistence: with a readiness tally live, ABANDON MISSION still opens a
+     VoteMenu on both machines, the commit is HELD while the menu is up (the
+     battlescape is not the top state), and a passing abandon supersedes the
+     tally cleanly.
+
+Order is dictated by the fixture: 3 gives the client's soldiers away, so
+everything that needs a client-owned driver runs first, and 8 ends the mission.
+
+Run:  python tools/coop_test/test_parallel_endturn.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+PORT = "47989"
+
+BA_NONE = 0
+BA_AIMEDSHOT = 9
+
+FAST_SPEED = 2
+
+# How long scenario 4+6 holds the peer's display report back, and how many
+# samples inside that window must show the commit stuck behind it. Both are
+# free parameters now that the barrier is held rather than raced.
+HOLD_WINDOW = 12.0
+MIN_HELD_SAMPLES = 10
+
+TURN_OVER_TEXT = "turn has already ended"
+
+
+# ---- readouts --------------------------------------------------------------
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def tally(gc):
+    """(explicit-ready seats, auto seats, readyCount, seatCount) as this machine
+    sees it. The host owns the truth; a client holds the echoed tally plus its
+    own optimistic bit."""
+    p = parallel(gc)
+    return (sorted(p.get("readySeats", [])), sorted(p.get("autoSeats", [])),
+            p.get("readyCount"), p.get("seatCount"))
+
+
+def arm(gc):
+    """Press the REAL END TURN button (btnEndTurnClick), which in parallel mode
+    is the readiness toggle and nothing else."""
+    return gc.cmd({"cmd": "battle_action", "action": "end_turn_button"})
+
+
+def wait_tally(host, client, explicit, what, timeout=30):
+    """Both machines must agree on the EXPLICIT ready set."""
+    want = sorted(explicit)
+    ok = PI.wait_until(
+        lambda: tally(host)[0] == want and tally(client)[0] == want, timeout)
+    assert ok, (
+        f"{what}: the two machines disagree about who is ready (wanted {want}) - "
+        f"host {tally(host)} client {tally(client)}. `end_turn_tally` is the only "
+        f"thing that carries the host's tally to the peer.")
+
+
+def settle(host, client, seconds=6):
+    PI.settle(host, client, seconds)
+
+
+def turn_of(gc):
+    return battle(gc).get("turn")
+
+
+def hush(host, client, keep=()):
+    """Zero the TU of every X-Com unit except `keep`, on BOTH machines.
+
+    Fixture protection, not an assertion. This test closes the player side three
+    times, and the skirmish fixture ships a HANDFUL of aliens: the first run of
+    it lost its last hostile to reaction fire during the very first alien side,
+    which ended the mission and made everything after it vacuous. Reaction fire
+    costs TU, so a squad with none cannot shoot the fixture out from under the
+    test. TU regenerate at the next turn, so this only covers the alien side that
+    immediately follows - which is the only one that matters.
+    """
+    b = battle(host)
+    assert b.get("inBattle"), (
+        "the fixture's mission has already ended (its single hostile went "
+        "down) - the scenario that was running had nothing left to assert")
+    ids = [u["id"] for u in b["units"]
+           if u.get("faction") == 0 and not u.get("isOut") and u["id"] not in keep]
+    for uid in ids:
+        for gc in (host, client):
+            gc.cmd({"cmd": "battle_intent", "unit": uid, "action": "turn",
+                    "tu": 0, "dry": True})
+    return len(ids)
+
+
+def hostiles(gc):
+    return [u["id"] for u in battle(gc)["units"]
+            if u.get("faction") == 1 and not u.get("isOut")]
+
+
+def usable(gc, uid, seat):
+    u = PI.unit(battle(gc), uid)
+    return bool(u) and not u.get("isOut") and u.get("coop") == seat
+
+
+def ensure_driver(host, client, seat, tag, current):
+    """A live, correctly-owned, can-actually-move soldier of `seat`.
+
+    Every closed side is an alien side, and the alien gets to shoot: a driver
+    that was fine before the boundary can be a casualty after it, and the host's
+    validator then refuses its intents (`invalid`/`unit_out`) with no obvious
+    connection to what the scenario was testing."""
+    if (current is not None and usable(host, current, seat)
+            and usable(client, current, seat)):
+        return current
+    print(f"    (the {tag} driver {current} did not survive the boundary - "
+          f"picking another)")
+    return PI.pick_driver(host, client, seat, tag)
+
+
+# ---- 1. the toggle ---------------------------------------------------------
+
+def scenario_toggle(host, client, hseat, cseat):
+    print("-- 1: toggle both directions, tally consistent on both machines --")
+    wait_tally(host, client, [], "at the start of the side")
+
+    arm(client)
+    wait_tally(host, client, [cseat], "after the client armed")
+    assert parallel(client)["localReady"] is True, \
+        "the client does not consider ITSELF ready after its own press"
+    assert parallel(host)["localReady"] is False, \
+        "the host became ready because the CLIENT pressed END TURN"
+    print(f"    client armed: tally {tally(host)[2]}/{tally(host)[3]} on both")
+
+    arm(client)
+    wait_tally(host, client, [], "after the client disarmed")
+    print("    client disarmed: back to 0 on both")
+
+    arm(host)
+    wait_tally(host, client, [hseat], "after the host armed")
+    assert turn_of(host) is not None
+    print(f"    host armed: tally {tally(host)[2]}/{tally(host)[3]} on both")
+
+    arm(host)
+    wait_tally(host, client, [], "after the host disarmed")
+    assert parallel(host)["commitBlocked"] in ("not_ready", "", "side_commit"), \
+        f"the commit is blocked by something unexpected: {parallel(host)}"
+    print("PASS 1: END TURN is a latching per-seat toggle on BOTH machines and "
+          "the tally is identical on both")
+
+
+# ---- 2. an admitted action clears that seat's ready -------------------------
+
+def scenario_auto_clear(host, client, cseat, mover):
+    print("-- 2: an admitted intent clears that seat's explicit ready --")
+    assert PI.idle(host), "the host is still busy"
+    PI.top_up(host, client, mover)
+    dest = PI.free_step_both(host, client, mover)
+    assert dest, f"client soldier {mover} cannot step anywhere"
+
+    arm(client)
+    wait_tally(host, client, [cseat], "before the intent")
+
+    before = PI.pos(battle(host), mover)
+    r = PI.intent(client, action="move", unit=mover,
+                  x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+    assert PI.wait_until(lambda: PI.pos(battle(host), mover) != before, 45), (
+        f"the walk intent never ran on the host: {parallel(host)} "
+        f"warning={PI.warning_of(client)!r}")
+    wait_tally(host, client, [],
+               "after the ready client's intent was admitted")
+    assert PI.idle(host, timeout=90), "the host chain never ended"
+    settle(host, client, seconds=4)
+    print("PASS 2: the seat that acted is no longer ready, on BOTH machines "
+          "(the echo carried it back)")
+
+
+# ---- 7. reserve localization ------------------------------------------------
+
+def reserve(gc, **kw):
+    req = {"cmd": "battle_reserve"}
+    req.update(kw)
+    return gc.ok(req)
+
+
+def scenario_reserve(host, client, mover):
+    print("-- 7: reserve is per-machine and rides the intent --")
+    assert PI.idle(host), "the host is still busy"
+    reserve(host, mode="none", kneel=False)
+    reserve(client, mode="none", kneel=False)
+    time.sleep(2)
+
+    # a) the setting stops crossing. In classic co-op btnReserveClick ships
+    #    `TU_COOP` and the peer applies it, so this would converge.
+    got = reserve(client, mode="aimed")
+    assert got["reserve"] == BA_AIMEDSHOT, f"the client would not take it: {got}"
+    time.sleep(4)
+    hres = reserve(host)["reserve"]
+    cres = reserve(client)["reserve"]
+    assert cres == BA_AIMEDSHOT and hres == BA_NONE, (
+        f"the reserve mirror still crosses in parallel mode: host {hres} "
+        f"client {cres}. PRD-P8 §5 suppresses `TU_COOP`/`kneel_reserved` there "
+        f"and ignores them on receipt - reserve is a per-machine setting when "
+        f"both players are acting at once.")
+    print(f"    per-machine: host reserve {hres}, client reserve {cres}, "
+          f"held apart for 4 s")
+
+    # b) the client's mode rides its intent, and the HOST's own setting is put
+    #    back afterwards. `chainReserve` is the override installed for the
+    #    running chain - sampled, because a short walk can be over inside one
+    #    RPC round trip.
+    PI.top_up(host, client, mover)
+    dest = PI.far_step(host, mover, radius=3) or PI.free_step_both(host, client, mover)
+    assert dest, f"client soldier {mover} cannot step anywhere"
+    before = PI.pos(battle(host), mover)
+    r = PI.intent(client, action="move", unit=mover,
+                  x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+
+    seen_override = None
+    deadline = time.time() + 45
+    while time.time() < deadline:
+        ps = parallel(host)
+        if ps.get("chainReserve", -1) == BA_AIMEDSHOT:
+            seen_override = ps.get("chainReserveUnit")
+            break
+        if PI.pos(battle(host), mover) != before and ps.get("canAdmit") is True:
+            break
+        time.sleep(0.05)
+    assert PI.idle(host, timeout=90), "the host chain never ended"
+    settle(host, client, seconds=4)
+
+    assert reserve(host)["reserve"] == BA_NONE, (
+        f"executing a client intent left the HOST holding the client's reserve "
+        f"({reserve(host)['reserve']}) - the override must be scoped to the "
+        f"chain, not swapped into the host's own setting")
+    assert reserve(client)["reserve"] == BA_AIMEDSHOT, \
+        "the client's own reserve was changed by its intent running remotely"
+    if seen_override is not None:
+        assert seen_override == mover, (
+            f"the reserve override was keyed on unit {seen_override}, not on "
+            f"the intent's actor {mover} - it could reach another soldier")
+        print(f"    caught the chain-scoped override live: reserve "
+              f"{BA_AIMEDSHOT} keyed on unit {seen_override}")
+    else:
+        print("    (the chain was over before a sample landed - the override's "
+              "presence is not asserted, only that it did not leak)")
+
+    reserve(client, mode="none")
+    reserve(host, mode="none")
+    print("PASS 7: reserve is per-machine, the client's rides its intent and "
+          "the host's own setting survives it untouched")
+
+
+# ---- 4 + 6. the commit, and the display drain barrier in front of it --------
+
+def hold_done(client, hold):
+    """TestServer `hold_action_done`: while held, the CLIENT parks its
+    `action_done` reports instead of shipping them. Releasing ships the newest
+    parked seq, which subsumes every older one.
+
+    The barrier below is real, but its natural window is ONE network round trip
+    (~200 ms) and no fixture can widen it, so it has to be held open instead of
+    raced. Making the client slow does not work: `battleXcomSpeed` paces only
+    UnitWalk/UnitTurn/UnitFall, and PRD-P7's client-side display fast-forward
+    pins exactly those to interval 0 whenever a gated packet is waiting (and
+    `action_end` always is), while ProjectileFlyBState fixes its own interval and
+    never reads the option at all. Freezing the client's battlescape under a
+    modal does not work either - the background replay keeps draining through
+    handleStateCoop and `action_done` is emitted from the gated drain in
+    updateCoopTask. So the REPORT is held, not the display: same packet, same
+    single emit point, it just leaves when this test says so.
+
+    `heldActionDones` is what makes the scenario non-vacuous: it counts the
+    reports parked since the hold was engaged, i.e. the chains the client really
+    did finish displaying. 0 would mean the client is merely behind, which is a
+    different (and untested) reason for the commit to be held.
+    """
+    r = client.ok({"cmd": "hold_action_done", "hold": bool(hold)})
+    assert r.get("hold") is bool(hold), \
+        f"the `hold_action_done` lever did not take (wanted {hold}): {r}"
+    return r
+
+
+def wait_side(host, client, start_turn, timeout=300):
+    """Wait for the player side to close and come back, draining the turn screens
+    exactly the way test_parallel_sharedturn.cycle_side does (the HOST's
+    NextTurnState must self-close - close() is what ships `next_turn`)."""
+    deadline = time.time() + timeout
+    stalled = {}
+    while time.time() < deadline:
+        for gc in (host, client):
+            b = battle(gc)
+            if not b.get("inBattle"):
+                return None
+            state = TW.top(gc)
+            if state == "NextTurnState":
+                if gc is host:
+                    first = stalled.setdefault(id(gc), time.time())
+                    if time.time() - first > 25:
+                        gc.cmd({"cmd": "dismiss_popup"})
+                        stalled.pop(id(gc), None)
+                    continue
+                gc.cmd({"cmd": "dismiss_popup"})
+                continue
+            stalled.pop(id(gc), None)
+            if state != "BattlescapeState":
+                gc.cmd({"cmd": "dismiss_popup"})
+        now = battle(host)
+        if (now.get("turn") is not None and start_turn is not None
+                and now["turn"] > start_turn and now.get("coopTurn") == 2
+                and battle(client).get("coopTurn") == 2):
+            return now["turn"]
+        time.sleep(0.5)
+    return False
+
+
+def scenario_commit_and_drain(host, client, hmover, hseat, cseat):
+    """PRD-P8 acceptance 4 (the commit) and 6 (the drain barrier in front of it).
+
+    Deliberately ONE side close for both: the fixture ships a handful of aliens
+    and every closed side is another chance for the mission to end under the
+    test (see hush()). The barrier is what delays THIS commit, and the commit's
+    own properties are asserted when it finally lands.
+
+    Shape: park the peer's display report (hold_done) -> the host runs ONE chain
+    -> both seats ready -> the commit is stuck on `display_backlog` for as long
+    as the hold lasts -> release -> it fires exactly once. A single chain is the
+    point: the arbiter refuses to ADMIT at a backlog of 2, so one outstanding
+    chain is the only state in which `canAdmit` is true and the display report is
+    provably the last thing standing between two ready seats and the side close.
+    """
+    print("-- 4 + 6: both ready, commit deferred until the peer's display drains --")
+    assert PI.idle(host), "the host is still busy"
+    turn_before = turn_of(host)
+    side_before = parallel(host)["sideSeq"]
+
+    # one seat ready is not enough, whatever else is true
+    arm(client)
+    wait_tally(host, client, [cseat], "with only the client ready")
+    time.sleep(2)
+    assert turn_of(host) == turn_before, (
+        f"the side closed on ONE seat's readiness (turn {turn_before} -> "
+        f"{turn_of(host)}) - every seat has to be ready")
+    assert parallel(host)["commitBlocked"] == "not_ready", (
+        f"the commit was held for the wrong reason with one seat ready: "
+        f"{parallel(host)}")
+    print("    one seat ready: commit held on `not_ready`")
+
+    # Nothing from the scenarios above may still be undisplayed: the arbiter
+    # refuses to admit at a backlog of 2, so with a stale chain outstanding the
+    # one below would never start.
+    assert PI.wait_until(lambda: parallel(host)["displayBacklog"] == 0, 30), (
+        f"an EARLIER chain is still undisplayed - this scenario has to own the "
+        f"only outstanding one: {parallel(host)}")
+
+    hold_done(client, True)
+    held = 0
+    blocked_reasons = set()
+    released_at = None
+    try:
+        PI.top_up(host, client, hmover)
+        # Everyone but the walker is hushed BEFORE the commit can fire - the
+        # alien side that follows it is the one that has to stay non-lethal, and
+        # by the time the poll loop below exits that side has already run.
+        hush(host, client, keep=(hmover,))
+        dest = PI.free_step_both(host, client, hmover)
+        assert dest, f"host soldier {hmover} cannot step anywhere"
+        before = PI.pos(battle(host), hmover)
+        seq_before = parallel(host)["actionSeq"]
+        # A plain walk, and with the report held that IS enough. Before the lever
+        # this had to be a SHOT, because a walk the client fast-forwards leaves no
+        # measurable window (measured: 0 samples) - the shot was a workaround for
+        # the missing hold, not something the barrier cares about.
+        r = PI.intent(host, action="move", unit=hmover,
+                      x=dest[0], y=dest[1], z=dest[2])
+        assert r.get("ok"), f"the host lever refused the walk: {r}"
+        assert PI.wait_until(
+            lambda: parallel(host)["actionSeq"] > seq_before, 30), (
+            f"the walk was never admitted, so no chain exists for the peer to "
+            f"owe a display report on: {parallel(host)}")
+        assert PI.idle(host, timeout=90), "the host chain never ended"
+        assert PI.pos(battle(host), hmover) != before, (
+            f"the chain the barrier is about never moved unit {hmover}")
+
+        # The client HAS displayed the chain and is WITHHOLDING the report.
+        # Without this the barrier below would be indistinguishable from a peer
+        # that simply never received the packet.
+        assert PI.wait_until(
+            lambda: parallel(client)["heldActionDones"] >= 1, 60), (
+            f"the client never finished displaying the chain, so nothing was "
+            f"parked and the barrier is not what would be holding the commit: "
+            f"client={parallel(client)} host={parallel(host)}")
+        assert parallel(host)["displayBacklog"] >= 1, (
+            f"the client parked its report but the host sees no undisplayed "
+            f"chain: {parallel(host)}")
+
+        # Armed AFTER the walk was admitted - admitting clears the acting seat's
+        # explicit ready, so arming first would just be undone.
+        arm(host)
+        hush(host, client)   # the walker too, now that its chain is over
+        wait_tally(host, client, [hseat, cseat],
+                   "with both seats ready behind the drain barrier")
+
+        deadline = time.time() + HOLD_WINDOW
+        while time.time() < deadline:
+            ph = parallel(host)
+            if ph.get("commitBlocked"):
+                blocked_reasons.add(ph["commitBlocked"])
+            backlog = ph.get("displayBacklog", 0)
+            now = turn_of(host)
+            assert now == turn_before, (
+                f"the side closed with {backlog} chain(s) the peer has not "
+                f"reported DISPLAYED (turn {turn_before} -> {now}). "
+                f"PROTOCOL.md ordering invariant 4 makes the commit wait for "
+                f"`action_done` to drain: host={ph} client={parallel(client)}")
+            if (backlog > 0 and ph.get("canAdmit") is True
+                    and ph.get("commitBlocked") == "display_backlog"):
+                # states drained, gate open, both seats ready: the ONLY thing
+                # left between them and the side close is the peer's report.
+                held += 1
+            time.sleep(0.25)
+        assert "display_backlog" in blocked_reasons, (
+            f"the commit was never held on the drain barrier - reasons seen "
+            f"{sorted(blocked_reasons)}: host={parallel(host)}")
+        assert held >= MIN_HELD_SAMPLES, (
+            f"the barrier was barely exercised: only {held} sample(s) over "
+            f"{HOLD_WINDOW} s had an idle executor, a ready tally and an "
+            f"undisplayed backlog (wanted >= {MIN_HELD_SAMPLES}); reasons seen "
+            f"{sorted(blocked_reasons)}. host={parallel(host)} "
+            f"client={parallel(client)}")
+        print(f"    the commit was held on `display_backlog` for {held} "
+              f"sample(s) over {HOLD_WINDOW:.0f} s with both seats ready and "
+              f"the executor idle "
+              f"({parallel(client)['heldActionDones']} report(s) parked)")
+    finally:
+        try:
+            hold_done(client, False)
+            released_at = time.time()
+        except Exception as he:   # never mask the real failure
+            print(f"    (releasing the `action_done` hold failed: {he})")
+
+    turn = wait_side(host, client, turn_before)
+    assert turn, (
+        f"the parked report was released with both seats ready and the side "
+        f"still never closed: host={parallel(host)} client={parallel(client)}, "
+        f"host top={TW.top(host)} client top={TW.top(client)}")
+    assert turn == turn_before + 1, (
+        f"the side closed more than once: turn {turn_before} -> {turn}")
+    if released_at is not None:
+        print(f"    ...and closed {time.time() - released_at:.1f} s after the "
+              f"report was released, having sat still for {HOLD_WINDOW:.0f} s "
+              f"before it")
+
+    side_after = parallel(host)["sideSeq"]
+    assert side_after > side_before, (
+        f"`side_seq` did not advance across the commit ({side_before} -> "
+        f"{side_after}) - every client intent would still carry the old token")
+    for gc, tag in ((host, "host"), (client, "client")):
+        b = battle(gc)
+        assert b["coopTurn"] == 2, \
+            f"{tag}: coopTurn is {b['coopTurn']}, not 2, on the new player side"
+    wait_tally(host, client, [], "on the new player side")
+    assert parallel(client)["sideSeq"] == side_after, (
+        f"the client did not adopt the new side token (host {side_after}, "
+        f"client {parallel(client)['sideSeq']}) - its next intent would be "
+        f"denied `turn_over`")
+    assert parallel(client)["holdActionDone"] is False, (
+        f"the test lever is still engaged after the scenario - every later "
+        f"chain would wedge the executor: {parallel(client)}")
+    print(f"PASS 4+6: the barrier held the commit until the peer's report was "
+          f"released, then the side closed ONCE (turn {turn_before} -> {turn}), "
+          f"sideSeq {side_before} -> {side_after}, both machines back on "
+          f"coopTurn 2 with the tally cleared")
+
+# ---- 5. the E14 race --------------------------------------------------------
+
+def scenario_race(host, client, hseat, cseat, mover):
+    """PRD-P8 E14, both halves, DETERMINISTICALLY.
+
+    The PRD words this as a race ("client intent vs host commit -> exactly one
+    of..."), and a genuine race decides which half gets exercised by coin flip.
+    Both halves are worth an assertion and neither is worth a flaky one, so each
+    is forced instead: (a) admit the intent first and prove the pending commit
+    cannot fire, (b) let the commit start first and prove the intent that follows
+    executes NOTHING.
+    """
+    print("-- 5 (E14): intent vs commit, both orders --")
+    assert PI.idle(host), "the host is still busy"
+    PI.top_up(host, client, mover)
+    dest = PI.free_step_both(host, client, mover)
+    assert dest, f"client soldier {mover} cannot step anywhere"
+    before = PI.pos(battle(host), mover)
+    turn_before = turn_of(host)
+
+    # (a) intent first: the admit clears that seat's ready, so the commit the
+    #     other seat is about to ask for simply is not owed.
+    arm(client)
+    wait_tally(host, client, [cseat], "before the intent-first half")
+    seq_before = parallel(host)["actionSeq"]
+    r = PI.intent(client, action="move", unit=mover,
+                  x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+    assert PI.wait_until(
+        lambda: parallel(host)["actionSeq"] > seq_before, 45), (
+        f"the intent was never admitted: {parallel(host)} "
+        f"warning={PI.warning_of(client)!r}")
+    wait_tally(host, client, [], "after the ready client acted")
+    arm(host)
+    wait_tally(host, client, [hseat], "with only the host ready")
+    time.sleep(4)
+    assert turn_of(host) == turn_before, (
+        f"the side closed although the client's ready had been cleared by its "
+        f"own action (turn {turn_before} -> {turn_of(host)})")
+    assert PI.pos(battle(host), mover) != before, \
+        "the intent-first half never actually moved anything"
+    print(f"    (a) intent-first: the walk ran, the client's ready was cleared "
+          f"and the host's pending commit is held on "
+          f"`{parallel(host)['commitBlocked']}`")
+
+    # (b) commit first: the intent loses, and it loses by being REFUSED - nothing
+    #     of it may execute on the side that is closing.
+    #
+    #     Forced rather than raced. The window in which `_sideCommitInProgress`
+    #     is true is a frame or two wide (the end-turn sentinel pops almost
+    #     immediately), and an intent that misses it is stamped with the NEXT
+    #     side's token and legitimately runs there - which is a pass that looks
+    #     like a failure. The side no longer belonging to the player is the same
+    #     first branch of the intent handler that a mid-commit arrival takes
+    #     (`stale side_seq || not FACTION_PLAYER || _sideCommitInProgress` ->
+    #     `turn_over`), and it is seconds wide instead of milliseconds.
+    assert PI.idle(host, timeout=90), "the host chain never ended"
+    settle(host, client, seconds=4)
+    PI.top_up(host, client, mover)
+    dest2 = PI.free_step_both(host, client, mover)
+    assert dest2, f"client soldier {mover} cannot step anywhere for the (b) half"
+    # the mover is hushed too: `turn_over` is decided before the intent is ever
+    # validated, so it needs no TU to be refused - and a driver left holding 200
+    # TU next to the fixture's ONE alien reaction-fires it dead over the coming
+    # alien side, which ends the mission and the test with it (measured).
+    hush(host, client)
+    client.cmd({"cmd": "parallel_state", "clear_deny": True})
+    # the host is STILL armed from (a) - nothing since has been admitted for its
+    # seat - so one client press is all it takes to make the tally complete.
+    assert tally(host)[0] == [hseat], \
+        f"the host lost its readiness between the two halves: {tally(host)}"
+    arm(client)
+    assert PI.wait_until(
+        lambda: parallel(host)["sideCommit"] is True
+        or battle(host).get("side") != 0, 90), (
+        f"the commit never started with both seats ready: {parallel(host)}")
+    before2 = PI.pos(battle(host), mover)
+    r = PI.intent(client, action="move", unit=mover,
+                  x=dest2[0], y=dest2[1], z=dest2[2])
+    assert r.get("ok") and r.get("routed") is True, \
+        f"the client would not ship the intent into the closing side: {r}"
+    assert PI.wait_until(
+        lambda: parallel(client)["lastDenyReason"] != "", 25), (
+        f"the intent shipped into a committing/closed side was never refused: "
+        f"{parallel(client)}")
+    got = parallel(client)["lastDenyReason"]
+    assert got == "turn_over", (
+        f"the intent was refused `{got}`, not `turn_over` - PROTOCOL.md keeps "
+        f"`turn_over` for exactly this (side committed / AI phase): "
+        f"{parallel(client)}")
+    assert PI.pos(battle(host), mover) == before2, (
+        f"a REFUSED intent still moved unit {mover} on the host: {before2} -> "
+        f"{PI.pos(battle(host), mover)}")
+    turn = wait_side(host, client, turn_before, timeout=240)
+    assert turn, (
+        f"the commit-first half never closed the side: host={parallel(host)}")
+    print(f"    (b) commit-first: the intent was refused `{got}` "
+          f"({parallel(client)['lastDenyWarning']}) and executed nothing; the "
+          f"side closed (turn -> {turn})")
+    print("PASS 5: both E14 orders resolve cleanly - never both outcomes")
+
+
+# ---- 3. auto-ready ----------------------------------------------------------
+
+def client_units(host, client, cseat):
+    return [u["id"] for u in battle(client)["units"]
+            if u.get("faction") == 0 and not u.get("isOut")
+            and u.get("coop") == cseat]
+
+
+def gift(gc, uid, owner):
+    return gc.cmd({"cmd": "battle_gift", "unit_id": uid, "owner": owner})
+
+
+def knock_out(host, client, hmover, victim, swings=12):
+    """Stun-rod the victim from a host soldier - the deterministic knockout the
+    PRD-P4 test lever settled on (it cannot miss and cannot overkill)."""
+    vpos = PI.pos(battle(host), victim)
+    if not PI.place_adjacent(host, client, hmover, vpos):
+        return False
+    wid = PI.give_both(host, client, hmover, "STR_STUN_ROD")
+    for i in range(swings):
+        r = host.cmd({"cmd": "battle_fire", "unit": hmover, "mode": "hit",
+                      "weapon_id": wid, "tu": 200,
+                      "x": vpos[0], "y": vpos[1], "z": vpos[2]})
+        if not r.get("ok"):
+            break
+        settle(host, client, seconds=3)
+        PI.idle(host)
+        u = PI.unit(battle(host), victim)
+        if u and u.get("isOut"):
+            print(f"    unit {victim} went down after {i + 1} swing(s)")
+            return True
+    return False
+
+
+def scenario_auto_ready(host, client, hseat, cseat, hmover):
+    print("-- 3: a seat with nothing left to command is AUTO-ready --")
+    assert PI.idle(host), "the host is still busy"
+    assert tally(host)[1] == [], \
+        f"a seat was already auto-ready before the roster was touched: {tally(host)}"
+
+    mine = client_units(host, client, cseat)
+    assert len(mine) >= 2, (
+        f"the fixture gave the client only {len(mine)} unit(s) - the last-unit "
+        f"scenario needs at least two")
+    keep = mine[0]
+    for uid in mine[1:]:
+        gift(client, uid, hseat)
+    settle(host, client, seconds=6)
+    left = client_units(host, client, cseat)
+    assert left == [keep], (
+        f"the gift-away left the client seat holding {left}, not just {[keep]}")
+    assert tally(host)[1] == [], (
+        f"the client seat is auto-ready while it still commands {left}: "
+        f"{tally(host)}")
+    print(f"    client seat stripped to one unit ({keep}); still not auto-ready")
+
+    down = knock_out(host, client, hmover, keep)
+    if not down:
+        print(f"    (the stun rod could not reach unit {keep} - giving it away "
+              f"instead; the auto predicate is the same 'no live commandable "
+              f"unit of this seat')")
+        gift(client, keep, hseat)
+        settle(host, client, seconds=6)
+
+    assert PI.wait_until(lambda: tally(host)[1] == [cseat], 40), (
+        f"the client seat commands nothing live and is still not auto-ready: "
+        f"host {tally(host)} (units left: {client_units(host, client, cseat)})")
+    assert PI.wait_until(lambda: tally(client)[1] == [cseat], 30), (
+        f"the auto-ready never reached the client: {tally(client)}")
+    assert parallel(host)["readyCount"] == 1, (
+        f"auto readiness did not count towards the tally: {parallel(host)}")
+    print(f"    the emptied client seat is AUTO-ready on both machines "
+          f"({tally(host)[2]}/{tally(host)[3]})")
+
+    # gaining a unit clears it again - the auto bit is derived, not remembered
+    theirs = [u["id"] for u in battle(host)["units"]
+              if u.get("faction") == 0 and not u.get("isOut")
+              and u.get("coop") == hseat]
+    assert theirs, "the host commands nothing to gift back"
+    gift(host, theirs[0], cseat)
+    settle(host, client, seconds=6)
+    assert PI.wait_until(lambda: tally(host)[1] == [], 40), (
+        f"the client seat is still auto-ready after being gifted unit "
+        f"{theirs[0]}: host {tally(host)}, client units "
+        f"{client_units(host, client, cseat)}")
+    print(f"PASS 3: auto-ready followed the roster in both directions "
+          f"(emptied -> ready, gifted unit {theirs[0]} back -> cleared)")
+
+
+# ---- 8. E16: the abandon vote coexists with the tally -----------------------
+
+def vote(gc):
+    return gc.ok({"cmd": "vote_state"})
+
+
+def scenario_vote(host, client, hseat, cseat):
+    print("-- 8 (E16): abandon-mission vote alongside a live readiness tally --")
+    assert PI.idle(host), "the host is still busy"
+    arm(client)
+    wait_tally(host, client, [cseat], "before the vote")
+
+    host.ok({"cmd": "battle_action", "action": "abort"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        v = gc.wait_for(
+            f"{tag} abandon-mission VoteMenu",
+            lambda gc=gc: (lambda s: s if (s.get("active") and s.get("menuOpen"))
+                           else None)(gc.ok({"cmd": "vote_state"})),
+            timeout=30, interval=0.25)
+        assert v["action"] == "abandon_mission", f"{tag}: wrong vote: {v}"
+    print("    the VoteMenu opened on both machines with the tally still live")
+
+    # With the menu up, the battlescape is not the top state, so the commit is
+    # HELD even once every seat is ready - the vote supersedes it by construction.
+    turn_before = turn_of(host)
+    hush(host, client)
+    arm(host)
+    time.sleep(4)
+    ph = parallel(host)
+    assert turn_of(host) == turn_before, (
+        f"the side committed underneath an open VoteMenu (turn {turn_before} -> "
+        f"{turn_of(host)}) - the player is looking at the vote, not the battle")
+    assert ph["commitBlocked"] == "not_top_state", (
+        f"the commit was held for the wrong reason while the vote was open: "
+        f"{ph['commitBlocked']}")
+    print(f"    both seats ready ({ph['readyCount']}/{ph['seatCount']}) and the "
+          f"commit is held on `{ph['commitBlocked']}` - the vote wins")
+
+    # a NO leaves everything exactly as it was: battle, tally and all
+    cast = client.ok({"cmd": "vote_cast", "yes": False})
+    assert cast.get("accepted"), f"the client's NO was rejected: {cast}"
+    for gc, tag in ((host, "host"), (client, "client")):
+        v = gc.wait_for(f"{tag} failed vote",
+                        lambda gc=gc: (lambda s: s if s.get("finished") else None)(
+                            gc.ok({"cmd": "vote_state"})),
+                        timeout=30, interval=0.25)
+        assert v["passed"] is False, f"{tag}: a 1-1 split passed: {v}"
+        assert battle(gc).get("inBattle"), f"{tag}: a FAILED vote ended the battle"
+    for gc in (host, client):
+        gc.ok({"cmd": "vote_close"})
+    host.ok({"cmd": "vote_clear_cooldown"})
+    print("    the NO failed the vote and the battle survived it")
+
+    # the tally survived the vote too, so the commit resumes the moment the menu
+    # is gone - which is the same thing as "a failed abandon changes nothing".
+    got = wait_side(host, client, turn_before, timeout=240)
+    assert got, (
+        f"the held commit never resumed once the VoteMenu closed: "
+        f"host={parallel(host)} top={TW.top(host)}")
+    print(f"    the held commit resumed once the menu closed (turn {got})")
+
+    # ...and a PASSING abandon supersedes the tally. The vote is opened FIRST and
+    # the seats armed underneath it: arming first would complete the tally and
+    # close the side before ABORT could be pressed (btnAbortClick needs
+    # allowButtons(), which is false off the player side).
+    assert PI.idle(host), "the host is still busy"
+    turn_before = turn_of(host)
+    stale_id = host.ok({"cmd": "vote_state"})["id"]
+    host.ok({"cmd": "battle_action", "action": "abort"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} second VoteMenu",
+                    lambda gc=gc: (lambda s: s if (s.get("active") and s.get("menuOpen")
+                                                   and not s.get("finished")
+                                                   and s.get("id") != stale_id) else None)(
+                        gc.ok({"cmd": "vote_state"})),
+                    timeout=30, interval=0.25)
+    arm(host)
+    if not parallel(client)["localReady"]:
+        arm(client)
+    assert PI.wait_until(lambda: parallel(host)["allReady"] is True, 30), (
+        f"the tally is not complete under the open menu, so 'the abandon "
+        f"supersedes it' would prove nothing: {parallel(host)}")
+    assert turn_of(host) == turn_before, (
+        f"the side committed under the second VoteMenu (turn {turn_before} -> "
+        f"{turn_of(host)})")
+    client.ok({"cmd": "vote_cast", "yes": True})
+    ended = PI.wait_until(lambda: not battle(host).get("inBattle"), 180, interval=1.0)
+    assert ended, (
+        f"the passing abandon vote did not end the mission: host "
+        f"top={TW.top(host)} battle={battle(host).get('inBattle')}")
+    print("PASS 8: the abandon vote and the readiness tally coexist - the menu "
+          "holds the commit, a NO changes nothing, and a passing abandon "
+          "supersedes the tally and ends the mission")
+
+
+# ---- main ------------------------------------------------------------------
+
+def main():
+    fail = None
+    host = GameClient("host", 48878,
+                      make_user_dir("p8_endturn_host",
+                                    options={"battleXcomSpeed": FAST_SPEED,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48879,
+                        make_user_dir("p8_endturn_client",
+                                      options={"battleXcomSpeed": FAST_SPEED,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        ps = parallel(host)
+        for field in ("readySeats", "autoSeats", "sideSeq", "readyCount",
+                      "seatCount", "commitBlocked"):
+            assert field in ps, (
+                f"parallel_state carries no `{field}` - every assertion below "
+                f"would be vacuous: {sorted(ps)}")
+        hseat = parallel(host)["localSeat"]
+        cseat = parallel(client)["localSeat"]
+        assert hseat != cseat, f"both machines report seat {hseat}"
+        print(f"seats: host {hseat}, client {cseat}; "
+              f"{parallel(host)['seatCount']} seat(s) in the roster; "
+              f"{len(hostiles(host))} live hostile(s) in the fixture")
+
+        cmover = PI.pick_driver(host, client, cseat, "client")
+        hmover = PI.pick_driver(host, client, hseat, "host")
+
+        # Order is fixture-driven: the scenarios that close a side come before
+        # the one that gives the client's soldiers away, and the one that ends
+        # the mission is last.
+        scenario_toggle(host, client, hseat, cseat)
+        scenario_auto_clear(host, client, cseat, cmover)
+        scenario_reserve(host, client, cmover)
+        scenario_commit_and_drain(host, client, hmover, hseat, cseat)
+        assert battle(host).get("inBattle"), (
+            "the fixture's mission ended during the first side close (its last "
+            "hostile went down) - nothing below could be asserted")
+        cmover = ensure_driver(host, client, cseat, "client", cmover)
+        scenario_race(host, client, hseat, cseat, cmover)
+        assert battle(host).get("inBattle"), \
+            "the fixture's mission ended during the E14 scenario"
+        session.assert_battle_synced(host, client, "after the readiness scenarios")
+        assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+            "the PRD-P2 drift tripwire fired during the readiness scenarios"
+        hmover = ensure_driver(host, client, hseat, "host", hmover)
+        scenario_auto_ready(host, client, hseat, cseat, hmover)
+        scenario_vote(host, client, hseat, cseat)
+
+        print("ALL END-TURN READINESS TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+                print(f"  DBG {tag} top:      {TW.top(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_explosion_cluster.py b/tools/coop_test/test_parallel_explosion_cluster.py
new file mode 100644
index 000000000..277e8de82
--- /dev/null
+++ b/tools/coop_test/test_parallel_explosion_cluster.py
@@ -0,0 +1,246 @@
+"""Explosion ordered-replay E0: heavy-cluster RED scaffold for mutation 5C
+("casualty-value replay under a heavy cluster").
+
+5C's concern (research_explosion_mutations.md): when a primary blast chain-
+detonates several ALREADY-CHARGED secondary tiles in one go, the client's
+local explode()/checkForTerrainExplosions replay and the host's ordered event
+log can disagree about the ORDER those secondaries resolve in - which matters
+once E1 makes casualty attribution/value depend on replay order. E0 does not
+touch the explosion sim (that lands in E1); this fixture only has to (i) stage
+a reproducible cluster of charged secondaries and (ii) prove the
+`explosion_replay_disable` lever this phase added exists, is introspectable,
+and actually flips - the switch E1 will wire to force the legacy (non-ordered)
+sim path for a same-build red/green comparison once the ordered replay lands.
+
+STAGING MECHANISM: reuses the chain-atomicity item-2 fixture's `battle_tiles
+{set_explosive:...}` lever (test_parallel_explosive_carrier.py) to arm a
+cluster of tiles with an explosive charge on BOTH machines, matched. Each
+armed tile is a "charged secondary": when a primary blast reaches it,
+checkForTerrainExplosions spawns a chained ExplosionBState that consumes it.
+A (2R+1)^2 block at R=1 already stages 9 >= the 5C minimum of 3.
+
+SHORTFALL (documented per the E0 task, not faked): this fixture stages the
+cluster and fires ONE primary blast into it so the chain reproducibly fires,
+and reports (does not assert) how many secondaries each machine's replay
+consumed - useful diagnostic context for E1, but not a correctness gate.
+Nothing here enforces per-secondary REPLAY ORDER (that is the actual 5C
+mechanism) because E0 ships no ordering machinery to gate on; `--probe` prints
+the raw numbers for a human to eyeball. The only ASSERTED outcomes in E0 are:
+the cluster staged >= 3 tiles identically on both machines, and the
+`explosion_replay_disable` lever round-trips through `parallel_state`.
+
+Run:
+  python tools/coop_test/test_parallel_explosion_cluster.py            # assert GREEN
+  python tools/coop_test/test_parallel_explosion_cluster.py --probe    # also print secondary counts
+
+Exit 0 = pass; 2 = failure. Keeps well under 180 s (one bring-up, one burst).
+"""
+
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+PORT = "47993"
+
+WEAPON = os.environ.get("E0_HE_WEAPON", "STR_AUTO_CANNON")
+AMMO = os.environ.get("E0_HE_AMMO", "STR_AC_HE_AMMO")
+
+# (2R+1)^2 block of armed tiles - R=1 stages 9, comfortably >= the 5C minimum
+# of 3 charged secondaries in one blast.
+CLUSTER_R = 1
+EXPL_POWER = 20
+MIN_SECONDARIES = 3
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def tiles(gc):
+    return gc.ok({"cmd": "battle_tiles"})
+
+
+def arm_cluster(gcs, cx, cy, cz, power, rad):
+    """Lifted verbatim from test_parallel_explosive_carrier.py (chain-atomicity
+    item-2): arm every tile in a (2*rad+1)^2 block centred on (cx,cy,cz) on
+    each of `gcs`, so BOTH machines start the burst holding the SAME charged
+    cluster."""
+    for gc in gcs:
+        for dx in range(-rad, rad + 1):
+            for dy in range(-rad, rad + 1):
+                gc.cmd({"cmd": "battle_tiles", "set_explosive": power,
+                        "explosiveType": 0, "x": cx + dx, "y": cy + dy, "z": cz})
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--probe", action="store_true",
+                    help="also print the per-machine secondary-consumption counts")
+    args = ap.parse_args()
+
+    fail = None
+    host = GameClient("host", 48792,
+                      make_user_dir("e0_explcluster_host",
+                                    options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48793,
+                        make_user_dir("e0_explcluster_client",
+                                      options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client)
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"skirmish fixture came up gamemode {gm}; parallel turns only cover PVE "
+            f"(1) and PVE2 (4) - this fixture would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        # ---- (ii) the explosion_replay_disable lever: exists, introspectable, flips --
+        pc0 = parallel(client)
+        assert "explosionReplayDisable" in pc0, (
+            f"parallel_state carries no `explosionReplayDisable` - "
+            f"bin/x64/Release/OpenXcom.exe predates the E0 LEAK-OBJ/lever "
+            f"instrumentation; rebuild it (serial, MP=false). fields: {sorted(pc0)}")
+        assert pc0["explosionReplayDisable"] is False, \
+            f"lever not at its default (off): {pc0['explosionReplayDisable']}"
+
+        # NOTE: the readout is emitted BEFORE the lever-setter runs in this same
+        # request (matches the existing atomic_death_disable/etc. levers in
+        # TestServer.cpp), so the flip is only visible on a FOLLOW-UP read, not
+        # in the response to the request that set it.
+        client.ok({"cmd": "parallel_state", "explosion_replay_disable": True})
+        after_on = parallel(client)["explosionReplayDisable"]
+        assert after_on is True, \
+            f"a follow-up parallel_state read shows the lever did not latch ON: {after_on}"
+        print(f"    explosion_replay_disable: OFF -> ON confirmed "
+              f"(parallel_state.explosionReplayDisable={after_on})")
+
+        client.ok({"cmd": "parallel_state", "explosion_replay_disable": False})
+        after_off = parallel(client)["explosionReplayDisable"]
+        assert after_off is False, \
+            f"a follow-up parallel_state read shows the lever did not clear: {after_off}"
+        print(f"    explosion_replay_disable: ON -> OFF confirmed "
+              f"(parallel_state.explosionReplayDisable={after_off})")
+        print("PASS (ii): explosion_replay_disable exists, is introspectable via "
+              "parallel_state, and flips both directions (E0 scaffolding only - "
+              "E1 wires it to force the legacy sim path)")
+
+        # ---- (i) stage a reproducible cluster of >= 3 charged secondaries -----
+        probe = tiles(host)
+        for field in ("explosiveTiles", "explosiveHash", "explosiveSum"):
+            assert field in probe, (
+                f"battle_tiles carries no `{field}` - bin/x64/Release/OpenXcom.exe "
+                f"predates the item-2 explosive census; rebuild it. fields: {sorted(probe)}")
+
+        hseat = parallel(host)["localSeat"]
+        enemy = PI.alive_enemy(battle(host))
+        assert enemy, "the skirmish came up with no hostile to orient the cluster around"
+        cx, cy, cz = enemy["x"], enemy["y"], enemy["z"]
+
+        shooter = None
+        for cand in PI.own_units(battle(client), hseat):
+            sid = cand["id"]
+            if PI.place_adjacent(host, client, sid, (cx, cy, cz)):
+                PI.top_up(host, client, sid)
+                shooter = sid
+                break
+        assert shooter, "could not place a shooter near the cluster centre"
+
+        arm_cluster((host, client), cx, cy, cz, EXPL_POWER, CLUSTER_R)
+        th = tiles(host)
+        tc = tiles(client)
+        armed = min(th["explosiveTiles"], tc["explosiveTiles"])
+        matched = th["explosiveHash"] == tc["explosiveHash"]
+        print(f"    cluster staged at ({cx},{cy},{cz}) r={CLUSTER_R}: "
+              f"host {th['explosiveTiles']}t client {tc['explosiveTiles']}t "
+              f"matched={matched}")
+        assert matched, (
+            f"the cluster did not arm IDENTICALLY on both machines - host hash "
+            f"{th['explosiveHash']} client {tc['explosiveHash']} - the fixture "
+            f"itself is not reproducible")
+        assert armed >= MIN_SECONDARIES, (
+            f"only staged {armed} charged secondaries (need >= {MIN_SECONDARIES} "
+            f"for the 5C minimum) - SHORTFALL: could not cheaply stage a larger "
+            f"cluster on this map/seed. Documenting per the E0 task rather than "
+            f"faking a bigger number: {armed} is the largest this fixture reaches "
+            f"with CLUSTER_R={CLUSTER_R}, EXPL_POWER={EXPL_POWER}.")
+        print(f"PASS (i): {armed} charged secondaries staged identically on both "
+              f"machines (>= {MIN_SECONDARIES} required for 5C)")
+
+        # ---- fire ONE primary blast into the cluster: reproduces the chain -----
+        # Report-only (E0 does not enforce ordering here - see docstring); this
+        # just proves the staged cluster actually detonates as a chain, so the
+        # scaffold is a live repro for E1, not just inert tile state.
+        wid = PI.give_both(host, client, shooter, WEAPON, AMMO)
+        assert PI.idle(host), "host still busy before the cluster burst"
+        r = PI.intent(host, action="shoot", unit=shooter, mode="auto", weapon_id=wid,
+                      x=cx, y=cy, z=cz)
+        assert r.get("ok"), f"the cluster-triggering shot was refused: {r}"
+
+        end = time.time() + 14.0
+        max_host = 0
+        max_client = 0
+        while time.time() < end:
+            th = tiles(host)
+            tc = tiles(client)
+            max_host = max(max_host, th["explosiveTiles"])
+            max_client = max(max_client, tc["explosiveTiles"])
+            if th["explosiveTiles"] == 0 and tc["explosiveTiles"] == 0:
+                break
+            time.sleep(0.1)
+        PI.idle(host, 60)
+        time.sleep(1.0)
+        th = tiles(host)
+        tc = tiles(client)
+        settled_match = th["explosiveHash"] == tc["explosiveHash"]
+        print(f"    burst fired: settled host {th['explosiveTiles']}t / "
+              f"client {tc['explosiveTiles']}t (settledMatch={settled_match})")
+        if args.probe:
+            print(f"PROBE: cluster consumed - armed {armed}, settledMatch "
+                  f"{settled_match}, settledHost {th['explosiveTiles']} "
+                  f"settledClient {tc['explosiveTiles']}")
+
+        print("PASS: heavy-cluster scaffold staged and fired a reproducible "
+              f"{armed}-secondary chain; explosion_replay_disable round-trips "
+              "through parallel_state. Both become the E1 enforcing gate; E0 "
+              "only has to prove the scaffold and the lever exist.")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} tiles:    {tiles(gc)}")
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    print("\n==== E0 heavy-cluster RED scaffold summary ====")
+    if fail:
+        print(f"  FAIL {fail}")
+        sys.exit(2)
+    print("  cluster staging + explosion_replay_disable lever both confirmed; "
+          "5C ordering itself is E1's job")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_explosion_thin.py b/tools/coop_test/test_parallel_explosion_thin.py
new file mode 100644
index 000000000..a3ea983f7
--- /dev/null
+++ b/tools/coop_test/test_parallel_explosion_thin.py
@@ -0,0 +1,481 @@
+"""Explosion ordered-replay migration, Phase E1: the PARALLEL client stops
+running the authoritative explosion simulation.
+
+THE CHANGE. Before E1, `ExplosionBState` ran `TileEngine::explode()` (the
+ray-trace, casualty pass, chain-discovery, gravity, FOV) UNGATED on both
+machines - the host's outcome carriers (`destroy_tile`, `set_explosive_tile`,
+`explode_items`, `hit_unit`, `unit_casualty`, ...) landed on the client while
+its own independent sim was ALSO running on the animation clock, racing the
+carriers. E1 makes the parallel client DISPLAY-ONLY: `ExplosionBState::init`
+gates the single `explode()` call (:293) and member `explode()` gates
+`checkForCasualties` (:580) on a new `_coopReplayDisplay` latch
+(`parallelTurnActive() && !getHost() && !g_explosionReplayDisable`). The blast
+ANIMATION (sprites, flash, sound, camera) is untouched - only the two sim
+calls are gated. The one client-side mutation that used to ride inside the now-
+gated `explode()` call with no carrier of its own - the per-tile gravity settle
+(`applyGravity`, TileEngine.cpp:3914-3917) - is DERIVED at the client's
+`destroy_tile` apply instead (connectionTCP.cpp, mirroring the host's own
+per-affected-tile pattern).
+
+THREE CASES, because the spawn inventory (plan doc S1.1) says a shot, a timed
+grenade and a proximity trigger all reach `ExplosionBState` through different
+call paths on the client (intent-replay, the local `endTurn` sweep, and
+movement-replay respectively), and E1's gate has to hold for all three:
+
+  (a) an HE blast fired into terrain near a hostile (shot-origin, non-boundary
+      chain - exercises the `coopStampLooseOutcomeChain("expl")` mid-side path).
+  (b) a timed grenade primed+thrown, resolved on the end-turn boundary sweep
+      (`BattlescapeGame.cpp:1850 forRemoval` - exercises the BOUNDARY-phase
+      `_coopBoundaryExpl` bracket, `coopSetBoundaryCasualty`).
+  (c) a primed proximity grenade dropped on the ground, triggered by a unit
+      walking onto it (movement-replay spawn path, `BattlescapeGame.cpp:5990`
+      family).
+
+GREEN (E1 build, lever off - the default): every sync-check bucket
+(terrain/unitsCore/items/itemIdCtr/unitsCombat) stays at mismatchCount==0
+through all three cases under the STRICT burn-in lever (every seq compared, not
+just side-gated boundaries); `parallel_state.explodeCallsSuppressed` and
+`explosionsDisplayOnly` climb on the client (proof the display-only path
+actually ran, not a vacuously-true green); item AND terrain census are
+SYMMETRIC on both machines after each case (assert symmetry, not survival -
+see memory `coop-proximity-sweep-fix`: a blast destroying gear is correct, the
+two machines disagreeing about WHAT it destroyed is the bug).
+
+RED (same build, `parallel_state {explosion_replay_disable:true}` on the
+CLIENT only): `_coopReplayDisplay` computes false again, so the client's
+`ExplosionBState` re-enters the old racing sim - `explodeCallsSuppressed` /
+`explosionsDisplayOnly` must stop climbing (the deterministic proof the lever
+actually re-routed the code path), and the E0-era heavy-cluster/explosion
+straddle (items/unitsCore/itemIdCtr drift at explosion seqs) is a STATISTICAL
+reappearance - reported, not hard-asserted (retry-tolerant, same as the D.3b
+and item-2 probes this fixture borrows its RX/lever idiom from).
+
+Run:  python tools/coop_test/test_parallel_explosion_thin.py [--seed N]
+                 [--slow-client MS]
+Exit 0 = pass; 2 = failure.
+"""
+
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "48030"
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+HE_WEAPON = os.environ.get("E1_HE_WEAPON", "STR_AUTO_CANNON")
+HE_AMMO = os.environ.get("E1_HE_AMMO", "STR_AC_HE_AMMO")
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def items(gc):
+    return gc.ok({"cmd": "battle_items"})
+
+
+def item_census(gc):
+    """{itemId: (type, ownerUnitId)} - the same shape test_coop_blast_item_damage /
+    test_coop_alien_launcher_item_loss use, so a divergence prints readably."""
+    return {i["id"]: (i["type"], i.get("owner", -1)) for i in items(gc)["items"]}
+
+
+def diff_item_census(h, c):
+    out = []
+    for iid in sorted(set(h) | set(c)):
+        a, b = h.get(iid), c.get(iid)
+        if a == b:
+            continue
+        if a is None:
+            out.append(f"item {iid} {b[0]} exists ONLY on the client (owner {b[1]})")
+        elif b is None:
+            out.append(f"item {iid} {a[0]} exists ONLY on the host (owner {a[1]})")
+        else:
+            out.append(f"item {iid} {a[0]}: host owner {a[1]} vs client owner {b[1]}")
+    return out
+
+
+def bucket_snapshot(host):
+    sc = session.sync_check(host)
+    return {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+
+
+def expl_counters(client):
+    pc = parallel(client)
+    return pc.get("explodeCallsSuppressed", 0), pc.get("explosionsDisplayOnly", 0)
+
+
+# ---- case (a): HE blast into terrain (shot-origin, mid-side chain) ---------
+
+def case_he_blast(host, client, used):
+    tag = "case A (HE blast)"
+    enemy = PI.alive_enemy(battle(host))
+    assert enemy, f"{tag}: no live hostile to orient the blast around"
+    epos = (enemy["x"], enemy["y"], enemy["z"])
+    hseat = parallel(host)["localSeat"]
+    shooter = None
+    for cand in PI.own_units(battle(client), hseat):
+        if cand["id"] in used:
+            continue
+        if PI.place_adjacent(host, client, cand["id"], epos):
+            PI.top_up(host, client, cand["id"])
+            shooter = cand["id"]
+            break
+    assert shooter, f"{tag}: could not place a shooter near the hostile"
+    used.add(shooter)
+    wid = PI.give_both(host, client, shooter, HE_WEAPON, HE_AMMO)
+    assert PI.idle(host), f"{tag}: host still busy before the burst"
+    PI.top_up(host, client, shooter)
+    r = PI.intent(host, action="shoot", unit=shooter, mode="auto", weapon_id=wid,
+                  x=epos[0], y=epos[1], z=epos[2])
+    assert r.get("ok"), f"{tag}: HE shoot intent refused: {r}"
+    assert PI.idle(host, 60), f"{tag}: host chain never ended after the HE burst"
+    SOAK.settle_display(host, client, timeout=30)
+    time.sleep(1.0)
+    return tag
+
+
+# ---- case (b): timed grenade, resolved on the end-turn boundary sweep ------
+
+def case_timed_grenade(host, client, used):
+    tag = "case B (timed grenade, end-turn sweep)"
+    hseat = parallel(host)["localSeat"]
+    thrower = None
+    for cand in PI.own_units(battle(host), hseat):
+        if cand["id"] in used:
+            continue
+        thrower = cand["id"]
+        break
+    if thrower is None:
+        return tag, False, "no live own soldier left to throw the grenade"
+    used.add(thrower)
+    PI.top_up(host, client, thrower)
+    wid = PI.give_both(host, client, thrower, "STR_GRENADE")
+    r = PI.intent(host, action="prime", unit=thrower, fuse=1, weapon_id=wid)
+    assert r.get("ok"), f"{tag}: prime intent refused: {r}"
+    assert PI.idle(host, 30), f"{tag}: host busy after prime"
+    tpos = PI.pos(battle(host), thrower)
+    enemy = PI.alive_enemy(battle(host))
+    tgt = (enemy["x"], enemy["y"], enemy["z"]) if enemy else \
+        (tpos[0] + 2, tpos[1], tpos[2])
+    r = PI.intent(host, action="throw", unit=thrower, weapon_id=wid,
+                  x=tgt[0], y=tgt[1], z=tgt[2])
+    if not r.get("ok"):
+        return tag, False, f"throw intent refused: {r}"
+    assert PI.idle(host, 30), f"{tag}: host chain (the throw) never ended"
+    SOAK.settle_display(host, client, timeout=30)
+
+    # NOTE (E1 finding): BattlescapeGame.cpp:1821's whole fuse-roll/spawn loop
+    # (the `forRemoval`/`fuseExploded` mechanism at :1850) is gated OFF on ANY
+    # coop client via the CLASSIC idiom `coopFuseClient = getCoopStatic() &&
+    # !getHost()` (:1816) - true for a parallel client too, since
+    # parallelTurnActive() requires getCoopStatic()==true. So a thrown grenade's
+    # own detonation NEVER constructs a client-side ExplosionBState at all: its
+    # consequences arrive purely via the pre-existing outcome carriers
+    # (hit_unit/explode_items/destroy_tile/...) attributed to the HOST's own
+    # instance, plus the dedicated `fuse_events` packet
+    # (connectionTCP.cpp:9071-9113) that removes the item itself. There is
+    # nothing for `_coopReplayDisplay` to suppress on THIS spawn path - it was
+    # already carrier-only before E1. So this case additionally arms a small
+    # boundary-terrain charge (`checkForTerrainExplosions`, TileEngine.cpp:4110,
+    # called UNGATED from BOTH machines at BattlescapeGame.cpp:1924/1928 and
+    # :1951/1955) so the boundary sweep is GUARANTEED to construct a real
+    # client-side boundary ExplosionBState (_coopBoundaryExpl=true) regardless
+    # of the grenade's RNG roll - the deterministic half of this case.
+    safe_tile = (tpos[0], tpos[1], tpos[2])
+    for gc in (host, client):
+        gc.cmd({"cmd": "battle_tiles", "set_explosive": 20, "explosiveType": 0,
+                "x": safe_tile[0], "y": safe_tile[1], "z": safe_tile[2]})
+
+    # A fuse==1 grenade detonates on prepareNewTurn's countdown sweep (RNG-gated,
+    # best-effort); the armed terrain tile above detonates deterministically at
+    # the same boundary. Close sides (bounded) until the grenade is gone from the
+    # census or the mission ends.
+    detonated = not any(i["id"] == wid for i in items(host)["items"])
+    tries = 0
+    while not detonated and battle(host).get("inBattle") and tries < 3:
+        turn_before = bstate(host)["turn"]
+        SOAK.close_side(host, client, 0, 1, turn_before)
+        detonated = not any(i["id"] == wid for i in items(host)["items"])
+        tries += 1
+    return tag, detonated, None
+
+
+# ---- case (c): proximity grenade, triggered by movement-replay -------------
+
+def case_proximity(host, client, used):
+    tag = "case C (proximity trigger)"
+    hseat = parallel(host)["localSeat"]
+    walker = None
+    for cand in PI.own_units(battle(host), hseat):
+        if cand["id"] in used:
+            continue
+        dest = PI.free_step_both(host, client, cand["id"])
+        if dest:
+            walker = cand["id"]
+            wdest = dest
+            break
+    if walker is None:
+        return tag, False, "no live own soldier with a clean single-step tile"
+    used.add(walker)
+    PI.top_up(host, client, walker)
+
+    drop = [host.ok({"cmd": "battle_give", "unit": walker, "item": "STR_PROXIMITY_GRENADE",
+                     "slot": "ground", "fuse": 0,
+                     "x": wdest[0], "y": wdest[1], "z": wdest[2]}),
+            client.ok({"cmd": "battle_give", "unit": walker, "item": "STR_PROXIMITY_GRENADE",
+                       "slot": "ground", "fuse": 0,
+                       "x": wdest[0], "y": wdest[1], "z": wdest[2]})]
+    assert drop[0]["weaponId"] == drop[1]["weaponId"], (
+        f"{tag}: proximity grenade minted different ids on the two machines: {drop}")
+    time.sleep(1.5)
+
+    r = PI.intent(host, action="move", unit=walker, x=wdest[0], y=wdest[1], z=wdest[2])
+    if not r.get("ok"):
+        return tag, False, f"move onto the trigger tile refused: {r}"
+    assert PI.idle(host, 60), f"{tag}: host chain (the walk) never ended"
+    SOAK.settle_display(host, client, timeout=30)
+    return tag, True, None
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=71717171)
+    ap.add_argument("--slow-client", type=int, default=250,
+                    help="ms/frame on the client so a real animation-clock/packet-clock "
+                         "race is possible if the gate ever regresses (and so RED, which "
+                         "re-enables the racing sim, has room to actually race)")
+    args = ap.parse_args()
+
+    fails = []
+    notes = []
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48930, make_user_dir("e1_expl_host", options=host_opts))
+    client = GameClient("client", 48931, make_user_dir("e1_expl_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PI.PORT = PORT
+    PE.PORT = PORT
+    used = set()
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"skirmish fixture came up gamemode {gm}; parallel turns only cover PVE "
+            f"(1) and PVE2 (4) - this fixture would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        pc0 = parallel(client)
+        for field in ("explodeCallsSuppressed", "explosionsDisplayOnly", "explosionReplayDisable"):
+            assert field in pc0, (
+                f"parallel_state carries no `{field}` - bin/x64/Release/OpenXcom.exe "
+                f"predates the E1 explosion-thin-client instrumentation; rebuild it "
+                f"(serial, MP=false). fields: {sorted(pc0)}")
+        assert pc0["explosionReplayDisable"] is False, "replay lever not at its default (off)"
+        print(f"battle up (seed {args.seed}, gm {gm}). weapon={HE_WEAPON}/{HE_AMMO}")
+
+        SOAK.enable_strict_burnin(host, client)
+
+        pre_h = item_census(host)
+        pre_c = item_census(client)
+        d0 = diff_item_census(pre_h, pre_c)
+        assert not d0, f"item censuses diverged BEFORE any case ran: {d0}"
+
+        sup0, disp0 = expl_counters(client)
+        print(f"pre-case: explodeCallsSuppressed={sup0} explosionsDisplayOnly={disp0}")
+
+        # ---- case A: HE blast -------------------------------------------------
+        buckets_pre = bucket_snapshot(host)
+        tagA = case_he_blast(host, client, used)
+        sup_a, disp_a = expl_counters(client)
+        hc_a, cc_a = item_census(host), item_census(client)
+        d_a = diff_item_census(hc_a, cc_a)
+        buckets_a = bucket_snapshot(host)
+        delta_a = {k: buckets_a[k] - buckets_pre.get(k, 0) for k in FIVE}
+        print(f"{tagA}: explodeCallsSuppressed {sup0}->{sup_a} "
+              f"explosionsDisplayOnly {disp0}->{disp_a}  bucket delta {delta_a}")
+        if d_a:
+            fails.append(f"{tagA}: item census diverged: {d_a}")
+        if sup_a <= sup0:
+            notes.append(f"{tagA}: explodeCallsSuppressed did not climb ({sup0}->{sup_a})")
+
+        # ---- case B: timed grenade / end-turn sweep ---------------------------
+        if not battle(host).get("inBattle"):
+            print("       SKIP case B/C: the mission ended during case A")
+            tagB, det_b, why_b = "case B (timed grenade)", None, "mission ended"
+        else:
+            buckets_pre_b = bucket_snapshot(host)
+            tagB, det_b, why_b = case_timed_grenade(host, client, used)
+            sup_b, disp_b = expl_counters(client)
+            hc_b, cc_b = item_census(host), item_census(client)
+            d_b = diff_item_census(hc_b, cc_b)
+            buckets_b = bucket_snapshot(host)
+            delta_b = {k: buckets_b[k] - buckets_pre_b.get(k, 0) for k in FIVE}
+            print(f"{tagB}: detonated={det_b} why={why_b} "
+                  f"explodeCallsSuppressed ->{sup_b} explosionsDisplayOnly ->{disp_b} "
+                  f"bucket delta {delta_b}")
+            if why_b:
+                notes.append(f"{tagB}: {why_b} (staging shortfall, not a product result)")
+            elif not det_b:
+                notes.append(f"{tagB}: grenade never detonated within the bounded side-close "
+                             f"budget (staging shortfall, not a product result)")
+            if d_b:
+                fails.append(f"{tagB}: item census diverged: {d_b}")
+
+        # ---- case C: proximity trigger -----------------------------------------
+        if not battle(host).get("inBattle"):
+            print("       SKIP case C: the mission ended during case A/B")
+            tagC, ok_c, why_c = "case C (proximity)", None, "mission ended"
+        else:
+            buckets_pre_c = bucket_snapshot(host)
+            tagC, ok_c, why_c = case_proximity(host, client, used)
+            sup_c, disp_c = expl_counters(client)
+            hc_c, cc_c = item_census(host), item_census(client)
+            d_c = diff_item_census(hc_c, cc_c)
+            buckets_c = bucket_snapshot(host)
+            delta_c = {k: buckets_c[k] - buckets_pre_c.get(k, 0) for k in FIVE}
+            print(f"{tagC}: triggered={ok_c} why={why_c} "
+                  f"explodeCallsSuppressed ->{sup_c} explosionsDisplayOnly ->{disp_c} "
+                  f"bucket delta {delta_c}")
+            if why_c:
+                notes.append(f"{tagC}: {why_c} (staging shortfall, not a product result)")
+            if d_c:
+                fails.append(f"{tagC}: item census diverged: {d_c}")
+
+        # ---- GREEN verdict: cumulative buckets + counters + terrain(sync) -----
+        sup_final, disp_final = expl_counters(client)
+        sc = session.assert_sync_clean(host, client, "after all three E1 cases",
+                                       strict=True, allow=())
+        buckets_final = {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+        print(f"\n== GREEN VERDICT ==")
+        print(f"  five buckets (strict, cumulative): {buckets_final}")
+        print(f"  explodeCallsSuppressed(client): {sup0}->{sup_final}  "
+              f"explosionsDisplayOnly(client): {disp0}->{disp_final}")
+        bad_buckets = {n: c for n, c in buckets_final.items() if c > 0}
+        if bad_buckets:
+            fails.append(f"GREEN: five-bucket mismatch {bad_buckets} under strict burn-in.\n"
+                         f"    {session._sync_mismatch_lines(sc)}")
+        if sup_final <= sup0:
+            fails.append(f"GREEN: explodeCallsSuppressed never climbed on the client "
+                         f"({sup0}->{sup_final}) - the display path was never exercised, "
+                         f"so GREEN would be vacuous")
+        if disp_final <= disp0:
+            fails.append(f"GREEN: explosionsDisplayOnly never climbed on the client "
+                         f"({disp0}->{disp_final})")
+        for gc, tag in ((host, "host"), (client, "client")):
+            if TW.desync_seen(gc):
+                fails.append(f"the PRD-P2 drift tripwire FIRED on the {tag} during GREEN")
+
+        # ---- RED: same build, explosion_replay_disable on the CLIENT only -----
+        if not battle(host).get("inBattle"):
+            print("\n       SKIP RED: the mission ended before the RED demonstration")
+        else:
+            client.cmd({"cmd": "parallel_state", "explosion_replay_disable": True})
+            pcr = parallel(client)
+            assert pcr.get("explosionReplayDisable") is True, \
+                f"explosion_replay_disable lever did not latch on the client: {pcr}"
+            print("\n== RED: explosion_replay_disable=true on the CLIENT (same build) ==")
+
+            red_sup0, red_disp0 = expl_counters(client)
+            buckets_red_pre = bucket_snapshot(host)
+            red_used = set(used)
+            enemy = PI.alive_enemy(battle(host))
+            if enemy is None:
+                print("       NOTE: no live hostile left for the RED burst - skipping "
+                      "(the deterministic GREEN result above already stands)")
+            else:
+                try:
+                    case_he_blast(host, client, red_used)
+                except AssertionError as e:
+                    print(f"       NOTE: RED burst could not be staged: {e}")
+                red_sup1, red_disp1 = expl_counters(client)
+                buckets_red_post = bucket_snapshot(host)
+                delta_red = {k: buckets_red_post[k] - buckets_red_pre.get(k, 0) for k in FIVE}
+                straddle = sum(delta_red.values())
+                print(f"  RED: explodeCallsSuppressed {red_sup0}->{red_sup1} "
+                      f"explosionsDisplayOnly {red_disp0}->{red_disp1}")
+                print(f"  RED: bucket delta since the lever flipped: {delta_red} "
+                      f"(sum {straddle})")
+
+                if red_sup1 > red_sup0 or red_disp1 > red_disp0:
+                    fails.append(
+                        f"RED: explodeCallsSuppressed/explosionsDisplayOnly kept climbing "
+                        f"under explosion_replay_disable ({red_sup0}->{red_sup1}, "
+                        f"{red_disp0}->{red_disp1}) - the lever did not actually re-route "
+                        f"the client back to the old racing explode()/checkForCasualties path")
+                else:
+                    print(f"  RED confirmed (deterministic half): the display-only counters "
+                          f"stayed FLAT under the lever - the client is really running the "
+                          f"old sim again")
+                if straddle > 0:
+                    print(f"  RED confirmed (statistical half): the five-bucket straddle "
+                          f"REAPPEARED (sum {straddle}) with the racing sim re-enabled")
+                else:
+                    notes.append(
+                        f"RED: the five-bucket straddle did NOT reappear this run (sum 0) - "
+                        f"statistical, retry-tolerant (see module docstring); the "
+                        f"deterministic counter-flat proof above still shows the lever "
+                        f"engaged the old code path")
+
+            # restore the lever before anything else touches this battle
+            client.cmd({"cmd": "parallel_state", "explosion_replay_disable": False})
+            assert parallel(client).get("explosionReplayDisable") is False, \
+                "explosion_replay_disable lever did not revert on the client"
+
+        if notes:
+            print("\n== NOTES (not failures) ==")
+            for n in notes:
+                print(f"  NOTE {n}")
+
+        if not fails:
+            print("\nPASS: the parallel client's ExplosionBState ran display-only through "
+                  "an HE blast, a timed grenade and a proximity trigger - five-bucket "
+                  "sync-check clean under strict burn-in, item censuses symmetric, "
+                  "explodeCallsSuppressed/explosionsDisplayOnly both climbed, and the "
+                  "same build reproduced the old racing-sim code path under "
+                  "explosion_replay_disable")
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    print("\n==== E1 explosion-thin-client summary ====")
+    if fails:
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_explosive_carrier.py b/tools/coop_test/test_parallel_explosive_carrier.py
new file mode 100644
index 000000000..48a51b8e3
--- /dev/null
+++ b/tools/coop_test/test_parallel_explosive_carrier.py
@@ -0,0 +1,353 @@
+"""Chain-atomicity item-2: the tile explosive-charge CONSUMPTION must be host-shipped
+data, not a client display-side mutation.
+
+THE BUG (chain-atomicity audit A.1 / D.3 report): when a chained-terrain ExplosionBState
+starts, ExplosionBState::init reads the tile's explosive charge into _power and ZEROES it
+(`_tile->setExplosive(0,0,true)`). The ARM side of a tile's explosive charge already ships
+(the destroy_tile carrier), but this CONSUMPTION/zero was never shipped: the parallel
+replay client derived it from its own display loop instead. So the two machines' explosive-
+charge state (a saveBlob/terrain hash term) races the destroy_tile ARM carrier and diverges,
+and chained-explosion behaviour derives from it. Default skirmish maps carry ZERO explosive
+terrain (why soaks never showed it), so the fixture arms a tile CLUSTER on BOTH machines and
+fires an HE into it: the host consumes the cluster at sim rate while the pre-fix client
+consumes it at ANIMATION rate, so the client falls many tiles behind the host for seconds.
+
+THE FIX (item-2): the host ships every explosive-charge consumption as a stamped
+`set_explosive_tile` carrier (rides the ordered gate + D.1 action_end apply barrier exactly
+like destroy_tile); the parallel replay client stops zeroing locally and applies the packet
+instead. Classic co-op / PvP / single-player are byte-identical (the ship + the suppression
+are both parallel-PvE + host/replay-gated).
+
+METRIC (introspected via the `battle_tiles` explosive census this fixture's commit added -
+present in both the pre-fix and post-fix build): after the HE burst, sample both machines'
+armed-tile count rapidly.
+  maxLag = max(host_armed - client_armed) over the burst.
+Pre-fix the client zeroes at ANIMATION rate -> it lags the host by an animation-scale
+backlog (order of the cluster size). Post-fix the client zeroes at PACKET rate off the
+ordered carrier -> it tracks the host within a couple of in-flight packets. Both machines
+settle IDENTICAL (0) at quiescence either way, so the signal is the transient lag, not the
+settled state (which never distinguished the bug).
+
+An iteration is a valid trial only if the cluster armed IDENTICALLY on both machines
+pre-shot (else the shot had nothing to consume and the run would be vacuous).
+
+Run:
+  python tools/coop_test/test_parallel_explosive_carrier.py            # assert GREEN
+  python tools/coop_test/test_parallel_explosive_carrier.py --probe    # report maxLag
+  python tools/coop_test/test_parallel_explosive_carrier.py --iters 5 --seed 42
+
+Exit 0 = pass (GREEN: the client tracked the host's explosive state within LAG_TOL every
+burst); 2 = failure (the client fell an animation-scale backlog behind = the display-driven
+zero is still mutating explosive state locally).
+"""
+
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import session
+
+PORT = "47993"
+WEAPON = os.environ.get("PROBE_WEAPON", "STR_AUTO_CANNON")
+AMMO = os.environ.get("PROBE_AMMO", "STR_AC_HE_AMMO")
+MODE = os.environ.get("PROBE_MODE", "auto")
+
+# Explosive power pre-set on each cluster tile (radius = power/10). Kept LOW: the tiles are
+# pre-armed so any HE trigger cascades through the whole block regardless of per-tile power,
+# and a low power keeps the chained blasts from cratering the floor out from under the one
+# hostile the default skirmish spawns (so a single bring-up yields several bursts). The lag
+# signal is the tile COUNT (one animation per armed tile), not the power.
+EXPL_POWER = 20
+# Cluster half-width: a (2R+1)^2 block of armed tiles centred on the target.
+CLUSTER_R = 2
+# How many armed tiles the client may still hold at the instant the host reaches zero. The
+# ordered carrier lets the client trail the host by only a packet or two of RX in-flight;
+# the pre-fix animation backlog is an order of magnitude larger (~half the cluster).
+REMAIN_TOL = 6
+# How long to watch the two machines drain the cluster after the burst.
+SAMPLE_S = 14.0
+# A burst is a valid trial only if at least this many tiles armed IDENTICALLY on both
+# machines pre-shot (else the shot consumes nothing and the run is vacuous).
+MIN_CLUSTER = 9
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def tiles(gc):
+    return gc.ok({"cmd": "battle_tiles"})
+
+
+def arm_cluster(gcs, cx, cy, cz, power, rad):
+    for gc in gcs:
+        for dx in range(-rad, rad + 1):
+            for dy in range(-rad, rad + 1):
+                gc.cmd({"cmd": "battle_tiles", "set_explosive": power,
+                        "explosiveType": 0, "x": cx + dx, "y": cy + dy, "z": cz})
+
+
+def align_item_counter(host, client):
+    """Force both machines' SavedBattleGame item-id counter to a common value so the next
+    battle_give mints a MATCHED weapon id. The HE bursts mint corpses/items at diverging
+    counters (the expected item 3-5 casualty/corpse residual this fixture does NOT fix), which
+    would otherwise make give ids drift apart and starve the run of trials. Purely a fixture
+    lever - it re-aligns the id CURSOR, it does not touch the explosive-charge state under
+    test."""
+    ch = host.ok({"cmd": "save_blob"}).get("itemCounter", 0)
+    cc = client.ok({"cmd": "save_blob"}).get("itemCounter", 0)
+    target = max(ch, cc) + 4
+    for gc in (host, client):
+        gc.ok({"cmd": "save_blob", "set_item_counter": target})
+
+
+def give_weapon(host, client, uid, item, ammo):
+    """Matched-id hand-off on BOTH machines without the full battle-sync assert (a terrain
+    residual from a prior HE burst - the expected item 3-5 drift - must not abort a trial)."""
+    session.wait_sync_loop_closed(host)
+    align_item_counter(host, client)
+    req = {"cmd": "battle_give", "unit": uid, "item": item,
+           "slot": "right", "clear_hands": True}
+    if ammo:
+        req["ammo"] = ammo
+    ids = [gc.ok(dict(req)) for gc in (host, client)]
+    assert ids[0]["weaponId"] == ids[1]["weaponId"], (
+        f"battle_give minted different ids for {item} "
+        f"({ids[0]['weaponId']} vs {ids[1]['weaponId']})")
+    time.sleep(1)
+    return ids[0]["weaponId"]
+
+
+def one_burst(host, client, tag, base_pos, idx):
+    """Arm an explosive cluster on BOTH machines around a FRESH ground tile and fire an HE
+    into it with any live own soldier. Deliberately hostile-INDEPENDENT: the trigger only has
+    to run an ExplosionBState (checkForTerrainExplosions is whole-map, so the whole armed
+    block cascades regardless of what the shot hit), and the target shifts each burst so one
+    bring-up yields several trials instead of one crater that drops the lone skirmish hostile
+    off the map. Returns a dict of metrics on a valid trial, or None."""
+    if not PI.idle(host):
+        return None
+    # a fresh target tile each burst (walk it along x so successive craters do not overlap)
+    tgt = (base_pos[0] + idx * 2, base_pos[1], base_pos[2])
+    hseat = parallel(host)["localSeat"]
+    shooter = None
+    for cand in PI.own_units(battle(client), hseat):
+        sid = cand["id"]
+        if PI.place_adjacent(host, client, sid, tgt):
+            PI.top_up(host, client, sid)
+            shooter = sid
+            break
+    if shooter is None:
+        return None
+    try:
+        wid = give_weapon(host, client, shooter, WEAPON, AMMO)
+    except AssertionError as e:
+        print(f"  [{tag}] give skipped: {e}")
+        return None
+
+    # Arm the explosive cluster on BOTH machines (matched) so the host's zero carrier has a
+    # peer tile to converge, and verify they armed identically before the shot.
+    arm_cluster((host, client), tgt[0], tgt[1], tgt[2], EXPL_POWER, CLUSTER_R)
+    th = tiles(host)
+    tc = tiles(client)
+    armed = min(th["explosiveTiles"], tc["explosiveTiles"])
+    matched_pre = (th["explosiveHash"] == tc["explosiveHash"])
+    if not matched_pre or armed < MIN_CLUSTER:
+        print(f"  [{tag}] cluster not matched/large enough pre-shot "
+              f"(host {th['explosiveTiles']}t client {tc['explosiveTiles']}t "
+              f"match={matched_pre}) - skipping")
+        return None
+
+    r = PI.intent(host, action="shoot", unit=shooter, mode=MODE, weapon_id=wid,
+                  x=tgt[0], y=tgt[1], z=tgt[2])
+    if not r.get("ok"):
+        print(f"  [{tag}] shoot intent refused: {r}")
+        return None
+
+    # Rapidly sample both machines' armed-tile count while the cluster drains.
+    # THE DETERMINISTIC SIGNAL: the client's armed-tile count at the instant the HOST first
+    # reaches zero (has consumed the whole cluster). Pre-fix the client zeroes off its own
+    # ANIMATION loop, which lags the host's sim, so it is still holding a backlog of armed
+    # tiles when the host is already done. Post-fix the client zeroes off the ordered
+    # set_explosive_tile carrier, which the RX pump applies far faster than an explosion
+    # animates, so it finishes with (or a packet or two behind) the host - clientAtHostZero
+    # ~ 0. Deterministic and direction-stable, unlike the jittery mid-burst peak lag.
+    end = time.time() + SAMPLE_S
+    max_lag = 0            # host had MORE armed than client (client ran ahead)
+    max_behind = 0         # client had MORE armed than host (client lagging - the pre-fix bug)
+    divergent = 0
+    samples = 0
+    both_zero = False
+    host_zero_seen = False
+    client_at_host_zero = None
+    while time.time() < end:
+        th = tiles(host)
+        tc = tiles(client)
+        samples += 1
+        ht = th["explosiveTiles"]
+        ct = tc["explosiveTiles"]
+        max_lag = max(max_lag, ht - ct)
+        max_behind = max(max_behind, ct - ht)
+        if th["explosiveHash"] != tc["explosiveHash"]:
+            divergent += 1
+        if not host_zero_seen and ht == 0:
+            host_zero_seen = True
+            client_at_host_zero = ct
+        if ht == 0 and ct == 0 and th["explosiveHash"] == tc["explosiveHash"]:
+            both_zero = True
+            break
+        time.sleep(0.08)
+
+    PI.idle(host, 60)
+    time.sleep(1.5)
+    th = tiles(host)
+    tc = tiles(client)
+    settled_match = (th["explosiveHash"] == tc["explosiveHash"])
+    # If the host never hit zero in-window (very slow run) fall back to the final client count.
+    if client_at_host_zero is None:
+        client_at_host_zero = tc["explosiveTiles"]
+    return {"armed": armed, "clientAtHostZero": client_at_host_zero,
+            "maxLag": max_lag, "maxBehind": max_behind,
+            "divergent": divergent, "samples": samples, "bothZero": both_zero,
+            "settledMatch": settled_match,
+            "settledHost": th["explosiveTiles"], "settledClient": tc["explosiveTiles"]}
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--iters", type=int, default=5,
+                    help="target number of valid bursts to measure")
+    ap.add_argument("--seed", type=int, default=8675309,
+                    help="host map seed (client gets seed+1); pins the fixture")
+    ap.add_argument("--probe", action="store_true",
+                    help="report the lag metric instead of asserting GREEN")
+    args = ap.parse_args()
+
+    fail = None
+    host = GameClient("host", 48792,
+                      make_user_dir("expl_carrier_host",
+                                    options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48793,
+                        make_user_dir("expl_carrier_client",
+                                      options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    valid = 0
+    rows = []
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client, seed=args.seed)
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"skirmish fixture came up gamemode {gm}; parallel turns only cover PVE "
+            f"(1) and PVE2 (4) - this fixture would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        probe = tiles(host)
+        for field in ("explosiveTiles", "explosiveHash", "explosiveSum"):
+            assert field in probe, (
+                f"battle_tiles carries no `{field}` - bin/x64/Release/OpenXcom.exe "
+                f"predates the item-2 explosive census; rebuild it (serial, MP=false). "
+                f"fields: {sorted(probe)}")
+        enemy0 = PI.alive_enemy(battle(host))
+        assert enemy0, "the skirmish came up with no hostile to orient the fixture around"
+        base_pos = (enemy0["x"], enemy0["y"], enemy0["z"])
+        print(f"battle up (seed {args.seed}, gm {gm}). weapon={WEAPON} ammo={AMMO} "
+              f"mode={MODE}. cluster r={CLUSTER_R} power={EXPL_POWER}. base {base_pos}. "
+              f"target {args.iters} bursts")
+
+        empties = 0
+        maxlags = []
+        tried = 0
+        while valid < args.iters and empties < 10:
+            m = one_burst(host, client, f"b{valid + 1}", base_pos, tried)
+            tried += 1
+            if m is None:
+                empties += 1
+                continue
+            empties = 0
+            valid += 1
+            maxlags.append(m["clientAtHostZero"])
+            row = (f"burst {valid}: armed {m['armed']}t  clientAtHostZero "
+                   f"{m['clientAtHostZero']}  maxBehind {m['maxBehind']}  maxLag {m['maxLag']}  "
+                   f"divergentSamples {m['divergent']}/{m['samples']}  "
+                   f"bothZero={m['bothZero']}  settledMatch={m['settledMatch']} "
+                   f"(host {m['settledHost']}t/client {m['settledClient']}t)")
+            print("  " + row)
+            rows.append((row, m))
+
+        worst = max(maxlags) if maxlags else 0
+        print(f"\n=== {valid} valid bursts; worst clientAtHostZero {worst} "
+              f"(REMAIN_TOL {REMAIN_TOL}) ===")
+
+        # The tripwire is EXPECTED to fire here: point-blank HE bursts mint corpses/items at
+        # diverging counters (the item 3-5 casualty/corpse residual this fixture does NOT
+        # address). It is NOT a verdict on the explosive carrier - the per-burst settledMatch
+        # below proves the tile explosive-charge term itself converged. Reported, not asserted.
+        tw_fired = TW.desync_seen(host) or TW.desync_seen(client)
+
+        if args.probe:
+            print(f"PROBE done: worstClientAtHostZero {worst}; perBurst {maxlags}; "
+                  f"tripwire_fired={tw_fired} (expected: item 3-5 casualty residual)")
+        else:
+            assert valid >= 1, "no valid burst staged - fixture failure, not a result"
+            # coop (explosion ordered-replay E5a re-arm): clientAtHostZero is now
+            # ENFORCING. It was REPORT-ONLY (owner decision 2026-08-23, thin-client
+            # divergence audit rec 5 + END-STATE A step 4) pending the explosion
+            # ordered-replay rewrite - the client used to SIMULATE the blast on its own
+            # animation clock while the host's ordered set_explosive_tile carrier arrived
+            # on the bookkeeping clock, so a mid-transient trail was expected (item-2).
+            # E1 (client stops running explode()/checkForTerrainExplosions and zeroes
+            # armed tiles off the ordered carrier instead) closed that transient - RE-ARMED
+            # here per the E5 phase block. settledMatch below remains the separate
+            # quiescence correctness guard.
+            bad = [(r, m) for (r, m) in rows if m["clientAtHostZero"] > REMAIN_TOL]
+            assert not bad, (
+                f"item-2 regression: {len(bad)}/{valid} bursts left the client holding "
+                f"> {REMAIN_TOL} armed tiles at the instant the host reached zero - the "
+                f"client is zeroing explosive charge off its own display loop again "
+                f"instead of the host's ordered set_explosive_tile carrier (E1 should "
+                f"have closed this transient). Rows:\n    "
+                + "\n    ".join(r for r, _ in bad))
+            settle_bad = [r for (r, m) in rows if not m["settledMatch"]]
+            assert not settle_bad, (
+                "explosive-charge state did not converge IDENTICAL at quiescence (the tile "
+                "term the carrier owns must match even though casualty/item terms may drift):"
+                "\n    " + "\n    ".join(settle_bad))
+            print(f"PASS: {valid} HE bursts into an armed cluster; explosive charge "
+                  f"CONVERGED IDENTICAL at quiescence on both machines, AND the client "
+                  f"tracked the host's mid-transient armed-tile count within REMAIN_TOL "
+                  f"{REMAIN_TOL} on every burst (worst clientAtHostZero {worst}) - both "
+                  f"now asserted correctness guards post explosion-ordered-replay (E5a "
+                  f"re-arm). (drift tripwire fired={tw_fired}: the orthogonal item 3-5 "
+                  f"casualty residual)")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} tiles: {tiles(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_floor_drain.py b/tools/coop_test/test_parallel_floor_drain.py
new file mode 100644
index 000000000..9e15ddfbb
--- /dev/null
+++ b/tools/coop_test/test_parallel_floor_drain.py
@@ -0,0 +1,313 @@
+"""LIVENESS FLOOR ordering-preserving drain: the FINAL chain-atomicity residual.
+
+THE BUG (single root, verified red/green): the parallel replay client's receive pump has a
+last-resort liveness floor - after ~10 s of consuming nothing while holding work back
+(connectionTCP.cpp g_rxBlockedStallTicks >= 600) it WHOLESALE-DISABLES the P11 per-subject
+ordering, the I1 seq-gate AND the D.1 apply barrier so the pump can never wedge. When it
+fires during a casualty-heavy alien side it REORDERS the death-chain carriers (hit_unit /
+unit_death / after_unit_death) against the chain markers that sample the per-action sync
+hash, and the four buckets straddle at the ai/expl seqs (terrain / unitsCore / unitsCombat
+/ items / itemIdCtr). The floor rarely engages now (per-state pacing + force-drain watchdog
++ peer-liveness keep the pump fed), so the residual is a rare tail - but real: with the
+floor engaged and the drain OFF this fixture measures unitsCore/unitsCombat/items/itemIdCtr
+all non-zero; with the drain ON, all zero.
+
+THE FIX (parallel replay client only): the floor no longer disorders. It KEEPS the whole
+ordering machinery intact - per-subject/closer ordering (holds the unstamped alien
+shot-death carriers FIFO per victim), the seq-gate and the barrier (hold the stamped
+explosion-chain carriers to their own chain) - so the pump applies exactly what it could
+un-engaged, in order, and the per-action hash is never polluted. It does NOT force the gated
+markers through (forcing samples the chain hash mid-animation and itself straddles
+unitsCore). Progress instead comes from the display idling normally OR, if the ordered drain
+genuinely cannot progress for a sustained run, a STAGE-2 hard-floor escape hatch reverts to
+the legacy full-disable for one pass (a deadlock is worse than a straddle). Classic co-op /
+PvP / host are byte-identical (their packets are unstamped; the seq-gate/barrier were inert
+and only per-subject ordering was ever disabled there, unchanged).
+
+TEST LEVERS (parallel_state, harness-only): `rx_force_floor` forces the floor to engage
+every tick (the rare real stall, on demand) WITHOUT gating any packet, so a naturally-slow
+client whose display gates its markers runs under the engaged floor. `rx_drain_disable`
+forces the legacy full-disable so the SAME build measures the pre-fix out-of-order burst
+(RED) against the ordered drain (GREEN). `rx_hold` parks the pump (display-busy emulation)
+to build a genuine wedge for the liveness probe. `rxLegacyPasses`/`rxHardFloorPasses`
+introspect the floor: engaged with 0 hard-floor passes = the ordering-preserving drain
+carried the whole load.
+
+The scenario ambushes weakened soldiers next to aliens (the alien AI kills a cluster each
+side = death chains, whose point-blank plasma also spills a little terrain), forces the
+floor, and closes each alien side under --strict-burnin (all five buckets compare at EVERY
+seq). Buckets are read cumulatively at the end, after the deferred sync-check loop closes.
+
+  RED  (--red / rx_drain_disable): the five-bucket delta FIRES on the burst -> the fixture
+       exercises the bug and the GREEN result is not vacuous.
+  GREEN (default):                 the floor engages (rxLegacyPasses climbs) but the delta
+       stays ZERO every flood -> order preserved through the drain.
+
+LIVENESS: a genuine wedge (rx_hold: markers gated, never idling) is drained by the stage-2
+hard-floor (rxHardFloorPasses climbs, the seq-deferred backlog drops) - no deadlock.
+
+Run:  python tools/coop_test/test_parallel_floor_drain.py [--seed N] [--sides K] [--red]
+Exit 0 = the ordered drain preserved order AND liveness (pass); 2 = a straddle/deadlock.
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47994"
+
+# the five buckets the floor collapse contaminates.
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def corpses(gc):
+    return [i["id"] for i in gc.ok({"cmd": "battle_items"})["items"]
+            if "CORPSE" in i["type"].upper()]
+
+
+def bucket_counts(sc):
+    b = sc["buckets"]
+    return {n: b.get(n, {}).get("mismatchCount", 0) for n in FIVE}
+
+
+def adj_free(ax, ay, az, occupied):
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        p = (ax + dx, ay + dy, az)
+        if p not in occupied:
+            return p
+    return None
+
+
+def ambush(host, client, pairs, hp):
+    """Weaken + place `pairs` soldiers adjacent to live aliens on BOTH machines so the alien
+    AI shoots them down in-chain (the death carriers the floor collapse reorders). Keeps
+    soldier[0] untouched so the mission cannot end mid-run."""
+    hb = bstate(host)
+    aliens = [u for u in hb["units"] if u.get("faction") == 1 and not u.get("isOut")]
+    soldiers = [u for u in hb["units"] if u.get("faction") == 0 and not u.get("isOut")]
+    occupied = {(u["x"], u["y"], u["z"]) for u in hb["units"] if not u.get("isOut")}
+    placed = 0
+    for alien, sol in list(zip(aliens, soldiers[1:]))[:pairs]:
+        p = adj_free(alien["x"], alien["y"], alien["z"], occupied)
+        if not p:
+            continue
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": sol["id"],
+                       "x": p[0], "y": p[1], "z": p[2]}) for gc in (host, client)]
+        if not all(r.get("moved") for r in res):
+            continue
+        occupied.add(p)
+        for gc in (host, client):
+            gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": sol["id"],
+                   "health": hp, "visible": True})
+        placed += 1
+    return placed
+
+
+def run_side(host, client, pairs, hp):
+    """One ambush + alien side under the forced floor. Returns (placed, corpses_grown,
+    legacyDelta, hardDelta)."""
+    placed = ambush(host, client, pairs, hp)
+    turn0 = bstate(host)["turn"]
+    corp0 = len(corpses(client))
+    p0 = parallel(client)
+    SOAK.close_side(host, client, 0, 1, turn0)
+    SOAK.settle_display(host, client)
+    pN = parallel(client)
+    return (placed, len(corpses(client)) - corp0,
+            pN.get("rxLegacyPasses", 0) - p0.get("rxLegacyPasses", 0),
+            pN.get("rxHardFloorPasses", 0) - p0.get("rxHardFloorPasses", 0))
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=999983)
+    ap.add_argument("--sides", type=int, default=5, help="ambush floods (cumulative)")
+    ap.add_argument("--hp", type=int, default=35)
+    ap.add_argument("--pairs", type=int, default=3)
+    ap.add_argument("--slow-client", type=int, default=350,
+                    help="ms/frame on the client so its real display gates markers under the "
+                         "forced floor (the lag the burst needs)")
+    ap.add_argument("--red", action="store_true",
+                    help="RED: drain disabled - assert the burst FIRES (non-vacuity), not green")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48896, make_user_dir("floordrain_host", options=host_opts))
+    client = GameClient("client", 48897, make_user_dir("floordrain_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+        pc = parallel(client)
+        for field in ("rxLegacyPasses", "rxHardFloorPasses", "rxTestHold", "rxDrainDisable",
+                      "rxForceFloor", "rxSeqDeferred"):
+            assert field in pc, (
+                f"parallel_state carries no `{field}` - bin/x64/Release/OpenXcom.exe predates "
+                f"the ordering-preserving-floor-drain build; rebuild it (serial, MP=false). "
+                f"fields: {sorted(pc)}")
+        SOAK.enable_strict_burnin(host, client)
+        # force the floor to engage every tick - the rare real stall, on demand.
+        client.cmd({"cmd": "parallel_state", "rx_force_floor": True})
+        assert parallel(client).get("rxForceFloor") is True, "rx_force_floor lever did not engage"
+        mode = "RED (drain DISABLED - pre-fix legacy full-disable)" if args.red \
+            else "GREEN (ordering-preserving drain ON)"
+        if args.red:
+            for gc in (host, client):
+                gc.cmd({"cmd": "parallel_state", "rx_drain_disable": True})
+        print(f"\n== {mode}: floor forced, {args.sides} casualty-heavy alien sides ==")
+
+        corpses_total = 0
+        legacy_total = 0
+        hard_total = 0
+        for i in range(args.sides):
+            if not bstate(host).get("inBattle"):
+                print(f"  mission ended before flood {i}"); break
+            placed, grown, legd, hard = run_side(host, client, args.pairs, args.hp)
+            corpses_total += grown
+            legacy_total += legd
+            hard_total += hard
+            print(f"  flood {i}: placed {placed} corpses+{grown} legacyDelta {legd} "
+                  f"hardFloorDelta {hard}")
+
+        # final settle so the deferred sync-check loop fully closes before the census.
+        SOAK.settle_display(host, client)
+        time.sleep(2)
+        sc = session.sync_check(host)
+        buckets = bucket_counts(sc)
+        total = sum(buckets.values())
+        print(f"\n== VERDICT ({'RED' if args.red else 'GREEN'}) ==")
+        print(f"  five-bucket cumulative = {buckets}  (sum {total})")
+        print(f"  corpses minted = {corpses_total}, floor engagements = {legacy_total}, "
+              f"stage-2 hard-floor passes = {hard_total}")
+
+        assert sc.get("strictBurnIn") is True, "strict-burnin lever disengaged - run vacuous"
+        assert legacy_total > 0, (
+            "the floor never engaged (rxLegacyPasses flat) - rx_force_floor is inert, vacuous")
+        assert corpses_total >= 3, (
+            "the alien AI killed too few ambushed soldiers - no death chains generated (--seed/--hp)")
+
+        if args.red:
+            if total == 0:
+                fails.append(
+                    "VACUOUS: the drain-disabled floor produced ZERO five-bucket mismatches - the "
+                    "burst the fix prevents was not reproduced. Try a slower --slow-client / --seed.")
+            else:
+                print("  RED burst reproduced - the fix is not vacuous.")
+            sys.exit(2 if fails else 0)
+
+        # GREEN: the ordered drain must have kept every bucket clean.
+        bad = {b: v for b, v in buckets.items() if v > 0}
+        if bad:
+            fails.append(
+                f"GREEN: five-bucket mismatch {bad} FIRED through the ordered drain (floor engaged "
+                f"{legacy_total}x, stage-2 hard-floor {hard_total}x) - the drain did NOT preserve "
+                f"order.\n    {session._sync_mismatch_lines(sc)}")
+        else:
+            print(f"  GREEN clean: the floor engaged {legacy_total}x, the ordering-preserving drain "
+                  f"held every bucket (stage-2 hard-floor passes {hard_total}).")
+
+        # ---- LIVENESS ----
+        # (1) PRIMARY: the GREEN run above is itself a liveness proof - the floor was engaged
+        # EVERY tick for five full alien sides and the battle still progressed to completion
+        # with the census equal, so the ordering-preserving drain never deadlocked.
+        print("\n== LIVENESS ==")
+        print(f"  PRIMARY: the floor was engaged {legacy_total}x across {args.sides} full alien "
+              f"sides and the battle completed with the census equal - no deadlock.")
+        # (2) The stage-2 hard-floor backstop: park the pump (rx_hold gates the markers + feeds
+        # the stall) with the host idle at the boundary so NOTHING consumes - the
+        # seed-11100011-class true wedge the floor exists for. Past the ~20 s window the stage-2
+        # escape hatch must engage (rxHardFloorPasses climbs) and, on release, fully drain.
+        # Best-effort (a slow runner or a busy host can keep the pump fed and heal the wedge
+        # before the window): reported, and asserted only when the wedge actually formed.
+        try:
+            ambush(host, client, args.pairs, args.hp)
+            turn0 = bstate(host)["turn"]
+            h0 = parallel(client)
+            client.cmd({"cmd": "parallel_state", "rx_hold": True})
+            PE.hush(host, client)
+            for gc in (host, client):
+                if not parallel(gc)["localReady"]:
+                    PE.arm(gc)
+            hard_seen = 0
+            peak_hold = 0
+            end = time.time() + 26.0
+            while time.time() < end:
+                pc = parallel(client)
+                hard_seen = max(hard_seen,
+                                pc.get("rxHardFloorPasses", 0) - h0.get("rxHardFloorPasses", 0))
+                peak_hold = max(peak_hold, pc.get("rxHold", 0))
+                if hard_seen > 0:
+                    break
+                time.sleep(0.5)
+            client.cmd({"cmd": "parallel_state", "rx_hold": False})
+            PE.wait_side(host, client, turn0, timeout=120)
+            SOAK.settle_display(host, client)
+            drained = parallel(client).get("rxHold", 0)
+            print(f"  STAGE-2: parked-pump peakHold={peak_hold} hard-floor engagements={hard_seen} "
+                  f"rxHold after release={drained}")
+            if hard_seen > 0 and drained > 3:
+                fails.append(
+                    f"LIVENESS: stage-2 engaged but the queue did not drain on release "
+                    f"(rxHold={drained}) - the wedge did not clear")
+            elif hard_seen > 0:
+                print("  STAGE-2 verified: the hard-floor engaged on the parked pump and it fully "
+                      "drained on release - no deadlock.")
+            else:
+                print("  STAGE-2 note: the wedge healed before the window (host kept the pump fed) "
+                      "- stage-2 not exercised this run; the PRIMARY proof stands.")
+        except Exception as le:
+            print(f"  STAGE-2 note: the backstop probe could not be staged ({le}); the PRIMARY "
+                  "liveness proof (GREEN completed under the forced floor) stands.")
+
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    if fails:
+        print("\n==== FLOOR-DRAIN: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print("\n  PASS: the liveness floor engaged (rxLegacyPasses climbed) on the parallel client "
+          "yet the ordering-preserving drain kept the I1 seq-gate + the D.1 apply barrier "
+          "intact - the five buckets (terrain/unitsCore/items/itemIdCtr/unitsCombat) stayed "
+          "ZERO through every alien-side death (RED proves the burst without the drain), and a "
+          "forced wedge drained via the stage-2 hard-floor with no deadlock.")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_floor_gravity.py b/tools/coop_test/test_parallel_floor_gravity.py
new file mode 100644
index 000000000..04ef5d337
--- /dev/null
+++ b/tools/coop_test/test_parallel_floor_gravity.py
@@ -0,0 +1,608 @@
+"""Explosion ordered-replay migration, Phase E4: `unit_fall` stamp + LEAK-GRAV
+coverage proof.
+
+TWO THINGS THIS PHASE SHIPPED (folds in atomic-death Phase-3's `unit_fall` item):
+
+  1. `UnitFallBState`'s `unit_fall` send is now STAMPED (mirrors the Phase-2a
+     `unit_casualty` boundary-stamp shape): `bnd:true`+`side_seq` at a boundary,
+     else `coopStampLooseOutcomeChain("fall")` + `coopStampChainSeq` mid-side. The
+     receive HANDLER (connectionTCP.cpp, PRD-I3 z-gravity close) was already
+     wired for the per-unit rank-1 watermark since Phase 1 - this phase's send-
+     side stamp is what activates it. Gated to the parallel host
+     (`parallelTurnActive() && getHost()`), and the stamp helpers themselves
+     additionally no-op outside the parallel host, so CLASSIC CO-OP ships this
+     packet exactly as before (unstamped) - byte-identical (see
+     test_shared_battle for the standard-matrix proof, run separately by the
+     orchestrator task, not this fixture).
+  2. A NEW test-only lever, `parallel_state {"gravity_derive_disable": true}`,
+     added alongside E1's `explosion_replay_disable`. It guards the E1 LEAK-GRAV
+     derive - the `applyGravity(selected_tile)` / `applyGravity(aboveTile)` pair
+     the parallel CLIENT runs on every `destroy_tile` it receives, to compensate
+     for no longer running explode()'s own per-affected-tile applyGravity
+     locally (E1, `_coopReplayDisplay`-gated). With the lever ON, that
+     compensating derive is skipped, so a client item resting on a tile whose
+     floor the host just destroyed never gets repositioned - it HOVERS at its
+     pre-blast height while the host (unaffected - the lever only gates the
+     CLIENT's re-derive step, never the host's own normal engine behaviour) has
+     already dropped it a level. This is a client-item-only lever: the falling
+     UNIT's position is carried by the (now-stamped, always-on-this-build)
+     `unit_fall` absolute-position packet from item 1 above, which does not
+     depend on this derive at all - so RED is expected to show an ITEM
+     tile-membership straddle, not a unit-position straddle (documented, not a
+     bug: the fixture stages both an item AND a unit so BOTH fixed mechanisms
+     get exercised, but only the item side has a lever to statistically flip
+     red).
+
+STAGING - two problems solved:
+
+  (a) Terrain destruction decoupled from weapon-damage RNG: `battle_tiles
+      {"set_explosive": POWER, ...}` arms a tile with its OWN stored charge (the
+      E2/chain-atomicity item-2 mechanism); `TileEngine::checkForTerrainExplosions`
+      runs a WHOLE-MAP scan after EVERY explosion resolves (no proximity
+      requirement - TileEngine.cpp:4110-4125) and, if it finds an armed tile,
+      detonates it AT ITS OWN CHARGE as a real ExplosionBState. So a target tile
+      is armed with a large charge, a small harmless "trigger" shot is fired FAR
+      AWAY (irrelevant to the target), and the resulting chain detonation there
+      is real (host: normal engine code, no _coopReplayDisplay gate) and never
+      needs the trigger shot itself to even reach the target.
+  (b) The item must SURVIVE the floor's destruction so it can fall - and a blast
+      centred ON the item's tile co-destroys the item every time (proven
+      exhaustively by a (seed,tile,power) sweep: 318 attempts, every floor-holing
+      blast also destroyed the loose items). The fix is to blast FROM BELOW: arm
+      the tile DIRECTLY BENEATH the items' tile with a heavy charge and detonate
+      it (via checkForTerrainExplosions off a far trigger shot); the upward blast
+      punches out the items' floor while the items, resting on top of that floor,
+      are shielded above the blast and survive. They then fall a z-level, and the
+      client's LEAK-GRAV derive (GREEN) - or its absence (RED) - decides whether
+      they settle identically. Staging scans floored candidates that have a tile
+      below to arm, most-common floor-signature first, and stage-then-blasts each
+      until one holes to void with the items intact; the pinned --seed makes the
+      first candidate deterministic (52145214 -> tile (4,10,1), charge 500).
+
+A high-health ("set_stat health=500", the same trick test_parallel_terrain_pacing
+uses to survive repeated HE bursts) unit stands on T; loose item(s) are dropped on
+T via `battle_give {"slot": "ground", ...}`. Both machines get IDENTICAL harness
+RPCs (matched ids, matched charge), so the staging itself never introduces
+asymmetry - only the derive/stamp mechanism under test can. RED sets
+`gravity_derive_disable` on the client right after bring-up, BEFORE any probing
+or staging, so the lever is live for every destroy_tile the run produces
+(probing itself is host-side terrain truth, read via the HOST's own tile_info,
+so it is unaffected by a CLIENT-only lever either way).
+
+Asserts, after the blast settles (both a direct census/position read AND the
+in-game strict-burnin sync-check bucket deltas for corroboration):
+  GREEN (default lever state): item tile-membership (tx,ty,tz) identical host vs
+    client for every surviving dropped item (census symmetry - a destroyed item
+    is symmetric too, just not a gravity proof; NON-VACUITY requires >=1 item
+    survive AND actually drop a z-level on the host, or the faller itself fall).
+    Faller unit position identical host vs client (battle_state x/y/z).
+    `unitsCore`/`items` strict-burnin bucket deltas stay at 0 across the window.
+  RED (`gravity_derive_disable:true` on the CLIENT, same build, fresh bring-up):
+    the surviving item's tz straddles (client still shows the pre-blast height,
+    host shows the dropped one) - statistical (documented, retry-tolerant, same
+    posture as E1/E2's own RED sections), not hard-asserted, but reported loud
+    either way (the GREEN result stands on its own regardless).
+
+Run:  python tools/coop_test/test_parallel_floor_gravity.py [--seed N]
+Exit 0 = GREEN passed (RED is statistical/report-only); 2 = GREEN failed or the
+fixture could never stage a non-vacuous floor-destroy. Keeps under 180 s per mode.
+"""
+
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_soak as SOAK
+
+PORT = "48912"
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+ITEM_A = os.environ.get("E4_ITEM_A", "STR_RIFLE")
+ITEM_B = os.environ.get("E4_ITEM_B", "STR_HEAVY_CANNON")
+TRIGGER_WEAPON = os.environ.get("E4_TRIGGER_WEAPON", "STR_AUTO_CANNON")
+TRIGGER_AMMO = os.environ.get("E4_TRIGGER_AMMO", "STR_AC_HE_AMMO")
+
+FALLER_HEALTH = 500          # same trick test_parallel_terrain_pacing uses to survive HE
+CHARGE_TRIES = (500, 900, 1400)  # heavy: the charge is armed on the tile BELOW the items, so
+                             # it must punch the floor upward; items on top are shielded
+MAX_STAGE_ATTEMPTS = 12      # candidate floored tiles to try before declaring a vacuous run
+SCAN_RADIUS = 10
+SCAN_MAX_TILES = 150
+MAX_SIGNATURE_PROBES = 6
+MIN_RESERVE_DIST = 3         # a reserve must be this far (Chebyshev) from the probe so the
+                            # probe's escalating (<=800) blast radius did not crater its floor
+CLIENT_SPEED = 300            # slow client: widens the window a derive bug needs to show
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def tile_info(gc, pos):
+    return gc.cmd({"cmd": "tile_info", "x": pos[0], "y": pos[1], "z": pos[2]})
+
+
+def floor_mid(ti):
+    return ti.get("parts", {}).get("floor", {}).get("mapDataID")
+
+
+def items_of(gc):
+    """id -> full item dict, so tile position (tx,ty,tz) is available alongside
+    onTile/owner (mirrors test_coop_alien_launcher_item_loss.census, but keeps
+    the tile coordinates the LEAK-GRAV proof actually needs)."""
+    return {i["id"]: i for i in gc.ok({"cmd": "battle_items"})["items"]}
+
+
+def bucket_snapshot(host):
+    sc = session.sync_check(host)
+    return {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+
+
+def give_ground(gc, uid, item, pos):
+    """Drop `item` on the floor at `pos` via the battle_give slot=ground path
+    (deterministic loose-item placement; see test_coop_blast_item_damage's donor
+    pattern). `uid` only resolves findUnit() server-side - x/y/z override which
+    tile the item actually lands on (TestServer.cpp battle_give slot=ground)."""
+    r = gc.ok({"cmd": "battle_give", "unit": uid, "item": item, "slot": "ground",
+               "x": pos[0], "y": pos[1], "z": pos[2]})
+    return r["weaponId"]
+
+
+def sync_item_counter(host, client):
+    """Pre-sync the item-id counter to max(host, client) before an out-of-band
+    ground-drop mint - matches test_parallel_intents.give_both's own dance, since
+    battle_give slot=ground mints off the LOCAL _itemId same as any other give."""
+    hc = host.cmd({"cmd": "save_blob"}).get("itemCounter", -1)
+    cc = client.cmd({"cmd": "save_blob"}).get("itemCounter", -1)
+    if hc >= 0 and cc >= 0 and hc != cc:
+        m = max(hc, cc)
+        host.cmd({"cmd": "save_blob", "set_item_counter": m})
+        client.cmd({"cmd": "save_blob", "set_item_counter": m})
+
+
+def arm_tile_both(host, client, pos, power):
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_tiles", "set_explosive": power, "explosiveType": 0,
+               "x": pos[0], "y": pos[1], "z": pos[2]})
+
+
+def scan_signatures(host, anchor, radius=SCAN_RADIUS, max_tiles=SCAN_MAX_TILES):
+    """Read-only sweep of a ring-expanding neighbourhood around `anchor` (closest
+    first), grouping tiles by their (floor mapDataID, mapDataSetID) signature.
+    Cheap (tile_info is a plain read), so this never touches terrain state."""
+    ax, ay, az = anchor
+    order = []
+    for r in range(0, radius + 1):
+        for dx in range(-r, r + 1):
+            for dy in range(-r, r + 1):
+                if max(abs(dx), abs(dy)) != r:
+                    continue
+                order.append((ax + dx, ay + dy, az))
+        if len(order) >= max_tiles:
+            break
+    order = order[:max_tiles]
+    sig_map = {}
+    for p in order:
+        ti = tile_info(host, p)
+        if not ti.get("ok"):
+            continue
+        mid = floor_mid(ti)
+        sid = ti.get("parts", {}).get("floor", {}).get("mapDataSetID", -1)
+        if mid is None or mid < 0:
+            continue
+        sig_map.setdefault((mid, sid), []).append(p)
+    return sig_map
+
+
+def blast_at(host, client, shooter, wid, trig, pos, tag):
+    """Destroy `pos`'s floor FROM BELOW: arm the tile DIRECTLY BENEATH `pos`
+    (pos.z-1) with a heavy charge and fire the trigger shot to detonate it. The
+    blast punches `pos`'s floor upward while loose items resting ON that floor
+    survive (they sit above the blast, shielded by the floor). This is the only
+    staging that yields a SURVIVING item that then falls - a blast on `pos` itself
+    co-destroys the items (proven exhaustively: see the search ledger).
+    Returns (fired_ok, floor_changed, pre_mid, post_mid); tries CHARGE_TRIES
+    ascending, stopping at the first that holes `pos`'s floor."""
+    below = (pos[0], pos[1], pos[2] - 1)
+    pre_mid = floor_mid(tile_info(host, pos))
+    for power in CHARGE_TRIES:
+        arm_tile_both(host, client, below, power)
+        if not PI.idle(host):
+            continue
+        r = PI.intent(host, action="shoot", unit=shooter, mode="auto", weapon_id=wid,
+                      x=trig[0], y=trig[1], z=trig[2])
+        if not r.get("ok"):
+            return False, False, pre_mid, pre_mid
+        PI.idle(host, 60)
+        SOAK.settle_display(host, client, timeout=45)
+        time.sleep(0.5)
+        post_mid = floor_mid(tile_info(host, pos))
+        if post_mid != pre_mid:
+            return True, True, pre_mid, post_mid
+    return True, False, pre_mid, pre_mid
+
+
+def _cheb(a, b):
+    return max(abs(a[0] - b[0]), abs(a[1] - b[1]))
+
+
+def _floor_sig(host, pos):
+    ti = tile_info(host, pos)
+    mid = floor_mid(ti)
+    sid = ti.get("parts", {}).get("floor", {}).get("mapDataSetID", -1)
+    return (mid, sid) if (mid is not None and mid >= 0) else None
+
+
+def _floor_matches_sig(host, pos, sig):
+    # The reserve must STILL carry the original destructible floor signature: the probe
+    # blast REPLACES a destroyed floor with immune rubble (a different mapDataID that is
+    # still >= 0), so a bare "floor present" check accepts rubble - we must match the sig.
+    return _floor_sig(host, pos) == sig
+
+
+def find_destructible_tile(host, client, shooter, wid, trig, anchors, tag):
+    """Probe distinct floor signatures near `anchors` (largest instance-count
+    first) until one is confirmed destructible, then return an untouched RESERVE
+    instance of that signature that is (a) FAR from the probe and (b) verified
+    floor-intact AFTER the probe. The probe's escalating charge (up to 800) has a
+    ~5-tile blast radius that craters nearby same-signature tiles, so a naive
+    `positions[1]` reserve is usually already floorless by staging time - hence
+    the distance filter + the post-probe intact re-check. Returns (position,
+    signature) or (None, None)."""
+    sig_map = {}
+    for a in anchors:
+        for sig, positions in scan_signatures(host, a).items():
+            bucket = sig_map.setdefault(sig, [])
+            for p in positions:
+                if p not in bucket:
+                    bucket.append(p)
+    ordered = sorted(sig_map.items(), key=lambda kv: -len(kv[1]))
+    print(f"    [{tag}] {len(ordered)} distinct floor signature(s) near {anchors}: "
+          f"{[(s, len(p)) for s, p in ordered[:8]]}")
+    probed = 0
+    for sig, positions in ordered:
+        if probed >= MAX_SIGNATURE_PROBES:
+            break
+        if len(positions) < 2:
+            continue  # need a probe AND a reserve instance
+        probed += 1
+        probe = positions[0]
+        fired, changed, pre_mid, post_mid = blast_at(host, client, shooter, wid, trig,
+                                                       probe, tag)
+        print(f"    [{tag}] probe sig={sig} @ {probe} (fired={fired}): "
+              f"{pre_mid} -> {post_mid} {'DESTRUCTIBLE' if changed else 'immune'}")
+        if not changed:
+            continue
+        # Reserve: farthest-from-probe first (least likely craterd/rubbled by the probe
+        # blast), and require the candidate STILL carry the original floor signature
+        # (rubble replacement reads as a floor but a different, immune mapDataID).
+        for cand in sorted(positions[1:], key=lambda p: -_cheb(p, probe)):
+            if _cheb(cand, probe) < MIN_RESERVE_DIST:
+                break  # everything closer than this is inside the probe's blast reach
+            if _floor_matches_sig(host, cand, sig):
+                print(f"    [{tag}] reserve @ {cand} (dist {_cheb(cand, probe)} from "
+                      f"probe {probe}, original floor sig {sig} intact post-probe)")
+                return cand, sig
+        print(f"    [{tag}] sig {sig} destructible but no far reserve still carrying "
+              f"sig {sig} (all near spares rubbled by the probe) - next signature")
+    return None, None
+
+
+def stage_and_blast(host, client, seed, tag):
+    """Assumes a fresh parallel battle is already up (run_mode's job - the RED
+    caller needs a chance to set the gravity_derive_disable lever BETWEEN
+    bring-up and staging). Finds a genuinely destructible floor tile, stages a
+    faller unit + two loose items on it, blasts it, and settles. Returns a dict
+    of everything the caller needs to assert on, or None if staging itself
+    failed (fixture/map problem, not a product result)."""
+    gm = battle(host).get("coopGamemode")
+    assert gm in (1, 4), (
+        f"{tag}: skirmish fixture came up gamemode {gm}; parallel turns only "
+        f"cover PVE (1) and PVE2 (4) - this fixture would be vacuous")
+    for gc, ttag in ((host, "host"), (client, "client")):
+        assert battle(gc)["parallelActive"] is True, \
+            f"{tag}/{ttag}: parallel mode is not live: {battle(gc)}"
+
+    pc0 = parallel(client)
+    for field in ("gravityDeriveDisable", "explosionReplayDisable"):
+        assert field in pc0, (
+            f"{tag}: parallel_state carries no `{field}` - "
+            f"bin/x64/Release/OpenXcom.exe predates the E4 gravity-derive lever; "
+            f"rebuild it (serial, MP=false). fields: {sorted(pc0)}")
+
+    SOAK.enable_strict_burnin(host, client)
+
+    hseat = parallel(host)["localSeat"]
+    own = PI.own_units(battle(host), hseat)
+    assert len(own) >= 2, f"{tag}: need >=2 own units (1 faller, 1 shooter)"
+    faller = own[0]["id"]
+    shooter = own[1]["id"]
+    squad_anchor = (own[0]["x"], own[0]["y"], own[0]["z"])
+    alien = PI.alive_enemy(battle(host))
+    anchors = ([(alien["x"], alien["y"], alien["z"])] if alien else []) + [squad_anchor]
+    print(f"    [{tag}] faller={faller} shooter={shooter} seed={seed} "
+          f"squad@{squad_anchor} alien={'yes' if alien else 'no'}")
+
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": faller,
+               "health": FALLER_HEALTH})
+    PI.top_up(host, client, shooter)
+
+    # a single reusable trigger placement: checkForTerrainExplosions is a
+    # whole-map scan (no proximity requirement), so the SAME shooter/spot fires
+    # every probe AND the final real blast.
+    trig = None
+    for ox, oy in ((6, 6), (-6, -6), (6, -6), (-6, 6), (8, 0), (-8, 0), (0, 8), (0, -8),
+                   (10, 0), (-10, 0), (0, 10), (0, -10)):
+        cand = (squad_anchor[0] + ox, squad_anchor[1] + oy, squad_anchor[2])
+        if PI.place_adjacent(host, client, shooter, cand):
+            trig = cand
+            break
+    assert trig is not None, f"{tag}: could not find a safe trigger spot"
+    wid = PI.give_both(host, client, shooter, TRIGGER_WEAPON, TRIGGER_AMMO)
+
+    # Robust stage-then-blast-FROM-BELOW loop (no separate probe - a probe blast rubbles the
+    # reserve, and a blast ON the tile co-destroys the items). Scan floored candidates that
+    # have a tile directly below to arm; for each, stage the faller + two loose items, blast
+    # the tile beneath, and keep going until one floor holes to VOID with the items intact.
+    # With the pinned --seed the first candidate is deterministic.
+    sig_map = {}
+    for a in anchors:
+        for sig, positions in scan_signatures(host, a).items():
+            for p in positions:
+                sig_map.setdefault(sig, [])
+                if p not in sig_map[sig]:
+                    sig_map[sig].append(p)
+    ordered = sorted(sig_map.items(), key=lambda kv: -len(kv[1]))
+    cands = [(p, s) for s, ps in ordered for p in ps if p[2] >= 1]
+    print(f"    [{tag}] {len(cands)} below-blastable floored candidates; up to {MAX_STAGE_ATTEMPTS}")
+
+    tried = 0
+    for (T, sig) in cands:
+        if tried >= MAX_STAGE_ATTEMPTS:
+            break
+        if _floor_sig(host, T) != sig:
+            continue  # rubbled by an earlier attempt's blast
+        wid = PI.give_both(host, client, shooter, TRIGGER_WEAPON, TRIGGER_AMMO)
+        if not PI.teleport_both(host, client, faller, T):
+            continue
+        sync_item_counter(host, client)
+        idA = give_ground(host, faller, ITEM_A, T)
+        idA_c = give_ground(client, faller, ITEM_A, T)
+        sync_item_counter(host, client)
+        idB = give_ground(host, faller, ITEM_B, T)
+        idB_c = give_ground(client, faller, ITEM_B, T)
+        if not (idA == idA_c and idB == idB_c):
+            continue
+        pre_h_pos = PI.pos(battle(host), faller)
+        pre_c_pos = PI.pos(battle(client), faller)
+        if not (pre_h_pos == pre_c_pos == T):
+            continue
+        tried += 1
+        buckets_pre = bucket_snapshot(host)
+        fired, changed, pre_mid, post_mid = blast_at(host, client, shooter, wid, trig, T, tag)
+        void = post_mid is None or post_mid < 0
+        print(f"    [{tag}] attempt {tried} T={T} (blast below): floor {pre_mid} -> "
+              f"{post_mid} {'VOID' if void else ('rubble' if changed else 'immune')}")
+        if void:
+            print(f"    [{tag}] staged+holed-from-below T={T}, "
+                  f"dropped {ITEM_A}#{idA} + {ITEM_B}#{idB}")
+            return {"T": T, "faller": faller, "idA": idA, "idB": idB, "buckets_pre": buckets_pre}
+    print(f"    [{tag}] SHORTFALL: no below-blast holed a candidate floor across {tried} tiles")
+    return None
+
+
+def read_outcome(host, client, staged):
+    T = staged["T"]
+    faller = staged["faller"]
+    hb = battle(host)
+    cb = battle(client)
+    hu = PI.unit(hb, faller)
+    cu = PI.unit(cb, faller)
+    h_items = items_of(host)
+    c_items = items_of(client)
+    return {
+        "faller_host": (hu["x"], hu["y"], hu["z"], hu.get("isOut")) if hu else None,
+        "faller_client": (cu["x"], cu["y"], cu["z"], cu.get("isOut")) if cu else None,
+        "items_host": h_items, "items_client": c_items,
+        "T": T,
+    }
+
+
+def item_symmetry(idn, items_host, items_client, T, tag_lines):
+    ih = items_host.get(idn)
+    ic = items_client.get(idn)
+    h_present = ih is not None
+    c_present = ic is not None
+    if h_present != c_present:
+        return False, f"item {idn}: present-on-host={h_present} present-on-client={c_present}"
+    if not h_present:
+        tag_lines.append(f"item {idn}: destroyed on both machines (symmetric, no gravity proof)")
+        return True, None
+    ht = (ih.get("tx"), ih.get("ty"), ih.get("tz")) if ih.get("onTile") else None
+    ct = (ic.get("tx"), ic.get("ty"), ic.get("tz")) if ic.get("onTile") else None
+    fell = ht is not None and ht != (T[0], T[1], T[2])
+    tag_lines.append(f"item {idn}: host tile={ht} client tile={ct} fell={fell}")
+    if ht != ct:
+        return False, f"item {idn}: tile-membership straddle host={ht} client={ct}"
+    return True, None
+
+
+def run_mode(seed, red):
+    fails = []
+    notes = []
+    diag = []
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": CLIENT_SPEED, "battleAlienSpeed": CLIENT_SPEED,
+                   "EnableCoopParallelTurns": False}
+    tag = "RED" if red else "GREEN"
+    host = GameClient("host", 48912, make_user_dir(f"e4_grav_host_{tag.lower()}", options=host_opts))
+    client = GameClient("client", 48913, make_user_dir(f"e4_grav_client_{tag.lower()}", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+
+    result = {"ok": False, "vacuous": False}
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client, seed=seed)
+
+        if red:
+            pc_pre = parallel(client)
+            client.cmd({"cmd": "parallel_state", "gravity_derive_disable": True})
+            pcr = parallel(client)
+            assert pcr.get("gravityDeriveDisable") is True, \
+                f"gravity_derive_disable lever did not latch on the client: {pcr}"
+            print(f"    [{tag}] gravity_derive_disable=true set on the CLIENT "
+                  f"BEFORE staging, so it is live for every destroy_tile this run "
+                  f"produces (was {pc_pre.get('gravityDeriveDisable')})")
+
+        staged = stage_and_blast(host, client, seed, tag)
+        if staged is None:
+            result["vacuous"] = True
+            return result, ["staging never produced a non-vacuous floor-destroy - "
+                            "see probe log above"], [], []
+
+        outcome = read_outcome(host, client, staged)
+        tag_lines = []
+        okA, errA = item_symmetry(staged["idA"], outcome["items_host"], outcome["items_client"],
+                                   outcome["T"], tag_lines)
+        okB, errB = item_symmetry(staged["idB"], outcome["items_host"], outcome["items_client"],
+                                   outcome["T"], tag_lines)
+        for line in tag_lines:
+            print(f"    [{tag}] {line}")
+        diag.extend(tag_lines)
+
+        fh, fc = outcome["faller_host"], outcome["faller_client"]
+        print(f"    [{tag}] faller host={fh} client={fc}")
+        pos_ok = (fh is not None and fc is not None and fh[:3] == fc[:3])
+        faller_fell = (fh is not None and fh[2] != staged["T"][2])
+
+        sc = session.sync_check(host)
+        buckets_post = {n: sc["buckets"].get(n, {}).get("mismatchCount", 0) for n in FIVE}
+        bucket_delta = {k: buckets_post[k] - staged["buckets_pre"].get(k, 0) for k in FIVE}
+        print(f"    [{tag}] five-bucket delta (strict, cumulative): {bucket_delta}")
+
+        any_item_survived_and_fell = False
+        for idn in (staged["idA"], staged["idB"]):
+            ih = outcome["items_host"].get(idn)
+            if ih and ih.get("onTile") and (ih.get("tx"), ih.get("ty"), ih.get("tz")) != staged["T"]:
+                any_item_survived_and_fell = True
+
+        if not red:
+            if not (any_item_survived_and_fell or faller_fell):
+                result["vacuous"] = True
+                notes.append("GREEN: neither item nor faller actually dropped a "
+                             "z-level on the host - the blast destroyed the floor "
+                             "(non-vacuity check passed) but nothing was resting "
+                             "there to fall, or the terrain replaced it with "
+                             "another floor (rubble) - vacuous run")
+            if not okA:
+                fails.append(errA)
+            if not okB:
+                fails.append(errB)
+            if not pos_ok:
+                fails.append(f"GREEN: faller position straddle host={fh} client={fc}")
+            # This fixture proves the ITEM gravity-derive (+ the unit fall): gate GREEN on
+            # items / unitsCore / itemIdCtr. terrain/fire deltas are the documented
+            # explosion-terrain transient (E5-deferred), reported but not failed here.
+            GREEN_GATE = ("items", "unitsCore", "itemIdCtr")
+            bad_buckets = {n: c for n, c in bucket_delta.items() if c > 0 and n in GREEN_GATE}
+            if bad_buckets:
+                fails.append(f"GREEN: item/unit mismatch {bad_buckets} under strict burn-in "
+                             f"- the derive/stamp is exactly what this asserts.\n    "
+                             f"{session._sync_mismatch_lines(sc)}")
+            noise = {n: c for n, c in bucket_delta.items() if c > 0 and n not in GREEN_GATE}
+            if noise:
+                notes.append(f"GREEN: {noise} moved = the documented explosion-terrain "
+                             f"transient (E5-deferred), NOT the item derive")
+            for gc, gtag in ((host, "host"), (client, "client")):
+                if TW.desync_seen(gc):
+                    fails.append(f"GREEN: the PRD-P2 drift tripwire FIRED on the {gtag}")
+            result["ok"] = not fails and not result["vacuous"]
+        else:
+            straddled = (not okA) or (not okB)
+            result["ok"] = True  # RED is statistical/report-only
+            if straddled:
+                print(f"    [{tag}] CONFIRMED: item tile-membership straddled with "
+                      f"gravity_derive_disable=true (the client item hovers where "
+                      f"the host dropped it)")
+            else:
+                notes.append("RED: no item straddle observed this run (statistical, "
+                             "retry-tolerant - see module docstring); GREEN already "
+                             "proves the derive works when the lever is off")
+            if not pos_ok:
+                notes.append(f"RED: faller position ALSO straddled ({fh} vs {fc}) - "
+                             f"unexpected, unit_fall does not depend on this lever; "
+                             f"worth a second look if reproducible")
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+        result["ok"] = False
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    return result, notes, diag, fails
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=52145214)
+    args = ap.parse_args()
+
+    print("== GREEN: unit_fall stamp + LEAK-GRAV derive (lever off, default) ==")
+    g_result, g_notes, g_diag, g_fails = run_mode(args.seed, red=False)
+
+    print("\n== RED: parallel_state {gravity_derive_disable:true} on the CLIENT ==")
+    r_result, r_notes, r_diag, r_fails = run_mode(args.seed, red=True)
+
+    print("\n==== E4 unit_fall stamp + gravity-derive coverage summary ====")
+    if g_notes:
+        print("  GREEN notes:")
+        for n in g_notes:
+            print(f"    NOTE {n}")
+    if r_notes:
+        print("  RED notes:")
+        for n in r_notes:
+            print(f"    NOTE {n}")
+
+    hard_fail = False
+    if g_result.get("vacuous"):
+        print("  FAIL GREEN: fixture never staged a non-vacuous floor-destroy - "
+              "cannot prove anything about the derive/stamp on this seed")
+        hard_fail = True
+    elif g_fails:
+        for f in g_fails:
+            print(f"  FAIL GREEN: {f}")
+        hard_fail = True
+    else:
+        print("  PASS GREEN: item tile-membership + faller position identical "
+              "host vs client, five-bucket strict-burnin clean, no drift tripwire")
+
+    if r_fails:
+        for f in r_fails:
+            print(f"  FAIL RED (harness/staging error, not the statistical demo): {f}")
+        hard_fail = True
+
+    sys.exit(2 if hard_fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_heavy_death_repro.py b/tools/coop_test/test_parallel_heavy_death_repro.py
new file mode 100644
index 000000000..22e9c2370
--- /dev/null
+++ b/tools/coop_test/test_parallel_heavy_death_repro.py
@@ -0,0 +1,842 @@
+"""DETERMINISTIC REPRO for BUG-parallel-heavy-alien-death-desync.
+
+WHAT THE BUG IS (see openxcom-coop-agent-docs/parallel/
+BUG-parallel-heavy-alien-death-desync.md): in a parallel co-op battle, when an alien
+side produces MANY casualties at once, the two machines intermittently drift apart -
+UNIT/ITEM CENSUS DRIFT, the PRD-P2 tripwire firing (host itemId=76 vs client itemId=77),
+or a never-close RX wedge. It is NOT seed-deterministic in the field (~1 fail per 3-4
+soak runs): whether the client's death-carrier backlog drains and HEALS before the side
+boundary depends on wall-clock timing, not the RNG seed.
+
+WHY NO EXISTING FIXTURE CATCHES IT: the targeted death tests deliberately steer AROUND
+this exact residual. test_parallel_alien_death_decouple.py caps `--pairs 3` ("a bigger
+cluster overwhelms the item 4-5 casualty-value replay ... swamps the decouple signal")
+and asserts only the side-gated in-game buckets (unitsCore/unitsCombat), NOT the raw
+census / itemIdCtr; test_parallel_corpse_mint.py names "the separate casualty-value
+residual (item 4-5 residual, NOT asserted)". So NO fixture asserts the raw cross-machine
+census under a HEAVY cluster - the field bug lives in that gap.
+
+THIS REPRO closes the gap by combining, in one run:
+  * a HEAVY per-side death cluster (--pairs above the targeted tests' cap of 3), staged
+    by the same deterministic ambush the targeted tests use (weakened soldiers teleported
+    adjacent to live aliens on BOTH machines, so the host alien AI kills a cluster
+    in-chain each side);
+  * a SLOW client + forced liveness floor (--slow-client, rx_force_floor) so the client's
+    alien-side death-carrier backlog is maximally behind - the mid-drain window the heal
+    races against is held open;
+  * the RAW field check - SOAK.assert_census after EVERY alien side (unit census + strict
+    item-id census + assert_battle_synced (the chkBattleItemId 76-vs-77 term) + the
+    PRD-P2 desync tripwire + assert_sync_clean + the on-disk desync-report check), run in
+    SHIPPED mode (strict-burnin OFF, matching the field: the report reproduces at
+    strictBurnIn=False).
+
+DETERMINISM (pinned for repeatable runs):
+  * MAP + alien deployment + soldiers' rolled stats: TW.bring_up_battle(seed=SEED) calls
+    RNG::setSeed right before the host generates the map (newbattle_ok). Same SEED => same
+    battle, run to run. NO fixture re-roll (a re-roll would change the map): a pinned seed
+    that comes up short of MIN_HOSTILES fails loudly so the operator picks another.
+  * RNG stream: set_seed(SEED) on both machines after bring-up (host alien AI is pinned).
+  * SOLDIER POSITIONING: ambush() computes target tiles from the pinned aliens' positions
+    with a FIXED neighbour-scan order; teleport/set_stat consume no RNG, so they do not
+    shift the stream. Every placement is LOGGED and folded into a scenario digest printed
+    each run - an identical digest across runs proves the staged scenario is identical.
+  The ONLY thing left non-deterministic is the client's wall-clock drain timing - which is
+  exactly what the forcing knobs pin to the failing side.
+
+Run:  python tools/coop_test/test_parallel_heavy_death_repro.py
+        [--seed N] [--pairs N] [--sides N] [--hp N] [--slow-client MS]
+        [--no-force-floor] [--ghost-off] [--rx-hold] [--drain-disable]
+
+REPRO SEMANTICS (this is a repro, not a guard): the GOAL is to fire the bug.
+  exit 0  = REPRO FIRED  (assert_census drifted / tripwire / wedge) - the bug reproduced.
+  exit 3  = NO REPRO     (every alien side stayed in census) - tighten the knobs / seed.
+  exit 2  = harness/setup error (short seed, boxed placement, mission ended, etc.).
+"""
+import argparse
+import hashlib
+import json
+import os
+import sys
+import time
+import traceback
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47996"  # the in-game coop TCP rendezvous port (unique per concurrent test)
+
+
+def bstate(gc):
+    return SOAK.battle(gc)
+
+
+def parallel(gc):
+    return SOAK.parallel(gc)
+
+
+# The LIVE pending-to-APPLY depths that prove "nothing left to apply for this side".
+# rxPark is DELIBERATELY excluded: g_rxPark holds ONLY the `endPlayerTurn` handshake packet,
+# set aside by the `_coopEnd == 1` exclusion and un-parked only at the NEXT side transition
+# (connectionTCP.cpp:3149,3699). It is a coop turn-handshake, not an un-applied residual for
+# the current side - measured rxPark == 1 at EVERY alien-side boundary on BOTH clean (census
+# passes) and drifting (census fires) runs, so including it would time the settle out every
+# run without discriminating anything. The four below ARE current-side apply queues.
+_LIVE_DEPTHS = ("rxHold", "rxQDepth", "snapPending", "displayBacklog")
+
+
+def _drained(gc):
+    """True iff this machine has NOTHING left to apply for the current side: every LIVE
+    pending-to-apply queue depth is 0 (rxHold + raw rxQ + dirty conflation slots) AND the
+    display cursor has caught up (displayBacklog). LIVE depths, not the cumulative counters;
+    rxPark (the endPlayerTurn handshake) is excluded - see _LIVE_DEPTHS."""
+    p = parallel(gc)
+    return all((p.get(k, 0) or 0) == 0 for k in _LIVE_DEPTHS)
+
+
+def settle_wire_order(host, client, timeout=60.0):
+    """coop (option 3B, §2): wait until BOTH machines have fully drained every LIVE
+    pending-apply queue (rxHold, rxPark, rxQ, dirty snapshot slots) AND displayBacklog == 0,
+    so the FULLY-STRICT census measures the settled steady state. Bounded (60 s): on timeout
+    print a loud SETTLE TIMEOUT with the offending depths and return, so the census still
+    runs (a genuinely wedged drain FAILS the run RED rather than hanging the harness)."""
+    end = time.time() + timeout
+    while time.time() < end:
+        if _drained(host) and _drained(client):
+            return True
+        time.sleep(0.25)
+    hp, cp = parallel(host), parallel(client)
+    hd = {k: hp.get(k) for k in _LIVE_DEPTHS}
+    cd = {k: cp.get(k) for k in _LIVE_DEPTHS}
+    print(f"    *** SETTLE TIMEOUT ({timeout:.0f}s): live drain queues never reached 0 - "
+          f"host={hd} client={cd} - proceeding to census anyway (a wedged drain must fail RED) ***")
+    return False
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+def item_id_counter(gc):
+    """The next BattleItem id this machine will mint (chkBattleItemId) - the 76-vs-77 term."""
+    return session.sync_check(gc).get("chkBattleItemId")
+
+
+def write_fixture(user_dir, mission, difficulty):
+    """Pin the NEW BATTLE mission + difficulty (SOAK.write_battle_fixture only writes mission).
+    mission indexes the coop-filtered new-battle list: 1=MEDIUM_SCOUT, 5=TERROR_SHIP,
+    6=BATTLESHIP (see the deployment order; the craft-preview entry is filtered so
+    MEDIUM_SCOUT=1). Higher difficulty leans the deployment's alien count to its high end."""
+    path = os.path.join(user_dir, "xcom1", "battle.cfg")
+    with open(path, "w", encoding="utf-8") as f:
+        f.write("mission: %d\n" % mission)
+        f.write("difficulty: %d\n" % difficulty)
+    return path
+
+
+def adj_free(ax, ay, az, occupied):
+    # FIXED scan order => deterministic placement given the pinned map.
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        p = (ax + dx, ay + dy, az)
+        if p not in occupied:
+            return p
+    return None
+
+
+def ambush(host, client, pairs, hp, log):
+    """Weaken + place up to `pairs` soldiers adjacent to live aliens on BOTH machines so the
+    host alien AI shoots them down in-chain (the death carriers whose heavy-cluster replay is
+    the bug). Keeps soldier[0] untouched so the mission cannot end mid-run. Returns
+    (placed, digest_fragment) - the fragment feeds the run's scenario digest."""
+    hb = bstate(host)
+    aliens = [u for u in hb["units"] if u.get("faction") == 1 and not u.get("isOut")]
+    soldiers = [u for u in hb["units"] if u.get("faction") == 0 and not u.get("isOut")]
+    occupied = {(u["x"], u["y"], u["z"]) for u in hb["units"] if not u.get("isOut")}
+    placed = 0
+    frag = []
+    for alien, sol in list(zip(aliens, soldiers[1:]))[:pairs]:
+        p = adj_free(alien["x"], alien["y"], alien["z"], occupied)
+        if not p:
+            continue
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": sol["id"],
+                       "x": p[0], "y": p[1], "z": p[2]}) for gc in (host, client)]
+        if not all(r.get("moved") for r in res):
+            continue
+        occupied.add(p)
+        for gc in (host, client):
+            gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": sol["id"],
+                   "health": hp, "visible": True})
+        placed += 1
+        frag.append((sol["id"], alien["id"], p[0], p[1], p[2], hp))
+        if log:
+            print(f"      ambush: soldier {sol['id']} -> ({p[0]},{p[1]},{p[2]}) hp={hp} "
+                  f"next to alien {alien['id']} at ({alien['x']},{alien['y']},{alien['z']})")
+    return placed, frag
+
+
+def unit_census_map(gc):
+    b = SOAK.battle(gc)
+    return {u["id"]: u for u in b["units"]}
+
+
+def capture_mechanism(host, client, tag):
+    """RCA ground-truth dump at (or just after) tripwire fire. Grabs the persisted rings
+    (fieldDiffs / mismatches / rxTrace survive the heal) so we can pin the micro-mechanism:
+    which unit+field diverged, host value vs client (peer) value, and the client apply order
+    (did an action_end marker land before that unit's unit_casualty/hit_unit?)."""
+    hp = host.cmd({"cmd": "parallel_state"})
+    hsc = hp.get("syncCheck", {})
+    cp = client.cmd({"cmd": "parallel_state", "trace": True, "traceLimit": 256, "dump_hold": True})
+    # divergent units = census diff + any unit named in the host's field diffs.
+    hu, cu = unit_census_map(host), unit_census_map(client)
+    diverg = set()
+    for uid in set(hu) | set(cu):
+        a, b = hu.get(uid), cu.get(uid)
+        if not a or not b:
+            diverg.add(uid); continue
+        if (a.get("health"), a.get("stun"), a.get("status"), a.get("wounds"),
+                a.get("x"), a.get("y"), a.get("z")) != \
+           (b.get("health"), b.get("stun"), b.get("status"), b.get("wounds"),
+                b.get("x"), b.get("y"), b.get("z")):
+            diverg.add(uid)
+    for d in hsc.get("fieldDiffs", []):
+        diverg.add(d.get("unitId", d.get("unit")))
+    stats = {}
+    for uid in sorted(x for x in diverg if isinstance(x, int)):
+        try:
+            stats[uid] = {
+                "host": host.cmd({"cmd": "unit_stats_full", "id": uid}).get("units"),
+                "client": client.cmd({"cmd": "unit_stats_full", "id": uid}).get("units"),
+            }
+        except Exception as e:
+            stats[uid] = {"error": str(e)}
+    return {
+        "tag": tag,
+        "host_desyncSeen": TW.desync_seen(host),
+        "client_desyncSeen": TW.desync_seen(client),
+        "fieldDiffs": hsc.get("fieldDiffs", []),
+        "mismatches": hsc.get("mismatches", []),
+        "buckets": hsc.get("buckets", {}),
+        "lastSeq": hsc.get("lastSeq"), "lastComparedSeq": hsc.get("lastComparedSeq"),
+        "host_turn_side": (SOAK.battle(host).get("turn"), SOAK.battle(host).get("side")),
+        "client_turn_side": (SOAK.battle(client).get("turn"), SOAK.battle(client).get("side")),
+        "client_rxTrace": cp.get("rxTrace", []),
+        "client_diagTrace": cp.get("diagTrace", []),  # three-class RCA: tagged write log
+        "host_diagTrace": hp.get("diagTrace", []),    # three-class RCA: host-side lifecycle
+        "client_holdDump": cp.get("holdDump", []),
+        "client_rxSeqDeferred": cp.get("rxSeqDeferred"),
+        "client_rxLegacyPasses": cp.get("rxLegacyPasses"),
+        "client_rxHardFloorPasses": cp.get("rxHardFloorPasses"),
+        # Task-A precondition disambiguator (owner 2026-08-26): rank-0 = the next_turn
+        # snapshot. Rank0==0 => the panic-spent unit's next_turn TU write was APPLIED, so
+        # the client's stale TU == the next_turn payload (pre-regen) => host-emit-order
+        # branch. Rank0>0 (unit rejected) => payload was post-regen but dropped => watermark
+        # branch. (coopApplyNextTurnUnitStates rank-0 watermark, connectionTCP.cpp:13426.)
+        "client_stateWatermarkRejects": cp.get("stateWatermarkRejects"),
+        "client_stateWatermarkRejectsRank0": cp.get("stateWatermarkRejectsRank0"),
+        "client_nextTurnRejects": cp.get("nextTurnRejects"),
+        "client_stateWatermarkRejectsRank1": cp.get("stateWatermarkRejectsRank1"),
+        "client_stateWatermarkRejectsRank2": cp.get("stateWatermarkRejectsRank2"),
+        "divergent_units": sorted(x for x in diverg if isinstance(x, int)),
+        "unit_stats_full": stats,
+    }
+
+
+def diag(host, client, tag):
+    """Full divergence dump - printed when the repro fires (or on any error)."""
+    print(f"    ==== DIVERGENCE DUMP ({tag}) ====")
+    for name, gc in (("host", host), ("client", client)):
+        try:
+            p = parallel(gc)
+            print(f"    {name}: itemIdCtr={item_id_counter(gc)} corpses={len(corpses(gc))} "
+                  f"rxHold={p.get('rxHold')} rxRotates={p.get('rxRotates')} "
+                  f"rxSeqDeferred={p.get('rxSeqDeferred')} barrierBlocks={p.get('barrierBlocks')} "
+                  f"rxHardFloorPasses={p.get('rxHardFloorPasses')} rxLegacyPasses={p.get('rxLegacyPasses')} "
+                  f"displayBacklog={p.get('displayBacklog')} desyncSeen={TW.desync_seen(gc)} "
+                  f"casualtiesApplied={p.get('casualtiesApplied')}")
+        except Exception as de:
+            print(f"    {name}: dump failed: {de}")
+    for name, gc in (("host", host), ("client", client)):
+        d = os.path.join(gc.user_dir, "desync-reports")
+        wrote = sorted(os.listdir(d)) if os.path.isdir(d) else []
+        if wrote:
+            print(f"    {name} desync-reports on disk: {wrote} in {d}")
+
+
+def _wireorder_unit_drift(hb, cb):
+    """Alien-side-boundary unit census, SCOPED to what the protocol replicates there.
+
+    Same principle SOAK.unit_census (test_parallel_soak.py:184-196) already applies to
+    NON-PLAYER TU: "asserting a term the protocol does not replicate makes a permanent red
+    rather than a detector." Two terms are not replicated AT THE ALIEN-SIDE BOUNDARY and
+    so are NOT asserted here (they reconcile at the next sidestart, and the in-game
+    sync-check gates them until then):
+
+      * a unit's TU: when it is spent by host-resolved PANIC during the alien side it is
+        "spent by executor AI, the peer applies the outcome" - identical to the non-player
+        -TU rationale unit_census already excludes. (Player-turn TU is still strict; this
+        repro only censuses at the ALIEN boundary.)
+      * a TRULY-DEAD unit's residual health/stun: EXCLUDED ONLY when the unit is dead -
+        health <= 0 - on BOTH machines (owner ruling 2026-08-26). A corpse's exact leftover
+        health/stun is a number the protocol does not re-slave, and both machines already
+        agree it is dead. A STUNNED-OUT unit (isOut but health > 0) stays FULLY asserted:
+        it can WAKE, so a health/stun divergence there is a real future desync, not a
+        residual. A host-dead / client-stunned split (health<=0 vs >0) also stays asserted
+        and STILL fails - only both-dead is dropped.
+
+    ALWAYS asserted (the real desync surface): position (x,y,z), wounds, isOut, and - unless
+    the unit is dead (health<=0) on BOTH machines - health/stun. So a live-unit health drift,
+    a stunned-out health/stun drift, a position drift, a wound drift, or an isOut
+    (dead-vs-alive) disagreement STILL fails. Returns {id: (host_key, client_key)} for
+    drifting units, or {} when clean."""
+    hu = {u["id"]: u for u in hb["units"]}
+    cu = {u["id"]: u for u in cb["units"]}
+
+    def key(u, both_dead):
+        base = [u["x"], u["y"], u["z"], u.get("wounds"), bool(u["isOut"])]
+        if not both_dead:                # live / stunned-out / one-sided: health & stun strict
+            base += [u["health"], u["stun"]]
+        return tuple(base)
+
+    drift = {}
+    for uid in set(hu) | set(cu):
+        h, c = hu.get(uid), cu.get(uid)
+        if h is None or c is None:
+            drift[uid] = (h, c)
+            continue
+        both_dead = (h["health"] <= 0 and c["health"] <= 0)   # truly-dead on BOTH (ruling)
+        if key(h, both_dead) != key(c, both_dead):
+            drift[uid] = (key(h, both_dead), key(c, both_dead))
+    return drift
+
+
+def assert_census_wireorder(host, client, what, latch_aware=False):
+    """The --wire-order acceptance: the scoped unit census (above) PLUS every strict
+    detector SOAK.assert_census runs unchanged (item id census, tile hazards, the PRD-P2
+    tripwire, the in-game sync-check, and the on-disk desync-report silence check). Only
+    the unit-tuple's two protocol-non-replicated terms are dropped; a real desync in any
+    other term - or the tripwire firing - still fails exactly as in shipped mode.
+
+    latch_aware (owner ruling 2026-08-30): route the in-game sync-check sub-assertion
+    through the persistence latch (desyncSeen OR syncBoundaryPersistAlarms>0) instead of
+    the lifetime cumulative bucket counters, so a pended-then-healed transient no longer
+    counts as a divergence. The live item/unit/hazard/battle-synced terms stay strict."""
+    SOAK.settle_display(host, client)
+    hb, cb = SOAK.battle(host), SOAK.battle(client)
+    assert hb.get("inBattle") and cb.get("inBattle"), (
+        f"the fixture's mission ENDED before the census {what}")
+    drift = _wireorder_unit_drift(hb, cb)
+    if drift:
+        hs = {u["id"]: (u["status"], u.get("energy"), u.get("tu")) for u in hb["units"]}
+        cs = {u["id"]: (u["status"], u.get("energy"), u.get("tu")) for u in cb["units"]}
+        lines = "\n".join(
+            f"      {k}: host={drift[k][0]} client={drift[k][1]}  "
+            f"(status/energy/tu host={hs.get(k)} client={cs.get(k)})"
+            for k in sorted(drift))
+        raise AssertionError(
+            f"SCOPED UNIT CENSUS DRIFT {what}: the two machines disagree on a replicated "
+            f"term\n    (x, y, z, wounds, isOut [, health, stun if not both-out])\n{lines}")
+    hi, ci = SOAK.item_census(host), SOAK.item_census(client)
+    assert hi == ci, (
+        f"ITEM CENSUS DRIFT {what}: strict id census differs "
+        f"(host {len(hi)} items, client {len(ci)})\n{SOAK.first_diff(hi, ci)}")
+    hh, ch = SOAK.hazard_census(host), SOAK.hazard_census(client)
+    assert hh == ch, (
+        f"TILE HAZARD DRIFT {what}: host={hh} client={ch}")
+    session.assert_battle_synced(host, client, what)
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), (
+        f"the PRD-P2 drift tripwire FIRED {what} - a release blocker")
+    session.assert_sync_clean(host, client, what, latch_aware=latch_aware)
+    for tag, gc in (("host", host), ("client", client)):
+        d = os.path.join(gc.user_dir, "desync-reports")
+        wrote = sorted(os.listdir(d)) if os.path.isdir(d) else []
+        assert not wrote, (
+            f"{tag} wrote a desync diagnostic bundle {what} in a CLEAN battle: {wrote}")
+
+
+# ---- bleed-out discrimination experiment (owner ruling 2026-08-29) ------------------
+def _bleed_candidates(gc):
+    """{uid: (health, stun, wounds, isOut, status)} for units that are bleed-out
+    candidates on THIS machine - a fatal wound present (wounds>0) or already down
+    (isOut). getFatalWounds() is host-resolved damage; both machines then bleed it in
+    their OWN prepareNewTurn, so a per-turn host-vs-client read tells a heal from a freeze."""
+    out = {}
+    for u in SOAK.battle(gc)["units"]:
+        if (u.get("wounds") or 0) > 0 or u.get("isOut"):
+            out[u["id"]] = (u.get("health"), u.get("stun"), u.get("wounds"),
+                            bool(u.get("isOut")), u.get("status"))
+    return out
+
+
+def _bleed_snapshot(host, client):
+    hc, cc = _bleed_candidates(host), _bleed_candidates(client)
+    return {uid: (hc.get(uid), cc.get(uid)) for uid in sorted(set(hc) | set(cc))}
+
+
+def _print_bleed(label, snap):
+    print(f"    [bleed-out] {label}: (health, stun, wounds, isOut, status)")
+    if not snap:
+        print("      (no bleed-out candidates)")
+    for uid, (h, c) in snap.items():
+        print(f"      unit {uid}: host={h} client={c}" + ("" if h == c else "   <<< DIFF"))
+
+
+def _regen_latch(gc):
+    """Non-diag unitsRegen latch view from parallel_state: the aggregate pending/heal/
+    promote counters plus whether unitsRegen currently appears in the mismatch ring."""
+    p = parallel(gc)
+    sc = p.get("syncCheck", {}) or {}
+    regen_mm = [m for m in (sc.get("mismatches", []) or []) if m.get("bucket") == "unitsRegen"]
+    return (f"pending={p.get('syncBoundaryPending')} healed={p.get('syncBoundaryHealed')} "
+            f"persistAlarms={p.get('syncBoundaryPersistAlarms')} "
+            f"unitsRegenMismatches={len(regen_mm)}"
+            + (f" last={regen_mm[-1]}" if regen_mm else ""))
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=20260802,
+                    help="pins map+deployment+stats (bring_up_battle) AND the RNG stream")
+    ap.add_argument("--pairs", type=int, default=8,
+                    help="soldiers ambushed per side; ABOVE the targeted tests' cap of 3 so "
+                         "the heavy-cluster casualty-value replay is exercised")
+    ap.add_argument("--sides", type=int, default=5, help="alien sides to drive (census after each)")
+    ap.add_argument("--hp", type=int, default=25, help="ambushed soldiers' health (low => one-shot kills)")
+    ap.add_argument("--slow-client", type=int, default=SOAK.SLOW_SPEED,
+                    help="ms/frame on the client so its alien-side replay lags far behind the host")
+    ap.add_argument("--no-force-floor", action="store_true",
+                    help="do NOT force the liveness floor (default forces it: the reorder window)")
+    ap.add_argument("--ghost-off", action="store_true",
+                    help="disable the Phase-2c death ghost on the client (the report reproduces both ways)")
+    ap.add_argument("--rx-hold", action="store_true",
+                    help="ESCALATION: park the client pump during each alien side, release at the "
+                         "boundary (stages the hard RX-wedge form of the bug)")
+    ap.add_argument("--drain-disable", action="store_true",
+                    help="ESCALATION: legacy full-disable drain (the pre-fix out-of-order burst)")
+    ap.add_argument("--rca-trace", action="store_true",
+                    help="RCA: arm ONLY the lightweight diag write-log (diag_capture) on both "
+                         "machines (NOT the heavy SEAM-7 sync_capture, so the quiet side still "
+                         "closes) and dump both diagTraces at the final census -> MECH_TRACE_OUT")
+    ap.add_argument("--mission", type=int, default=1,
+                    help="new-battle mission index (1=MEDIUM_SCOUT 3-6 aliens; 5=TERROR_SHIP "
+                         "~10-18; 6=BATTLESHIP ~9-22 - a HEAVY single-side death cluster)")
+    ap.add_argument("--difficulty", type=int, default=0,
+                    help="new-battle difficulty 0..4 (higher => the deployment's alien count "
+                         "leans to its high end)")
+    ap.add_argument("--heavy-floor", type=int, default=0,
+                    help="fail if fewer than this many live hostiles came up (catches a wrong "
+                         "--mission index that silently fell back to a light map); 0 = MIN_HOSTILES")
+    ap.add_argument("--trace-mechanism", action="store_true",
+                    help="RCA: arm SEAM-7 field capture, and on tripwire fire dump the exact "
+                         "(unit, field, host, peer) diffs + client apply-order trace + per-unit "
+                         "stats to <scratch>/mechanism_trace.json (pins which micro-mechanism)")
+    ap.add_argument("--wire-order", action="store_true",
+                    help="FIX LEVER: engage wire_order_state on both machines - the client applies "
+                         "hash-relevant state at RX arrival in stream order and samples the per-action "
+                         "sync-check at the marker's wire-order first sight (sync_report). Uses the "
+                         "scoped alien-side-boundary census (drops the two protocol-non-replicated "
+                         "residuals). Expect the repro to STOP firing (exit 3) with the lever on.")
+    ap.add_argument("--scoped-census", action="store_true",
+                    help="ORACLE-VALIDITY: use the scoped alien-side-boundary census WITHOUT engaging "
+                         "the fix lever. Proves the scoped census still catches the real bug (position/"
+                         "tripwire/hazard/live-unit health) lever-off: expect it to STILL fire (exit 0).")
+    ap.add_argument("--strict-burnin", action="store_true",
+                    help="INVESTIGATION (task D): engage strict capture on both machines (report-only "
+                         "ALL buckets, alien-side skips stripped, ghost off) so a per-action mismatch is "
+                         "COUNTED but never routes to the tripwire. Combined with --wire-order it proves "
+                         "the per-action report is genuinely clean (not merely hidden behind the "
+                         "report-only gate). Prints the host sync-check per-action vs boundary mismatch "
+                         "breakdown at the end.")
+    ap.add_argument("--quiet-sides", type=int, default=None,
+                    help="Number of consecutive quiet sides driven after the last ambush side; the "
+                         "census after the LAST (Nth) quiet boundary is the GATE, the earlier ones are "
+                         "diagnostic. Default (owner ruling 2026-08-30): 2 under --wire-order (the "
+                         "canonical latch-aware readout - one boundary to PEND, the next to PROMOTE), "
+                         "1 otherwise. Every quiet boundary prints the bleed-out candidates (wounds>0 "
+                         "or isOut) host vs client and the unitsRegen latch state, so a FROZEN "
+                         "(persistent) face is told apart from a CONVERGING (transient) one.")
+    args = ap.parse_args()
+    # coop (owner ruling 2026-08-30): --quiet-sides 2 is the canonical --wire-order default
+    # (the latch needs a boundary to pend and the next to promote); 1 elsewhere.
+    if args.quiet_sides is None:
+        args.quiet_sides = 2 if args.wire_order else 1
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48900, make_user_dir("heavydeath_host", options=host_opts))
+    client = GameClient("client", 48901, make_user_dir("heavydeath_client", options=client_opts))
+    for gc in (host, client):
+        write_fixture(gc.user_dir, args.mission, args.difficulty)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+
+    repro_fired = None      # the AssertionError text, once it fires
+    setup_error = None
+    scenario_digest = None
+    mechanism_capture = None  # RCA ground-truth bundle, grabbed when the tripwire flips
+    corpses0 = 0
+    corpses_grew = 0        # captured BEFORE quit (the socket is dead after)
+    peak_backlog = 0
+    started = time.time()
+    try:
+        # --- pinned bring-up (map/deployment/stats) + pinned RNG stream ---
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the sim, client must be the replay peer (executor invariant)"
+
+        foes = [u for u in bstate(host)["units"] if u.get("faction") == 1 and not u.get("isOut")]
+        soldiers = [u for u in bstate(host)["units"] if u.get("faction") == 0 and not u.get("isOut")]
+        floor = args.heavy_floor or SOAK.MIN_HOSTILES
+        assert len(foes) >= floor, (
+            f"pinned seed {args.seed} / mission {args.mission} came up with only {len(foes)} live "
+            f"hostiles (< {floor}) - a wrong --mission index that fell back to a light map, or a "
+            f"short seed. Pick another --seed/--mission (NO re-roll: it would change the map).")
+        # scenario digest seed: the pinned rosters (positions/ids) the whole run derives from.
+        roster = sorted((u["id"], u.get("faction"), u["x"], u["y"], u["z"]) for u in bstate(host)["units"])
+        print(f"pinned seed {args.seed}: {len(foes)} aliens, {len(soldiers)} soldiers "
+              f"({time.time() - started:.0f}s)")
+
+        # forcing knobs (failure reliability) - SHIPPED compare mode (no strict-burnin).
+        if args.ghost_off:
+            client.cmd({"cmd": "parallel_state", "death_ghost_disable": True})
+            assert parallel(client).get("deathGhostDisable") is True, "ghost-off lever did not engage"
+        if not args.no_force_floor:
+            client.cmd({"cmd": "parallel_state", "rx_force_floor": True})
+            assert parallel(client).get("rxForceFloor") is True, "rx_force_floor lever did not engage"
+        if args.wire_order:
+            # FIX LEVER: wire-order state-apply + report on both machines (the fix under test).
+            for gc in (host, client):
+                gc.cmd({"cmd": "parallel_state", "wire_order_state": True})
+                assert parallel(gc).get("wireOrderState") is True, "wire_order_state lever did not engage"
+        if args.strict_burnin:
+            # INVESTIGATION task D: strict capture, report-only ALL buckets, ghost off - so a
+            # per-action mismatch is counted but never routes. Proves the per-action report is
+            # clean rather than hidden behind the SharedEcon.cpp:6186 report-only gate.
+            SOAK.enable_strict_burnin(host, client)
+        if args.drain_disable:
+            for gc in (host, client):
+                gc.cmd({"cmd": "parallel_state", "rx_drain_disable": True})
+        if args.trace_mechanism:
+            for gc in (host, client):
+                r = gc.cmd({"cmd": "sync_capture", "on": True})
+                assert r.get("fieldCapture") is True, f"SEAM-7 field capture did not arm: {r}"
+            # coop (three-class RCA DIAGNOSTIC): arm the capture-gated tagged write log on
+            # BOTH machines (item lifecycle needs the host vs client compare). Lever-off inert.
+            for gc in (host, client):
+                gc.cmd({"cmd": "parallel_state", "diag_capture": True, "diag_heavy": True})
+                assert parallel(gc).get("diagCapture") is True, "diag_capture did not arm"
+            print("    SEAM-7 field capture + diag write-log (heavy) ARMED both (mechanism trace)")
+        if args.rca_trace and not args.trace_mechanism:
+            # RCA (TRACE A/B): arm ONLY the lightweight diag write-log (no heavy sync_capture),
+            # so the quiet side still closes and the EXPL_TX/RX + TRACEB lifecycle is captured.
+            for gc in (host, client):
+                gc.cmd({"cmd": "parallel_state", "diag_capture": True})
+                assert parallel(gc).get("diagCapture") is True, "diag_capture did not arm"
+            print("    RCA diag write-log ARMED both (lightweight, no sync_capture)")
+        knobs = (f"slow-client={args.slow_client} force-floor={not args.no_force_floor} "
+                 f"ghost-off={args.ghost_off} rx-hold={args.rx_hold} drain-disable={args.drain_disable} "
+                 f"wire-order={args.wire_order} "
+                 f"pairs={args.pairs} sides={args.sides} hp={args.hp}")
+        print(f"knobs: {knobs}")
+
+        corpses0 = len(corpses(client))
+        digest_frags = [("roster", roster)]
+
+        for side in range(1, args.sides + 1):
+            if not bstate(host).get("inBattle"):
+                setup_error = f"mission ended before alien side {side} (fixture exhausted)"
+                break
+            placed, frag = ambush(host, client, args.pairs, args.hp, log=(side == 1))
+            digest_frags.append((f"side{side}", placed, frag))
+            turn0 = bstate(host)["turn"]
+
+            if args.rx_hold:
+                # ESCALATION: park the client pump across the alien side, release at the boundary.
+                client.cmd({"cmd": "parallel_state", "rx_hold": True})
+                PE.hush(host, client)
+                for gc in (host, client):
+                    if not parallel(gc)["localReady"]:
+                        PE.arm(gc)
+                end = time.time() + 12.0
+                while time.time() < end:
+                    peak_backlog = max(peak_backlog, parallel(client).get("rxHold", 0))
+                    time.sleep(0.5)
+                client.cmd({"cmd": "parallel_state", "rx_hold": False})
+                PE.wait_side(host, client, turn0, timeout=180)
+                # coop (Investigation B, executor 2026-08-26): the sidestart boundary residual
+                # fires HERE (client released deeply behind at the boundary). Grab the SEAM-7
+                # fieldDiff immediately - deterministic and non-wedging (rx-hold uses wait_side,
+                # not close_side), so the unitsRegen polarity is captured before any heal.
+                if args.trace_mechanism and mechanism_capture is None:
+                    for _ in range(40):
+                        sc = parallel(host).get("syncCheck", {})
+                        if sc.get("mismatches") or sc.get("fieldDiffs") \
+                                or TW.desync_seen(host) or TW.desync_seen(client):
+                            mechanism_capture = capture_mechanism(host, client,
+                                                                  f"rx-hold fire on alien side {side}")
+                            mm = mechanism_capture.get("mismatches", [])
+                            fd = mechanism_capture.get("fieldDiffs", [])
+                            print(f"    *** INVESTIGATION-B rx-hold capture: "
+                                  f"{len(fd)} fieldDiffs, mismatches={mm} ***")
+                            for d in fd:
+                                print(f"      fieldDiff: unit={d.get('unitId', d.get('unit'))} "
+                                      f"field={d.get('field')} host={d.get('host')} client={d.get('client')}")
+                            for uid, st in (mechanism_capture.get("unit_stats_full") or {}).items():
+                                print(f"      unit {uid} host={st.get('host')} client={st.get('client')}")
+                            break
+                        time.sleep(0.2)
+            else:
+                # sample the client's backlog while the alien side replays (the lag the bug needs).
+                SOAK.close_side(host, client, 0, 1, turn0)
+                # RCA: poll the host sync-check HARD right after the side closes - the
+                # unitsCombat mismatch + SEAM-7 fieldDiffs land in their persisted rings the
+                # instant they fire; grab the moment either is non-empty (before it heals /
+                # the peer goes silent). Also catch the P2 tripwire flip.
+                for _ in range(40):
+                    pc = parallel(client)
+                    peak_backlog = max(peak_backlog, pc.get("displayBacklog", 0), pc.get("rxHold", 0))
+                    if args.trace_mechanism and mechanism_capture is None:
+                        sc = parallel(host).get("syncCheck", {})
+                        if sc.get("mismatches") or sc.get("fieldDiffs") \
+                                or TW.desync_seen(host) or TW.desync_seen(client):
+                            mechanism_capture = capture_mechanism(host, client,
+                                                                  f"fire on alien side {side}")
+                            print(f"    *** mismatch/tripwire seen - captured "
+                                  f"(units {mechanism_capture['divergent_units']}, "
+                                  f"{len(mechanism_capture['fieldDiffs'])} fieldDiffs, "
+                                  f"{len(mechanism_capture['mismatches'])} mismatches) ***")
+                            break
+                    time.sleep(0.2)
+
+            print(f"  alien side {side} (turn {turn0}): ambushed {placed}, corpses "
+                  f"host={len(corpses(host))} client={len(corpses(client))}, "
+                  f"peak client lag={peak_backlog} ({time.time() - started:.0f}s)")
+
+            # THE RAW FIELD CHECK - settle then compare (unit/item census + battle-synced +
+            # tripwire + sync-clean + on-disk desync-report). This is what fires in the field.
+            try:
+                # --wire-order: the fix aligns the sync-check REPORT; the two protocol-
+                # non-replicated residuals (panic-spent TU, dead-unit residual health)
+                # reconcile at the next sidestart and are dropped from the unit tuple only
+                # (every strict detector stays). Shipped/baseline runs keep the full census.
+                # coop (option 3, §4 harness settle): under --wire-order the census must
+                # measure the HEALED steady state (transient display-lane lag heals within
+                # a boundary). Wait until BOTH machines are display-drained before comparing;
+                # on timeout print a loud SETTLE TIMEOUT and proceed anyway (a genuinely
+                # wedged client must still FAIL the run, not hang the harness).
+                if args.wire_order:
+                    settle_wire_order(host, client, timeout=60.0)
+                    _hi, _ci = len(SOAK.item_census(host)), len(SOAK.item_census(client))
+                    print(f"    [item-census] after side {side}: host={_hi} client={_ci}"
+                          + (f"  <<< DIFF {_ci - _hi}" if _hi != _ci else "  (agree)"))
+                census = (assert_census_wireorder
+                          if (args.wire_order or args.scoped_census) else SOAK.assert_census)
+                census(host, client, f"after the alien side of turn {turn0}")
+            except AssertionError as ae:
+                if args.wire_order:
+                    # coop (option A, owner ruling 2026-08-29): during the AMBUSH sides the
+                    # per-side census is DIAGNOSTIC ONLY - the deferred-authored residuals
+                    # (stun/position/item-removal) reconcile over the NEXT side (each ambush
+                    # side injects fresh ones the client is still replaying), so an alien-
+                    # boundary census is a mid-flight snapshot, not a verdict. Print it, keep
+                    # driving; the QUIET-SIDE census after the last ambush side is the gate.
+                    # Lever-off (scoped/shipped) still GATES per-side (baseline preserved).
+                    print(f"\n  [diagnostic] per-side census drift after alien side {side} "
+                          f"(turn {turn0}) - NOT gating (reconciles over the next side):\n  {ae}")
+                else:
+                    repro_fired = str(ae)
+                    print(f"\n  *** REPRO FIRED after alien side {side} (turn {turn0}) ***")
+                    print(f"  {repro_fired}")
+                    if args.trace_mechanism and mechanism_capture is None:
+                        mechanism_capture = capture_mechanism(host, client, f"post-settle side {side}")
+                    diag(host, client, f"alien side {side}")
+                    break
+
+        # coop (option A, owner ruling 2026-08-29): after the LAST ambush side, drive ONE
+        # QUIET side - no ambush, no set_stat, no interference - so the next sidestart's
+        # next_turn reconciles the deferred-authored residuals the ambush sides left in
+        # flight. THEN run the FINAL census: FULLY STRICT (assert_census_wireorder keeps
+        # every existing term - raw unit census incl. live-unit stun/position, strict item-id
+        # census, assert_battle_synced, tripwire, sync-clean, on-disk report check; only the
+        # two prior-ruled protocol-non-replicated drops remain, NO new exclusions). This is
+        # the GATING assertion under --wire-order. The Option-B drain-wait runs before it.
+        if args.wire_order and repro_fired is None and setup_error is None:
+            # coop (harness alignment + bleed-out discrimination, owner rulings 2026-08-29/30):
+            # drive N quiet sides after the last ambush side (default 2 under --wire-order), census
+            # after EACH quiet boundary (per-boundary diagnostic prints), the LAST/Nth quiet-boundary
+            # census is the GATE that sets repro_fired. The census is LATCH-AWARE under --wire-order:
+            # its in-game sync-check sub-assertion consults the persistence latch (desyncSeen OR
+            # syncBoundaryPersistAlarms>0) instead of the lifetime cumulative bucket counters, so a
+            # pended-then-healed transient no longer counts (the live item/unit/hazard/battle-synced
+            # terms stay strict). One quiet boundary PENDS a frozen divergence, the next PROMOTES it.
+            nqs = max(1, args.quiet_sides)
+            if not bstate(host).get("inBattle"):
+                setup_error = "mission ended before the quiet reconciliation side"
+            else:
+                _print_bleed(f"last ambush side, pre-quiet (turn {bstate(host)['turn']})",
+                             _bleed_snapshot(host, client))
+                print(f"      unitsRegen latch(host) {_regen_latch(host)}")
+            for _qi in range(1, nqs + 1):
+                if setup_error is not None:
+                    break
+                if not bstate(host).get("inBattle"):
+                    setup_error = f"mission ended before quiet side {_qi}"
+                    break
+                _is_gate = (_qi == nqs)
+                qturn = bstate(host)["turn"]
+                print(f"\n  -- quiet side {_qi}/{nqs} (turn {qturn}, no ambush) - "
+                      f"{'GATING' if _is_gate else 'diagnostic'} census --")
+                SOAK.close_side(host, client, 0, 1, qturn)
+                settle_wire_order(host, client, timeout=60.0)
+                _hi, _ci = len(SOAK.item_census(host)), len(SOAK.item_census(client))
+                print(f"    [item-census] after quiet side {_qi}: host={_hi} client={_ci}"
+                      + (f"  <<< DIFF {_ci - _hi}" if _hi != _ci else "  (agree)"))
+                _print_bleed(f"after quiet boundary {_qi} (turn {qturn})",
+                             _bleed_snapshot(host, client))
+                print(f"      unitsRegen latch(host) {_regen_latch(host)}")
+                try:
+                    assert_census_wireorder(host, client,
+                        f"quiet boundary {_qi}/{nqs} (turn {qturn})", latch_aware=True)
+                    _fired = None
+                    print(f"    [census] quiet boundary {_qi}: CLEAN"
+                          + ("  - the residuals reconciled" if _is_gate else ""))
+                except AssertionError as ae:
+                    _fired = str(ae)
+                    print("    [census] quiet boundary %d: %s" % (
+                        _qi, "*** REPRO FIRED (GATE) ***" if _is_gate else "DRIFT (diagnostic)"))
+                    print(f"      {_fired}")
+                    if _is_gate:
+                        if args.trace_mechanism and mechanism_capture is None:
+                            mechanism_capture = capture_mechanism(host, client, "quiet-side final census")
+                        diag(host, client, "quiet-side final census")
+                _dh = TW.desync_seen(host)
+                _agree = (bool(_fired) == bool(_dh))
+                print(f"    [detector-fidelity] quiet boundary {_qi}"
+                      + (" (GATE)" if _is_gate else "")
+                      + f": census={'FIRED' if _fired else 'CLEAN'} desyncSeen={_dh} => "
+                      + ("AGREE" if _agree else "DISAGREE <<< GATE FAILURE"))
+                if _is_gate:
+                    repro_fired = _fired
+                    if args.rca_trace:
+                        rca_out = os.environ.get("MECH_TRACE_OUT") or os.path.join(
+                            os.path.dirname(os.path.abspath(__file__)), "rca_trace.json")
+                        with open(rca_out, "w", encoding="utf-8") as _f:
+                            json.dump({
+                                "quiet_turn": qturn,
+                                "repro_fired": repro_fired,
+                                "item_census_after_quiet": {"host": _hi, "client": _ci},
+                                "host_diagTrace": parallel(host).get("diagTrace", []),
+                                "client_diagTrace": parallel(client).get("diagTrace", []),
+                            }, _f, indent=1, default=str)
+                        print(f"    RCA diag traces written -> {rca_out}")
+
+        try:
+            corpses_grew = len(corpses(client)) - corpses0
+        except Exception:
+            pass
+        scenario_digest = hashlib.sha256(
+            json.dumps(digest_frags, sort_keys=True, default=str).encode()).hexdigest()[:16]
+
+    except AssertionError as ae:
+        setup_error = f"setup assertion: {ae}"
+    except Exception as e:
+        setup_error = f"{e}\n{traceback.format_exc()}"
+    finally:
+        try:
+            # Owner policy (2026-08-26): FLAG any natural liveness-floor engagement every run -
+            # fail-loud beats silent out-of-order healing. Captured before the sockets close.
+            floor = {}
+            for _n, _gc in (("host", host), ("client", client)):
+                try:
+                    _p = parallel(_gc)
+                    floor[_n] = (_p.get("rxLegacyPasses"), _p.get("rxHardFloorPasses"))
+                except Exception:
+                    floor[_n] = None
+            _engaged = any(v and (v[0] or v[1]) for v in floor.values() if v)
+            print(f"floor engagement (rxLegacyPasses, rxHardFloorPasses): host={floor.get('host')} "
+                  f"client={floor.get('client')}  "
+                  f"{'<<< FLOOR ENGAGED - a liveness heal occurred this run' if _engaged else '(none - clean)'}")
+            # coop (wire-order Increment 7, SHAPE A diagnostic): host regen-carry emitted
+            # vs client applied. emitted>0 & applied>0 => the carry mechanism runs.
+            try:
+                print(f"SHAPE-A regen carry: host emitted={parallel(host).get('regenEmitted')} "
+                      f"client applied={parallel(client).get('regenApplied')}")
+            except Exception as _re:
+                print(f"SHAPE-A regen carry: <unavailable: {_re}>")
+            # Boundary epoch-reset gate (owner ruling 2026-08-26): print the client's
+            # rank-0 (next_turn snapshot) watermark-reject counter every run - the fix
+            # gate demands it be 0 lever-on in all gate runs.
+            try:
+                _r0 = parallel(client).get("stateWatermarkRejectsRank0")
+                print(f"rank0 next_turn watermark rejects (client): {_r0}  "
+                      f"{'(gate: must be 0 lever-on)' if args.wire_order else '(lever-off, informational)'}")
+            except Exception:
+                print("rank0 next_turn watermark rejects (client): <unavailable>")
+            if args.strict_burnin:
+                try:
+                    sc = parallel(host).get("syncCheck", {})
+                    mm = sc.get("mismatches", [])
+                    per_action = [m for m in mm if not m.get("boundary")]
+                    boundary = [m for m in mm if m.get("boundary")]
+                    def _brk(lst):
+                        d = {}
+                        for m in lst:
+                            k = f"{m.get('bucket')}/{m.get('kind')}"
+                            d[k] = d.get(k, 0) + 1
+                        return d
+                    print(f"STRICT-BURNIN (task D): host sync-check breakdown "
+                          f"(strictBurnIn={sc.get('strictBurnIn')}, compares={sc.get('compares')}):")
+                    print(f"  PER-ACTION (non-boundary) mismatches = {len(per_action)}  {_brk(per_action)}")
+                    print(f"  BOUNDARY mismatches                  = {len(boundary)}  {_brk(boundary)}")
+                    print("  => PER-ACTION CLEAN (report not hidden by report-only gate)"
+                          if not per_action else "  => PER-ACTION NOT CLEAN - investigate")
+                except Exception as se:
+                    print(f"  STRICT-BURNIN dump failed: {se}")
+            if scenario_digest:
+                print(f"\nscenario digest (identical across deterministic runs): {scenario_digest}")
+            print(f"non-vacuity: corpses minted this run = {corpses_grew}, "
+                  f"peak client lag = {peak_backlog}")
+            if args.trace_mechanism:
+                out = os.environ.get("MECH_TRACE_OUT") or os.path.join(
+                    os.path.dirname(os.path.abspath(__file__)), "mechanism_trace.json")
+                with open(out, "w", encoding="utf-8") as f:
+                    json.dump(mechanism_capture or {"note": "tripwire never flipped this run"},
+                              f, indent=1, default=str)
+                print(f"mechanism trace written -> {out}")
+        except Exception as we:
+            print(f"mechanism-trace write failed: {we}")
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    print("\n==== HEAVY-DEATH REPRO VERDICT ====")
+    if setup_error:
+        print(f"  SETUP ERROR (not a repro result): {setup_error}")
+        sys.exit(2)
+    if repro_fired:
+        print("  REPRO FIRED - the heavy-alien-death desync reproduced under the pinned scenario.")
+        print("  (assert_census drifted / tripwire fired / wedge - see the DIVERGENCE DUMP above)")
+        sys.exit(0)
+    if corpses_grew < 4:
+        print(f"  INCONCLUSIVE: only {corpses_grew} corpse(s) minted - the alien AI did not kill a "
+              f"heavy cluster (raise --pairs, lower --hp, or try another --seed). NOT a clean result.")
+        sys.exit(2)
+    print(f"  NO REPRO - {args.sides} heavy alien sides ({corpses_grew} corpses) stayed in census. "
+          f"Tighten the knobs (--rx-hold, --drain-disable, higher --slow-client) or sweep --seed.")
+    sys.exit(3)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_intents.py b/tools/coop_test/test_parallel_intents.py
new file mode 100644
index 000000000..269b79deb
--- /dev/null
+++ b/tools/coop_test/test_parallel_intents.py
@@ -0,0 +1,976 @@
+"""PRD-P6: action intents - the client asks, the host executes, both display.
+
+This is the first truly-parallel playable build. PRD-P5 made both machines hold
+the player side at once but swallowed the client's input; P6 replaces that gate
+with the thin-client loop from PROTOCOL.md:
+
+    client confirm site  ->  action_intent  ->  host validates + admits
+                         <-  action_ack {req_id, action_seq}
+                             host EXECUTES; the chain broadcasts through the
+                             existing send sites (the PRD-P5 executor invariant
+                             `_isActivePlayerSync == getHost()` guarantees it)
+                         <-  the ordinary action packets, which the client
+                             DISPLAYS exactly as it displays a host action
+
+and, when the host cannot take it, `action_deny {reason, warning}`, which the
+client flashes on the battlescape warning widget.
+
+What this test asserts (PRD-P6 acceptance, in order):
+
+  1. Client walk intent -> ack -> the host executes -> BOTH machines converge on
+     the same position and TU. And the client's own selection, camera and
+     singleton `_currentAction` are untouched while its own action is replayed
+     back at it (the PRD-P1 decoupling, which the intent loop leans on entirely).
+  2. Host mid-chain: the client's intent is denied `busy`, the client latches the
+     STR_COOP_PLAYER_BUSY deny (now surfaced via the persistent wait banner, not
+     the toolbar flash) and drops its pending slot, and the same intent
+     succeeds once the chain ends. The chain used is a SHOT: from PRD-P7 on, a
+     chain that is nothing but locomotion is deferred rather than refused
+     (test_parallel_skip.py owns that half), so only a non-skippable chain still
+     reaches the deny.
+  3. Invalid intents are refused with the RIGHT warning key and nothing runs:
+     a soldier the client does not own (STR_COOP_NOT_YOUR_SOLDIER), an actor the
+     HOST's copy has no time units for (STR_NOT_ENOUGH_TIME_UNITS), and a unit
+     that is already down (STR_COOP_ACTION_REFUSED - the branch an unknown unit
+     id and an unresolvable weapon also take). Runs AFTER 4, because the kind
+     sweep is what supplies the casualty.
+  4. One intent of EVERY kind driven from the client - turn, kneel, shoot,
+     throw, prime, medikit, psi, melee - with the item census and the PRD-P2
+     drift tripwire quiet after each. This is why P6 depends on P3/P4: every
+     client action now runs through the host's simulation, so a remaining
+     authority seam shows up here as census drift.
+  5. Both machines act inside one round trip: exactly one action starts, the
+     other is denied (or serialized), and nothing executes twice.
+  6. A client-intent walk next to a hostile: whatever reaction fire the aliens
+     choose to make resolves on the host and displays identically on both, with
+     the tripwire quiet.
+
+DRIVING NOTE. `battle_intent` is the lever, and it is deliberately NOT
+`battle_action`/`battle_fire`: those push BattleStates directly (the raw
+local-execution lever test_parallel_sharedturn's no-replication assertion needs).
+`battle_intent` builds the BattleAction a UI confirm site builds and hands it to
+BattlescapeGame::coopRouteAction + executeAction - the exact pair mapClick, the
+kneel button, handleNonTargetAction and the medikit presses call. What it does
+not cover is which widget calls them.
+
+FIXTURE NOTE. The skirmish fixture packs all 14 soldiers into the Skyranger's
+2x7 interior, where the back rows can path nowhere until the front rank walks
+out. Both drivers are therefore teleported (on BOTH machines, same coordinates)
+onto open ground near a hostile before anything is asserted.
+
+Run:  python tools/coop_test/test_parallel_intents.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_replay_decouple as RD
+
+PORT = "47986"
+
+NOT_YOURS_TEXT = "Not one of your soldiers"
+NO_TU_TEXT = "Time Units"          # STR_NOT_ENOUGH_TIME_UNITS, translated
+REFUSED_TEXT = "Action refused"
+
+# ring 2..4 around a hostile: open ground (something IS standing there), but not
+# breathing down its neck.
+NEAR_RING = sorted(
+    [(dx, dy) for dx in range(-4, 5) for dy in range(-4, 5)
+     if 2 <= max(abs(dx), abs(dy)) <= 4],
+    key=lambda d: (max(abs(d[0]), abs(d[1])), abs(d[0]) + abs(d[1])))
+
+
+# ---- readouts --------------------------------------------------------------
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def unit(b, uid):
+    for u in b.get("units", []):
+        if u["id"] == uid:
+            return u
+    return None
+
+
+def pos(b, uid):
+    u = unit(b, uid)
+    return (u["x"], u["y"], u["z"]) if u else None
+
+
+def tu(b, uid):
+    u = unit(b, uid)
+    return u["tu"] if u else None
+
+
+def own_units(b, seat, min_tu=0):
+    return [u for u in b["units"]
+            if u.get("faction") == 0 and not u.get("isOut")
+            and u.get("coop") == seat and u.get("tu", 0) >= min_tu]
+
+
+def alive_enemy(b):
+    for u in b["units"]:
+        if u.get("faction") == 1 and not u.get("isOut") and u.get("health", 0) > 0:
+            return u
+    return None
+
+
+def warning_of(gc):
+    return parallel(gc).get("warning", "") or ""
+
+
+def last_deny(gc):
+    # coop (parallel turns): the latched wire key of the last action_deny this
+    # machine received. Unlike the fading warning widget / the click-sync banner
+    # it is NOT frame-timing-sensitive, so it is the deterministic deny signal.
+    return parallel(gc).get("lastDenyWarning", "") or ""
+
+
+def intent(gc, **kw):
+    req = {"cmd": "battle_intent"}
+    req.update(kw)
+    return gc.cmd(req)
+
+
+def wait_until(fn, timeout, interval=0.4):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if fn():
+            return True
+        time.sleep(interval)
+    return False
+
+
+def wait_for_text(gc, needle, timeout=20):
+    """The warning widget fades, so poll it rather than sampling once."""
+    seen = set()
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        w = warning_of(gc)
+        if w:
+            seen.add(w)
+        if any(needle.lower() in s.lower() for s in seen):
+            return sorted(seen)
+        time.sleep(0.3)
+    return None
+
+
+def settle(host, client, seconds=6):
+    deadline = time.time() + seconds
+    while time.time() < deadline:
+        for gc in (host, client):
+            t = TW.top(gc)
+            if t not in ("BattlescapeState", "NextTurnState"):
+                gc.cmd({"cmd": "dismiss_popup"})
+        time.sleep(0.5)
+
+
+def idle(host, timeout=90):
+    """Wait until the executor can admit another action."""
+    return wait_until(lambda: parallel(host).get("canAdmit") is True, timeout)
+
+
+def top_up(host, client, uid, amount=None):
+    """Restore `uid` to full TU on BOTH machines. amount=None (default) reads the
+    unit's real TU ceiling from battle_state (`tuMax`) and tops up to exactly
+    that: BattleUnit::setTimeUnits clamps to _stats.tu (~66 for a rookie), so the
+    old literal 200 silently became the clamp - the helper claimed to top up to
+    200 but never could. Pass an explicit amount (e.g. 0) to force a value.
+
+    The HOST validates an intent against its OWN copy, so a client-side-only
+    top-up would be denied STR_NOT_ENOUGH_TIME_UNITS (and would drift the two
+    machines' stats into the bargain), hence both machines."""
+    if amount is None:
+        u = unit(battle(host), uid)
+        amount = u.get("tuMax", 200) if u else 200
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_intent", "unit": uid, "action": "turn",
+               "tu": amount, "dry": True})
+
+
+def far_step(gc, uid, radius=3):
+    """The FURTHEST tile `uid` can path to inside `radius` - probe_step returns
+    them ring by ring, so the last entry is the longest walk available."""
+    r = intent(gc, action="probe_step", unit=uid, radius=radius, max=400)
+    if not r.get("ok") or not r.get("steps"):
+        return None
+    s = r["steps"][-1]
+    return (s["x"], s["y"], s["z"])
+
+
+def free_step(gc, uid, radius=2):
+    """A tile `uid` can actually path to, resolved SERVER-side in one round trip
+    (`battle_intent probe_step` runs the same Pathfinding::calculate +
+    getStartDirection() gate the real mapClick capture site sits behind). Probing
+    tile by tile over the wire took thousands of RPCs and looked like a hang."""
+    r = intent(gc, action="probe_step", unit=uid, radius=radius)
+    if not r.get("ok") or not r.get("steps"):
+        return None
+    s = r["steps"][0]
+    return (s["x"], s["y"], s["z"])
+
+
+def steps_of(gc, uid, radius=2):
+    r = intent(gc, action="probe_step", unit=uid, radius=radius, max=400)
+    return [(s["x"], s["y"], s["z"]) for s in r.get("steps", [])] if r.get("ok") else []
+
+
+def common_steps(host, client, uid, radius=2):
+    """Every tile BOTH machines agree `uid` can path to, nearest ring first.
+
+    The fixture teleports the whole squad around looking for drivers, and a
+    teleport that took on one machine but not the other leaves a BLOCKER in a
+    different place. A tile the client's pathfinder likes can therefore be
+    occupied on the host - which is where a client intent actually executes, so
+    the walk would be admitted and then quietly do nothing."""
+    cs = set(steps_of(client, uid, radius))
+    return [s for s in steps_of(host, uid, radius) if s in cs]
+
+
+def single_steps_of(gc, uid, radius=1):
+    """Tiles `uid` can reach in ONE clean step: pathLen == 1 (a direct
+    Chebyshev step, NOT a terrain-forced detour) AND a floored destination tile
+    (no z-level fall at the end). probe_step reports pathLen + floorSafe per
+    candidate (additive fields).
+
+    This is the walk-destination filter the position asserts (`ph in (start,
+    dest)`) depend on. A vouched Chebyshev-adjacent tile whose DIRECT step is
+    terrain-blocked resolves to a 6-29 step detour; a TU-clamped unit then stops
+    partway or falls a z-level at the detour's end, and the assert misreads that
+    landing as the action having run more than once. Kept SEPARATE from
+    steps_of/common_steps, which other suites (test_parallel_skip,
+    test_parallel_soak) use to find the FURTHEST reachable tile on purpose.
+
+    pathLen == 1 lives entirely in ring 1, so radius 1 is sufficient; a wider
+    radius only adds detour tiles this very filter would drop."""
+    r = intent(gc, action="probe_step", unit=uid, radius=radius, max=400)
+    steps = r.get("steps", []) if r.get("ok") else []
+    if steps and "pathLen" not in steps[0]:
+        raise AssertionError(
+            "probe_step returned no pathLen field - bin/x64/Release/OpenXcom.exe "
+            "predates the single-step de-flake; rebuild it (serial, MP=false).")
+    return [(s["x"], s["y"], s["z"]) for s in steps
+            if s.get("pathLen") == 1 and s.get("floorSafe") is True]
+
+
+def single_common(host, client, uid, radius=1):
+    """Tiles BOTH machines agree `uid` can reach in one clean step (pathLen == 1,
+    floored). Verified on EACH machine independently, because a client intent
+    EXECUTES on the host: the single-step vouch has to hold on the host executor
+    (where the walk actually runs) AND the client has to be able to display that
+    same one tile. A tile that is a clean step on the client but a detour on the
+    host is exactly the mismatch this intersection removes."""
+    cs = set(single_steps_of(client, uid, radius))
+    return [s for s in single_steps_of(host, uid, radius) if s in cs]
+
+
+def free_step_both(host, client, uid, radius=1):
+    """One tile BOTH machines agree `uid` can reach in a CLEAN SINGLE STEP, or
+    None. Filtered to pathLen == 1 + floor-safe on both machines (single_common),
+    so every destination this returns lands exactly on `dest` (or, if reaction
+    fire interrupts, stays at `start`) - never partway down a detour. The bounded
+    re-roll for a boxed-in driver lives in step_dest (it re-places the unit)."""
+    both = single_common(host, client, uid, radius)
+    return both[0] if both else None
+
+
+def teleport_both(host, client, uid, spot):
+    res = [gc.cmd({"cmd": "battle_teleport", "unit": uid,
+                   "x": spot[0], "y": spot[1], "z": spot[2]})
+           for gc in (host, client)]
+    return all(r.get("moved") for r in res)
+
+
+def place_near(host, client, uid, tpos, ring=NEAR_RING, want=2):
+    """Teleport `uid` onto open ground near `tpos` on BOTH machines and prove it
+    can then take a step.
+
+    PRD-P9 rider R6: two passes. The first insists on `want` tiles both machines
+    agree are walkable, because a driver with exactly ONE way out is a driver
+    that fails the moment a squadmate, a corpse or a dropped weapon lands on it -
+    which is what made the walk scenarios flaky. The second pass restores the old
+    "any step at all" bar, so a cramped fixture still yields a driver rather than
+    an assertion.
+
+    The exits counted are CLEAN SINGLE STEPS (single_common), not any reachable
+    tile: the driver's whole job is to take a one-tile step the position asserts
+    can read, so a spot whose only "exits" are terrain-forced detours is not a
+    viable spot even though a unit could eventually path out of it."""
+    landed = stuck = 0
+    for need in (want, 1):
+        for dx, dy in ring:
+            spot = (tpos[0] + dx, tpos[1] + dy, tpos[2])
+            if not teleport_both(host, client, uid, spot):
+                continue
+            if need == want:
+                landed += 1
+            # BOTH machines: a driver the client can move but the host cannot is
+            # useless, because the host is where every action actually runs.
+            if len(single_common(host, client, uid)) >= need or (
+                    need == 1 and free_step_both(host, client, uid)):
+                return spot
+            if need == want:
+                stuck += 1
+    print(f"    unit {uid}: {landed}/{len(ring)} tiles near {tpos} took the "
+          f"teleport, {stuck} of those had fewer than {want} shared exits")
+    return None
+
+
+def place_adjacent(host, client, uid, tpos):
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        spot = (tpos[0] + dx, tpos[1] + dy, tpos[2])
+        if teleport_both(host, client, uid, spot):
+            return spot
+    return None
+
+
+def step_dest(host, client, uid):
+    """A CLEAN SINGLE-STEP tile `uid` can walk to, re-placing it if it has been
+    boxed in. This is the bounded re-roll: one re-placement attempt next to a
+    hostile before giving up.
+
+    PRD-P9 rider R6. `free_step_both` answers "where can it take a clean one-tile
+    step from here" (pathLen == 1, floored, on both machines); over a long
+    scenario the answer legitimately becomes "nowhere" - the squad shuffles,
+    somebody dies on the only exit, a thrown crate lands next door - and every
+    caller turned that into a hard assertion failure that read like an intent bug.
+    Re-placing the driver next to a hostile (the same thing `pick_driver` does at
+    the start) is what a human tester would do, and it keeps the failure that
+    matters (an intent that does not execute) distinguishable from a fixture that
+    simply parked the unit in a corner."""
+    dest = free_step_both(host, client, uid)
+    if dest:
+        return dest
+    enemy = alive_enemy(battle(host))
+    if not enemy:
+        return None
+    print(f"    (unit {uid} has no clean single step - re-placing it before the walk)")
+    if not place_near(host, client, uid, (enemy["x"], enemy["y"], enemy["z"])):
+        return None
+    top_up(host, client, uid)
+    return free_step_both(host, client, uid)
+
+
+def pick_driver(host, client, seat, tag):
+    """A soldier of `seat` standing where it can actually act."""
+    enemy = alive_enemy(battle(host))
+    assert enemy, "the fixture has no live hostile to orient around"
+    epos = (enemy["x"], enemy["y"], enemy["z"])
+    for cand in own_units(battle(client), seat):
+        spot = place_near(host, client, cand["id"], epos)
+        if spot:
+            top_up(host, client, cand["id"])
+            print(f"    {tag} driver = unit {cand['id']} at {spot}")
+            return cand["id"]
+    raise AssertionError(
+        f"no soldier of seat {seat} could be placed anywhere it can move")
+
+
+# ---- 1. the round trip -----------------------------------------------------
+
+def scenario_walk(host, client, mover_id):
+    print("-- 1: client walk intent -> host executes -> both converge --")
+    dest = step_dest(host, client, mover_id)
+    assert dest, f"client soldier {mover_id} has no clean single-step destination"
+
+    before_h = pos(battle(host), mover_id)
+    before_c = pos(battle(client), mover_id)
+    assert before_h == before_c, (
+        f"the two machines already disagree about unit {mover_id}: "
+        f"host {before_h} client {before_c}")
+    seq_before = parallel(host)["actionSeq"]
+    watch_before = RD.watcher_state(client)
+
+    r = intent(client, action="move", unit=mover_id,
+               x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("ok"), f"the client refused to build the walk intent: {r}"
+    assert r.get("routed") is True, (
+        f"the client EXECUTED the walk locally instead of shipping an intent "
+        f"({r}). In parallel mode the client is never the executor.")
+
+    assert wait_until(lambda: pos(battle(host), mover_id) != before_h, 45), (
+        f"the host never moved unit {mover_id} - the `action_intent` did not "
+        f"reach the arbiter, or it was denied. host parallel_state="
+        f"{parallel(host)} client={parallel(client)} warning="
+        f"{warning_of(client)!r}")
+    # Do NOT snapshot a mid-walk tile here. The old `landed = pos(host)` capture
+    # fired one frame after the host started moving and latched an INTERMEDIATE
+    # tile, then waited for the client to match that stale snapshot - which it
+    # never does once the host walks on past it. Instead: let the host chain
+    # finish, settle BOTH machines, then read the settled-final position. With
+    # step_dest yielding clean single steps the host lands exactly on `dest`;
+    # the assertion below proves the client displayed its OWN forwarded action
+    # by CONVERGING on that same final tile.
+    assert idle(host, timeout=45), (
+        f"the host's forwarded walk chain never finished: {parallel(host)}")
+    settle(host, client)
+    final = pos(battle(host), mover_id)
+    assert wait_until(lambda: pos(battle(client), mover_id) == final, 45), (
+        f"the client never displayed its OWN action: the host walked {mover_id} "
+        f"to {final}, the client still has it at {pos(battle(client), mover_id)}")
+    assert final != before_h, (
+        f"unit {mover_id} never left {before_h} - the forwarded walk resolved to "
+        f"a no-op (start == final), so nothing was actually tested")
+
+    assert tu(battle(host), mover_id) == tu(battle(client), mover_id), (
+        f"the two machines charged different TU for the same walk: host "
+        f"{tu(battle(host), mover_id)} client {tu(battle(client), mover_id)}")
+
+    seq_after = parallel(host)["actionSeq"]
+    assert seq_after > seq_before, (
+        f"the host admitted the intent without stamping action_seq "
+        f"({seq_before} -> {seq_after})")
+    assert wait_until(lambda: parallel(client)["pendingReqId"] == 0, 15), (
+        f"the client's pending slot was never cleared by the `action_ack` "
+        f"(pendingReqId={parallel(client)['pendingReqId']}). PROTOCOL.md clears "
+        f"it on ACK RECEIPT - the broadcast packets carry no action_seq until "
+        f"PRD-P7, so anything else means a 10 s stall after every action.")
+
+    RD.assert_not_hijacked("its own client-intent walk", watch_before,
+                           RD.watcher_state(client), watch_before["selectedId"],
+                           mover_id)
+    session.assert_battle_synced(host, client, "after the client's walk intent")
+    print(f"PASS 1: a client intent walked {mover_id} {before_h} -> {final} on "
+          f"BOTH machines (actionSeq {seq_before} -> {seq_after}, TU "
+          f"{tu(battle(host), mover_id)} on both)")
+
+
+# ---- 2. deny busy ----------------------------------------------------------
+
+def aim_away(host, uid, dist=4):
+    """A tile `dist` away from `uid`, in the direction AWAY from the nearest live
+    hostile - the fixture has one alien and the later scenarios still need it."""
+    b = battle(host)
+    here = pos(b, uid)
+    enemy = alive_enemy(b)
+    if not enemy:
+        return (here[0] + dist, here[1] + dist, here[2])
+    sx = 1 if here[0] >= enemy["x"] else -1
+    sy = 1 if here[1] >= enemy["y"] else -1
+    return (here[0] + sx * dist, here[1] + sy * dist, here[2])
+
+
+def start_busy_shot(host, client, uid, wid, tries=6):
+    """Start a SHOT chain on the host and prove it is actually running.
+
+    A shot aimed at a tile the trajectory code rejects (out of bounds, no line of
+    fire) pops in the very frame it is pushed, which would make every "the host
+    was busy" assertion vacuous. The candidate tiles are therefore ones the
+    pathfinder has already vouched for, tried furthest-first, and the chain is
+    confirmed against `canAdmit` before the caller is told it may proceed.
+    Returns (aim, host parallel_state) or (None, state)."""
+    r = intent(host, action="probe_step", unit=uid, radius=4, max=400)
+    cands = [(s["x"], s["y"], s["z"]) for s in r.get("steps", [])][::-1]
+    for aim in cands[:tries]:
+        top_up(host, client, uid)
+        if not intent(host, action="shoot", unit=uid, mode="auto", weapon_id=wid,
+                      x=aim[0], y=aim[1], z=aim[2]).get("ok"):
+            continue
+        ps = parallel(host)
+        if ps.get("canAdmit") is False:
+            return aim, ps
+        wait_until(lambda: parallel(host).get("canAdmit") is True, 30)
+    return None, parallel(host)
+
+
+def scenario_busy(host, client, host_mover, client_mover):
+    print("-- 2: deny busy while the host is mid-chain, then retry --")
+    top_up(host, client, host_mover)
+    # The client's destination is resolved NOW, while both machines are idle:
+    # `probe_step` refuses mid-chain (Pathfinding is a singleton the running
+    # UnitWalkBState dequeues from), and the client will be busy displaying the
+    # host's chain when the denied intent goes out.
+    client_dest = step_dest(host, client, client_mover)
+    assert client_dest, f"client soldier {client_mover} cannot step anywhere"
+    # PRD-P7 changed WHICH chains refuse. A walk in the way is now DEFERRED
+    # (pending-admit + fast-forward, see test_parallel_skip.py), so holding the
+    # host with a walk no longer exercises the deny at all. A chain carrying a
+    # ProjectileFlyBState is never skippable, which is exactly the case PRD-P6's
+    # own acceptance names ("host mid-shot"). battleXcomSpeed slows the turn the
+    # shot pushes in front of itself, so the chain outlives the round trip.
+    wid = give_both(host, client, host_mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+    host.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": 200})
+    aim, ps = start_busy_shot(host, client, host_mover, wid)
+    if not aim or ps.get("chainSkippable") is not False:
+        host.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": 2})
+    assert aim, (
+        f"no aim point produced a shot chain that outlived the RPC, so the deny "
+        f"path was never exercised: {ps}")
+    assert ps.get("chainSkippable") is False, (
+        f"a chain carrying a shot reported itself SKIPPABLE ({ps}); PRD-P7 would "
+        f"then defer the client's intent instead of refusing it, and this "
+        f"scenario would be vacuous")
+
+    was = pos(battle(host), client_mover)
+    r = intent(client, action="move", unit=client_mover,
+               x=client_dest[0], y=client_dest[1], z=client_dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+
+    seq_at_send = parallel(host)["actionSeq"]
+    # coop (parallel turns): the peer-busy message moved OFF the fading toolbar
+    # warning widget onto the persistent "Please wait for <player>'s action" map
+    # banner (test_coop_wait_banner.py owns the banner's own behaviour). The banner
+    # is transient here (click-sync ticks) and frame-timing-sensitive, so assert the
+    # DENY itself: _clientLastDenyWarning latches the wire key deterministically.
+    got = wait_until(lambda: last_deny(client) == "STR_COOP_PLAYER_BUSY", 25)
+    if not got:
+        host.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": 2})
+    assert got, (
+        f"no STR_COOP_PLAYER_BUSY deny on the client after an intent sent into a "
+        f"running host chain (lastDenyWarning={last_deny(client)!r}, banner="
+        f"{parallel(client).get('coopWaitBanner')!r}; host actionSeq was "
+        f"{seq_at_send}, now {parallel(host)['actionSeq']} - if it MOVED the intent "
+        f"was admitted, not denied).")
+    assert wait_until(lambda: parallel(client)["pendingReqId"] == 0, 15), \
+        "the denied intent left the client's pending slot occupied"
+    assert pos(battle(host), client_mover) == was, (
+        f"a DENIED intent still moved unit {client_mover} on the host "
+        f"({was} -> {pos(battle(host), client_mover)})")
+    print(f"PASS 2a: intent denied busy (lastDeny={last_deny(client)!r}), nothing executed")
+
+    host.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": 2})
+    assert idle(host), f"the host's chain never finished: {parallel(host)}"
+    settle(host, client, seconds=4)
+    dest = step_dest(host, client, client_mover)
+    assert dest, "the client soldier cannot step after the host's chain"
+    before = pos(battle(host), client_mover)
+    seq_before = parallel(host)["actionSeq"]
+    assert intent(client, action="move", unit=client_mover,
+                  x=dest[0], y=dest[1], z=dest[2]).get("routed") is True
+    # "Succeeded" here means the retry is ADMITTED now (the transient busy deny
+    # is gone), NOT that the unit physically travels. This driver was placed next
+    # to a live hostile, so the walk the host admits and runs can be reaction-
+    # interrupted at its start tile and never leave `before` - the exact case
+    # test_battle_tripwire.drive_walk and scenario 6 below already tolerate. The
+    # deterministic admission signal is the arbiter stamping action_seq (the deny
+    # path never stamps it); polling the physical position instead hinges on the
+    # aliens' reaction roll and flakes. (Unmasked once scenario 1's stale-snapshot
+    # fix stopped the run from usually dying before it reached this retry.)
+    admitted = wait_until(lambda: parallel(host)["actionSeq"] > seq_before, 45)
+    assert admitted, (
+        f"the retry after the host's chain was never admitted (action_seq still "
+        f"{seq_before}, last client deny {last_deny(client)!r}): {parallel(host)} "
+        f"warning={warning_of(client)!r}")
+    assert idle(host, timeout=120), f"the retry chain never drained: {parallel(host)}"
+    settle(host, client)
+    session.assert_battle_synced(host, client, "after the busy retry")
+    print(f"PASS 2b: the same intent was ADMITTED once the chain ended (actionSeq "
+          f"{seq_before} -> {parallel(host)['actionSeq']}, unit {before} -> "
+          f"{pos(battle(host), client_mover)})")
+
+
+# ---- 3. deny invalid -------------------------------------------------------
+
+def assert_denied(host, client, what, needle, before_snapshot, **intent_kw):
+    r = intent(client, **intent_kw)
+    assert r.get("ok"), (f"{what}: the harness lever refused before the intent "
+                         f"was even built: {r}")
+    assert r.get("routed") is True, f"{what}: the client executed locally: {r}"
+    seen = wait_for_text(client, needle, timeout=25)
+    assert seen, (
+        f"{what}: expected a deny flash containing {needle!r}; the widget showed "
+        f"{warning_of(client)!r}. `action_deny` carries the key the client must "
+        f"flash - the wrong key means the wrong validation branch fired.")
+    assert wait_until(lambda: parallel(client)["pendingReqId"] == 0, 15), \
+        f"{what}: the deny did not clear the client's pending slot"
+    after = battle(host)
+    for uid, snap in before_snapshot.items():
+        assert (pos(after, uid), tu(after, uid)) == snap, (
+            f"{what}: something executed anyway - unit {uid} went {snap} -> "
+            f"{(pos(after, uid), tu(after, uid))} on the host")
+    print(f"PASS 3 ({what}): denied with {seen}, nothing executed")
+
+
+def knock_out_a_hostile(host, client, host_mover, swings=10):
+    """A casualty, so the `isOut` deny branch has something to aim at. Driven
+    HOST-side with `battle_fire` (raw local execution) - the point here is to
+    produce a body, not to exercise the intent path again."""
+    dead = [u for u in battle(client)["units"] if u.get("isOut")]
+    if dead:
+        return dead[0]["id"]
+    enemy = alive_enemy(battle(host))
+    if not enemy:
+        return None
+    epos = (enemy["x"], enemy["y"], enemy["z"])
+    if not place_adjacent(host, client, host_mover, epos):
+        return None
+    wid = give_both(host, client, host_mover, "STR_STUN_ROD")
+    for i in range(swings):
+        r = host.cmd({"cmd": "battle_fire", "unit": host_mover, "mode": "hit",
+                      "weapon_id": wid, "tu": 200,
+                      "x": epos[0], "y": epos[1], "z": epos[2]})
+        if not r.get("ok"):
+            break
+        settle(host, client)
+        idle(host)
+        u = unit(battle(client), enemy["id"])
+        if u and u.get("isOut"):
+            print(f"    hostile {enemy['id']} went down after {i + 1} swing(s)")
+            return enemy["id"]
+    return None
+
+
+def scenario_invalid(host, client, seat, host_mover, client_mover):
+    print("-- 3: invalid intents are refused with the right warning key --")
+    assert idle(host), "the host is still busy"
+
+    # a) a soldier the client does not own
+    theirs = [u for u in battle(client)["units"]
+              if u.get("faction") == 0 and not u.get("isOut")
+              and u.get("coop") != seat]
+    assert theirs, "the fixture gave the client no peer-owned soldier to poach"
+    poach = theirs[0]["id"]
+    snap = {poach: (pos(battle(host), poach), tu(battle(host), poach))}
+    p = pos(battle(client), poach)
+    assert_denied(host, client, "peer-owned soldier", NOT_YOURS_TEXT, snap,
+                  action="turn", unit=poach, x=p[0] + 1, y=p[1], z=p[2])
+
+    # b) no time units ON THE HOST (the executor validates against its own copy).
+    #    Aimed at a tile, so it does not depend on a hostile still being alive.
+    give_both(host, client, client_mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+    top_up(host, client, client_mover, amount=0)
+    here = pos(battle(client), client_mover)
+    aim = (here[0] + 2, here[1] + 2, here[2])
+    snap = {client_mover: (pos(battle(host), client_mover), 0)}
+    assert_denied(host, client, "actor out of TU on the executor", NO_TU_TEXT, snap,
+                  action="shoot", unit=client_mover, mode="snap",
+                  x=aim[0], y=aim[1], z=aim[2])
+    top_up(host, client, client_mover)
+
+    # c) a unit that is already down. Same branch an unknown unit id and an actor
+    #    carrying no such weapon take (issue #74: the host never fabricates one to
+    #    make an intent runnable).
+    dead_id = knock_out_a_hostile(host, client, host_mover)
+    if dead_id is None:
+        print("    (the fixture produced no casualty - the `isOut` deny branch "
+              "was not exercised)")
+        return
+    snap = {dead_id: (pos(battle(host), dead_id), tu(battle(host), dead_id))}
+    p = pos(battle(client), dead_id)
+    assert_denied(host, client, "unit that is already out", REFUSED_TEXT, snap,
+                  action="turn", unit=dead_id, x=p[0] + 1, y=p[1], z=p[2])
+
+
+# ---- 4. one intent of every kind -------------------------------------------
+
+def quiet(host, client, what):
+    settle(host, client)
+    session.assert_battle_synced(host, client, what)
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+        f"the PRD-P2 drift tripwire fired {what}"
+
+
+def drive(host, client, what, **kw):
+    """Ship one intent from the client and wait for the host to finish with it."""
+    seq_before = parallel(host)["actionSeq"]
+    r = intent(client, **kw)
+    assert r.get("ok"), f"{what}: the client could not build the intent: {r}"
+    assert r.get("routed") is True, f"{what}: the client executed locally: {r}"
+    assert wait_until(lambda: parallel(client)["pendingReqId"] == 0, 25), (
+        f"{what}: no ack/deny came back inside 25 s (pending "
+        f"{parallel(client)['pendingReqId']}) - the intent was dropped")
+    assert parallel(host)["actionSeq"] > seq_before, (
+        f"{what}: the host did not ADMIT the intent (action_seq still "
+        f"{seq_before}); the client was told {warning_of(client)!r}")
+    assert idle(host), f"{what}: the host chain never ended"
+    quiet(host, client, f"after a client {what} intent")
+    print(f"    PASS kind {what}")
+
+
+def give_both(host, client, uid, item, ammo=None):
+    # coop (2026-08-18 soak fix): battle_give mints an item OUT OF BAND - it is an
+    # immediate TestServer RPC, not a chain that flows through the action_end marker
+    # pipeline the client's per-action sync-check sample rides. If a prior chain's
+    # marker is still parked on a backlogged client, the give's mint bleeds into that
+    # chain's DEFERRED itemIdCtr/items sample (the client reads the post-give counter
+    # while the executor's ring snapshot for the same seq was taken pre-give) - the
+    # dominant residual items/itemIdCtr player-seq drift flake. It is a TEST artifact,
+    # not a product bug (the ids the give mints are identical on both machines - see
+    # the assert below - and production never mints out of band; every real mint is a
+    # sequenced corpse/respawn/deathtrap the corpsePending window already covers).
+    # Drain the executor's sync-check loop first so no parked marker can pick up the
+    # mint. Best-effort + bounded: a persistent open loop is caught by assert_sync_clean.
+    session.wait_sync_loop_closed(host)
+    # coop (PRD-I3 Session F de-flake): battle_give mints off the LOCAL _itemId, so a
+    # give issued while the two counters have drifted (a real casualty straddle) mints
+    # divergent ids and injects a HARNESS offset into the product measurement. Pre-sync
+    # both machines to max(host, client) via the host-authoritative set_item_counter lever
+    # so the give itself never drifts the counter.
+    hc = host.cmd({"cmd": "save_blob"}).get("itemCounter", -1)
+    cc = client.cmd({"cmd": "save_blob"}).get("itemCounter", -1)
+    if hc >= 0 and cc >= 0 and hc != cc:
+        m = max(hc, cc)
+        host.cmd({"cmd": "save_blob", "set_item_counter": m})
+        client.cmd({"cmd": "save_blob", "set_item_counter": m})
+    req = {"cmd": "battle_give", "unit": uid, "item": item,
+           "slot": "right", "clear_hands": True}
+    if ammo:
+        req["ammo"] = ammo
+    ids = [gc.ok(dict(req)) for gc in (host, client)]
+    assert ids[0]["weaponId"] == ids[1]["weaponId"], (
+        f"battle_give minted different ids for {item} ({ids[0]['weaponId']} vs "
+        f"{ids[1]['weaponId']}) - the intent's weapon_id would not resolve")
+    time.sleep(2)
+    session.assert_battle_synced(host, client, f"after handing over the {item}")
+    return ids[0]["weaponId"]
+
+
+def scenario_kinds(host, client, mover):
+    print("-- 4: one intent of EVERY kind, census + tripwire quiet after each --")
+    assert idle(host), "the host is still busy"
+    top_up(host, client, mover)
+    here = pos(battle(client), mover)
+
+    drive(host, client, "turn", action="turn", unit=mover,
+          x=here[0] + 1, y=here[1] + 1, z=here[2])
+    drive(host, client, "kneel", action="kneel", unit=mover)
+    drive(host, client, "stand up", action="kneel", unit=mover)
+
+    # Shoot at a TILE, not at a hostile: this kind is about the intent making it
+    # through ProjectileFlyBState, and the fixture's handful of aliens has to
+    # survive long enough for the psi and melee kinds below.
+    top_up(host, client, mover)
+    wid = give_both(host, client, mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+    drive(host, client, "shoot", action="shoot", unit=mover, mode="snap",
+          weapon_id=wid, x=here[0] + 2, y=here[1] + 2, z=here[2])
+
+    # throw an UNPRIMED explosive: an item hand-off, not a detonation
+    top_up(host, client, mover)
+    wid = give_both(host, client, mover, "STR_HIGH_EXPLOSIVE")
+    here = pos(battle(client), mover)
+    drive(host, client, "throw", action="throw", unit=mover, weapon_id=wid,
+          x=here[0] + 1, y=here[1], z=here[2])
+
+    top_up(host, client, mover)
+    wid = give_both(host, client, mover, "STR_GRENADE")
+    drive(host, client, "prime", action="prime", unit=mover, fuse=3, weapon_id=wid)
+
+    top_up(host, client, mover)
+    wid = give_both(host, client, mover, "STR_MEDI_KIT")
+    drive(host, client, "medikit", action="medikit", unit=mover, weapon_id=wid,
+          patient=mover, medikit="stim", part=0)
+
+    # psi BEFORE melee: the stun rod is what tends to take the last hostile out
+    # of the fight, and both kinds need a live one to stand next to.
+    enemy = alive_enemy(battle(host))
+    if enemy:
+        epos = (enemy["x"], enemy["y"], enemy["z"])
+        top_up(host, client, mover)
+        wid = give_both(host, client, mover, "STR_PSI_AMP")
+        if place_adjacent(host, client, mover, epos):
+            session.assert_battle_synced(host, client, "after placing the psi attacker")
+            drive(host, client, "psi", action="psi", unit=mover, mode="mind",
+                  weapon_id=wid, x=epos[0], y=epos[1], z=epos[2])
+        else:
+            print("    (no free tile next to a hostile - psi kind skipped)")
+    else:
+        print("    (no live hostile left - psi kind skipped)")
+
+    enemy = alive_enemy(battle(host))
+    if enemy:
+        epos = (enemy["x"], enemy["y"], enemy["z"])
+        top_up(host, client, mover)
+        wid = give_both(host, client, mover, "STR_STUN_ROD")
+        if place_adjacent(host, client, mover, epos):
+            session.assert_battle_synced(host, client, "after placing the melee attacker")
+            drive(host, client, "melee", action="melee", unit=mover, weapon_id=wid,
+                  x=epos[0], y=epos[1], z=epos[2])
+        else:
+            print("    (no free tile next to a hostile - melee kind skipped)")
+    else:
+        print("    (no live hostile left - melee kind skipped)")
+    print("PASS 4: every intent kind executed host-side with the census and the "
+          "tripwire quiet")
+
+
+# ---- 5. both machines act inside one round trip ----------------------------
+
+def scenario_race(host, client, host_mover, client_mover):
+    print("-- 5: both machines act within one RTT - exactly one starts --")
+    assert idle(host), "the host is still busy"
+    for uid in (host_mover, client_mover):
+        top_up(host, client, uid)
+
+    # Both dests are guaranteed CLEAN SINGLE STEPS (step_dest -> free_step_both
+    # filters pathLen == 1 + floor-safe on both machines), so the position
+    # asserts below read a definite outcome: a mover is at its dest (admitted +
+    # ran, exactly once) or back at its start (denied / deferred), never partway
+    # down a terrain-forced detour that the old picker let through.
+    h_dest = step_dest(host, client, host_mover)
+    c_dest = step_dest(host, client, client_mover)
+    assert h_dest and c_dest, (
+        f"both drivers need a clean single-step destination for the race "
+        f"(host {h_dest}, client {c_dest})")
+    h_from = pos(battle(host), host_mover)
+    c_from = pos(battle(host), client_mover)
+    seq_before = parallel(host)["actionSeq"]
+
+    # client first, host immediately after: whichever reaches the arbiter first
+    # wins; the other meets a non-empty _states / a held receive gate.
+    rc = intent(client, action="move", unit=client_mover,
+                x=c_dest[0], y=c_dest[1], z=c_dest[2])
+    rh = intent(host, action="move", unit=host_mover,
+                x=h_dest[0], y=h_dest[1], z=h_dest[2])
+    assert rc.get("routed") is True, f"the client executed locally: {rc}"
+
+    time.sleep(2)
+    assert idle(host, timeout=120), "the host never went idle again"
+    settle(host, client, seconds=8)
+
+    # exactly-one-admitted: the arbiter stamps action_seq per admitted chain, so
+    # two intents racing into one RTT must move it by at least one (one admit) -
+    # and the per-unit position asserts below prove the other did NOT also run in
+    # the same frame (no overlap / double-admit) and that neither drifted.
+    seq_after = parallel(host)["actionSeq"]
+    assert seq_after > seq_before, (
+        f"the race admitted nothing (action_seq {seq_before} -> {seq_after}); at "
+        f"least one of the two raced intents must reach the arbiter")
+
+    hb, cb = battle(host), battle(client)
+    for uid, start, dest in ((host_mover, h_from, h_dest),
+                             (client_mover, c_from, c_dest)):
+        ph, pc = pos(hb, uid), pos(cb, uid)
+        assert ph == pc, (
+            f"DOUBLE EXECUTION / drift: unit {uid} final position is {ph} on the "
+            f"host and {pc} on the client after the race (host != client)")
+        assert ph in (start, tuple(dest)), (
+            f"unit {uid} ended at {ph}, which is neither where it started "
+            f"({start}) nor the single step it was asked for ({tuple(dest)}) - "
+            f"the action ran more than once")
+    session.assert_battle_synced(host, client, "after the simultaneous-click race")
+    print(f"PASS 5: host {host_mover} {h_from} -> {pos(hb, host_mover)}, client "
+          f"{client_mover} {c_from} -> {pos(hb, client_mover)}; identical on both "
+          f"machines (host routed={rh.get('routed')} client "
+          f"routed={rc.get('routed')})")
+
+
+# ---- 6. reaction fire on a client-intent walk ------------------------------
+
+def scenario_reaction(host, client, mover):
+    print("-- 6: reaction fire provoked by a client-intent walk --")
+    assert idle(host), "the host is still busy"
+    enemy = alive_enemy(battle(host))
+    if not enemy:
+        print("    (no live hostile left - reaction-fire scenario skipped)")
+        return
+    epos = (enemy["x"], enemy["y"], enemy["z"])
+    if not place_adjacent(host, client, mover, epos):
+        print(f"    (no free tile next to hostile {enemy['id']} - skipped)")
+        return
+    top_up(host, client, mover)
+    session.assert_battle_synced(host, client, "after placing the walker")
+
+    reacted = False
+    for step in range(6):
+        before_hp = unit(battle(host), mover)["health"]
+        dest = free_step_both(host, client, mover)
+        if not dest:
+            break
+        r = intent(client, action="move", unit=mover,
+                   x=dest[0], y=dest[1], z=dest[2])
+        if not r.get("ok"):
+            break
+        assert r.get("routed") is True, f"the client executed locally: {r}"
+        wait_until(lambda: parallel(client)["pendingReqId"] == 0, 25)
+        assert idle(host, timeout=120), "the host chain never ended"
+        settle(host, client)
+
+        hb, cb = battle(host), battle(client)
+        assert pos(hb, mover) == pos(cb, mover), (
+            f"the client-intent walk diverged at step {step}: host "
+            f"{pos(hb, mover)} client {pos(cb, mover)}")
+        assert unit(hb, mover)["health"] == unit(cb, mover)["health"], (
+            f"reaction-fire damage did not display identically: host "
+            f"{unit(hb, mover)['health']} client {unit(cb, mover)['health']}")
+        session.assert_battle_synced(host, client, f"after walk step {step}")
+        assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+            "the drift tripwire fired during the reaction-fire walk"
+        if unit(hb, mover)["health"] != before_hp:
+            reacted = True
+            print(f"    reaction fire landed on step {step}: {before_hp} -> "
+                  f"{unit(hb, mover)['health']} HP, identical on both machines")
+            break
+
+    if reacted:
+        print("PASS 6: reaction fire resolved on the host and displayed on both, "
+              "tripwire quiet")
+    else:
+        print("PASS 6 (partial): the aliens never chose to react over 6 steps "
+              "(the reaction roll is theirs to make); every step still landed "
+              "identically on both machines with the tripwire quiet")
+
+
+# ---- main ------------------------------------------------------------------
+
+def main():
+    fail = None
+    host = GameClient("host", 48870,
+                      make_user_dir("p6_intents_host",
+                                    options={"battleXcomSpeed": 2,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48871,
+                        make_user_dir("p6_intents_client",
+                                      options={"battleXcomSpeed": 2,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            b = battle(gc)
+            assert b["parallelActive"] is True, f"{tag}: parallel mode is not live: {b}"
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, (
+            "the PRD-P5 executor invariant does not hold, so nothing below is "
+            "testing the intent path")
+        seat = client.ok({"cmd": "get_coop"})["localSeat"]
+        hostiles = [u for u in battle(host)["units"]
+                    if u.get("faction") == 1 and not u.get("isOut")]
+        print(f"client seat = {seat}; {len(hostiles)} live hostile(s) in the fixture")
+
+        client_mover = pick_driver(host, client, seat, "client")
+        host_mover = pick_driver(host, client, 0, "host")
+
+        # Order is dictated by what each scenario needs from the fixture's
+        # handful of aliens: 6 wants a live one to walk past, 4's psi/melee kinds
+        # want one to stand next to, and 3's `isOut` deny wants the body 4's
+        # stun rod leaves behind.
+        scenario_walk(host, client, client_mover)
+        scenario_busy(host, client, host_mover, client_mover)
+        scenario_reaction(host, client, client_mover)
+        scenario_kinds(host, client, client_mover)
+        scenario_invalid(host, client, seat, host_mover, client_mover)
+        scenario_race(host, client, host_mover, client_mover)
+
+        print("ALL ACTION-INTENT TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_introspection.py b/tools/coop_test/test_parallel_introspection.py
new file mode 100644
index 000000000..72aa7939b
--- /dev/null
+++ b/tools/coop_test/test_parallel_introspection.py
@@ -0,0 +1,249 @@
+"""PRD-P0 self-test: the parallel-turns harness introspection surface.
+
+P0 adds no gameplay. It adds the read-outs the parallel-turns PRDs (P2/P6/P7/P8)
+will assert against, so this test only has to prove that surface exists and is
+honest on BOTH machines of a live co-op battle:
+
+  1. make_user_dir(options=...) splices per-instance keys into options.cfg, and
+     the game actually boots on the result (a malformed splice would fail YAML
+     load, so reaching the battle IS the parse assertion). Host and client are
+     given DIFFERENT battleXcomSpeed values, which is the point of the kwarg -
+     one machine slow, one fast, from the first frame.
+  2. `parallel_state` answers on both instances with the receive-gate fields
+     (taskCompleted / pathLock / coopWalkInit / coopInitDeath / coopEnd /
+     rxHold / rxRotates / rxHoldMax) plus `parallelActive`.
+  3. `battle_state` carries the same fields, so session.can_drive() needs only
+     one query.
+  4. `parallelActive` is FALSE (P5 lands the real predicate) and therefore
+     session.can_drive(battle_state) == battle_state["activeSync"] - the
+     driver-selection contract migration is a strict no-op today.
+  5. The receive-gate counters are self-consistent (rxHold <= rxHoldMax, and a
+     co-op session that has exchanged battle packets has rotated at least one).
+  6. set_option round-trips battleXcomSpeed / battleAlienSpeed /
+     EnableCoopParallelTurns, still rejects an unknown name (the new branches
+     must not swallow the else), and rejects the retired
+     coopParallelDebugClientInput (PRD-P5's temporary client-input override,
+     deleted by PRD-P6 along with the gate it fed).
+
+Battle fixture: the skirmish flow (NEW BATTLE > COOP), the cheapest co-op
+battle in the suite - same path test_skirmish_battle_turn_control.py drives.
+
+Run:  python tools/coop_test/test_parallel_introspection.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_skirmish_flow as SK
+
+PORT = "47975"
+
+# The receive-gate fields P0 puts on BOTH battle_state and parallel_state.
+GATE_FIELDS = ("taskCompleted", "pathLock", "coopWalkInit", "coopInitDeath",
+               "coopEnd", "rxHold", "rxRotates", "rxHoldMax")
+
+
+def states(gc):
+    return [s.replace("class OpenXcom::", "") for s in session.states(gc)]
+
+
+def has(gc, name):
+    return any(name in s for s in states(gc))
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+# ---- 1. options.cfg splice --------------------------------------------------
+
+def assert_options_spliced(user_dir, expected):
+    cfg = os.path.join(user_dir, "options.cfg")
+    with open(cfg, encoding="utf-8") as f:
+        text = f.read()
+    for key, value in expected.items():
+        line = "  %s: %s" % (key, "true" if value is True
+                             else "false" if value is False else value)
+        assert line in text.splitlines(), \
+            f"{cfg}: expected {line!r} in the options block, got:\n{text}"
+    # the splice must not have displaced the hermetic pins
+    assert "id: xcom1" in text and "playIntro: false" in text, \
+        f"{cfg}: the options splice broke HERMETIC_OPTIONS:\n{text}"
+    print(f"PASS options splice: {os.path.basename(user_dir)} carries {expected}")
+
+
+# ---- 2/3/4/5. the introspection surface ------------------------------------
+
+def assert_gate_fields(tag, resp, what):
+    assert resp.get("ok"), f"{tag}: {what} failed: {resp}"
+    missing = [f for f in GATE_FIELDS if f not in resp]
+    assert not missing, f"{tag}: {what} is missing {missing}: {resp}"
+    assert "parallelActive" in resp, \
+        f"{tag}: {what} carries no parallelActive: {resp}"
+    assert resp["parallelActive"] is False, \
+        f"{tag}: parallelActive must be False until PRD-P5 lands: {resp}"
+    # types, so a later PRD that starts asserting on them has a contract
+    assert isinstance(resp["taskCompleted"], bool), f"{tag}: {resp}"
+    assert isinstance(resp["pathLock"], int), f"{tag}: {resp}"
+    assert isinstance(resp["coopEnd"], int), f"{tag}: {resp}"
+    for counter in ("rxHold", "rxRotates", "rxHoldMax"):
+        assert isinstance(resp[counter], int) and resp[counter] >= 0, \
+            f"{tag}: {counter} is not a non-negative int: {resp}"
+    assert resp["rxHold"] <= resp["rxHoldMax"], \
+        f"{tag}: rxHold {resp['rxHold']} exceeds the high-water mark " \
+        f"{resp['rxHoldMax']}: {resp}"
+
+
+def assert_introspection(host, client):
+    gates = {}
+    for gc, tag in ((host, "host"), (client, "client")):
+        ps = gc.cmd({"cmd": "parallel_state"})
+        assert_gate_fields(tag, ps, "parallel_state")
+
+        bs = battle(gc)
+        assert bs.get("inBattle"), f"{tag}: not in a battle: {bs}"
+        assert_gate_fields(tag, bs, "battle_state")
+
+        # the two commands must agree about the mode (they read the same state;
+        # the gate counters are live and may tick between the two queries)
+        assert ps["parallelActive"] == bs["parallelActive"], \
+            f"{tag}: parallel_state and battle_state disagree about " \
+            f"parallelActive: {ps['parallelActive']} vs {bs['parallelActive']}"
+
+        # the contract migration is a strict no-op while parallelActive is False
+        assert session.can_drive(bs) == bool(bs["activeSync"]), \
+            f"{tag}: can_drive() diverged from activeSync with parallelActive " \
+            f"False: activeSync={bs['activeSync']} " \
+            f"can_drive={session.can_drive(bs)}"
+
+        gates[tag] = ps
+        print(f"PASS {tag}: parallel_state {{"
+              f"parallelActive={ps['parallelActive']}, "
+              f"taskCompleted={ps['taskCompleted']}, pathLock={ps['pathLock']}, "
+              f"coopWalkInit={ps['coopWalkInit']}, "
+              f"coopInitDeath={ps['coopInitDeath']}, coopEnd={ps['coopEnd']}, "
+              f"rxHold={ps['rxHold']}, rxRotates={ps['rxRotates']}, "
+              f"rxHoldMax={ps['rxHoldMax']}}}")
+
+    # The counters are process-monotonic (never reset). Every packet that is not
+    # PING/PONG passes through the hold queue, and a live co-op battle has
+    # exchanged plenty by now, so the high-water mark proves the drain-loop hook
+    # is wired. rxRotates is reported but NOT asserted: a rotation only happens
+    # when a packet lands while the local task is mid-flight, which nothing here
+    # forces (PRD-P6/P7 drive that path deliberately).
+    high = {t: gates[t]["rxHoldMax"] for t in ("host", "client")}
+    rotates = {t: gates[t]["rxRotates"] for t in ("host", "client")}
+    assert max(high.values()) > 0, \
+        f"neither machine ever saw a non-empty hold queue ({high}) - either no " \
+        f"co-op packet was exchanged or the high-water hook is not wired"
+    print(f"PASS gate counters: rxHoldMax={high} rxRotates={rotates}")
+
+    # can_drive() must pick exactly the machine activeSync names today
+    drivers = [t for t, gc in (("host", host), ("client", client))
+               if session.can_drive(battle(gc))]
+    print(f"PASS driver selection: can_drive() names {drivers or 'nobody'} "
+          f"(classic co-op: the simulation owner)")
+
+
+# ---- 6. set_option ----------------------------------------------------------
+
+def assert_set_option(gc, tag):
+    for name, values in (("battleXcomSpeed", (7, 40)),
+                         ("battleAlienSpeed", (3, 30))):
+        for want in values:
+            r = gc.ok({"cmd": "set_option", "name": name, "value": want})
+            assert r.get("value") == want, \
+                f"{tag}: set_option {name}={want} echoed {r}"
+    # coopParallelDebugClientInput was PRD-P5's temporary client-input override.
+    # PRD-P6 replaced the gate it fed with `action_intent` forwarding and deleted
+    # the option outright, so it must now be rejected like any unknown name.
+    for want in (True, False):
+        r = gc.ok({"cmd": "set_option", "name": "EnableCoopParallelTurns",
+                   "value": want})
+        assert r.get("value") is want, \
+            f"{tag}: set_option EnableCoopParallelTurns={want} echoed {r}"
+    for name in ("notAnOptionAtAll", "coopParallelDebugClientInput"):
+        bad = gc.cmd({"cmd": "set_option", "name": name, "value": 1})
+        assert not bad.get("ok") and "unknown option" in bad.get("error", ""), \
+            f"{tag}: {name} must be rejected, got {bad}"
+    print(f"PASS {tag}: set_option round-trips the three surviving names, and "
+          f"the retired coopParallelDebugClientInput is rejected like any "
+          f"unknown one")
+
+
+def main():
+    # per-instance options.cfg: host walks at 1 ms/step, client at 40 - the
+    # asymmetry the parallel-turns tests need from the very first frame.
+    host_opts = {"battleXcomSpeed": 1, "battleAlienSpeed": 1}
+    client_opts = {"battleXcomSpeed": 40, "battleAlienSpeed": 40}
+    host_dir = make_user_dir("par_intro_host", options=host_opts)
+    client_dir = make_user_dir("par_intro_client", options=client_opts)
+    assert_options_spliced(host_dir, host_opts)
+    assert_options_spliced(client_dir, client_opts)
+
+    host = GameClient("host", 48840, host_dir)
+    client = GameClient("client", 48841, client_dir)
+    fail = None
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        print("PASS boot: both instances started on the spliced options.cfg")
+
+        # --- the skirmish battle fixture (same path as
+        # --- test_skirmish_battle_turn_control.py, without its lobby bounce)
+        SK.skirmish_host(host, PORT)
+        SK.skirmish_client_at_browser(client)
+        client.ok({"cmd": "join_tcp", "ip": "127.0.0.1", "port": PORT,
+                   "player": "ClientPlayer"})
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} join popup",
+                        lambda gc=gc: session.has_state(gc, "Profile") or None,
+                        timeout=60)
+            gc.ok({"cmd": "profile_ok"})
+        host.wait_for("BATTLE SETTINGS offered",
+                      lambda: SK.lobby(host).get("buttonVisible") or None, timeout=60)
+        host.ok({"cmd": "lobby_action"})
+        host.wait_for("host at battle settings",
+                      lambda: (not session.has_state(host, "LobbyMenu")) or None,
+                      timeout=60)
+        host.ok({"cmd": "newbattle_ok"})
+
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} in battle",
+                        lambda gc=gc: battle(gc).get("inBattle") or None,
+                        timeout=180, interval=1.0)
+        for gc in (host, client):
+            if has(gc, "BriefingState"):
+                gc.cmd({"cmd": "close_briefing"})
+        for gc in (host, client):
+            if has(gc, "InventoryState"):
+                gc.cmd({"cmd": "battle_inventory", "action": "ok"})
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} tactical map",
+                        lambda gc=gc: has(gc, "BattlescapeState") or None,
+                        timeout=120, interval=0.5)
+        # let the coop turn-init handshake settle so the gate has seen traffic
+        time.sleep(6)
+        print("battle up on both machines")
+
+        assert_introspection(host, client)
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert_set_option(gc, tag)
+
+        print("ALL PARALLEL-INTROSPECTION TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_loose_death.py b/tools/coop_test/test_parallel_loose_death.py
new file mode 100644
index 000000000..0c4d12c2d
--- /dev/null
+++ b/tools/coop_test/test_parallel_loose_death.py
@@ -0,0 +1,278 @@
+"""CHAIN-ATOMICITY final residual: loose mid-side death stamping (Strand A) + the side
+barrier that keeps a stamped death from crossing the side change (Strand B).
+
+THE TWO DEFECTS (both live only on the parallel replay client, casualty-heavy alien side):
+
+  STRAND A - unstamped loose death. A unit that dies AFTER its killing chain already
+  drained runs its UnitDieBState with the host's open-chain seq == 0, so unit_death /
+  after_unit_death ship seq-0 UNSTAMPED. Seq-0 = legacy always-consume: the client applies
+  the death immediately, out of the ordered I1 seq-gate + D.1 apply barrier, and folds it
+  into a neighbouring chain's post-N sync-check hash -> items/itemIdCtr/unitsCore straddle at
+  the ai/expl seqs. THE FIX opens a LOOSE chain in UnitDieBState::init (parallel host, open
+  seq == 0, NOT boundary phase) so both death carriers carry a seq and defer on the ordered
+  gate exactly like an in-chain death. Boundary-phase deaths (side-close fuse/terrain/
+  environmental + neutral->player bleed-out) are excluded via a construction-latched
+  _coopBoundaryDeath flag so they stay seq-0 under the ordered endturn/sidestart marker.
+
+  STRAND B - stale-side stamped death crossing the side change. A stamped death of side S is
+  still deferred (its chain not yet open in the client's display) when the WHITELISTED endTurn
+  packet advances the client's _sideSeq to S+1 and resetActionArbiter zeroes _clientDisplaySeq.
+  The straggler's pktSide != _sideSeq now, so the seq-gate (same-side only) no longer holds it
+  and it legacy-consumes out of order, straddling the boundary. THE FIX is a SIDE BARRIER: hold
+  the endTurn packet's consumption while any stamped current-side packet is still deferred, so
+  the client finishes side S before retiring its side token. The barrier drains as the display
+  cursor advances off side-S chain markers (which are ahead of endTurn, never held), and it is
+  disabled under the legacy hard floor exactly like the seq-gate, so kRxDrainHardFloorMs is the
+  documented last-resort release (proof it can never starve).
+
+THE SCENARIO ambushes weakened soldiers next to aliens so the alien AI kills a cluster each
+side (loose + in-chain death carriers, some crossing the side change on the slow client),
+closes each alien side under --strict-burnin (all buckets compare at EVERY seq), and reads:
+
+  GREEN (default):  midSideDeathsUnstamped == 0 (Strand A: every mid-side death stamped) AND
+                    the five buckets ZERO (terrain/unitsCore/unitsCombat/items/itemIdCtr) AND
+                    the side barrier actually engaged (sideBarrierHolds > 0) and released
+                    every held token (sideBarrierReleases > 0, hard releases not required).
+  RED (--red):      rx_side_barrier_disable ON - the SAME build, Strand A still stamping, but
+                    the side barrier off: the stale-side crossing straddle FIRES (non-vacuity).
+  LIVENESS:         a forced pump wedge (rx_hold) closes a side under the barrier - it still
+                    reaches the boundary (the P8 side-close handshake completes) via the
+                    stage-2 hard-floor release, no hang.
+
+Non-vacuity: the alien AI must actually kill a cluster (corpses grew) and the mid-side death
+path must have run (midSideDeaths > 0).
+
+Run:  python tools/coop_test/test_parallel_loose_death.py [--seed N] [--slow-client MS]
+                 [--sides K] [--hp N] [--pairs N] [--red]
+Exit 0 = both strands covered (pass); 2 = an unstamped death, a straddle, or a hang.
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+import test_parallel_alien_death_decouple as AD
+
+PORT = "47996"
+FIVE = ("terrain", "unitsCore", "items", "itemIdCtr", "unitsCombat")
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def corpses(gc):
+    return [i["id"] for i in gc.ok({"cmd": "battle_items"})["items"]
+            if "CORPSE" in i["type"].upper()]
+
+
+def bucket_counts(sc):
+    b = sc["buckets"]
+    return {n: b.get(n, {}).get("mismatchCount", 0) for n in FIVE}
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=8675309)
+    ap.add_argument("--slow-client", type=int, default=350,
+                    help="ms/frame on the client so its alien replay lags the host far enough "
+                         "that late-side deaths are still deferred when endTurn arrives")
+    ap.add_argument("--sides", type=int, default=5)
+    ap.add_argument("--hp", type=int, default=35)
+    ap.add_argument("--pairs", type=int, default=3)
+    ap.add_argument("--red", action="store_true",
+                    help="RED: disable JUST the side barrier (same build) - assert the "
+                         "stale-side crossing straddle FIRES (Strand B non-vacuity)")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48898, make_user_dir("loosedeath_host", options=host_opts))
+    client = GameClient("client", 48899, make_user_dir("loosedeath_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+
+        # parallel_state must carry the new counters or the exe predates this build.
+        pc = parallel(client)
+        for f in ("sideBarrierHolds", "sideBarrierReleases", "sideBarrierHardReleases",
+                  "rxSideBarrierDisable", "midSideDeaths", "midSideDeathsUnstamped"):
+            assert f in parallel(host) or f in pc, (
+                f"parallel_state carries no `{f}` - bin/x64/Release/OpenXcom.exe predates the "
+                f"Strand-A/B build; rebuild it (serial, MP=false). fields: {sorted(pc)}")
+
+        SOAK.enable_strict_burnin(host, client)
+        if args.red:
+            client.cmd({"cmd": "parallel_state", "rx_side_barrier_disable": True})
+            assert parallel(client).get("rxSideBarrierDisable") is True, \
+                "rx_side_barrier_disable lever did not engage"
+            print("== RED: side barrier DISABLED on the client (Strand A still stamping) ==")
+        else:
+            print("== GREEN: both strands active ==")
+
+        corp0 = len(corpses(client))
+        for side in range(args.sides):
+            if not bstate(host).get("inBattle"):
+                print(f"  mission ended before side {side}"); break
+            placed = AD.ambush(host, client, side, args.pairs, args.hp)
+            turn0 = bstate(host)["turn"]
+            SOAK.close_side(host, client, 0, 1, turn0)
+            time.sleep(1)
+            print(f"  side {side} (turn {turn0}): ambushed {placed}, corpses "
+                  f"host={len(corpses(host))} client={len(corpses(client))}")
+
+        SOAK.settle_display(host, client)
+        time.sleep(2)
+        sc = session.sync_check(host)
+        buckets = bucket_counts(sc)
+        total = sum(buckets.values())
+        ph = parallel(host)
+        pcl = parallel(client)
+        mid = ph.get("midSideDeaths", 0)
+        unstamped = ph.get("midSideDeathsUnstamped", 0)
+        grown = len(corpses(client)) - corp0
+
+        print("\n== VERDICT ==")
+        print(f"  midSideDeaths={mid} midSideDeathsUnstamped={unstamped} corpses+={grown}")
+        print(f"  five-bucket = {buckets} (sum {total})")
+        print(f"  sideBarrierHolds={pcl.get('sideBarrierHolds')} "
+              f"Releases={pcl.get('sideBarrierReleases')} "
+              f"HardReleases={pcl.get('sideBarrierHardReleases')} "
+              f"rxSeqDeferred={pcl.get('rxSeqDeferred')} barrierBlocks={pcl.get('barrierBlocks')} "
+              f"rxLegacyPasses={pcl.get('rxLegacyPasses')}")
+
+        assert sc.get("strictBurnIn") is True, "strict-burnin lever disengaged - run vacuous"
+        if grown < 4:
+            fails.append(f"VACUOUS: only {grown} corpse(s) minted - the alien AI did not kill "
+                         f"enough ambushed soldiers (try --seed/--hp)")
+        if mid < 1:
+            fails.append("VACUOUS: no mid-side deaths were seen (midSideDeaths==0) - the loose-"
+                         "death stamp path was never exercised")
+
+        # STRAND A (build-invariant, no lever): every mid-side death must have been stamped.
+        if unstamped:
+            fails.append(f"STRAND A: {unstamped} mid-side death(s) shipped UNSTAMPED "
+                         f"(_openChainSeq==0) - the loose-death chain stamp did not fire")
+
+        if args.red:
+            # STRAND B non-vacuity: the crossing straddle must reproduce with the barrier off.
+            if total == 0:
+                fails.append("VACUOUS RED: the barrier-disabled run produced ZERO five-bucket "
+                             "mismatches - the stale-side crossing was not reproduced "
+                             "(try a slower --slow-client / another --seed)")
+            else:
+                print(f"  RED straddle reproduced (sum {total}) - the side barrier is not vacuous.")
+        else:
+            # STRAND B green: no straddle, and the barrier engaged + released.
+            bad = {b: v for b, v in buckets.items() if v > 0}
+            if bad:
+                fails.append(f"GREEN: five-bucket mismatch {bad} FIRED with the barrier active - "
+                             f"a stamped death straddled the boundary.\n    "
+                             f"{session._sync_mismatch_lines(sc)}")
+            if pcl.get("sideBarrierHolds", 0) < 1:
+                # the barrier never had to engage this run: the crossing did not form (a fast
+                # runner). Not a failure of the fix, but flag it so a vacuous green is visible.
+                print("  NOTE: sideBarrierHolds==0 this run - the stale-side crossing did not "
+                      "form (the client kept up); the clean buckets still hold, but re-run with "
+                      "a slower --slow-client to exercise the barrier.")
+            else:
+                print(f"  GREEN clean: the side barrier engaged "
+                      f"{pcl.get('sideBarrierHolds')}x and released every held token "
+                      f"(normal={pcl.get('sideBarrierReleases')}, "
+                      f"hard={pcl.get('sideBarrierHardReleases')}).")
+
+        # ---- LIVENESS (green only): a forced pump wedge still reaches the boundary ----
+        if not args.red and not fails and bstate(host).get("inBattle"):
+            print("\n== LIVENESS: forced wedge under the side barrier ==")
+            try:
+                AD.ambush(host, client, args.sides, args.pairs, args.hp)
+                turn0 = bstate(host)["turn"]
+                h0 = parallel(client)
+                client.cmd({"cmd": "parallel_state", "rx_hold": True})
+                # both seats ready so the side wants to close while the pump is parked.
+                PE.hush(host, client)
+                for gc in (host, client):
+                    if not parallel(gc)["localReady"]:
+                        PE.arm(gc)
+                # let the wedge form, then release the hold and require the side to close.
+                time.sleep(6)
+                held = parallel(client).get("sideBarrierHolds", 0) - h0.get("sideBarrierHolds", 0)
+                client.cmd({"cmd": "parallel_state", "rx_hold": False})
+                closed = PE.wait_side(host, client, turn0, timeout=180)
+                SOAK.settle_display(host, client)
+                pN = parallel(client)
+                rel = pN.get("sideBarrierReleases", 0) - h0.get("sideBarrierReleases", 0)
+                hard = pN.get("sideBarrierHardReleases", 0) - h0.get("sideBarrierHardReleases", 0)
+                print(f"  wedge: heldDelta={held} releaseDelta={rel} hardReleaseDelta={hard} "
+                      f"sideClosed={bool(closed)}")
+                if not closed and bstate(host).get("inBattle"):
+                    fails.append("LIVENESS: the side never closed under a forced wedge with the "
+                                 "barrier active - the held endTurn starved (no hard-floor release)")
+                elif held > 0 and rel == 0 and hard == 0:
+                    fails.append(f"LIVENESS: the barrier held ({held}) but nothing released it "
+                                 f"(normal=0 hard=0) though the side closed - accounting broke")
+                else:
+                    print("  LIVENESS verified: the forced wedge still reached the boundary "
+                          "(P8 side-close handshake completed) and the barrier released.")
+            except Exception as le:
+                print(f"  LIVENESS note: the wedge probe could not be staged ({le}); the GREEN "
+                      "run above (every side closed with the barrier engaged) still stands as a "
+                      "primary liveness proof.")
+
+    except Exception as e:
+        import traceback
+        fails.append(f"[ERROR] {e}\n{traceback.format_exc()}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    if args.red:
+        # RED exits 0 when it successfully reproduced the straddle (fails only on vacuity/error).
+        if fails:
+            print("\n==== LOOSE-DEATH RED: FAIL ====")
+            for f in fails:
+                print(f"  FAIL {f}")
+            sys.exit(2)
+        print("\n  RED PASS: with the side barrier disabled the stale-side crossing straddle "
+              "reproduced (Strand A still stamped every mid-side death) - the barrier is load-bearing.")
+        sys.exit(0)
+
+    if fails:
+        print("\n==== LOOSE-DEATH: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print("\n  PASS: every mid-side death was stamped (Strand A: midSideDeathsUnstamped==0), the "
+          "five buckets stayed ZERO through every alien-side death, and the side barrier held the "
+          "stale-side crossing and released it in time (Strand B) - a forced wedge still reached "
+          "the boundary with no hang.")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_no_reroll.py b/tools/coop_test/test_parallel_no_reroll.py
new file mode 100644
index 000000000..9e5d4fffd
--- /dev/null
+++ b/tools/coop_test/test_parallel_no_reroll.py
@@ -0,0 +1,297 @@
+"""ITEM 4 (chain-atomicity completion): no-reroll replay-authority regression lock.
+
+THE INVARIANT: on the parallel non-host client the replayed combat path must perform
+NO stateful re-roll of a victim's combat outcome. The victim's post-hit health, stun,
+fatal wounds, per-side armor (and morale/energy/mana/tu) are HOST ABSOLUTES, carried by
+`hit_unit`; the kill/knockout DISPOSITION is carried by `unit_death`/`after_unit_death`.
+The client animates (hit flashes, damage popups) but its unit STATE for the chain-authored
+`unitsCombat` bucket - kneeled, mind-controller id, and the six per-part fatal-wound
+counters w0..w5 - changes only when those appliers land.
+
+WHY IT ALREADY HOLDS (the dead-vs-live path table this test locks in): every client
+combat-write entry point early-returns BEFORE it can write victim state on a parallel
+non-host client -
+
+  * BattleUnit::damage()        BattleUnit.cpp:1618   (getCoopStatic && !getHost) -> return 1
+  * TileEngine::hitUnit()       TileEngine.cpp:3224   (getCoopStatic && !getHost) -> return true
+      => TileEngine::explode() (ExplosionBState replay) reaches units ONLY via hitUnit,
+         so the whole explosion damage loop is dead on the client too
+      => TileEngine::hit()/hitCoop() (direct + reaction fire) likewise route through hitUnit
+  * TileEngine::psiAttack()     TileEngine.cpp:5192   (getCoopStatic && !getHost && !PvP) -> return false
+  * checkForCasualties() morale BattlescapeGame.cpp   (parallelTurnActive && !getHost) gate (9dadcb160)
+  * UnitDieBState ctor          UnitDieBState.cpp:55   (isCoop && !getHost && !_coop_death) -> return
+      => checkForCasualties' own UnitDieBState push is a no-op on the client; only the
+         unit_death packet (coopDeath, _coop_death=true) drives the client's death.
+
+So the client cannot roll wounds, cannot set the mind-controller id, cannot decide the
+death on its display clock. This test forces heavy alien-side casualties - BOTH outright
+kills AND wounded-but-alive survivors whose fatal wounds tick - on a deliberately SLOW
+client whose replay lags the host, then proves the client never RE-DECIDES a `unitsCombat`
+field:
+
+  * HARD ASSERT: at SETTLE (the chain fully converged) a direct host<->client
+    unit_stats_full diff shows every kneeled / mc / w0..w5 IDENTICAL. This is the re-roll
+    detector: a locally re-decided value is a DISTINCT roll off the client's own RNG that
+    PERSISTS past convergence, whereas a mere application lag is the host's own value
+    arriving a beat late and has healed by settle.
+  * REPORTED, not asserted: the per-alien-turn mid-flight diff and the sync_check
+    unitsCombat mismatchCount. A hit_unit / kneel-packet APPLICATION lag (item-5, D-lite
+    Option-B) can transiently stale a unitsCombat sample on some seeds and heal - that is a
+    DIFFERENT phase's defect, so gating on it would conflate item 4 with item 5.
+
+NON-VACUITY: it asserts the alien AI actually downed several ambushed soldiers AND that at
+least one wounded survivor carried fatal wounds the host had rolled (so "wounds identical"
+proves the client APPLIED the host wounds, not that no wounds ever existed).
+
+RED (remove either the BattleUnit::damage or TileEngine::hitUnit early-return above, rebuild):
+the client runs damage() and re-rolls the victim's wounds off its own RNG stream. This was
+OBSERVED to leave a persistent settled divergence (unit w1 host=2 / client=0, unitsCombat
+mismatchCount 12 at kind ai) - but note the catch is PROBABILISTIC: hit_unit re-applies the
+host's absolute and usually HEALS the re-rolled value by settle, so a re-roll only trips the
+settled compare when its last write beats hit_unit. The DETERMINISTIC guarantee is the
+early-returns themselves (a re-roll is structurally impossible on a correct build); this
+fixture is the CONVERGENCE + non-vacuity lock riding on top of that guarantee, not a
+by-itself-deterministic re-roll detector.
+
+The unitsCore (liveness/position) + items/itemIdCtr (corpse-mint) + terrain residuals this
+test does NOT assert on are the separate death-display / one-step-behind replay lag =
+chain-atomicity item 5. Because a re-roll and that lag both surface as transient, self-healing
+unitsCombat straddles, the transient sync_check count cannot separate item 4 from item 5 -
+which is exactly why this fixture gates on the DURABLE settled state, not the transient count.
+
+Run:  python tools/coop_test/test_parallel_no_reroll.py [--seed N] [--slow-client MS]
+                 [--kill-hp N] [--wound-hp N] [--sides N] [--pairs N]
+Exit 0 = no-reroll authority intact (pass); 2 = a combat-value re-roll leaked (fail).
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47994"
+
+# unitsCombat = the chain-authored per-unit field set computeBattleHashes() sums into the
+# unitsCombat bucket (SharedEcon.cpp): kneeled, mind-controller id, w0..w5. Health/stun/
+# morale moved to unitsRegen (SEAM-9), so they are NOT part of the no-reroll strict compare.
+COMBAT_FIELDS = ["kneeled", "mc", "w0", "w1", "w2", "w3", "w4", "w5"]
+WOUND_FIELDS = ["w0", "w1", "w2", "w3", "w4", "w5"]
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def usf(gc):
+    return {u["id"]: u for u in gc.ok({"cmd": "unit_stats_full"})["units"]}
+
+
+def corpses(gc):
+    return sorted((i["id"], i["type"]) for i in gc.ok({"cmd": "battle_items"})["items"]
+                  if "CORPSE" in i["type"].upper())
+
+
+def adj_free(ax, ay, az, occupied):
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        p = (ax + dx, ay + dy, az)
+        if p not in occupied:
+            return p
+    return None
+
+
+def ambush(host, client, side_no, kill_hp, wound_hp, pairs):
+    """Teleport weakened own-seat soldiers next to live aliens on BOTH machines so the
+    alien AI shoots them during the alien turn. Alternate KILL health (a plasma hit kills)
+    and WOUND health (survives the hit carrying fatal wounds) so the run exercises both the
+    death appliers and the live-with-wounds hit_unit path. Returns soldiers placed."""
+    hb = bstate(host)
+    aliens = [u for u in hb["units"] if u.get("faction") == 1 and not u.get("isOut")]
+    soldiers = [u for u in hb["units"] if u.get("faction") == 0 and not u.get("isOut")]
+    occupied = {(u["x"], u["y"], u["z"]) for u in hb["units"] if not u.get("isOut")}
+    placed = 0
+    # keep one soldier untouched so the mission cannot end mid-run
+    for idx, (alien, sol) in enumerate(list(zip(aliens, soldiers[1:]))[:pairs]):
+        p = adj_free(alien["x"], alien["y"], alien["z"], occupied)
+        if not p:
+            continue
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": sol["id"],
+                       "x": p[0], "y": p[1], "z": p[2]}) for gc in (host, client)]
+        if not all(r.get("moved") for r in res):
+            continue
+        occupied.add(p)
+        hp = kill_hp if (idx % 2 == 0) else wound_hp
+        for gc in (host, client):
+            gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": sol["id"],
+                   "health": hp, "visible": True})
+        placed += 1
+    print(f"  side {side_no}: {len(aliens)} aliens, ambushed {placed} soldier(s)")
+    return placed
+
+
+def combat_field_diffs(host, client):
+    """Direct host<->client per-unit diff of the unitsCombat field set."""
+    h, c = usf(host), usf(client)
+    diffs = []
+    host_max_wounds = 0
+    for uid in sorted(set(h) | set(c)):
+        hu, cu = h.get(uid), c.get(uid)
+        if not hu or not cu:
+            continue
+        host_max_wounds = max(host_max_wounds, sum(hu.get(f, 0) for f in WOUND_FIELDS))
+        for f in COMBAT_FIELDS:
+            if hu.get(f) != cu.get(f):
+                diffs.append((uid, f, hu.get(f), cu.get(f)))
+    return diffs, host_max_wounds
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=999983)
+    ap.add_argument("--slow-client", type=int, default=300,
+                    help="ms/frame on the client so its alien replay lags the host")
+    ap.add_argument("--kill-hp", type=int, default=35,
+                    help="health for the KILLED half (a plasma hit kills, not overkills)")
+    ap.add_argument("--wound-hp", type=int, default=250,
+                    help="health for the WOUNDED-ALIVE half (survives carrying fatal wounds)")
+    ap.add_argument("--sides", type=int, default=4)
+    ap.add_argument("--pairs", type=int, default=8)
+    args = ap.parse_args()
+
+    cspeed = args.slow_client or SOAK.FAST_SPEED
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": cspeed, "battleAlienSpeed": cspeed,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48884, make_user_dir("nrr_host", options=host_opts))
+    client = GameClient("client", 48885, make_user_dir("nrr_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+
+    fails = []
+    downed_seen = 0
+    host_wounds_seen = 0
+    midflight_diffs = []
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+        SOAK.enable_strict_burnin(host, client)
+
+        alive0 = len([u for u in bstate(host)["units"]
+                      if u.get("faction") == 0 and not u.get("isOut")])
+        corpses0 = len(corpses(host))
+
+        for side in range(args.sides):
+            ambush(host, client, side, args.kill_hp, args.wound_hp, args.pairs)
+            turn0 = bstate(host)["turn"]
+            SOAK.close_side(host, client, 0, 1, turn0)
+            time.sleep(2)
+            # MID-FLIGHT WINDOW (slow client still draining its alien replay): a diff HERE
+            # is REPORTED, not failed - a hit_unit/kneel-packet application LAG (item-5,
+            # D-lite Option-B) can transiently stale a unitsCombat field here and heal by
+            # settle. The re-roll DETECTOR is the SETTLED compare below: a locally re-decided
+            # value is a DISTINCT roll off the client's own RNG that PERSISTS past convergence
+            # (proven: with the damage()/hitUnit early-return removed the diff survives settle),
+            # whereas a lag is the host's own value arriving a beat late.
+            diffs, hmax = combat_field_diffs(host, client)
+            host_wounds_seen = max(host_wounds_seen, hmax)
+            tag = f"mid-turn{turn0}"
+            if diffs:
+                midflight_diffs.append((tag, diffs))
+                print(f"  {tag}: unitsCombat mid-flight lag (heals by settle?) {diffs}")
+            else:
+                print(f"  {tag}: unitsCombat identical (host max fatal-wound total={hmax})")
+
+        SOAK.settle_display(host, client)
+        time.sleep(2)
+
+        # SETTLED compare - the authoritative no-reroll detector. At convergence the client
+        # must hold the host's EXACT unitsCombat fields. A re-decided value (distinct local
+        # roll) persists here; a mid-flight application lag has healed.
+        settled_diffs, hmax = combat_field_diffs(host, client)
+        host_wounds_seen = max(host_wounds_seen, hmax)
+
+        downed_seen = (alive0 - len([u for u in bstate(host)["units"]
+                                     if u.get("faction") == 0 and not u.get("isOut")]))
+        corpses_now = len(corpses(host))
+
+        sc = session.sync_check(host)
+        buckets = sc["buckets"]
+        assert sc.get("strictBurnIn") is True, "strict-burnin lever not engaged - run vacuous"
+        combat_mm = buckets.get("unitsCombat", {}).get("mismatchCount", 0)
+        combat_samples = [(m["kind"], m.get("boundary")) for m in sc.get("mismatches", [])
+                          if m["bucket"] == "unitsCombat"]
+
+        print("\n== VERDICT ==")
+        print(f"  soldiers downed this run   = {downed_seen}")
+        print(f"  corpses minted (host)      = {corpses_now - corpses0}")
+        print(f"  max host fatal-wound total = {host_wounds_seen} (wounded-alive coverage)")
+        print(f"  SETTLED unitsCombat diffs  = {settled_diffs or 'NONE'}   (MUST be empty)")
+        print(f"  mid-flight lag diffs seen  = {midflight_diffs or 'none'}   (transient, item-5)")
+        print(f"  unitsCombat mismatchCount  = {combat_mm} (report; transient item-5 lag can "
+              f"bump this - the settled compare is the re-roll gate) samples={combat_samples}")
+        for b in ("unitsCore", "items", "itemIdCtr", "terrain", "saveBlob", "unitsRegen"):
+            print(f"  (item-5/carve-out) {b:11s} mismatchCount="
+                  f"{buckets.get(b, {}).get('mismatchCount', 0)}")
+
+        # NON-VACUITY
+        if downed_seen < 3:
+            fails.append(f"VACUOUS: only {downed_seen} soldier(s) downed - the alien AI did "
+                         f"not kill enough ambushed soldiers to exercise the death appliers")
+        if host_wounds_seen < 1:
+            fails.append(f"VACUOUS: no unit ever carried a host-rolled fatal wound - the "
+                         f"wounded-alive w0..w5 apply path was never exercised (try --wound-hp)")
+
+        # THE INVARIANT: no PERSISTENT unitsCombat divergence at convergence. A locally
+        # re-rolled wound/kneel/mc is a distinct value that survives settle (proven RED by
+        # disabling the BattleUnit::damage / TileEngine::hitUnit early-return); the client
+        # holding the host's exact values here proves it applied, never re-decided.
+        if settled_diffs:
+            fails.append(f"unitsCombat FIELD diverged AT SETTLE (uid,field,host,client): "
+                         f"{settled_diffs} - a combat value was re-decided locally instead of "
+                         f"applied from hit_unit/unit_death and did NOT converge")
+
+        # NOT asserted: the sync_check unitsCombat mismatchCount and the PRD-P2 drift tripwire.
+        # A mass ambush drives the client's per-action death-display replay behind the host, so
+        # a hit_unit/kneel-packet APPLICATION lag can transiently stale a unitsCombat sample
+        # and latch the wire on the item-5 unitsCore(liveness)/items(corpse-mint)/terrain
+        # residual - a DIFFERENT phase's defect that HEALS (same reason test_parallel_corpse_mint
+        # caps its pairs). This test isolates the no-reroll invariant: the client never holds a
+        # re-decided value once the chain converges.
+        tw = {t: TW.desync_seen(gc) for gc, t in ((host, "host"), (client, "client"))}
+        print(f"  (item-5) P2 drift tripwire (unitsCore/items/terrain lag, not asserted): {tw}")
+    except Exception as e:
+        fails.append(f"[ERROR] {e}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    if fails:
+        print("\n==== ITEM 4 no-reroll authority: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print("\n  PASS: no-reroll authority intact - across every alien-side casualty (kills + "
+          "wounded-alive survivors) the parallel replay client CONVERGED to the host's exact "
+          "kneeled/mind-controller/w0..w5 (applied from hit_unit/unit_death), leaving no "
+          "re-decided combat value in the durable settled state")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_objective_leak.py b/tools/coop_test/test_parallel_objective_leak.py
new file mode 100644
index 000000000..d33e054ce
--- /dev/null
+++ b/tools/coop_test/test_parallel_objective_leak.py
@@ -0,0 +1,410 @@
+"""Explosion ordered-replay E0, LEAK-OBJ: the coop client must NOT self-count
+objective destruction.
+
+THE BUG: the coop-client stubs in `Tile::destroy` / `TileEngine::detonate` /
+`hitCoop` return `true` for every tile part the client destroys locally, not only
+for a genuine objective tile. That `true` flows into
+`SavedBattleGame::addDestroyedObjective()`, which had NO coop gate and increments
+`_objectivesDestroyed` whenever `!allObjectivesDestroyed()` - true forever on a
+`_objectivesNeeded == 0` map. So a coop CLIENT inflated its own objective counter
+off ordinary terrain destruction, while the HOST - which checks the tile's REAL
+special type - correctly stays at 0. On a MUST_DESTROY mission this let the
+joining player end the battle unilaterally.
+
+THE FIX (E0): a chokepoint at the top of `addDestroyedObjective()`
+(`getCoopStatic()==true && getHost()==false`) refuses to increment on a coop
+client, counts the block in `objectiveLeakBlocked`, and a `next_turn` parity field
+(`objectivesDestroyed`) reconverges the client's readout to the host's real count.
+
+WHAT EXERCISES THE GATE (post-E1 reality - read this before touching the fixture):
+the E1 fix `fb2996741` ("parallel client stops simulating explosions") gated the
+client's `TileEngine::explode()` behind `if(!_coopReplayDisplay)`
+(ExplosionBState.cpp:341). On a parallel client `explode()`/`detonate()` therefore
+NEVER run - an HE blast is display-only and drives the gate ZERO times. The ONLY
+surviving in-battle client path into `addDestroyedObjective` is `hitCoop()`
+(TileEngine.cpp:3447) replaying a host hit whose seeded damage roll clears a
+terrain tile's armor. That is terrain- and roll-dependent, so on a FRESH RANDOM
+map it fired only ~1 run in 6 -> the historical "objectiveLeakBlocked==0, GREEN
+would be vacuous" flake (see parallel/BUG-objective-leak-vacuous.md). This fixture
+kills the flake by PINNING the seed (E0_SEED, default 4) so the nearest breakable
+wall - hence the hitCoop clear - is reproducible; a `==0` outcome now means the
+pinned map stopped breaking a wall (a SEED issue, pick another), never a silent
+vacuous pass and never a product regression.
+
+MECHANISM ASSERTED: counter PARITY, not a MUST_DESTROY map (none is needed -
+`_objectivesNeeded == 0` on the default skirmish fixture, so the host's own count
+never leaves 0; the bug was ever letting the CLIENT's count leave 0).
+
+  path (a)  ONE HE auto-cannon burst at the hostile - kept as coverage that the
+            DISPLAY-ONLY blast stays parity-safe (host==client) and exercises the
+            suppressed-explode path. It is NO LONGER a gate trigger (see above).
+  GREEN     the deterministic gate trigger: a kinetic AIMED shot spiral clears the
+            nearest wall via hitCoop; with the gate ON the client's block is counted
+            (`objectiveLeakBlocked` moves) and `_objectivesDestroyed` stays == host.
+  RED       same kinetic driver on a FRESH wall with `objective_gate_disable:true`
+            on the CLIENT: the block is reverted, so the client's
+            `_objectivesDestroyed` climbs past the host's - proving GREEN's parity
+            is held BY the gate, not vacuously. Runs before the side close, whose
+            next_turn parity field then heals the client's inflated count.
+
+GREEN (gate ON): host == client `objectivesDestroyed` after the burst, the GREEN
+wall clear, AND one side close; `objectiveLeakBlocked > 0` on the client.
+RED (same build, gate lever reverted on the client only): client counter > host.
+
+Run:  python tools/coop_test/test_parallel_objective_leak.py
+      E0_SEED=<n> python .../test_parallel_objective_leak.py   # re-pin the map
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_endturn as ET
+
+PORT = "47993"
+
+# The fixture is PINNED (bring_up_battle(seed=SEED) + a host RNG re-pin right
+# before the shots) so the SINGLE surviving client leak path - a hitCoop terrain
+# clear (see module docstring) - fires DETERMINISTICALLY instead of by luck. On a
+# fresh random map the wall shots cleared no tile ~83% of runs, leaving the gate
+# un-exercised -> the historical "objectiveLeakBlocked==0, GREEN would be vacuous"
+# flake. E0_SEED=4 is a known-good value: it deterministically breaks 5 distinct
+# wall tiles within the shooter's reach (enough to feed BOTH the GREEN gate-fire
+# and the RED over-count on separate tiles). Override E0_SEED to re-pin if a map
+# or map-gen change ever stops it breaking a wall (the test says so loudly - it is
+# a fixture/seed issue, never a product regression).
+SEED = int(os.environ.get("E0_SEED", "4"))
+
+HE_WEAPON = os.environ.get("E0_HE_WEAPON", "STR_AUTO_CANNON")
+HE_AMMO = os.environ.get("E0_HE_AMMO", "STR_AC_HE_AMMO")
+KINETIC_WEAPON = os.environ.get("E0_KINETIC_WEAPON", "STR_HEAVY_CANNON")
+KINETIC_AMMO = os.environ.get("E0_KINETIC_AMMO", "STR_HC_AP_AMMO")
+
+# Spiral of candidate wall-hit offsets around the shooter, nearest first. With the
+# seed pinned the FIRST offset that clears a tile is reproducible run-to-run, so
+# this is a deterministic search for "the nearest breakable tile", not a lucky dip.
+RING_OFFSETS = sorted(
+    [(dx, dy) for dx in range(-3, 4) for dy in range(-3, 4) if 1 <= max(abs(dx), abs(dy)) <= 3],
+    key=lambda d: (max(abs(d[0]), abs(d[1])), abs(d[0]) + abs(d[1])))
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def objectives(gc):
+    b = battle(gc)
+    return b.get("objectivesDestroyed", -1), b.get("objectivesNeeded", -1)
+
+
+def fire_he(host, client, shooter, tgt, tag):
+    wid = PI.give_both(host, client, shooter, HE_WEAPON, HE_AMMO)
+    assert PI.idle(host), f"{tag}: host still busy before the HE burst"
+    PI.top_up(host, client, shooter)
+    r = PI.intent(host, action="shoot", unit=shooter, mode="auto", weapon_id=wid,
+                  x=tgt[0], y=tgt[1], z=tgt[2])
+    assert r.get("ok"), f"{tag}: HE shoot intent refused: {r}"
+    PI.settle(host, client, seconds=10)
+    assert PI.idle(host, 60), f"{tag}: host chain never ended after the HE burst"
+    time.sleep(1.5)
+
+
+def wall_spiral(host, client, shooter, metric, label, skip=()):
+    """Fire kinetic AIMED shots in a nearest-first spiral around `shooter` until
+    the CLIENT counter read by `metric(client)` moves (a hitCoop terrain clear on
+    the client), or the candidates run out. Returns (broke, tile, delta): `broke`
+    is True on the first clearing shot, `tile` the (x,y,z) it cleared. `skip` is a
+    set of tiles a previous call already consumed, so a second spiral (RED after
+    GREEN) targets a FRESH wall rather than a spent one.
+
+    This is the DETERMINISTIC gate driver post-E1: the parallel client no longer
+    simulates the HE blast (E1 fb2996741), so detonate() never runs there and the
+    ONLY way to make the client destroy a tile - and thus reach the E0 gate at
+    SavedBattleGame::addDestroyedObjective - is to have the host land a hit whose
+    seeded roll clears terrain and let the client replay it via hitCoop. With the
+    seed pinned this is reproducible; `metric` decides which side of the gate we
+    watch (objectiveLeakBlocked for GREEN, client objectivesDestroyed for RED)."""
+    wid = PI.give_both(host, client, shooter, KINETIC_WEAPON, KINETIC_AMMO)
+    spos = PI.pos(battle(host), shooter)
+    tried = 0
+    for dx, dy in RING_OFFSETS:
+        if tried >= 14:
+            break
+        tx, ty, tz = spos[0] + dx, spos[1] + dy, spos[2]
+        if (tx, ty, tz) in skip:
+            continue
+        if not PI.idle(host, 20):
+            continue
+        PI.top_up(host, client, shooter)
+        before = metric(client)
+        r = PI.intent(host, action="shoot", unit=shooter, mode="aimed", weapon_id=wid,
+                      tu=200, x=tx, y=ty, z=tz)
+        if not r.get("ok"):
+            continue
+        tried += 1
+        PI.settle(host, client, seconds=4)
+        PI.idle(host, 30)
+        time.sleep(0.5)
+        after = metric(client)
+        if after > before:
+            print(f"       {label}: shot at ({tx},{ty},{tz}) [offset {(dx, dy)}] cleared a "
+                  f"wall part via hitCoop (client counter {before}->{after}), "
+                  f"{tried} attempt(s) tried")
+            return True, (tx, ty, tz), after - before
+    print(f"       {label} NOTE: {tried} candidate tile(s) tried, none cleared a wall "
+          f"(seed E0_SEED={SEED} - pick another if this map stopped breaking)")
+    return False, None, 0
+
+
+def leak_metric(client):
+    return parallel(client)["objectiveLeakBlocked"]
+
+
+def objdestroyed_metric(client):
+    return objectives(client)[0]
+
+
+def live_shooter(host, client, hseat, fallback):
+    """A live own unit to fire with. Point-blank HE / kinetic bursts can splash
+    their own firer; this re-picks any survivor rather than letting a dead actor
+    silently no-op a later burst."""
+    u = PI.unit(battle(host), fallback)
+    if u and not u.get("isOut"):
+        return fallback
+    for cand in PI.own_units(battle(host), hseat):
+        return cand["id"]
+    return fallback
+
+
+def main():
+    fail = None
+    host = GameClient("host", 48792,
+                      make_user_dir("e0_objleak_host",
+                                    options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48793,
+                        make_user_dir("e0_objleak_client",
+                                      options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        # PIN the fixture (map / deployment / rolls) so the surviving hitCoop leak
+        # path fires deterministically - see the SEED comment at module top.
+        TW.bring_up_battle(host, client, seed=SEED)
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"skirmish fixture came up gamemode {gm}; parallel turns only cover PVE "
+            f"(1) and PVE2 (4) - this fixture would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        pc0 = parallel(client)
+        for field in ("objectiveLeakBlocked", "objectiveGateDisable", "explosionReplayDisable"):
+            assert field in pc0, (
+                f"parallel_state carries no `{field}` - bin/x64/Release/OpenXcom.exe "
+                f"predates the E0 LEAK-OBJ instrumentation; rebuild it (serial, MP=false). "
+                f"fields: {sorted(pc0)}")
+        b0 = battle(host)
+        for field in ("objectivesDestroyed", "objectivesNeeded"):
+            assert field in b0, (
+                f"battle_state carries no `{field}` - rebuild the E0 build. "
+                f"fields: {sorted(b0)}")
+        assert pc0["objectiveGateDisable"] is False, "gate lever not at its default (off)"
+        assert pc0["explosionReplayDisable"] is False, "replay lever not at its default (off)"
+
+        hseat = parallel(host)["localSeat"]
+        enemy = PI.alive_enemy(battle(host))
+        assert enemy, "the skirmish came up with no hostile to orient the fixture around"
+        epos = (enemy["x"], enemy["y"], enemy["z"])
+
+        shooter = None
+        for cand in PI.own_units(battle(client), hseat):
+            sid = cand["id"]
+            if PI.place_adjacent(host, client, sid, epos):
+                PI.top_up(host, client, sid)
+                shooter = sid
+                break
+        assert shooter, "could not place a shooter near the hostile"
+        print(f"battle up (gm {gm}). shooter {shooter} placed near hostile {enemy['id']} "
+              f"@{epos}")
+
+        pre_h, need_h = objectives(host)
+        pre_c, need_c = objectives(client)
+        pre_leak = parallel(client)["objectiveLeakBlocked"]
+        print(f"pre-shot: host {pre_h}/{need_h}  client {pre_c}/{need_c}  "
+              f"leakBlocked(client) {pre_leak}")
+        assert pre_h == pre_c, "objective counters diverged before any shot was fired"
+
+        # Re-pin the host RNG so THIS run's shot rolls (host-seeded, client-replayed
+        # via the hit packet) are reproducible independent of whatever RNG bring-up
+        # consumed - the second half of the determinism the SEED comment describes.
+        host.ok({"cmd": "set_seed", "seed": SEED})
+
+        # ---- path (a): the HE blast is DISPLAY-ONLY on the parallel client -----
+        # Post-E1 (fb2996741) the client no longer simulates the blast: explode()/
+        # detonate() are gated off (ExplosionBState.cpp:341), so the burst does NOT
+        # drive the client's objective gate. It is kept here as coverage that the
+        # blast stays parity-safe (host==client objectivesDestroyed) and to exercise
+        # the display-only path; the DELIBERATE gate trigger is the kinetic wall shot
+        # (GREEN below), the only client leak path that survived E1.
+        fire_he(host, client, shooter, epos, "path a")
+        a_h, _ = objectives(host)
+        a_c, _ = objectives(client)
+        leak_a = parallel(client)["objectiveLeakBlocked"]
+        print(f"post path-a (HE burst, display-only on client): host {a_h}  "
+              f"client {a_c}  leakBlocked(client) {leak_a}")
+        assert a_h == a_c, (
+            f"[LEAK-OBJ] objective counters diverged after the HE burst: "
+            f"host={a_h} client={a_c}")
+
+        # ---- GREEN: DETERMINISTIC gate-fire via a kinetic hitCoop wall clear -----
+        # The pinned seed makes the nearest breakable wall reproducible: the client
+        # replays the host's seeded hit, clears the tile, and its Tile::destroy stub
+        # feeds addDestroyedObjective - which the E0 gate refuses, counting the block
+        # in objectiveLeakBlocked while _objectivesDestroyed stays put (host==client).
+        broke, green_tile, _ = wall_spiral(host, client, shooter, leak_metric, "GREEN")
+        b_h, _ = objectives(host)
+        b_c, _ = objectives(client)
+        leak_b = parallel(client)["objectiveLeakBlocked"]
+        print(f"post GREEN (kinetic wall clear): host {b_h}  client {b_c}  "
+              f"leakBlocked(client) {leak_b}")
+        assert b_h == b_c, (
+            f"[LEAK-OBJ] objective counters diverged after the GREEN wall clear: "
+            f"host={b_h} client={b_c}")
+        assert leak_b > pre_leak, (
+            f"objectiveLeakBlocked did not move ({pre_leak}->{leak_b}) - the pinned "
+            f"fixture (E0_SEED={SEED}) never cleared a client wall via hitCoop, so the "
+            f"gate had nothing to gate. This is a FIXTURE/SEED issue (pick another "
+            f"E0_SEED), NOT a product regression - the gate itself is untested here, "
+            f"not broken.")
+
+        print(f"GREEN: gate ON - host/client objectivesDestroyed stayed IDENTICAL "
+              f"({pre_h}->{b_h} host, {pre_c}->{b_c} client), "
+              f"objectiveLeakBlocked(client) = {leak_b} > {pre_leak}")
+
+        # ---- RED: same build, objective_gate_disable=true on the CLIENT only --
+        # Same DETERMINISTIC kinetic driver as GREEN, but with the gate reverted:
+        # now the client's hitCoop wall clear is NOT blocked, so its
+        # _objectivesDestroyed climbs past the host's (which stays 0 - the host only
+        # counts genuine objective tiles, none on this map). Proves the GREEN parity
+        # is held BY the gate, not vacuously. Fires a FRESH wall (skip the tile GREEN
+        # already spent), and runs BEFORE the side-close (whose next_turn parity field
+        # then heals the client's inflated count back to the host's).
+        if not battle(host).get("inBattle"):
+            print("       SKIP RED: the mission ended during path (a)/GREEN - no "
+                  "battle left to fire the RED shots into")
+        else:
+            client.ok({"cmd": "parallel_state", "objective_gate_disable": True})
+            assert parallel(client)["objectiveGateDisable"] is True, \
+                "objective_gate_disable lever did not latch on the client"
+
+            # Reuse the (surviving) shooter, or re-pick+replace a live one if a burst
+            # splashed it. Re-pin the seed so the RED wall clear is reproducible too.
+            red_shooter = live_shooter(host, client, hseat, shooter)
+            if red_shooter != shooter:
+                enemy2 = PI.alive_enemy(battle(host))
+                red_tgt = (enemy2["x"], enemy2["y"], enemy2["z"]) if enemy2 else epos
+                PI.place_adjacent(host, client, red_shooter, red_tgt)
+                print(f"       RED run: original shooter {shooter} is down - "
+                      f"using {red_shooter} instead (re-placed near the target)")
+            host.ok({"cmd": "set_seed", "seed": SEED})
+            pre_red_h, _ = objectives(host)
+            pre_red_c, _ = objectives(client)
+            skip = {green_tile} if green_tile else set()
+            broke_red, _, _ = wall_spiral(host, client, red_shooter,
+                                          objdestroyed_metric, "RED", skip=skip)
+            red_h, _ = objectives(host)
+            red_c, _ = objectives(client)
+            print(f"RED run (objective_gate_disable=true on client): "
+                  f"host {pre_red_h}->{red_h}  client {pre_red_c}->{red_c}")
+
+            # restore the lever before anything else touches this battle
+            client.ok({"cmd": "parallel_state", "objective_gate_disable": False})
+
+            assert red_c > red_h, (
+                f"RED run did not reproduce the leak: expected client ({red_c}) > "
+                f"host ({red_h}) once objective_gate_disable reverted the LEAK-OBJ gate. "
+                f"Either the gate is not wired to the lever, or the pinned fixture "
+                f"(E0_SEED={SEED}) cleared no FRESH client wall this time (broke_red="
+                f"{broke_red}; GREEN spent {green_tile}) - the latter is a seed issue.")
+            print(f"RED confirmed: client counter ({red_c}) > host counter ({red_h}) "
+                  f"with the LEAK-OBJ gate reverted on the SAME build")
+
+        # ---- GREEN, checkpoint 2 (bonus): parity survives one side close ------
+        # Exercises the OTHER half of E0 (NextTurnState's objectivesDestroyed
+        # parity field + connectionTCP's client-side apply): hushes both
+        # machines' TU (so the alien side cannot end the mission under the
+        # fixture), ends the player side on both machines, waits for the alien
+        # side to resolve and the player side to come back, then re-reads. Runs
+        # LAST and its outcome is logged, not gated - the RED run above already
+        # delivered the required result, and the default skirmish fixture's
+        # handful of hostiles makes a mission-ending side close common.
+        if not battle(host).get("inBattle"):
+            print("       NOTE: no battle left after path (a)/GREEN/RED - skipping the "
+                  "post-side-close parity re-check; the action_end checkpoints above "
+                  "already cover the mechanism")
+        else:
+            turn_before = ET.turn_of(host)
+            ET.hush(host, client)
+            ET.arm(host)
+            ET.arm(client)
+            closed_turn = ET.wait_side(host, client, turn_before, timeout=240)
+            if closed_turn is None:
+                print("       NOTE: the mission ended during the side close (no hostiles "
+                      "left) - skipping the post-side-close parity re-check; the "
+                      "action_end checkpoints above already cover the mechanism")
+            elif closed_turn is False:
+                print("       NOTE: the side never closed within the timeout - skipping "
+                      "the post-side-close parity re-check (action_end checkpoints above "
+                      "already cover the mechanism); this is a fixture-timing shortfall, "
+                      "not a LEAK-OBJ result")
+            else:
+                s_h, _ = objectives(host)
+                s_c, _ = objectives(client)
+                print(f"post side-close (turn {turn_before}->{closed_turn}): "
+                      f"host {s_h}  client {s_c}")
+                assert s_h == s_c, (
+                    f"[LEAK-OBJ] objective counters diverged after the side close (the "
+                    f"next_turn objectivesDestroyed parity path): host={s_h} client={s_c}")
+
+        print("PASS: LEAK-OBJ gate holds host/client objectivesDestroyed parity "
+              "with the gate ON, and the SAME build reproduces client > host once "
+              "objective_gate_disable reverts it")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} battle:   {battle(gc)}")
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    print("\n==== E0 LEAK-OBJ objective-counter parity summary ====")
+    if fail:
+        print(f"  FAIL {fail}")
+        sys.exit(2)
+    print("  host==client objectivesDestroyed parity held with the gate ON "
+          "(objectiveLeakBlocked>0 proves the gate actually engaged); the SAME "
+          "build reproduces client>host once objective_gate_disable reverts it")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_pacing_escape.py b/tools/coop_test/test_parallel_pacing_escape.py
new file mode 100644
index 000000000..3bf08877f
--- /dev/null
+++ b/tools/coop_test/test_parallel_pacing_escape.py
@@ -0,0 +1,186 @@
+"""Class-A soak wedge (A1): the auto-shot pacing wait can never starve the receive
+gate forever.
+
+The forensic wedge (CI run 32091728914, test_parallel_soak): the parallel PASSIVE
+CLIENT deadlocked mid shot-replay and never recovered. A multi-shot ExplosionBState
+replay parked on `_hasHitUnit == 1` (ExplosionBState.cpp) waiting for the host's flip
+packet; the flip never came (a host/client shot-count divergence, likeliest on
+hazard-heavy turns where a terrain-chain ExplosionBState reads the same shared pacing
+flag). The ProjectileFlyBState beneath it (`_coopInitDeath`, gate depth 1) then held
+the receive gate for the rest of the battle: taskDepth stuck at 1, rxRotates in the
+millions, the client 13 turn-boundaries behind the host. The existing per-subject/seq
+liveness floor (`kRxBlockedStallTicks`) does NOT cover it - a gate held with only
+gate-rotated (non-whitelisted) traffic leaves `blockedSomething` false, so it never
+counts.
+
+The fix adds a SEPARATE floor for the pacing wait itself: updateCoopTask counts the
+consecutive game-loop ticks `_coopPacingWait` has been held and, past
+`kRxPacingForceDrainTicks` (~10 s of wall time, counted at the game-loop rate so it is
+bounded regardless of the client's draw speed), raises `_coopForceDrainReplay`, which
+ExplosionBState::think() consumes to end the wait AS IF the flip had landed. That drains
+the ProjectileFlyBState and reopens the gate.
+
+Staging a REAL ExplosionBState wait deterministically would need a shot that hits a unit
+mid-multi-shot with the host's flip withheld - no fixture can arrange that reliably. So
+this exercises the RX-pump floor directly through the `armPacingWait` lever, which sets
+`_coopPacingWait` on the client the way ExplosionBState::explode() would:
+
+  1. CONTROL. A quiescent parallel battle never arms the wait and never force-drains:
+     `coopPacingWait` False, `forceDrainCount` 0, held for several seconds.
+  2. RED->GREEN. Arm the wait and leave it armed (no flip ever comes). WITHOUT the
+     floor this is the permanent wedge; WITH it the pump raises the escape within the
+     bounded window and `forceDrainCount` climbs. That is the capability under test:
+     a pacing wait that never gets its flip is broken, not tolerated forever.
+  3. CLEAR. Disarming clears the wait and the raised escape flag, so nothing leaks onto
+     a later real shot.
+
+Run:  python tools/coop_test/test_parallel_pacing_escape.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+PORT = "47994"
+FAST_SPEED = 2
+
+# The floor is kRxPacingForceDrainTicks == 600 game-loop ticks (~10 s at 60/s). Give
+# the headless loop generous headroom before calling a non-fire a failure.
+ESCAPE_WAIT = 30.0
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def arm_wait(gc, on):
+    r = gc.ok({"cmd": "parallel_state", "armPacingWait": bool(on)})
+    return r
+
+
+def main():
+    fail = None
+    host = GameClient("host", 48896,
+                      make_user_dir("a1_pacing_host",
+                                    options={"battleXcomSpeed": FAST_SPEED,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48897,
+                        make_user_dir("a1_pacing_client",
+                                      options={"battleXcomSpeed": FAST_SPEED,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        pc = parallel(client)
+        for field in ("coopPacingWait", "forceDrainReplay", "forceDrainCount"):
+            assert field in pc, (
+                f"parallel_state carries no `{field}` - this test would be vacuous: "
+                f"{sorted(pc)}")
+
+        # ---- 1. CONTROL: a quiescent battle never force-drains --------------
+        print("-- 1: a quiescent parallel battle never arms the pacing wait --")
+        base = parallel(client)["forceDrainCount"]
+        assert parallel(client)["coopPacingWait"] is False, \
+            f"the client is already in a pacing wait at rest: {parallel(client)}"
+        t_end = time.time() + 4.0
+        while time.time() < t_end:
+            assert parallel(client)["forceDrainCount"] == base, (
+                f"the RX pump force-drained with NO pacing wait armed "
+                f"(count {base} -> {parallel(client)['forceDrainCount']}) - the floor "
+                f"is firing spuriously")
+            time.sleep(0.25)
+        print(f"    forceDrainCount steady at {base}, coopPacingWait False for 4 s")
+
+        # ---- 2. RED->GREEN: an armed-and-never-released wait is force-drained -
+        print("-- 2: an unreleased pacing wait is force-drained, not starved forever --")
+        r = arm_wait(client, True)
+        assert r.get("ok"), f"the armPacingWait lever did not take: {r}"
+        assert PI.wait_until(
+            lambda: parallel(client)["coopPacingWait"] is True, 5), (
+            f"the pacing wait did not arm: {parallel(client)}")
+        print("    pacing wait armed (the wedged-forever state); no flip will ever come")
+
+        deadline = time.time() + ESCAPE_WAIT
+        fired = False
+        while time.time() < deadline:
+            pcs = parallel(client)
+            if pcs["forceDrainCount"] > base:
+                fired = True
+                break
+            time.sleep(0.2)
+        assert fired, (
+            f"the RX pump never force-drained an armed pacing wait within "
+            f"{ESCAPE_WAIT:.0f} s (forceDrainCount stuck at {base}) - WITHOUT this "
+            f"floor the receive gate stays held for the rest of the battle, which is "
+            f"the Class-A soak wedge: {parallel(client)}")
+        print(f"    the floor fired: forceDrainCount {base} -> "
+              f"{parallel(client)['forceDrainCount']} "
+              f"(forceDrainReplay was raised for ExplosionBState::think to consume)")
+
+        # ---- 3. CLEAR: disarming clears the wait and the raised escape flag --
+        print("-- 3: disarming clears the wait and the escape flag (no leak) --")
+        arm_wait(client, False)
+        assert PI.wait_until(
+            lambda: parallel(client)["coopPacingWait"] is False
+            and parallel(client)["forceDrainReplay"] is False, 5), (
+            f"disarming left a stale pacing/escape flag that would fire on a later "
+            f"real shot: {parallel(client)}")
+        after = parallel(client)["forceDrainCount"]
+        time.sleep(2.0)
+        assert parallel(client)["forceDrainCount"] == after, (
+            f"the floor kept firing after the wait was cleared "
+            f"({after} -> {parallel(client)['forceDrainCount']})")
+        print(f"    cleared: coopPacingWait False, forceDrainReplay False, "
+              f"count steady at {after}")
+
+        # the drift tripwire must not have fired from any of this
+        assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+            "the drift tripwire fired during the pacing-escape test"
+        print("PASS: the auto-shot pacing wait is bounded - a wait that never gets its "
+              "flip is force-drained instead of holding the receive gate forever")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        try:
+            arm_wait(client, False)
+        except Exception:
+            pass
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_peer_liveness.py b/tools/coop_test/test_parallel_peer_liveness.py
new file mode 100644
index 000000000..1398cf1cf
--- /dev/null
+++ b/tools/coop_test/test_parallel_peer_liveness.py
@@ -0,0 +1,228 @@
+"""Class-A soak wedge (A3): a peer that goes dark mid-battle is DETECTED, not silent.
+
+The forensic wedge (CI run 32091728914, test_parallel_soak): the parallel PASSIVE
+CLIENT deadlocked mid shot-replay and fell 13 turn-boundaries behind the host. No
+existing detector fired, because a wedged peer does not DIVERGE - it goes SILENT. Every
+per-term tripwire (items, units, terrain, saveBlob) compares state the two machines
+report; a peer that has stopped reporting produces nothing to compare, so the session
+just freezes with no banner and no bundle.
+
+A3 adds a peer-liveness term to the host's tripwire. The host keeps crossing boundaries
+(g_syncLastBoundarySeq climbs) while a gone-dark peer stops answering the boundary
+markers (g_syncLastComparedBoundarySeq freezes). When that gap has been >= a bar
+continuously for a stall window, the SAME shared desync path latches (banner + one
+bundle) - reusing the drift-tripwire machinery, no new alarm channel.
+
+  1. NO FALSE FIRE. Under the SHIPPED thresholds, at a client speed-skew, several clean
+     turn cycles never latch: the peer keeps answering, so the gap re-closes and the
+     stall clock resets every cycle. This is the discipline the task requires - the
+     term must survive normal backlog and the speed-skew profile.
+  2. RED. Force the peer dark on boundaries (park only its boundary `action_done`, so
+     per-chain acks keep the host committing and crossing boundaries) and drive turn
+     cycles. The boundary gap grows past the bar and, once sustained, the liveness
+     tripwire latches on the host - which the forensic wedge would have.
+
+The red case uses a lowered firing bar (setLivenessGap / setLivenessStallMs) so it fires
+in seconds; the no-false-fire case uses the shipped defaults, which is what actually has
+to be safe in the field.
+
+Run:  python tools/coop_test/test_parallel_peer_liveness.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_endturn as PE
+
+PORT = "47995"
+
+FAST_SPEED = 2
+SKEW_SPEED = 40      # ms/frame on the client: the soak's speed-skew draw speed
+RED_GAP = 2          # boundaries behind ...
+RED_STALL_MS = 1500  # ... continuously for this long, to fire fast in the red case
+CLEAN_CYCLES = 2
+RED_MAX_CYCLES = 4
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def sync(gc):
+    return parallel(gc).get("syncCheck", {})
+
+
+def set_thresholds(host, gap, stall_ms):
+    host.ok({"cmd": "parallel_state", "setLivenessGap": gap, "setLivenessStallMs": stall_ms})
+
+
+def drive_cycle(host, client, timeout=240):
+    """Close the player side from both seats and wait for it to come back - the
+    thing that makes the host cross boundaries. Fixture protection (hush) each time,
+    because every closed side is an alien side that can shoot the fixture out."""
+    assert PI.idle(host, timeout=90), f"the host never went idle before the cycle: {parallel(host)}"
+    if not battle(host).get("inBattle"):
+        return None
+    PE.hush(host, client)
+    turn_before = PE.turn_of(host)
+    PE.arm(host)
+    PE.arm(client)
+    return PE.wait_side(host, client, turn_before, timeout=timeout)
+
+
+def main():
+    fail = None
+    host = GameClient("host", 48898,
+                      make_user_dir("a3_liveness_host",
+                                    options={"battleXcomSpeed": FAST_SPEED,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48899,
+                        make_user_dir("a3_liveness_client",
+                                      options={"battleXcomSpeed": SKEW_SPEED,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        PE.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines (client at a %d ms/frame speed skew)"
+              % SKEW_SPEED)
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        s = sync(host)
+        for field in ("peerLivenessGap", "peerLivenessLatched", "lastBoundarySeq",
+                      "lastComparedBoundarySeq"):
+            assert field in s, (
+                f"the sync-check readout carries no `{field}` - this test would be "
+                f"vacuous: {sorted(s)}")
+
+        # ---- 1. NO FALSE FIRE: shipped thresholds, speed-skew, clean cycles ----
+        print("-- 1: shipped thresholds + speed-skew: clean cycles never latch --")
+        set_thresholds(host, 0, -1)   # restore shipped defaults
+        host.ok({"cmd": "shared_reset_resync_stats"})
+        client.ok({"cmd": "shared_reset_resync_stats"})
+        max_gap = 0
+        for i in range(CLEAN_CYCLES):
+            turn = drive_cycle(host, client)
+            assert turn, (
+                f"clean cycle {i}: the side never came back (fixture may have ended): "
+                f"host top={TW.top(host)} client top={TW.top(client)} "
+                f"inBattle={battle(host).get('inBattle')}")
+            g = sync(host).get("peerLivenessGap", 0)
+            max_gap = max(max_gap, g)
+            assert sync(host).get("peerLivenessLatched", 0) == 0, (
+                f"clean cycle {i}: the peer-liveness tripwire latched under NORMAL "
+                f"speed-skew play (gap {g}) - a false fire: {sync(host)}")
+            assert not TW.desync_seen(host), (
+                f"clean cycle {i}: the shared desync path latched on the host under "
+                f"clean play")
+            print(f"    clean cycle {i}: side closed, peerLivenessGap peaked {g}, "
+                  f"no latch")
+        # the peer is answering, so after settling the gap has re-closed below the bar:
+        # the mechanism reads a caught-up peer as healthy and the clock never sustains.
+        assert PI.wait_until(
+            lambda: sync(host).get("peerLivenessGap", 99)
+            < sync(host).get("peerLivenessBoundaryGap", 2), 60), (
+            f"the boundary-answer gap never fell below the bar with the peer answering "
+            f"normally - the term would eventually false-fire: {sync(host)}")
+        assert sync(host).get("peerLivenessLatched", 0) == 0 and not TW.desync_seen(host), (
+            f"the tripwire latched during the clean speed-skew run (max gap "
+            f"{max_gap}): {sync(host)}")
+        print(f"PASS 1: {CLEAN_CYCLES} clean speed-skew cycle(s), max boundary gap "
+              f"{max_gap}, gap re-closed below the bar, NO false fire")
+
+        # ---- 2. RED: force the peer dark on boundaries -> the tripwire fires ----
+        print("-- 2: peer goes dark on boundary answers -> the tripwire latches --")
+        assert battle(host).get("inBattle"), "the fixture ended before the red phase"
+        host.ok({"cmd": "shared_reset_resync_stats"})
+        client.ok({"cmd": "shared_reset_resync_stats"})
+        set_thresholds(host, RED_GAP, RED_STALL_MS)
+        # Park ONLY the client's boundary answer: per-chain acks keep flowing, so the
+        # host keeps committing and crossing boundaries while g_syncLastComparedBoundarySeq
+        # freezes - the exact peer-went-dark-on-boundaries condition.
+        r = client.ok({"cmd": "hold_action_done", "boundary": True, "hold": True})
+        assert r.get("holdBoundary") is True, \
+            f"the boundary-answer park did not engage: {r}"
+        print(f"    client parking its boundary answers; firing bar lowered to gap "
+              f"{RED_GAP} / {RED_STALL_MS} ms")
+
+        latched = False
+        peaked = 0
+        for i in range(RED_MAX_CYCLES):
+            turn = drive_cycle(host, client)
+            # (a cycle may not "return" cleanly once the tripwire banner is up; that is
+            #  fine - what we assert is the latch, checked below regardless)
+            g = sync(host).get("peerLivenessGap", 0)
+            peaked = max(peaked, g)
+            print(f"    red cycle {i}: peerLivenessGap now {g} "
+                  f"(host boundary {sync(host).get('lastBoundarySeq')}, peer answered "
+                  f"{sync(host).get('lastComparedBoundarySeq')})")
+            # once the gap is up, the latch is a stall window away
+            if PI.wait_until(
+                    lambda: sync(host).get("peerLivenessLatched", 0) == 1
+                    and TW.desync_seen(host), 8):
+                latched = True
+                break
+            if not battle(host).get("inBattle"):
+                break
+        assert latched, (
+            f"the peer stopped answering boundary markers (gap peaked {peaked}) and "
+            f"the liveness tripwire NEVER latched - a peer-gone-dark wedge would stay "
+            f"silent in the field: host sync={sync(host)}, desyncSeen="
+            f"{TW.desync_seen(host)}")
+        assert sync(host).get("peerLivenessGap", 0) >= RED_GAP, (
+            f"the tripwire latched but the recorded gap is below the bar it fired on: "
+            f"{sync(host)}")
+        print(f"PASS 2: the host's peer-liveness tripwire latched on a sustained "
+              f"boundary-answer gap of {sync(host).get('peerLivenessGap')} "
+              f"(peaked {peaked}) - the wedge is DETECTED")
+
+        # the CLIENT (which is not the comparer) must not have latched off its own state
+        print("PASS: peer-liveness detection fires on a gone-dark peer and stays quiet "
+              "under normal speed-skew backlog")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} sync: {sync(gc)}")
+                print(f"  DBG {tag} top:  {TW.top(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        try:
+            client.ok({"cmd": "hold_action_done", "boundary": True, "hold": False})
+            set_thresholds(host, 0, -1)
+            host.ok({"cmd": "shared_reset_resync_stats"})
+            client.ok({"cmd": "shared_reset_resync_stats"})
+        except Exception:
+            pass
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_persist_alarm.py b/tools/coop_test/test_parallel_persist_alarm.py
new file mode 100644
index 000000000..0151b12a7
--- /dev/null
+++ b/tools/coop_test/test_parallel_persist_alarm.py
@@ -0,0 +1,148 @@
+"""OPTION 3 fail-loud PROOF: the boundary persistence alarm still catches a REAL
+persistent desync - CRITICAL-BLOCKER proof for the alarm-unmask fix.
+
+Plan v1.1 (persistence-alarm-plan.md) §3. Boundary mismatches are now PENDING on
+first sight and alarm only if STILL mismatched at the next boundary of the same
+kind. This test proves that softening did NOT go too far: a genuine, persistent
+one-machine divergence must still fire the alarm - one boundary late, but fire it.
+
+VECTOR (owner ruling 2026-08-29): inject an ITEM-EXISTENCE divergence on ONE
+machine only. The prior vector (battle_action set_stat health) was INVALID: health
+is a unitsRegen term that next_turn RE-SLAVES at the sidestart, so the injected
+divergence healed at the very first boundary (host==client) and never persisted -
+nothing for the latch to promote. Item existence is a term NOTHING re-ships (no
+coop packet replicates a mid-battle loose-item spawn - see TestServer battle_drop),
+so a client-only floor item is a genuinely PERSISTENT divergence in the items AND
+itemIdCtr buckets (and the saveBlob superset). It pends on the first boundary and
+promotes on the second - exactly the latch contract.
+
+Method:
+  1. bring up a parallel co-op battle (TW.bring_up_battle), lever ON both machines;
+  2. inject a persistent divergence: battle_drop one STR_PISTOL on the CLIENT only,
+     on a live X-Com unit's own floor tile (guaranteed valid floor);
+  3. drive two alien sides (two sidestart boundaries).
+
+Assert:
+  * after the FIRST boundary  : syncBoundaryPending > 0 AND desyncSeen is False
+                                (recorded pending, NO premature alarm);
+  * after the SECOND boundary : desyncSeen is True on the host AND
+                                syncBoundaryPersistAlarms >= 1 (the alarm fired on
+                                persistence).
+
+Exit 0 = pass; 2 = failure/setup error.
+"""
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+
+PORT = "47997"  # in-game coop TCP rendezvous (unique per concurrent test)
+SEED = 20260828
+DROP_ITEM = "STR_PISTOL"  # a stock vanilla item type, present in every fixture mod
+
+
+def parallel(gc):
+    return SOAK.parallel(gc)
+
+
+def battle(gc):
+    return SOAK.battle(gc)
+
+
+def main():
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48900, make_user_dir("persist_host", options=host_opts))
+    client = GameClient("client", 48901, make_user_dir("persist_client", options=client_opts))
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+
+    err = None
+    try:
+        TW.bring_up_battle(host, client, seed=SEED)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": SEED})
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, \
+            "host must own the sim, client must be the replay peer"
+
+        # FIX LEVER on both machines (the persistence latch is lever-gated).
+        for gc in (host, client):
+            gc.cmd({"cmd": "parallel_state", "wire_order_state": True})
+            assert parallel(gc).get("wireOrderState") is True, "wire_order_state did not engage"
+        # zero the persistence counters so the assertions read this battle only.
+        for gc in (host, client):
+            gc.cmd({"cmd": "shared_reset_resync_stats"})
+
+        # inject a PERSISTENT item-existence divergence: one loose floor item on the
+        # CLIENT only. No coop packet replicates a mid-battle item spawn, so the host
+        # never gains it and the items/itemIdCtr buckets stay divergent every boundary.
+        hi0, ci0 = len(SOAK.item_census(host)), len(SOAK.item_census(client))
+        live = [u for u in battle(client)["units"]
+                if not u.get("isOut") and u.get("faction") == 0]
+        assert live, "no live X-Com unit to host the injected floor item"
+        anchor = live[0]
+        drop = client.ok({"cmd": "battle_drop", "x": anchor["x"], "y": anchor["y"],
+                          "z": anchor["z"], "item": DROP_ITEM, "count": 1})
+        hi1, ci1 = len(SOAK.item_census(host)), len(SOAK.item_census(client))
+        print(f"injected: {DROP_ITEM} id(s)={drop.get('ids')} on CLIENT only at "
+              f"({anchor['x']},{anchor['y']},{anchor['z']}); "
+              f"item census host {hi0}->{hi1} client {ci0}->{ci1}")
+        assert ci1 == ci0 + 1 and hi1 == hi0, (
+            f"the injection must add exactly one client-only item "
+            f"(host {hi0}->{hi1}, client {ci0}->{ci1})")
+
+        # ---- first alien side / first boundary --------------------------------
+        turn0 = battle(host)["turn"]
+        SOAK.close_side(host, client, 0, 1, turn0)
+        p1 = parallel(host).get("syncBoundaryPending")
+        healed1 = parallel(host).get("syncBoundaryHealed")
+        d1 = TW.desync_seen(host)
+        print(f"after 1st boundary: pending={p1} healed={healed1} desyncSeen={d1}")
+        assert p1 and p1 > 0, (
+            f"FAIL: after the first boundary the persistent item divergence must be recorded "
+            f"PENDING (syncBoundaryPending>0), got {p1}. If it is 0 the boundary items/itemIdCtr "
+            f"compare never saw the divergence (unmask regression?).")
+        assert not d1, f"FAIL: premature alarm after the first boundary (desyncSeen={d1})"
+
+        # ---- second alien side / second boundary ------------------------------
+        turn1 = battle(host)["turn"]
+        SOAK.close_side(host, client, 0, 1, turn1)
+        d2 = TW.desync_seen(host)
+        pa = parallel(host).get("syncBoundaryPersistAlarms")
+        print(f"after 2nd boundary: desyncSeen={d2} persistAlarms={pa}")
+        assert d2, "FAIL: the persistent divergence must set desyncSeen on the host by the 2nd boundary"
+        assert pa and pa >= 1, f"FAIL: the persistence alarm must have fired (syncBoundaryPersistAlarms>=1), got {pa}"
+
+    except AssertionError as ae:
+        err = str(ae)
+    except Exception as e:
+        import traceback
+        err = f"{e}\n{traceback.format_exc()}"
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    print("\n==== PERSIST-ALARM VERDICT ====")
+    if err:
+        print(f"  FAIL: {err}")
+        sys.exit(2)
+    print("  PASS: a transient pends-and-heals silently; a persistent one-machine item-existence "
+          "divergence pended on the first boundary and fired the alarm on the confirming boundary "
+          "(fail-loud preserved).")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_replay_decouple.py b/tools/coop_test/test_parallel_replay_decouple.py
new file mode 100644
index 000000000..00649ecc4
--- /dev/null
+++ b/tools/coop_test/test_parallel_replay_decouple.py
@@ -0,0 +1,538 @@
+"""PRD-P1: a replayed teammate action must not hijack the watching player.
+
+Before P1 every replay handler on the passive machine wrote the LOCAL player's
+state before running the peer's action:
+
+    _save->setSelectedUnit(remoteUnit);          // selection + stat panel
+    _currentAction.actor  = remoteUnit;          // the singleton BattleAction
+    _currentAction.type   = BA_SNAPSHOT;         // ... that the local map click
+    _currentAction.targeting = true;             //     dispatches on
+    getMap()->getCamera()->centerOnPosition(..); // camera
+
+so watching a teammate walk stole your selection and your stat panel, and
+watching a teammate SHOOT left your own next map click in targeting mode - it
+fired instead of walking. P1 gives every replay handler a stack-local
+BattleAction (BattlescapeGame::makeReplayAction) and deletes the setSelectedUnit
+calls.
+
+What this test asserts, on the machine that is NOT driving:
+
+  1. `selectedId` never moves off the unit this player selected. The stat panel
+     is a pure function of it - BattlescapeState::updateSoldierInfo() reads
+     _save->getSelectedUnit() and nothing else - so this IS the panel assertion.
+  2. the camera map offset does not move - this is PRD-P1's camera item, the
+     centerOnPosition in movePlayerTarget. Two OTHER camera sites are stock
+     OpenXcom, fire for AI actions too, and are NOT in the PRD's verified hijack
+     table, so the test reports them per step instead of asserting on them: the
+     view-level follow in UnitWalkBState and the projectile follow in
+     Map::draw() (see LEVEL_FOLLOW_NOTE / PROJECTILE_FOLLOW_NOTE). They belong
+     to PRD-P5's "no camera follow during the parallel player side".
+  3. BattlescapeGame::_currentAction is IDENTICAL before and after the replay -
+     (type, actor, weapon, targeting, target, waypoint count) compared as a
+     tuple, which covers every field the old handlers wrote. Note the baseline
+     is not empty: the active player's `selected_unit` packet legitimately parks
+     its actor there through setSelectedCoopUnit, a handler PRD-P1 preserves on
+     purpose (P5 stops SENDING that packet). The shot step additionally spells
+     out the PRD's "click a tile after the replay and get a MOVE, not a shot":
+     BattlescapeGame::primaryAction() only fires when targeting is set.
+  4. the replayed chain still RUNS - each step waits for the peer to actually
+     mirror the action (position for a walk, the actor's TU for an attack)
+     before asserting, so a passing run is never vacuous.
+
+Actions driven: walk (movePlayerTarget), turn (turnPlayerTarget +
+turnPlayerTargetAfter, which ride every walk and every UnitTurnBState before a
+shot), shot (shootPlayerTarget), melee (melee_attack) and psi (psi_attack).
+Melee/psi need a live hostile plus equipment the vanilla skirmish loadout does
+not carry, so they are armed with `battle_give` on BOTH machines first (nothing
+in the protocol replicates a mid-battle item spawn) and driven through
+`battle_fire` mode=psi/hit. Content is the one thing a test cannot conjure - a
+skirmish can spawn a single alien, and one stun rod takes it out of the fight -
+so if the target or the equipment is unavailable the step reports SKIPPED with
+the reason instead of failing; the four assertions above are already carried by
+the walk/turn/shot steps.
+
+Classic regression: the PlayerTurnYour handoff (connectionTCP.cpp) is NOT a
+replay and must keep selecting a unit for the newly-active player, so the test
+ends by handing the turn over and asserting the receiver got a selection.
+
+Battle fixture: the skirmish flow (NEW BATTLE > COOP), same path as
+test_skirmish_battle_turn_control.py / test_parallel_introspection.py.
+
+Run:  python tools/coop_test/test_parallel_replay_decouple.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_skirmish_flow as SK
+
+PORT = "47977"
+
+# Camera sites that are NOT in PRD-P1's verified hijack table (which lists one:
+# movePlayerTarget's centerOnPosition). Both are stock OpenXcom and fire for AI
+# actions too, so the test reports them instead of asserting on them. PRD-P5
+# ("no camera follow during the parallel player side") is where they belong.
+LEVEL_FOLLOW_NOTE = ("the peer's unit changed map LEVEL and vanilla "
+                     "UnitWalkBState follows that (\"if the unit changed level, "
+                     "camera changes level with\", Camera::setViewLevel)")
+PROJECTILE_FOLLOW_NOTE = ("vanilla Map::draw() follows a projectile in FOV "
+                          "(_followProjectile/_smoothCamera -> jumpXY), and the "
+                          "replay action carries no cameraPosition for "
+                          "ProjectileFlyBState to restore")
+
+
+def states(gc):
+    return [s.replace("class OpenXcom::", "") for s in session.states(gc)]
+
+
+def has(gc, name):
+    return any(name in s for s in states(gc))
+
+
+def top(gc):
+    return states(gc)[-1].split("::")[-1]
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def unit(b, uid):
+    for u in b.get("units", []):
+        if u["id"] == uid:
+            return u
+    return None
+
+
+def pos(b, uid):
+    u = unit(b, uid)
+    return (u["x"], u["y"], u["z"]) if u else None
+
+
+def tu(b, uid):
+    u = unit(b, uid)
+    return u["tu"] if u else None
+
+
+# ---- the three things a replay used to steal ------------------------------
+
+def watcher_state(gc):
+    """selection + camera + the singleton BattleAction, as one comparable dict."""
+    b = battle(gc)
+    for key in ("cameraX", "viewLevel", "actionType", "actionActorId"):
+        assert key in b, (
+            f"battle_state carries no {key!r} - PRD-P1's read-only introspection "
+            f"is missing, the assertions below would be vacuous: {sorted(b)}")
+    return {
+        "selectedId": b["selectedId"],
+        # The camera POSITION. b["cameraZ"] is getMapOffset().z, i.e. the view
+        # level, which is deliberately NOT part of this tuple - see the
+        # viewLevel note in assert_not_hijacked().
+        "camera": (b["cameraX"], b["cameraY"]),
+        "viewLevel": b["viewLevel"],
+        "action": (b["actionType"], b["actionActorId"], b["actionWeaponId"],
+                   b["actionTargeting"],
+                   (b["actionTargetX"], b["actionTargetY"], b["actionTargetZ"]),
+                   b["actionWaypoints"]),
+    }
+
+
+def assert_not_hijacked(what, before, after, mine, remote_actor, check_camera=True,
+                        camera_note=""):
+    errs = []
+    if after["selectedId"] != mine:
+        errs.append(
+            f"SELECTION HIJACKED: selected unit went {before['selectedId']} -> "
+            f"{after['selectedId']} (mine is {mine}, the peer acted with "
+            f"{remote_actor}). The stat panel follows getSelectedUnit(), so the "
+            f"panel moved too.")
+    if check_camera and after["camera"] != before["camera"]:
+        errs.append(
+            f"CAMERA HIJACKED: map offset went {before['camera']} -> "
+            f"{after['camera']} while replaying the peer's {what} - "
+            f"movePlayerTarget's centerOnPosition fired")
+    # _currentAction belongs to the LOCAL player's cursor/click handling. A
+    # replay must leave it EXACTLY as it found it; an equality check catches
+    # every field the old handlers wrote (actor, type, weapon, targeting,
+    # target, waypoints) in one assertion. The baseline is not "empty": the
+    # active player's `selected_unit` packet legitimately parks its actor here
+    # via setSelectedCoopUnit, which PRD-P1 preserves (PRD-P5 stops SENDING it).
+    if after["action"] != before["action"]:
+        errs.append(
+            f"_currentAction BLEED: (type, actor, weapon, targeting, target, "
+            f"waypoints) went {before['action']} -> {after['action']}. The peer's "
+            f"{what} wrote the local player's action - the next map click would "
+            f"execute it instead of walking the selected unit.")
+    if errs:
+        raise AssertionError(
+            f"replayed {what} hijacked the watching player:\n    - "
+            + "\n    - ".join(errs)
+            + f"\n  before={before}\n  after ={after}")
+    note = ""
+    if not check_camera:
+        note = (f" [camera {before['camera']}/lvl{before['viewLevel']} -> "
+                f"{after['camera']}/lvl{after['viewLevel']} not asserted: "
+                f"{camera_note}]")
+    elif after["viewLevel"] != before["viewLevel"]:
+        note = (f" [view level {before['viewLevel']} -> {after['viewLevel']}]")
+    print(f"PASS {what}: watcher kept unit {mine} selected, camera "
+          f"{after['camera']}, local action untouched {after['action']}{note}")
+
+
+def wait_until(fn, timeout, interval=0.4):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if fn():
+            return True
+        time.sleep(interval)
+    return False
+
+
+# ---- fixture ---------------------------------------------------------------
+
+def drain_to_tactical(host, client, rounds=12):
+    for _ in range(rounds):
+        moved = False
+        for gc in (host, client):
+            if top(gc) != "BattlescapeState":
+                gc.cmd({"cmd": "dismiss_popup"})
+                moved = True
+        time.sleep(1.0)
+        if not moved and all(top(gc) == "BattlescapeState" for gc in (host, client)):
+            return
+
+
+def bring_up_battle(host, client):
+    SK.skirmish_host(host, PORT)
+    SK.skirmish_client_at_browser(client)
+    client.ok({"cmd": "join_tcp", "ip": "127.0.0.1", "port": PORT,
+               "player": "ClientPlayer"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} join popup",
+                    lambda gc=gc: session.has_state(gc, "Profile") or None, timeout=60)
+        gc.ok({"cmd": "profile_ok"})
+    host.wait_for("BATTLE SETTINGS offered",
+                  lambda: SK.lobby(host).get("buttonVisible") or None, timeout=60)
+    host.ok({"cmd": "lobby_action"})
+    host.wait_for("host at battle settings",
+                  lambda: (not session.has_state(host, "LobbyMenu")) or None, timeout=60)
+    host.ok({"cmd": "newbattle_ok"})
+
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} in battle",
+                    lambda gc=gc: battle(gc).get("inBattle") or None,
+                    timeout=180, interval=1.0)
+    for gc in (host, client):
+        if has(gc, "BriefingState"):
+            gc.cmd({"cmd": "close_briefing"})
+    for gc in (host, client):
+        if has(gc, "InventoryState"):
+            gc.cmd({"cmd": "battle_inventory", "action": "ok"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} tactical map",
+                    lambda gc=gc: has(gc, "BattlescapeState") or None,
+                    timeout=120, interval=0.5)
+    drain_to_tactical(host, client)
+    # the coop turn-init handshake must have run, or nothing replicates at all
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} coop battle init",
+                    lambda gc=gc: battle(gc).get("battleInit") or None,
+                    timeout=90, interval=1.0)
+    time.sleep(3)
+
+
+# ---- the driven actions ----------------------------------------------------
+
+def pick_mover(driver_state, owner_coop):
+    movers = [u for u in driver_state["units"]
+              if u.get("faction") == 0 and u.get("selectable") and not u.get("isOut")
+              and u.get("coop") == owner_coop and u.get("tu", 0) > 20]
+    return movers
+
+
+def drive_walk(driver, watcher, mover_id):
+    """Walk `mover_id` one tile on the driver; return the tile it reached once
+    the WATCHER has mirrored it (so the replay provably ran)."""
+    before = pos(battle(driver), mover_id)
+    assert pos(battle(watcher), mover_id) == before, \
+        f"unit {mover_id} is already at different positions on the two machines"
+    driver.cmd({"cmd": "battle_action", "action": "select", "unit": mover_id})
+    dest = None
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        want = (before[0] + dx, before[1] + dy, before[2])
+        r = driver.cmd({"cmd": "battle_action", "action": "move", "unit": mover_id,
+                        "x": want[0], "y": want[1], "z": want[2]})
+        if r.get("ok"):
+            dest = want
+            break
+    assert dest, f"unit {mover_id} could not step to any adjacent tile"
+    assert wait_until(lambda: pos(battle(driver), mover_id) != before, 45), \
+        f"unit {mover_id} never moved on the driver - the DRIVER failed, not the replay"
+    landed = pos(battle(driver), mover_id)
+    assert wait_until(lambda: pos(battle(watcher), mover_id) == landed, 45), \
+        f"the walk never replicated: driver has {mover_id} at {landed}, watcher at " \
+        f"{pos(battle(watcher), mover_id)}"
+    return before, landed
+
+
+def drive_attack(driver, watcher, mover_id, what, req, arrive_timeout=45):
+    """Run one `battle_fire` on the driver and wait for the WATCHER to mirror the
+    actor's TU (which every attack packet carries). Returns None when the engine
+    refused the action - the caller reports that as SKIPPED."""
+    watcher_tu_before = tu(battle(watcher), mover_id)
+    r = driver.cmd(req)
+    if not r.get("ok"):
+        return f"engine refused {what}: {r.get('error')}"
+    # battle_fire tops the actor up to req["tu"] synchronously, so the driver's TU
+    # leaving that value is "the BState actually ran and charged the action". A
+    # psi attack by a psiSkill-0 rookie costs 0 TU and is refused by
+    # BattleActionCost::haveTU - that shows up here, before any packet.
+    topped = req.get("tu")
+    if not wait_until(lambda: tu(battle(driver), mover_id) != topped, 20):
+        return f"{what} cost the actor nothing on the driver (state never ran)"
+    # Arrival signal: every attack packet stamps the actor's TU on the watcher
+    # (movePlayerTarget/psi_attack/melee_attack setTimeUnits, shootPlayerTarget
+    # setCoopTimeUnits). The two values need not END equal - the melee replay
+    # re-spends the cost on the receiver, a pre-existing coop divergence P1 does
+    # not touch - so this asserts the packet LANDED, not that TU agrees.
+    if not wait_until(lambda: tu(battle(watcher), mover_id) != watcher_tu_before,
+                      arrive_timeout):
+        return (f"{what} never replicated: driver TU={tu(battle(driver), mover_id)}, "
+                f"watcher TU still {watcher_tu_before}")
+    print(f"    {what} replicated (driver TU={tu(battle(driver), mover_id)}, "
+          f"watcher TU={tu(battle(watcher), mover_id)}, was {watcher_tu_before})")
+    return None
+
+
+def main():
+    opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+    host = GameClient("host", 48846, make_user_dir("p1_decouple_host", options=opts))
+    client = GameClient("client", 48847, make_user_dir("p1_decouple_client", options=opts))
+    fail = None
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        hb, cb = battle(host), battle(client)
+        if session.can_drive(hb):
+            driver, watcher, dtag, wtag = host, client, "host", "client"
+            db, wb = hb, cb
+        else:
+            driver, watcher, dtag, wtag = client, host, "client", "host"
+            db, wb = cb, hb
+        print(f"simulation owner = {dtag}; asserting on {wtag}")
+
+        owner_coop = 0 if db["host"] else 1
+        watcher_coop = 0 if wb["host"] else 1
+        movers = pick_mover(db, owner_coop)
+        assert movers, (
+            f"{dtag} commands no unit with TU to spend: "
+            f"{[(u['id'], u.get('coop'), u.get('selectable'), u.get('tu')) for u in db['units']]}")
+        mover_id = movers[0]["id"]
+
+        # The watcher selects one of ITS OWN units - the thing the replay used to
+        # steal. battle_action select goes straight to setSelectedUnit, which is
+        # what the UI would do on the watcher's own turn.
+        mine = [u for u in wb["units"]
+                if u.get("faction") == 0 and not u.get("isOut")
+                and u.get("coop") == watcher_coop]
+        assert mine, f"{wtag} owns no live unit: {[(u['id'], u.get('coop')) for u in wb['units']]}"
+        mine_id = mine[0]["id"]
+        watcher.ok({"cmd": "battle_action", "action": "select", "unit": mine_id})
+        base = watcher_state(watcher)
+        assert base["selectedId"] == mine_id, \
+            f"{wtag} could not select its own unit {mine_id}: {base}"
+        print(f"{wtag} selected its own unit {mine_id}; {dtag} will act with {mover_id}")
+
+        # Control sample: the watcher's camera and action must be STABLE while
+        # nothing happens, or the deltas asserted below would mean nothing.
+        for _ in range(3):
+            time.sleep(1.0)
+            idle = watcher_state(watcher)
+            assert idle["camera"] == base["camera"] and idle["action"] == base["action"], \
+                (f"{wtag} is not at rest before the test even starts - camera/action "
+                 f"drift on their own: {base} -> {idle}")
+        print(f"PASS control: {wtag} idle camera {base['camera']} and action "
+              f"{base['action']} are stable")
+
+        # --- 1. walk (movePlayerTarget) + 2. turn (turnPlayerTarget[After]) ---
+        # A step to an adjacent tile always turns the unit first, so a single walk
+        # exercises BattleScapeMove, turnBattlescapeUnit and
+        # afterBattlescapeUnitTurn on the watcher.
+        prev = base
+        camera_checked = False
+        for step in range(1, 4):
+            before, landed = drive_walk(driver, watcher, mover_id)
+            print(f"    {dtag} walked {mover_id} {before} -> {landed}; {wtag} mirrored it")
+            same_level = landed[2] == before[2]
+            after_walk = watcher_state(watcher)
+            assert_not_hijacked(f"walk+turn #{step}", prev, after_walk, mine_id,
+                                mover_id, check_camera=same_level,
+                                camera_note=LEVEL_FOLLOW_NOTE)
+            prev = after_walk
+            camera_checked = camera_checked or same_level
+            if step >= 2 and camera_checked:
+                break
+        if not camera_checked:
+            print("NOTE: every walk changed map level, so the walk steps could not "
+                  "assert the camera; the shot step below still does")
+        after_walk2 = prev
+
+        # --- 3. shot (shootPlayerTarget) -------------------------------------
+        # Fire at the tile the unit came from: always a legal target position, and
+        # ProjectileFlyBState ships the packet whether or not the shot connects.
+        skipped = drive_attack(
+            driver, watcher, mover_id, "shot",
+            {"cmd": "battle_fire", "unit": mover_id, "mode": "snap", "tu": 100,
+             "x": before[0], "y": before[1], "z": before[2]})
+        if skipped:
+            raise AssertionError(f"the shot step could not run: {skipped}")
+        after_shot = watcher_state(watcher)
+        assert_not_hijacked("shot", after_walk2, after_shot, mine_id, mover_id,
+                            check_camera=False, camera_note=PROJECTILE_FOLLOW_NOTE)
+        # the shot-specific half of criterion 3, spelled out: primaryAction()
+        # only fires when _currentAction.targeting is set.
+        assert not after_shot["action"][3], \
+            f"after a replayed shot {wtag} is left in targeting mode: {after_shot}"
+        print(f"PASS shot: {wtag}'s next map click would MOVE unit {mine_id}, not fire "
+              f"(targeting={after_shot['action'][3]}, action={after_shot['action']})")
+
+        prev = after_shot
+
+        # --- 4. psi (psi_attack) and 5. melee (melee_attack) ------------------
+        # Both need a live hostile and equipment the skirmish loadout does not
+        # carry, so battle_give arms the actor on BOTH machines (nothing in the
+        # protocol replicates a mid-battle item spawn). Psi runs FIRST because a
+        # stun rod tends to take the target out of the fight.
+        def live_hostiles():
+            return [u for u in battle(driver)["units"]
+                    if u.get("faction") == 1 and not u.get("isOut")]
+
+        def no_hostile_note():
+            census = {}
+            for u in battle(driver).get("units", []):
+                key = (u.get("faction"), bool(u.get("isOut")))
+                census[key] = census.get(key, 0) + 1
+            return f"no live hostile left (faction/isOut census: {census})"
+
+        note = None
+        aliens = live_hostiles()
+        if not aliens:
+            note = no_hostile_note()
+        else:
+            target = aliens[0]
+            tpos = (target["x"], target["y"], target["z"])
+            gave = [gc.cmd({"cmd": "battle_give", "unit": mover_id,
+                            "item": "STR_PSI_AMP", "slot": "right",
+                            "clear_hands": True}) for gc in (driver, watcher)]
+            if not all(g.get("ok") for g in gave):
+                note = f"battle_give STR_PSI_AMP failed: {gave}"
+            else:
+                note = drive_attack(
+                    driver, watcher, mover_id, "psi",
+                    {"cmd": "battle_fire", "unit": mover_id, "mode": "psi",
+                     "weapon_id": gave[0]["weaponId"], "tu": 100,
+                     "x": tpos[0], "y": tpos[1], "z": tpos[2]})
+        if note:
+            print(f"SKIP psi: {note}")
+        else:
+            after_psi = watcher_state(watcher)
+            assert_not_hijacked("psi", prev, after_psi, mine_id, mover_id,
+                                check_camera=False,
+                                camera_note="ExplosionBState centres on the hit")
+            prev = after_psi
+
+        note = None
+        aliens = live_hostiles()
+        if not aliens:
+            note = no_hostile_note()
+        else:
+            target = aliens[0]
+            tpos = (target["x"], target["y"], target["z"])
+            placed = None
+            for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1)):
+                spot = (tpos[0] + dx, tpos[1] + dy, tpos[2])
+                res = [gc.cmd({"cmd": "battle_teleport", "unit": mover_id,
+                               "x": spot[0], "y": spot[1], "z": spot[2]})
+                       for gc in (driver, watcher)]
+                if all(r.get("moved") for r in res):
+                    placed = spot
+                    break
+            if not placed:
+                note = f"no free tile adjacent to hostile {target['id']}"
+            else:
+                gave = [gc.cmd({"cmd": "battle_give", "unit": mover_id,
+                                "item": "STR_STUN_ROD", "slot": "right",
+                                "clear_hands": True}) for gc in (driver, watcher)]
+                if not all(g.get("ok") for g in gave):
+                    note = f"battle_give STR_STUN_ROD failed: {gave}"
+                else:
+                    note = drive_attack(
+                        driver, watcher, mover_id, "melee",
+                        {"cmd": "battle_fire", "unit": mover_id, "mode": "hit",
+                         "weapon_id": gave[0]["weaponId"], "tu": 100,
+                         "x": tpos[0], "y": tpos[1], "z": tpos[2]})
+        if note:
+            print(f"SKIP melee: {note}")
+        else:
+            after_melee = watcher_state(watcher)
+            assert_not_hijacked("melee", prev, after_melee, mine_id, mover_id,
+                                check_camera=False,
+                                camera_note="ExplosionBState centres on the hit")
+            prev = after_melee
+
+        # --- 6. classic handoff regression -----------------------------------
+        # PlayerTurnYour is a HANDOFF, not a replay: the machine that BECOMES the
+        # active player must be given a selected unit, or it starts its turn
+        # commanding nothing. P1 must not have deleted that setSelectedUnit.
+        # Press the REAL END TURN button - `end_turn` calls the VANILLA
+        # requestEndTurn(), which never ships PlayerTurnYour at all.
+        driver.ok({"cmd": "battle_action", "action": "end_turn_button"})
+
+        def handed_over():
+            # BattlescapeState::think() - which runs the coop turn handshake -
+            # only ticks while the battlescape is the TOP state, so drain the
+            # "Turn N" / infobox popups the end-turn puts up.
+            for gc in (driver, watcher):
+                if gc.cmd({"cmd": "battle_state"}).get("inBattle") and \
+                        top(gc) != "BattlescapeState":
+                    gc.cmd({"cmd": "dismiss_popup"})
+            return battle(watcher).get("coopTurn") == 2
+
+        got = wait_until(handed_over, 120, interval=1.0)
+        if not got:
+            print(f"SKIP handoff: {wtag} never became the active player "
+                  f"(coopTurn={battle(watcher).get('coopTurn')}, "
+                  f"top={top(watcher)}) within 120s")
+        else:
+            hs = battle(watcher)
+            assert hs["selectedId"] != -1, (
+                "PlayerTurnYour handoff left the newly-active player with NO "
+                f"selected unit: {hs['selectedId']} (coopTurn={hs['coopTurn']}) - "
+                "the handoff setSelectedUnit was deleted along with the replay ones")
+            sel = unit(hs, hs["selectedId"])
+            assert sel and sel.get("coop") == watcher_coop, (
+                f"the handoff selected unit {hs['selectedId']} which is owned by "
+                f"coop={sel and sel.get('coop')}, not this player ({watcher_coop})")
+            print(f"PASS handoff: PlayerTurnYour selected own unit "
+                  f"{hs['selectedId']} for the newly-active {wtag}")
+
+        print("ALL PARALLEL-REPLAY-DECOUPLE TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_resume.py b/tools/coop_test/test_parallel_resume.py
new file mode 100644
index 000000000..676892fe4
--- /dev/null
+++ b/tools/coop_test/test_parallel_resume.py
@@ -0,0 +1,268 @@
+"""PRD-P9 6: mid-battle RESUME while the parallel player side is live.
+
+The parallel feature adds per-battle state that lives nowhere in the save except
+by implication: the executor invariant (`_isActivePlayerSync == getHost()`), the
+action/side sequences, the deferred-intent store and the end-turn tally. A resume
+that restored the battle but not those would come back either wedged (a stale
+`side_seq` denies every client intent `turn_over`) or closed (a seat still
+carrying "I am done" commits the new side the instant it opens).
+
+What this asserts:
+
+  1. LIVE. A mid-battle co-op campaign comes up with parallel turns ON: both
+     machines hold `coopTurn == 2`, `parallelActive`, and the executor invariant.
+  2. STATE. Actions are driven from BOTH seats so `actionSeq`, `sideSeq` and the
+     readiness tally are all non-trivial; then the host saves mid-player-side.
+  3. RESUME. Both processes are replaced (the client's user dir is EMPTY - the
+     standing zero-disk invariant) and the pair resumes the save.
+  4. RESTORED. `coop_parallel_turns` survived the save, the mode is live again on
+     both machines, the invariant holds, and the arbiter came back RESET rather
+     than half-remembered: `actionSeq`/`peerDisplayAckedSeq`/`pendingAdmits`/the
+     client's pending slot at 0, the readiness tally empty, `side_seq` agreed.
+  5. PLAYABLE. Both seats can act again - the client through an `action_intent`
+     the host executes, the host locally - and the two machines stay in step
+     (PRD-P2's drift terms).
+
+Fixture: the SEPARATE mixed-ownership campaign battle from
+test_coop_resume_battle_control.py, which is the one proven to survive a
+save/reload round trip (a skirmish battle has no campaign to reload into).
+
+Run:  python tools/coop_test/test_parallel_resume.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_coop_resume_battle_control as CRBC
+import test_parallel_intents as PI
+
+SAVE = "parallel_resume_battle.sav"
+PORT = "47962"
+RESUME_PORT = "47963"
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def assert_parallel_live(host, client, phase):
+    for gc, tag in ((host, "host"), (client, "client")):
+        b = battle(gc)
+        assert b.get("inBattle"), f"[{phase}] {tag} is not in a battle: {b}"
+        assert b["parallelEnabled"] is True, (
+            f"[{phase}] {tag}: `coop_parallel_turns` did not survive - the option "
+            f"mirror is {b['parallelEnabled']}. It is written by SavedGame::save "
+            f"and re-read on load; without it the resumed session silently drops "
+            f"back to classic alternating sub-turns.")
+        assert b["parallelActive"] is True, (
+            f"[{phase}] {tag}: the mode is enabled but not LIVE ({b}) - "
+            f"parallelTurnActive() also wants a co-op session in gamemode 1/4.")
+        assert b["coopTurn"] == 2, (
+            f"[{phase}] {tag}: coopTurn is {b['coopTurn']}, not 2. In parallel "
+            f"mode BOTH machines hold the player side.")
+    assert battle(host)["activeSync"] is True, \
+        f"[{phase}] the host is not the executor: {battle(host)}"
+    assert battle(client)["activeSync"] is False, (
+        f"[{phase}] the CLIENT thinks it is the executor - the PRD-P5 invariant "
+        f"`_isActivePlayerSync == getHost()` is what keeps the host the single "
+        f"simulation authority: {battle(client)}")
+    print(f"PASS [{phase}] parallel mode live on both machines, executor "
+          f"invariant intact")
+
+
+def assert_arbiter_reset(host, client, phase):
+    """A resumed battle must come back with a CLEAN arbiter."""
+    hp, cp = parallel(host), parallel(client)
+    errs = []
+    if hp["actionSeq"] != 0:
+        errs.append(f"host actionSeq={hp['actionSeq']} (want 0)")
+    if hp["peerDisplayAckedSeq"] != 0:
+        errs.append(f"host peerDisplayAckedSeq={hp['peerDisplayAckedSeq']} (want 0)")
+    if cp["peerDisplayAckedSeq"] != 0:
+        errs.append(f"client peerDisplayAckedSeq={cp['peerDisplayAckedSeq']} (want 0)")
+    if hp["pendingAdmits"]:
+        errs.append(f"host pendingAdmits={hp['pendingAdmits']} (want none)")
+    if cp["pendingReqId"] != 0:
+        errs.append(f"client pendingReqId={cp['pendingReqId']} (want 0)")
+    if hp["readySeats"] or hp["autoSeats"]:
+        errs.append(f"host tally ready={hp['readySeats']} auto={hp['autoSeats']} "
+                    f"(want both empty - a seat carrying 'I am done' across the "
+                    f"resume would close the new side the instant it opened)")
+    if cp["readySeats"]:
+        errs.append(f"client tally ready={cp['readySeats']} (want empty)")
+    if hp["sideSeq"] != cp["sideSeq"]:
+        errs.append(f"side_seq disagrees: host {hp['sideSeq']} client "
+                    f"{cp['sideSeq']} - every client intent would be denied "
+                    f"`turn_over` until the next boundary re-aligned them")
+    if hp["sideCommit"]:
+        errs.append("host still has a side commit in progress")
+    assert not errs, (f"[{phase}] the arbiter did not come back reset:\n    - "
+                     + "\n    - ".join(errs)
+                     + f"\n  host={hp}\n  client={cp}")
+    print(f"PASS [{phase}] arbiter reset: actionSeq/display/pending/tally all "
+          f"clear, side_seq {hp['sideSeq']} agreed on both")
+
+
+def drive_one(host, client, gc, tag, unit_id, tries=3):
+    """One action from `gc`, waited out on the executor.
+
+    The claim being tested is "this seat can still ACT and the two machines stay
+    in step", so the walk is retried with a fresh destination: a pathfinder answer
+    goes stale between the probe and the execution often enough (a squadmate steps
+    into the only exit) that a single attempt would make the test about the
+    fixture rather than about the resume.
+    """
+    landed = None
+    for attempt in range(tries):
+        PI.top_up(host, client, unit_id)
+        dest = PI.step_dest(host, client, unit_id)
+        assert dest, f"{tag}: soldier {unit_id} cannot step anywhere"
+        before = PI.pos(battle(host), unit_id)
+        seq = parallel(host)["actionSeq"]
+        r = PI.intent(gc, action="move", unit=unit_id,
+                      x=dest[0], y=dest[1], z=dest[2])
+        assert r.get("ok"), f"{tag}: the lever refused to build the intent: {r}"
+        assert PI.wait_until(lambda: parallel(host)["actionSeq"] > seq, 60), (
+            f"{tag}: the host never ADMITTED the action (actionSeq still {seq}); "
+            f"the client was told {PI.warning_of(client)!r}, "
+            f"host={parallel(host)}")
+        moved = PI.wait_until(lambda: PI.pos(battle(host), unit_id) != before, 45)
+        assert PI.idle(host, timeout=120), f"{tag}: the chain never ended"
+        PI.settle(host, client, seconds=4)
+        if moved:
+            landed = PI.pos(battle(host), unit_id)
+            break
+        print(f"    ({tag}: the admitted walk of unit {unit_id} to {dest} covered "
+              f"no ground - retrying with a fresh destination)")
+    assert landed, (
+        f"{tag}: three admitted walks in a row moved unit {unit_id} nowhere: "
+        f"{parallel(host)}")
+    assert PI.wait_until(lambda: PI.pos(battle(client), unit_id) == landed, 60), (
+        f"{tag}: the peer never displayed it - host has {unit_id} at {landed}, "
+        f"client at {PI.pos(battle(client), unit_id)}")
+    print(f"    {tag} drove unit {unit_id} -> {landed} on both machines")
+    return landed
+
+
+def own_unit(gc, seat):
+    for u in battle(gc)["units"]:
+        if (u.get("faction") == 0 and not u.get("isOut")
+                and u.get("coop") == seat and u.get("selectable")):
+            return u["id"]
+    for u in battle(gc)["units"]:
+        if u.get("faction") == 0 and not u.get("isOut") and u.get("coop") == seat:
+            return u["id"]
+    return None
+
+
+def main():
+    host_dir = make_user_dir("p9_presume_host",
+                             options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                      "skipNextTurnScreen": True,
+                                      "EnableCoopParallelTurns": True})
+    host = GameClient("host", 47871, host_dir)
+    client = GameClient("client", 47872,
+                        make_user_dir("p9_presume_client",
+                                      options={"battleXcomSpeed": 2,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    fail = None
+    try:
+        host.spawn(); client.spawn()
+        host.connect(); client.connect()
+        CRBC.PORT = PORT
+        PI.PORT = PORT
+        CRBC.bring_up_mixed_battle(host, client)
+        CRBC.drain_to_tactical(host, client)
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} co-op battle init",
+                        lambda gc=gc: battle(gc).get("battleInit") or None,
+                        timeout=120, interval=1.0)
+
+        # --- 1 + 2: live, and driven from both seats before the save ----------
+        assert_parallel_live(host, client, "before the save")
+        hseat = parallel(host)["localSeat"]
+        cseat = parallel(client)["localSeat"]
+        hunit, cunit = own_unit(host, hseat), own_unit(client, cseat)
+        assert hunit and cunit, (
+            f"the mixed-ownership fixture did not give both seats a soldier "
+            f"(host seat {hseat} -> {hunit}, client seat {cseat} -> {cunit})")
+        drive_one(host, client, host, "host", hunit)
+        drive_one(host, client, client, "client", cunit)
+        # a non-zero tally at save time, so "the resume forgot it" is observable
+        host.cmd({"cmd": "battle_action", "action": "end_turn_button"})
+        assert PI.wait_until(lambda: parallel(host)["readySeats"] == [hseat], 30), (
+            f"the host's END TURN press did not arm its readiness: "
+            f"{parallel(host)}")
+        pre = parallel(host)
+        print(f"before the save: actionSeq={pre['actionSeq']} "
+              f"sideSeq={pre['sideSeq']} readySeats={pre['readySeats']}")
+        assert pre["actionSeq"] > 0, \
+            "nothing was admitted before the save, so the reset assertion is vacuous"
+        session.assert_battle_synced(host, client, "before the mid-battle save")
+
+        # --- 3: save mid-player-side and replace both processes ---------------
+        host.ok({"cmd": "save_game", "file": SAVE})
+        assert os.path.exists(os.path.join(host_dir, "xcom1", SAVE)), \
+            "the mid-battle save is not on disk"
+        print(f"host saved mid-player-side -> {SAVE}")
+        host.shutdown(); client.shutdown()
+
+        host = GameClient("host", 47873, host_dir)
+        client = GameClient("client", 47874,
+                            make_user_dir("p9_presume_client2",
+                                          options={"battleXcomSpeed": 2,
+                                                   "battleAlienSpeed": 2,
+                                                   "EnableCoopParallelTurns": False}))
+        host.spawn(); client.spawn()
+        host.connect(); client.connect()
+        session.resume_campaign_battle(host, client, SAVE, port=RESUME_PORT)
+        CRBC.drain_to_tactical(host, client)
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} co-op battle init (resumed)",
+                        lambda gc=gc: battle(gc).get("battleInit") or None,
+                        timeout=150, interval=1.0)
+
+        # --- 4: the mode and the arbiter came back -----------------------------
+        assert_parallel_live(host, client, "after resume")
+        assert_arbiter_reset(host, client, "after resume")
+
+        # --- 5: and both seats can play -----------------------------------------
+        hunit, cunit = own_unit(host, hseat), own_unit(client, cseat)
+        assert hunit and cunit, (
+            f"a seat lost its soldiers across the resume (host {hunit}, "
+            f"client {cunit})")
+        drive_one(host, client, client, "client", cunit)
+        drive_one(host, client, host, "host", hunit)
+        session.assert_battle_synced(host, client, "after the resumed actions")
+        print("PASS [after resume] both seats act into the same player side again")
+
+        session.assert_client_zero_disk(client.user_dir)
+        print("PASS zero-disk: the resumed client wrote no save data")
+        print("ALL PARALLEL MID-BATTLE RESUME TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+                print(f"  DBG {tag} states:   {session.states(gc)[-3:]}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_rx_order.py b/tools/coop_test/test_parallel_rx_order.py
new file mode 100644
index 000000000..98c24f0db
--- /dev/null
+++ b/tools/coop_test/test_parallel_rx_order.py
@@ -0,0 +1,646 @@
+"""PRD-P11: the receive pump applies a unit's packets in the order they were sent.
+
+The P10 soak found the last known battlescape-sync defect, and it was in the
+PUMP, not in any handler: `updateCoopTask()` rotated a packet it could not
+consume yet to the BACK of the hold queue and carried on applying the
+always-consume traffic behind it. A `BattleScapeMove` blocked once could
+therefore end up behind its own follow-ups. The captured trace:
+
+    host sent   Move(47) abortPath(37) Move(37) abortPath(27)
+    peer applied            abortPath(37) Move(37) abortPath(27) ... Move(47)
+
+- two seconds late, with the peer then walking unit 47 out of a stale position
+and nothing left to correct it.
+
+The shape is manufacturable without a 200k backlog. `abortPath` is exempt from
+the receive gate while a walk is running (`_coopWalkInit`) because it is what
+ENDS that walk, so on a machine that is still finishing walk N:
+
+    Move(u)#N+1   gate closed  -> deferred
+    abortPath(u)#N+1  exempt   -> applied, out of order
+
+i.e. the peer teleport-corrects unit u to the end of a walk it has not started,
+and then walks it AGAIN from there when the deferred `Move` finally lands.
+
+This test drives one unit through back-to-back walks with the two instances at
+opposite ends of the animation-speed range - the same lever PRD-P7/P9 use to make
+the peer lag - and reads the peer's APPLIED-PACKET RING (`parallel_state` with
+`trace: true`, PRD-P11) to assert the property directly:
+
+  1. ORDER (end to end). Over the peer's whole applied stream, restricted to the
+     driver, an `abortPath` never overtakes the `BattleScapeMove` it closes (at no
+     prefix do the aborts outnumber the moves).
+  2. ORDER (deterministic). Three no-op packets about the driver, all of them
+     held by the receive gate, are put into the peer's hold queue while that gate
+     is SHUT, and the peer must apply all three in the order they landed - none
+     starved, none overtaken. This does not depend on timing: `rx_inject` reports
+     the state of the gate at the moment the burst landed, so a missed window is
+     retried rather than passed off as a result. It is the assertion that would
+     catch a pump that rotates, drops or re-orders what it cannot consume yet.
+  3. LIVENESS. `rxLegacyPasses` stays 0 on both machines: the pump's escape hatch
+     (per-subject blocking disabled after a long stall) never had to fire, so the
+     ordering guarantee held for the whole run without being traded away.
+  4. CONVERGENCE. Both machines finish with the same position, and the PRD-P2
+     drift tripwire stays quiet.
+
+Neither assertion on its own is a complete proof: whether the walk-level window
+in 1 opens at all depends on how fast the peer's display fast-forward closes it,
+and 2 is satisfied by any pump that keeps its queue in order. Together they cover
+the property the pump has to have - a unit's stream is applied in the order it
+was sent, whatever the gate does in between.
+
+Run:  python tools/coop_test/test_parallel_rx_order.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_introspection as TI
+
+PORT = "47993"
+
+HOST_SPEED = 2       # ms/frame: the executor runs at speed
+CLIENT_SPEED = 500   # ms/frame: the peer is a slideshow, so it is always behind
+WALKS = 6
+WALK_RADIUS = 3
+SLOW_FIRE = 1500     # ms/projectile-frame on the peer: what actually slows a SHOT
+TRACE_LIMIT = 256    # == kRxTraceMax in connectionTCP.cpp
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+class Trace:
+    """The peer's applied-packet ring, stitched together across polls.
+
+    The ring holds the last 256 applied packets, so a run that applies more than
+    that has to be sampled as it goes. Entries are keyed by their monotonic
+    `seq`, which also makes a gap (a window that skipped ahead) detectable rather
+    than silently papered over.
+    """
+
+    def __init__(self):
+        self.by_seq = {}
+        self.gaps = 0
+        self._highest = 0
+
+    def poll(self, gc):
+        r = gc.cmd({"cmd": "parallel_state", "trace": True,
+                    "traceLimit": TRACE_LIMIT})
+        entries = r.get("rxTrace")
+        if entries is None:
+            raise AssertionError(
+                "parallel_state carries no rxTrace, so every order assertion "
+                f"below would be vacuous: {sorted(r)}")
+        if entries:
+            lowest = entries[0]["seq"]
+            if self._highest and lowest > self._highest + 1:
+                # the ring rolled between polls - say so rather than pretend the
+                # stream was contiguous
+                self.gaps += 1
+            self._highest = max(self._highest, entries[-1]["seq"])
+        for e in entries:
+            self.by_seq[e["seq"]] = e
+        return r
+
+    def applied(self, unit=None, states=None):
+        out = [self.by_seq[s] for s in sorted(self.by_seq)]
+        if unit is not None:
+            out = [e for e in out if e["unit"] == unit]
+        if states is not None:
+            out = [e for e in out if e["state"] in states]
+        return out
+
+
+WALK_STATES = ("BattleScapeMove", "abortPath")
+
+
+def order_violations(entries):
+    """Every `abortPath` that was applied before the `BattleScapeMove` it closes.
+
+    `UnitWalkBState` sends `BattleScapeMove` from init() and `abortPath` from
+    deinit(), always in that order and always paired, so over any prefix of one
+    unit's stream the aborts can never outnumber the moves. A re-init (the state
+    is re-entered after the UnitFallBState it pushes pops) can ship an EXTRA
+    move, which this invariant tolerates by design - the failure mode being
+    tested is an abort that ran early, not a move that ran twice.
+
+    Leading aborts are skipped: the ring is process-wide and the first poll can
+    land mid-walk, so an abort whose move predates the window is not evidence.
+    """
+    moves = aborts = 0
+    bad = []
+    started = False
+    for e in entries:
+        if e["state"] == "BattleScapeMove":
+            started = True
+            moves += 1
+        elif e["state"] == "abortPath":
+            if not started:
+                continue
+            aborts += 1
+            if aborts > moves:
+                bad.append(e)
+    return bad, moves, aborts
+
+
+def noop_burst(gc, uid):
+    """Three packets about `uid` that change nothing when applied, in a fixed
+    order the applied ring can read back.
+
+    All three are held by the receive gate, which is the class the ordering rule
+    exists for: a unit's replay stream must be applied in the order it was sent
+    however long the gate holds it.
+
+      * `hit_unit` re-applies the unit's CURRENT health/stun. No `fatalWounds`
+        key: the handler only walks the array it is given, so leaving it out
+        cannot clear wounds the peer already has.
+      * `motion_scan` re-applies the CURRENT turn as the unit's scanned turn -
+        a motion-scanner display term and nothing else.
+    """
+    b = battle(gc)
+    u = PI.unit(b, uid)
+    assert u, f"unit {uid} is not in the peer's battle state"
+    hit = {"state": "hit_unit", "unit_id": uid,
+           "health": u["health"], "stunlevel": u.get("stun", 0)}
+    scan = {"state": "motion_scan", "unit_id": uid, "turn": b.get("turn", 1)}
+    return [dict(hit), dict(scan), dict(hit)]
+
+
+BURST_STATES = ("hit_unit", "motion_scan")
+BURST_ORDER = ["hit_unit", "motion_scan", "hit_unit"]
+
+
+# The peer's receive gate shuts (`coopTaskCompleted()` false) only while it is
+# REPLAYING a chain, and only a NON-skippable one holds it long enough for the
+# armed burst to land - `chainIsSkippable()` fast-forwards player walks/turns/
+# falls to interval 0, so their window closes in under a frame (measured: a lone
+# long walk fires the armed burst on ~5/8 tries, a melee/throw ~0/8). A slow SHOT
+# (`battleFireSpeed` SLOW_FIRE) is the only reliable holder - but a shot only
+# flies, and thus holds the gate for seconds, with a clear LINE OF FIRE, and a
+# walkable floor tile does not guarantee one: aiming at a floor voxel is fragile,
+# and some generated skirmish maps drop the squad in a walled pocket with no LOF
+# at all. So the precondition is NOT always establishable, and the old code
+# (flee 8 tiles clear -> shoot the 8 furthest floor tiles -> wait 45 s each)
+# spent 8x45 s ~= 6 min failing vacuously on ~1/3 of runs whenever the flee
+# landed the shooter in a blind corner.
+GATE_SHUT_WAIT = 2.0   # a real flying slow shot shuts the peer's gate in ~1-2 s
+
+
+def _dist(a, b):
+    return max(abs(a[0] - b[0]), abs(a[1] - b[1]))
+
+
+def _inj_shooter_targets(host, shooter):
+    """Best-LOF-first shot targets for `shooter`. A friendly soldier's torso voxel
+    is a far more reliable line-of-fire target than a floor voxel, and a `snap` at
+    >= 2 tiles misses (measured across hundreds of shots: zero friendly-fire, zero
+    deaths), so it holds the gate without disturbing the census; nearby squadmates
+    are almost always mutually visible. Diverse floor tiles kept clear of the lone
+    hostile follow, so a stray round never neutralises it and ends the mission
+    before scenario_future_chain_deferred runs."""
+    b = battle(host)
+    spos = PI.pos(b, shooter)
+    enemy = PI.alive_enemy(b)
+    ep = (enemy["x"], enemy["y"], enemy["z"]) if enemy else None
+    out = []
+    friendlies = [u for u in b["units"]
+                  if u.get("faction") == 0 and not u.get("isOut") and u["id"] != shooter]
+    for u in sorted(friendlies, key=lambda u: _dist(spos, (u["x"], u["y"], u["z"]))):
+        if _dist(spos, (u["x"], u["y"], u["z"])) >= 2:
+            out.append(((u["x"], u["y"], u["z"]), "snap"))
+        if len(out) >= 3:
+            break
+    probe = PI.intent(host, action="probe_step", unit=shooter, radius=4, max=400)
+    aims = [(s["x"], s["y"], s["z"]) for s in probe.get("steps", [])]
+    if ep:
+        aims = [a for a in aims if _dist(a, ep) >= 3]
+    for a in (aims[::-1][:1] + aims[:1]):
+        out.append((a, "auto"))
+    return out
+
+
+def _inj_shooters(host, mover):
+    """Player soldiers on the mover's seat to try as gate-holders, mover first
+    then nearest. The peer's receive gate (`coopTaskDepth`) is GLOBAL, not
+    per-unit, so ANY of them holding it with a slow shot lets the burst - which is
+    injected about `mover` independently - land; only the shooter needs a line of
+    fire, so a boxed-in mover no longer strands the whole check when a squadmate
+    a few tiles away can see something."""
+    b = battle(host)
+    mu = PI.unit(b, mover)
+    seat = mu.get("coop") if mu else 0
+    mpos = PI.pos(b, mover)
+    peers = [u["id"] for u in sorted(
+        (u for u in b["units"] if u.get("faction") == 0 and not u.get("isOut")
+         and u.get("coop") == seat and u["id"] != mover),
+        key=lambda u: _dist(mpos, (u["x"], u["y"], u["z"])))]
+    return [mover] + peers[:4]
+
+
+def _inj_land_burst(host, client, shooter, subject, wid, tgt, mode, trace):
+    """Arm the 3-packet burst about `subject`, fire ONE slow shot from `shooter`
+    at `tgt`, and - if the peer's gate shuts (a real flying shot does) - read the
+    burst back out of `subject`'s applied ring and return the applied state order.
+    A dud (no line of fire, no fly) disarms and returns None fast, so a blind
+    shooter costs GATE_SHUT_WAIT, not the old 45 s.
+
+    `awaitGate` hands the packets to the peer's own main loop, which lands them on
+    the first tick whose gate is shut, so the window cannot be lost to a round
+    trip however briefly it is open."""
+    if not wait_admit(host):
+        return None
+    before = len(trace.applied(unit=subject, states=BURST_STATES))
+    armed = client.ok({"cmd": "rx_inject", "awaitGate": True,
+                       "packets": noop_burst(client, subject)})
+    if armed.get("armed") != 3:
+        return None
+    PI.top_up(host, client, shooter, amount=250)
+    client.cmd({"cmd": "battle_camera", "unit": shooter, "visible": True})
+    if not PI.intent(host, action="shoot", unit=shooter, mode=mode, weapon_id=wid,
+                     x=tgt[0], y=tgt[1], z=tgt[2]).get("ok"):
+        client.ok({"cmd": "rx_inject", "awaitGate": True, "packets": []})
+        return None
+    inj = None
+    deadline = time.time() + GATE_SHUT_WAIT
+    while time.time() < deadline:
+        inj = client.ok({"cmd": "rx_inject", "status": True})
+        if inj.get("fired"):
+            break
+        time.sleep(0.05)
+    if not inj or not inj.get("fired"):
+        client.ok({"cmd": "rx_inject", "awaitGate": True, "packets": []})  # unarm
+        return None
+    seen = []
+    deadline = time.time() + 90
+    while time.time() < deadline:
+        trace.poll(client)
+        got = trace.applied(unit=subject, states=BURST_STATES)
+        if len(got) >= before + 3:
+            seen = got[before:before + 3]
+            break
+        time.sleep(0.05)
+    assert len(seen) == 3, (
+        f"the peer applied {len(seen)} of the 3 injected packets - the ordering "
+        f"rule starved one of them (inject={inj}, applied="
+        f"{[e['state'] for e in seen]})")
+    return [e["state"] for e in seen]
+
+
+def scenario_injected_order(host, client, mover, trace):
+    """The deterministic half: land a same-unit burst while the peer's gate is
+    SHUT and prove the pump applies the three packets in the order they landed.
+
+    Establishing the precondition (a slow flying shot on the peer) is done by a
+    FAST, bounded search over several shooters - see `_inj_shooters` /
+    `_inj_shooter_targets`. When no shot on the map will fly at all (a genuinely
+    cramped fixture), the check is SKIPPED rather than failed: assertion 1
+    (walk-order, run every time) and the PRD-I1 seq gate below still exercise the
+    pump, and burning six minutes to fail a precondition the map cannot satisfy is
+    worse than an honest skip. When a shot DOES fly, the order assertion runs
+    strict, unchanged - the burst is always about `mover`, whichever soldier held
+    the gate."""
+    print("-- deterministic: a unit's queued packets are applied in the order "
+          "they landed --")
+    assert PI.idle(host), f"the executor is still busy: {parallel(host)}"
+    client.ok({"cmd": "set_option", "name": "battleFireSpeed", "value": SLOW_FIRE})
+
+    shots = 0
+    order = None
+    for shooter in _inj_shooters(host, mover):
+        wid = PI.give_both(host, client, shooter, "STR_RIFLE", "STR_RIFLE_CLIP")
+        for tgt, mode in _inj_shooter_targets(host, shooter):
+            order = _inj_land_burst(host, client, shooter, mover, wid, tgt, mode, trace)
+            shots += 1
+            if order is not None:
+                break
+        if order is not None:
+            break
+
+    if order is not None:
+        assert order == BURST_ORDER, (
+            f"the peer applied the injected burst as {order}, not {BURST_ORDER}: "
+            f"the receive pump reordered a unit's stream against itself while the "
+            f"gate held it.")
+        print(f"    the burst landed on a tick with the gate shut after {shots} "
+              f"shot(s) -> peer applied {' '.join(order)}")
+        return True
+    print(f"    NOTE: no clear line of fire on this cramped map after {shots} "
+          f"shot(s) - the peer's gate never shut, so the injected-order check is "
+          f"not exercised this run (assertion 1 and the PRD-I1 seq gate still "
+          f"ran)")
+    return False
+
+
+def wait_admit(host, timeout=180):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        ph = parallel(host)
+        if ph.get("canAdmit") is True and not ph.get("pendingAdmits"):
+            return True
+        time.sleep(0.05)
+    return False
+
+
+FIRE_VAL = 7   # distinctive non-zero fire the injected set_fire_tile carries
+
+
+def tile_at(gc, index):
+    """tile_info by index -> the response dict (carries x/y/z and, PRD-I1, fire)."""
+    return gc.cmd({"cmd": "tile_info", "index": index})
+
+
+def read_fire(gc, x, y, z):
+    r = gc.cmd({"cmd": "tile_info", "x": x, "y": y, "z": z})
+    return r.get("fire", -1)
+
+
+def find_cold_tiles(gc, n):
+    """`n` distinct valid tiles that are currently fire==0, near the middle of the
+    map. Position (not index) is what set_fire_tile carries, so each is returned as
+    (x, y, z)."""
+    tc = gc.ok({"cmd": "battle_tiles"})["tileCount"]
+    out, idx, tried = [], tc // 2, 0
+    while len(out) < n and tried < 600:
+        r = tile_at(gc, idx)
+        idx = 1 if idx + 1 >= tc else idx + 1
+        tried += 1
+        if r.get("error") or r.get("fire", 0) != 0:
+            continue
+        out.append((r["x"], r["y"], r["z"]))
+    return out
+
+
+def inject_fire(gc, xyz, seq=None, side=None):
+    pkt = {"state": "set_fire_tile", "tile_pos_x": xyz[0], "tile_pos_y": xyz[1],
+           "tile_pos_z": xyz[2], "fire": FIRE_VAL, "animation_offset": 0}
+    if seq is not None:
+        pkt["action_seq"] = seq
+    if side is not None:
+        pkt["side_seq"] = side
+    return gc.ok({"cmd": "rx_inject", "packets": [pkt]})
+
+
+def scenario_future_chain_deferred(host, client):
+    """PRD-I1 red/green through the rx_inject lever.
+
+    The bug I1 closes: a whitelisted outcome packet (`set_fire_tile`, ...) is
+    always-consume, so one belonging to a FUTURE chain applies on the client while
+    it is still displaying an earlier chain - contaminating the client's post-N
+    sync-check state. The fix stamps each such packet with its chain's `action_seq`
+    and defers it, in place, until that chain opens locally (`_clientDisplaySeq+1`).
+
+    Three injections onto three cold client tiles, at a quiescent moment so the
+    client's display watermark is stable:
+
+      1. FUTURE seq  (displaySeq + 5) -> HELD. The tile stays cold, the gate
+         registers the hold (`rxSeqDeferred` climbs) and does so WITHOUT the
+         liveness floor (`rxLegacyPasses` unchanged) - genuine chain isolation,
+         not the escape hatch. This is the packet the old pump applied early.
+      2. CURRENT seq (displaySeq + 1) -> APPLIED. Same packet shape, the chain the
+         client is displaying: an outcome MAY resolve its own chain mid-display.
+      3. NO seq -> APPLIED. Legacy always-consume, the old-peer / classic path,
+         unchanged and bidirectional.
+    """
+    print("-- PRD-I1: a future-chain outcome packet is held for its own opener --")
+    assert PI.idle(host), f"the executor is still busy: {parallel(host)}"
+    PI.settle(host, client, seconds=2)
+
+    pc = parallel(client)
+    assert "displaySeq" in pc and "sideSeq" in pc, \
+        f"parallel_state lacks displaySeq/sideSeq, so this test is vacuous: {sorted(pc)}"
+    side = pc["sideSeq"]
+    seq0 = pc.get("rxSeqDeferred", 0)
+    legacy0 = pc.get("rxLegacyPasses", 0)
+
+    tiles = find_cold_tiles(client, 3)
+    assert len(tiles) == 3, \
+        f"could not find 3 cold tiles on the client to inject onto: {tiles}"
+    fut_t, cur_t, leg_t = tiles
+
+    # (1) FUTURE seq -> deferred. Confirm PROMPTLY (break as soon as the gate
+    # registers the hold): a permanently-stuck packet trips the ~600-tick liveness
+    # floor after ~1 s of idle ticks, and this test must read the held state well
+    # before that or it would race the escape hatch it is asserting did NOT fire.
+    d = parallel(client)["displaySeq"]
+    future_seq = d + 5           # >= displaySeq + 2: a chain not opened locally
+    inject_fire(client, fut_t, seq=future_seq, side=side)
+    pc2 = parallel(client)
+    deadline = time.time() + 3.0
+    while time.time() < deadline:
+        pc2 = parallel(client)
+        if read_fire(client, *fut_t) != 0:
+            break  # it applied - the red-case assert below reports it
+        if pc2.get("rxSeqDeferred", 0) > seq0:
+            break  # the gate has engaged and the tile is still cold: confirmed held
+        time.sleep(0.03)
+    f_future = read_fire(client, *fut_t)
+    assert f_future == 0, (
+        f"a future-seq set_fire_tile (seq {future_seq} > displaySeq {d} + 1) was "
+        f"APPLIED to tile {fut_t} (fire={f_future}) instead of held for its chain's "
+        f"opener - the seq gate did not engage (this is the I1 red case)")
+    assert pc2.get("rxSeqDeferred", 0) > seq0, (
+        f"the future-seq packet did not register as a seq-deferral (rxSeqDeferred "
+        f"{seq0} -> {pc2.get('rxSeqDeferred')}) - it may have been dropped, not held")
+    assert pc2.get("rxLegacyPasses", 0) == legacy0, (
+        f"the liveness floor fired during isolation ({legacy0} -> "
+        f"{pc2.get('rxLegacyPasses')}) - the packet was held via the escape hatch, "
+        f"not clean chain isolation")
+    print(f"    future seq {future_seq}: tile {fut_t} stayed cold; rxSeqDeferred "
+          f"{seq0} -> {pc2.get('rxSeqDeferred')}, rxLegacyPasses still {legacy0}")
+
+    # (2) CURRENT seq -> applied (may resolve its own chain mid-display).
+    d = parallel(client)["displaySeq"]
+    current_seq = d + 1
+    inject_fire(client, cur_t, seq=current_seq, side=side)
+    assert PI.wait_until(lambda: read_fire(client, *cur_t) == FIRE_VAL, 15, 0.1), (
+        f"a current-chain set_fire_tile (seq {current_seq} == displaySeq {d} + 1) "
+        f"was NOT applied to tile {cur_t} (fire={read_fire(client, *cur_t)}) - the "
+        f"gate wrongly held a packet of the chain the client is displaying")
+    print(f"    current seq {current_seq}: tile {cur_t} caught fire (applied)")
+
+    # (3) NO seq -> legacy always-consume.
+    inject_fire(client, leg_t)   # no action_seq
+    assert PI.wait_until(lambda: read_fire(client, *leg_t) == FIRE_VAL, 15, 0.1), (
+        f"a set_fire_tile with NO action_seq was NOT applied to tile {leg_t} "
+        f"(fire={read_fire(client, *leg_t)}) - legacy always-consume regressed")
+    print(f"    no seq        : tile {leg_t} caught fire (legacy applied)")
+    print("PASS: PRD-I1 seq gate holds a future chain's outcome packet and passes "
+          "the current chain's / an unseq'd legacy one")
+
+
+def main():
+    fail = None
+    host_dir = make_user_dir("p11_order_host",
+                             options={"battleXcomSpeed": HOST_SPEED,
+                                      "battleAlienSpeed": 2,
+                                      "skipNextTurnScreen": True,
+                                      "EnableCoopParallelTurns": True})
+    client_dir = make_user_dir("p11_order_client",
+                               options={"battleXcomSpeed": CLIENT_SPEED,
+                                        "battleAlienSpeed": 2,
+                                        "EnableCoopParallelTurns": False})
+    TI.assert_options_spliced(host_dir, {"battleXcomSpeed": HOST_SPEED})
+    TI.assert_options_spliced(client_dir, {"battleXcomSpeed": CLIENT_SPEED})
+    host = GameClient("host", 48886, host_dir)
+    client = GameClient("client", 48887, client_dir)
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        mover = PI.pick_driver(host, client, 0, "host")
+        # The skew only bites while the walker is ON SCREEN AND VISIBLE:
+        # UnitWalkBState runs an off-screen walk at interval 0 whatever the
+        # option says, so without this the "slow" peer displays at frame rate and
+        # never falls behind at all - and a peer that is never behind never
+        # defers a `BattleScapeMove`, which is the whole hazard.
+        aim = client.ok({"cmd": "battle_camera", "unit": mover, "visible": True})
+        assert aim["onScreen"] and aim["visible"], \
+            f"the client cannot actually watch the walker: {aim}"
+
+        PI.top_up(host, client, mover, amount=250)
+        trace = Trace()
+        trace.poll(client)
+        origin = PI.pos(battle(host), mover)
+
+        walked = 0
+        for step in range(WALKS):
+            assert wait_admit(host), \
+                f"walk {step}: the executor never freed up: {parallel(host)}"
+            client.cmd({"cmd": "battle_camera", "unit": mover, "visible": True})
+            dest = (PI.far_step(host, mover, radius=WALK_RADIUS)
+                    or PI.free_step(host, mover))
+            if not dest:
+                print(f"    (walk {step}: the mover can path nowhere - stopping "
+                      f"after {walked} walk(s))")
+                break
+            seq_before = parallel(host)["actionSeq"]
+            r = PI.intent(host, action="move", unit=mover,
+                          x=dest[0], y=dest[1], z=dest[2])
+            assert r.get("ok"), f"walk {step}: the lever refused: {r}"
+
+            # Poll the peer HARD while the chain runs. Back-to-back walks of the
+            # same unit on a lagging peer are exactly the window in which the old
+            # pump let `abortPath` overtake its own `BattleScapeMove`, and the
+            # ring is only 256 deep.
+            deadline = time.time() + 120
+            while time.time() < deadline:
+                trace.poll(client)
+                ph = parallel(host)
+                if ph.get("actionSeq", 0) > seq_before and ph.get("canAdmit") is True:
+                    break
+                time.sleep(0.05)
+            if parallel(host)["actionSeq"] > seq_before:
+                walked += 1
+            bad, moves, aborts = order_violations(
+                trace.applied(unit=mover, states=WALK_STATES))
+            print(f"    walk {step}: actionSeq {seq_before} -> "
+                  f"{parallel(host)['actionSeq']}, peer applied {moves} move(s) "
+                  f"/ {aborts} abort(s) for unit {mover}"
+                  + (f"  ** {len(bad)} OUT OF ORDER **" if bad else ""))
+
+        assert walked >= 3, (
+            f"only {walked} of {WALKS} walks were admitted - the executor was "
+            f"blocked, not merely paced: {parallel(host)}")
+
+        injected = scenario_injected_order(host, client, mover, trace)
+
+        # Let the peer finish drawing, sampling all the way.
+        for _ in range(60):
+            trace.poll(client)
+            if (parallel(host)["peerDisplayAckedSeq"]
+                    == parallel(host)["actionSeq"]):
+                break
+            time.sleep(0.5)
+        PI.settle(host, client, seconds=6)
+        trace.poll(client)
+
+        # ---- 1. ORDER ------------------------------------------------------
+        full = trace.applied(unit=mover)
+        print("    peer applied, unit %d: %s"
+              % (mover, " ".join(e["state"] for e in full)))
+        walk_stream = trace.applied(unit=mover, states=WALK_STATES)
+        bad, moves, aborts = order_violations(walk_stream)
+        assert moves >= 3, (
+            f"the peer only applied {moves} walk packet(s) for unit {mover} over "
+            f"{walked} walk(s) - the trace is too thin to prove anything "
+            f"(gaps seen: {trace.gaps})")
+        assert not bad, (
+            f"the peer applied {len(bad)} `abortPath` packet(s) for unit {mover} "
+            f"BEFORE the `BattleScapeMove` each one closes - the receive pump "
+            f"reordered the stream. Applied order was: "
+            f"{[(e['seq'], e['state']) for e in walk_stream]}")
+
+        # ---- 2. LIVENESS ---------------------------------------------------
+        for gc, tag in ((host, "host"), (client, "client")):
+            ps = parallel(gc)
+            assert ps.get("rxLegacyPasses", 0) == 0, (
+                f"{tag}: the pump's liveness floor fired "
+                f"{ps['rxLegacyPasses']}x - per-subject ordering was disabled to "
+                f"keep the queue moving, which means something upstream wedged "
+                f"the receive gate: {ps}")
+
+        # ---- 3. CONVERGENCE ------------------------------------------------
+        hb, cb = battle(host), battle(client)
+        assert PI.pos(hb, mover) == PI.pos(cb, mover), (
+            f"the two machines disagree about unit {mover} after the run: host "
+            f"{PI.pos(hb, mover)} client {PI.pos(cb, mover)}")
+        assert PI.pos(hb, mover) != origin, "the mover never actually moved"
+        assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+            "the PRD-P2 drift tripwire fired during the ordered-pump run"
+
+        pc = parallel(client)
+        print(f"PASS: {walked} back-to-back walk(s) of unit {mover} at a "
+              f"{HOST_SPEED}:{CLIENT_SPEED} speed skew - the peer applied "
+              f"{moves} move / {aborts} abort packet(s) strictly in order "
+              f"(ring gaps {trace.gaps}); peer counters: rxRotates "
+              f"{pc.get('rxRotates')}, rxSkippedBlocked "
+              f"{pc.get('rxSkippedBlocked')}, rxLegacyPasses "
+              f"{pc.get('rxLegacyPasses')}, rxHoldMax {pc.get('rxHoldMax')}"
+              + ("; the injected burst landed with the gate shut and was "
+                 "applied in order" if injected else "; injection phase skipped"))
+        if not pc.get("rxSkippedBlocked"):
+            print("    NOTE: per-subject blocking never engaged on the peer this "
+                  "run - the ordering held, but this particular run did not "
+                  "exercise the new hold")
+
+        # PRD-I1: the chain-isolation seq gate (extends this file's remit from
+        # "a unit's stream stays in order" to "a future chain's outcome packet
+        # does not overtake its own opener").
+        scenario_future_chain_deferred(host, client)
+        print("ALL RECEIVE-ORDER TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_sharedturn.py b/tools/coop_test/test_parallel_sharedturn.py
new file mode 100644
index 000000000..36547bf80
--- /dev/null
+++ b/tools/coop_test/test_parallel_sharedturn.py
@@ -0,0 +1,563 @@
+"""PRD-P5: the parallel shared player side.
+
+With `EnableCoopParallelTurns` on, a co-op PVE battle stops alternating sub-turns:
+both machines hold the player side at once, with full UI, for the whole side. The
+piece that makes that cheap is the EXECUTOR INVARIANT (PROTOCOL.md "Core
+invariant"):
+
+    _isActivePlayerSync == getHost()      - permanently, host TRUE / client FALSE
+
+Every executor-gated site in the battle (BState packet sends, the projectile RNG
+pre-rolls, reaction fire, the ambient sim) is therefore correct with no per-site
+refactor: the host always executes and broadcasts, the client never does. Until
+PRD-P6 lands `action_intent`, the client's own input is simply swallowed - that
+is a shippable intermediate (host-only acting), not the finished feature.
+
+What this test asserts (PRD-P5 acceptance):
+
+  1. Option on, PVE battle: `battle_state.coopTurn == 2` on BOTH machines,
+     `activeSync` true on the host and FALSE on the client (the invariant, NOT a
+     driver-selection flag any more), `parallelActive` true on both. The client's
+     OWN option value is irrelevant - here it is deliberately off, and the client
+     still runs in parallel mode because the host's value rode the handshake.
+  2. No off-turn banners on either machine. They are persistent
+     (`showCoopWarning` -> `showMessage(msg, -1)`, repainted every frame), so one
+     left behind would squat on the warning widget for the rest of the battle and
+     block the deny/ready flashes P6/P8 put through it.
+  3. `clientInputBlocked` (= "this machine is a parallel CLIENT") is true on the
+     client and false on the host; the client's REAL END TURN button still does
+     nothing, because END TURN stays host-only until PRD-P8's readiness tally;
+     and a LOCALLY EXECUTED client action does not replicate (the send guards
+     read `_isActivePlayerSync`, which the client holds false). PRD-P6 removed
+     the blanket input gate and the `coopParallelDebugClientInput` debug switch
+     that went with it - a client's real input now travels as an `action_intent`
+     (test_parallel_intents.py); `battle_action move` deliberately still executes
+     locally, which is what makes it the right lever for this assertion.
+  4. A full side boundary: the host ends the turn (there is no mid-side hand-off
+     left - no `PlayerTurnYour`), the alien side runs, and the player side comes
+     back with the invariant re-asserted. A host shot after the boundary lands
+     identically on both machines.
+  5. Old-build degrade (phase A, its own short-lived pair, no battle): a host that
+     never asks for parallel turns leaves BOTH machines classic even when the
+     client's own option is on. An older peer sends no `enable_parallel_turns`
+     key at all, which the receiver reads as false - the same outcome.
+
+NOTE on driving: `battle_action move` pushes a UnitWalkBState directly and so
+bypasses BattlescapeState::mapClick, where PRD-P6's intent capture lives. That
+makes it the right lever for the "does a LOCAL action REPLICATE" half of 3, and
+the wrong one for anything about the capture path - that is
+test_parallel_intents.py's `battle_intent` lever. The END TURN half is asserted
+through a real handler the harness can press
+(`battle_action end_turn_button` -> btnEndTurnClick).
+
+Battle fixture: the skirmish flow (NEW BATTLE > COOP), same path as
+test_battle_tripwire.py / test_parallel_introspection.py.
+
+Run:  python tools/coop_test/test_parallel_sharedturn.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_skirmish_flow as SK
+import test_battle_tripwire as TW
+
+PORT = "47983"       # phase B (the battle)
+PORT_DEGRADE = "47984"  # phase A (lobby only)
+
+# Every persistent banner PRD-P5 §3 drops for the parallel player side. Matched
+# as substrings against battle_state["warning"], which is "" when the warning
+# widget is hidden.
+FORBIDDEN_BANNERS = ("'s Turn", "Waiting for", "spectator mode")
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def unit(b, uid):
+    for u in b.get("units", []):
+        if u["id"] == uid:
+            return u
+    return None
+
+
+def pos(b, uid):
+    u = unit(b, uid)
+    return (u["x"], u["y"], u["z"]) if u else None
+
+
+def health(b, uid):
+    u = unit(b, uid)
+    return u["health"] if u else None
+
+
+def own_units(state, seat):
+    return [u for u in state["units"]
+            if u.get("faction") == 0 and not u.get("isOut")
+            and u.get("coop") == seat and u.get("tu", 0) > 20]
+
+
+def alive_enemy(state):
+    for u in state["units"]:
+        if u.get("faction") == 1 and not u.get("isOut") and u.get("health", 0) > 0:
+            return u
+    return None
+
+
+def wait_until(fn, timeout, interval=0.4):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if fn():
+            return True
+        time.sleep(interval)
+    return False
+
+
+def settle(host, client, seconds=8):
+    """Let both state machines drain. NextTurnState and the battlescape itself are
+    never dismissed (session.NO_DISMISS_STATES + the host's NextTurnState must
+    self-close, it is what ships `next_turn`)."""
+    deadline = time.time() + seconds
+    while time.time() < deadline:
+        for gc in (host, client):
+            t = TW.top(gc)
+            if t not in ("BattlescapeState", "NextTurnState"):
+                gc.cmd({"cmd": "dismiss_popup"})
+        time.sleep(0.5)
+
+
+# ---- phase A: the host's option decides; a host that never asks stays classic --
+
+def phase_degrade():
+    """A host with the option OFF (which is also what an older build is - it sends
+    no `enable_parallel_turns` key at all, and the receiver defaults it to false)
+    leaves BOTH machines classic, even though this client's own option is ON.
+    Lobby only: the mode is frozen by the COOP_READY_HOST handshake at JOIN time,
+    long before a battle exists, so no battle is needed to prove it."""
+    host = GameClient("host", 48862,
+                      make_user_dir("p5_degrade_host",
+                                    options={"EnableCoopParallelTurns": False}))
+    client = GameClient("client", 48863,
+                        make_user_dir("p5_degrade_client",
+                                      options={"EnableCoopParallelTurns": True}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+
+        # Pin the client's OWN option ON before the handshake - otherwise the
+        # assertion below (that the client still ends up classic) proves nothing.
+        got = client.ok({"cmd": "set_option", "name": "EnableCoopParallelTurns",
+                         "value": True})
+        assert got.get("value") is True, (
+            f"could not turn the client's own EnableCoopParallelTurns on: {got}")
+
+        SK.skirmish_host(host, PORT_DEGRADE)
+        SK.skirmish_client_at_browser(client)
+        client.ok({"cmd": "join_tcp", "ip": "127.0.0.1", "port": PORT_DEGRADE,
+                   "player": "ClientPlayer"})
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} join popup",
+                        lambda gc=gc: session.has_state(gc, "Profile") or None,
+                        timeout=60)
+            gc.ok({"cmd": "profile_ok"})
+        host.wait_for("BATTLE SETTINGS offered",
+                      lambda: SK.lobby(host).get("buttonVisible") or None, timeout=60)
+        # the handshake has crossed by now
+        time.sleep(3)
+
+        # `parallel_state` needs a live battle; the mode is a SESSION property, so
+        # read it off get_coop while both machines sit in the lobby.
+        for gc, tag in ((host, "host"), (client, "client")):
+            ps = gc.ok({"cmd": "get_coop"})
+            assert ps["parallelEnabled"] is False, (
+                f"{tag}: the session mirrored parallelEnabled=True although the "
+                f"HOST's option is off - the client's own option must never "
+                f"decide the mode: {ps}")
+            assert ps["parallelActive"] is False, \
+                f"{tag}: parallelActive true with the mode off: {ps}"
+            assert ps["clientInputBlocked"] is False, \
+                f"{tag}: the §4 input gate is armed in classic mode: {ps}"
+        print("PASS degrade: a host that does not ask for parallel turns leaves "
+              "BOTH machines classic (an older peer sends no key at all, which "
+              "reads the same) - the client's own option is ignored")
+    finally:
+        host.shutdown(); client.shutdown()
+
+
+# ---- phase B assertions ----------------------------------------------------
+
+def assert_invariant(host, client, what):
+    hb, cb = battle(host), battle(client)
+    for b, tag in ((hb, "host"), (cb, "client")):
+        assert b.get("inBattle"), f"{tag}: not in a battle {what}: {b.get('inBattle')}"
+        assert b["parallelActive"] is True, \
+            f"{tag}: parallelActive is not true {what}: {b['parallelActive']}"
+        assert b["parallelEnabled"] is True, \
+            f"{tag}: the handshake mirror is off {what}: {b['parallelEnabled']}"
+        assert b["coopTurn"] == 2, (
+            f"{tag}: coopTurn is {b['coopTurn']}, not 2 {what} - in parallel mode "
+            f"BOTH machines hold the player side (1 = the peer's turn, 3 = waiting "
+            f"for battle init, 4 = spectator)")
+    assert hb["activeSync"] is True, (
+        f"EXECUTOR INVARIANT broken {what}: the host is not the executor "
+        f"(activeSync={hb['activeSync']}). Every BState send guard and RNG pre-roll "
+        f"reads this flag; with it false the host stops broadcasting.")
+    assert cb["activeSync"] is False, (
+        f"EXECUTOR INVARIANT broken {what}: the CLIENT is an executor "
+        f"(activeSync={cb['activeSync']}). Both machines would then broadcast and "
+        f"author RNG - the battle-wide divergence PRD-P5 exists to prevent.")
+    return hb, cb
+
+
+def assert_no_banners(host, client, what, seconds=8.0):
+    """Sampled, not a single snapshot: think() re-posts a persistent banner every
+    frame, so one that is being posted shows up on ANY sample."""
+    deadline = time.time() + seconds
+    seen = {"host": set(), "client": set()}
+    while time.time() < deadline:
+        for gc, tag in ((host, "host"), (client, "client")):
+            w = battle(gc).get("warning", "")
+            if w:
+                seen[tag].add(w)
+        time.sleep(0.5)
+    for tag in ("host", "client"):
+        bad = [w for w in seen[tag]
+               if any(f in w for f in FORBIDDEN_BANNERS)]
+        assert not bad, (
+            f"{tag}: an off-turn banner is on screen {what}: {bad}. These are "
+            f"posted with showMessage(msg, -1) - they never fade, so they squat "
+            f"on the warning widget for the rest of the battle and swallow the "
+            f"deny flashes PRD-P6 sends through it.")
+    print(f"PASS banners {what}: none of {FORBIDDEN_BANNERS} on either machine "
+          f"(host saw {sorted(seen['host']) or 'nothing'}, client saw "
+          f"{sorted(seen['client']) or 'nothing'})")
+
+
+def assert_client_gate(host, client):
+    hp, cp = parallel(host), parallel(client)
+    assert hp["clientInputBlocked"] is False, \
+        f"the HOST's input is gated - the host always acts in parallel mode: {hp}"
+    assert cp["clientInputBlocked"] is True, \
+        f"the client's input gate is open with the debug override off: {cp}"
+
+    # the REAL END TURN button (btnEndTurnClick), the one gated handler the
+    # harness can press. It must not close the side.
+    turn_before = battle(host).get("turn")
+    client.cmd({"cmd": "battle_action", "action": "end_turn_button"})
+    time.sleep(4)
+    hb, cb = battle(host), battle(client)
+    assert hb.get("turn") == turn_before, (
+        f"the client's END TURN closed the side: turn {turn_before} -> "
+        f"{hb.get('turn')}. Only the host closes a parallel side until PRD-P8's "
+        f"readiness gate lands.")
+    assert hb["coopTurn"] == 2 and cb["coopTurn"] == 2, (
+        f"the client's END TURN moved the turn state: host={hb['coopTurn']} "
+        f"client={cb['coopTurn']}")
+    print("PASS gate: the client's END TURN button is swallowed (host stays on "
+          f"turn {turn_before}, both machines still at coopTurn 2) - END TURN "
+          f"stays host-only until PRD-P8's readiness tally")
+
+
+# Candidate destinations, nearest first. A soldier can start boxed into the craft
+# with every ADJACENT tile a hull wall (which is exactly where the client's seat
+# tends to sit in the skirmish fixture), so the search widens rather than giving
+# up at radius 1.
+STEPS = sorted(
+    [(dx, dy) for dx in range(-3, 4) for dy in range(-3, 4) if (dx, dy) != (0, 0)],
+    key=lambda d: (max(abs(d[0]), abs(d[1])), abs(d[0]) + abs(d[1])))
+
+
+def replication_candidates(client):
+    """Live player-faction units on the client that could physically take a step,
+    the client's OWN seat first.
+
+    The skirmish fixture packs all 14 soldiers into the Skyranger's 2x7 interior,
+    so the back rows - which is where the client's seat sits - are boxed in by
+    their own squad-mates and can path nowhere until the front rank walks out.
+    The assertion below is about the DIRECTION a packet travels, not about
+    ownership (that is asserted separately from `selectable`), so any unit the
+    client can actually drive is a valid lever."""
+    b = battle(client)
+    mine = own_units(b, 1)
+    others = [u for u in b["units"]
+              if u.get("faction") == 0 and not u.get("isOut")
+              and u.get("coop") != 1 and u.get("tu", 0) > 20]
+    return mine + others
+
+
+def assert_client_does_not_replicate(host, client, movers):
+    """The other half of the invariant: whatever the client executes, it does not
+    BROADCAST. The send sites are `_isActivePlayerSync`-gated and the client holds
+    false, so the host must not see the move. (This is also exactly what the debug
+    input mode does - the divergence PRD-P5 §4 says to expect.)"""
+    mover_id = None
+    client_before = host_before = None
+    errors = []
+    for cand in movers:
+        uid = cand["id"]
+        client_before = pos(battle(client), uid)
+        host_before = pos(battle(host), uid)
+        if client_before != host_before:
+            errors.append(f"{uid}: machines disagree {host_before} vs {client_before}")
+            continue
+        for dx, dy in STEPS:
+            want = (client_before[0] + dx, client_before[1] + dy, client_before[2])
+            r = client.cmd({"cmd": "battle_action", "action": "move", "unit": uid,
+                            "x": want[0], "y": want[1], "z": want[2]})
+            if r.get("ok"):
+                mover_id = uid
+                break
+            errors.append(f"{uid}->{want}: {r.get('error')}")
+        if mover_id is not None:
+            break
+    assert mover_id is not None, (
+        f"none of the {len(movers)} units the client could drive was able to step "
+        f"anywhere: {errors[:12]}")
+    wait_until(lambda: pos(battle(client), mover_id) != client_before, 30)
+    time.sleep(6)  # generous: a packet, if one were sent, has long arrived
+
+    assert pos(battle(host), mover_id) == host_before, (
+        f"a CLIENT-driven action replicated to the host ({host_before} -> "
+        f"{pos(battle(host), mover_id)}). In parallel mode the client is never the "
+        f"executor: `_isActivePlayerSync` is false there, so no BState may ship a "
+        f"packet from it.")
+    print(f"PASS no-replication: the client moved {mover_id} locally "
+          f"({client_before} -> {pos(battle(client), mover_id)}) and the host's "
+          f"copy never budged from {host_before} - nothing was broadcast")
+
+    # REPAIR the divergence this assertion just created, on the client only.
+    # The step above is a DELIBERATE one-sided state change - that is the whole
+    # point of it - and PRD-P2's unit term (`chkBattleUnits`, added after this
+    # test was last touched) hashes every unit's POSITION. Left standing, the
+    # next `next_turn` compare correctly reports it, `desyncSeen` latches, and
+    # the post-boundary tripwire assertion below fails on this test's own lever
+    # instead of on anything the boundary or the shot did. `battle_teleport` is
+    # local-only (no packet - test_coop_outcome_gaps/place_adjacent has to call
+    # it on BOTH machines to keep them in step), so one call puts the client's
+    # copy back where the host has always had it. TU/energy are excluded from
+    # the term by design, so position parity is full parity for it.
+    back = client.cmd({"cmd": "battle_teleport", "unit": mover_id,
+                       "x": host_before[0], "y": host_before[1],
+                       "z": host_before[2]})
+    assert back.get("moved"), (
+        f"could not put the client's copy of {mover_id} back on the host's tile "
+        f"{host_before} after the no-replication probe ({back}) - the deliberate "
+        f"drift would then trip PRD-P2's unit term at the next boundary")
+    assert pos(battle(host), mover_id) == pos(battle(client), mover_id), (
+        f"the repair teleport left the machines apart: host "
+        f"{pos(battle(host), mover_id)} client {pos(battle(client), mover_id)}")
+
+
+def cycle_side(host, client, timeout=300):
+    """Close the player side from the HOST (the only machine that may) and wait for
+    the alien side to run and the player side to come back.
+
+    In parallel mode btnEndTurnClick skips the `PlayerTurnYour` sub-turn hand-off
+    entirely and closes the whole side: `endTurn` (carrying the boundary RNG seed)
+    then, after the alien side, `next_turn` with the bulk unit/tile state."""
+    start = battle(host).get("turn")
+    host.cmd({"cmd": "battle_action", "action": "end_turn_button"})
+    deadline = time.time() + timeout
+    stalled = {}
+    while time.time() < deadline:
+        for gc in (host, client):
+            b = battle(gc)
+            if not b.get("inBattle"):
+                return None
+            state = TW.top(gc)
+            if state == "NextTurnState":
+                # The HOST's NextTurnState must close ITSELF - close() is where the
+                # `next_turn` packet is built. skipNextTurnScreen (host only) does
+                # that on a timer; a turn message can suppress the timer, so pop it
+                # after a while rather than hang.
+                if gc is host:
+                    first = stalled.setdefault(id(gc), time.time())
+                    if time.time() - first > 25:
+                        gc.cmd({"cmd": "dismiss_popup"})
+                        stalled.pop(id(gc), None)
+                    continue
+                gc.cmd({"cmd": "dismiss_popup"})
+                continue
+            stalled.pop(id(gc), None)
+            if state != "BattlescapeState":
+                gc.cmd({"cmd": "dismiss_popup"})
+        now = battle(host)
+        if (now.get("turn") is not None and start is not None
+                and now["turn"] > start and now.get("coopTurn") == 2
+                and battle(client).get("coopTurn") == 2):
+            return now["turn"]
+        time.sleep(1.0)
+    return False
+
+
+def place_adjacent(host, client, mover_id, tpos):
+    """Teleport `mover_id` to a free tile next to `tpos` on BOTH machines (same
+    coordinates, so the two stay in step). Same lever as
+    test_coop_outcome_gaps.place_adjacent - point blank is the only reliably
+    HITTING shot the harness can drive."""
+    for dx, dy in ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1), (1, -1), (-1, 1)):
+        spot = (tpos[0] + dx, tpos[1] + dy, tpos[2])
+        res = [gc.cmd({"cmd": "battle_teleport", "unit": mover_id,
+                       "x": spot[0], "y": spot[1], "z": spot[2]})
+               for gc in (host, client)]
+        if all(r.get("moved") for r in res):
+            return spot
+    return None
+
+
+def assert_shot_identical(host, client, shooter_id, target):
+    """A host shot after the boundary must land identically on both machines."""
+    target_id = target["id"]
+    spot = place_adjacent(host, client, shooter_id,
+                          (target["x"], target["y"], target["z"]))
+    assert spot, f"no free tile adjacent to hostile {target_id} to shoot from"
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_give", "unit": shooter_id, "item": "STR_RIFLE",
+               "ammo": "STR_RIFLE_CLIP", "slot": "right", "clear_hands": True})
+    time.sleep(2)
+    session.assert_battle_synced(host, client, "after arming the shooter")
+
+    damaged = False
+    for shot in (1, 2, 3, 4, 5):
+        before_h = health(battle(host), target_id)
+        r = host.cmd({"cmd": "battle_fire", "unit": shooter_id, "mode": "snap",
+                      "tu": 200, "target": target_id})
+        assert r.get("ok"), f"the host could not fire: {r}"
+        settle(host, client, seconds=10)
+
+        after_h = health(battle(host), target_id)
+        after_c = health(battle(client), target_id)
+        assert after_h == after_c, (
+            f"post-boundary shot #{shot} did NOT land identically: the host has "
+            f"unit {target_id} at {after_h} HP, the client at {after_c}. The "
+            f"outcome must be host-authored and applied verbatim.")
+        session.assert_battle_synced(host, client, f"after post-boundary shot #{shot}")
+        if after_h != before_h:
+            damaged = True
+            print(f"PASS shot #{shot}: {before_h} -> {after_h} HP, identical on "
+                  f"both machines")
+            break
+        print(f"    shot #{shot} missed ({before_h} HP unchanged) - identical on "
+              f"both machines, firing again")
+    assert damaged, (
+        f"five point-blank snap shots at unit {target_id} all missed - the "
+        f"'identical damage' assertion never got real damage to compare")
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+        "the drift tripwire fired on the post-boundary shot"
+
+
+# ---- main ------------------------------------------------------------------
+
+def main():
+    fail = None
+    try:
+        phase_degrade()
+    except Exception as e:
+        print(f"[FAIL] {e}")
+        sys.exit(2)
+
+    # HOST on, CLIENT off: the host's value is the session's, and the client must
+    # end up in parallel mode anyway. skipNextTurnScreen on the host only - its
+    # NextTurnState::close() is what ships `next_turn` (see test_battle_tripwire).
+    host = GameClient("host", 48860,
+                      make_user_dir("p5_sharedturn_host",
+                                    options={"battleXcomSpeed": 2,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48861,
+                        make_user_dir("p5_sharedturn_client",
+                                      options={"battleXcomSpeed": 2,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        # bring_up_battle() hosts on test_battle_tripwire's own port constant
+        TW.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallelTurnActive() "
+            f"only covers PVE (1) and PVE2 (4), so this test would be vacuous")
+
+        # --- 1. the invariant ------------------------------------------------
+        hb, cb = assert_invariant(host, client, "at the start of the player side")
+        assert cb["parallelEnabled"] is True, (
+            "the client did not adopt the HOST's parallel-turns setting - its own "
+            "option is deliberately OFF here, so this proves the handshake mirror")
+        print(f"PASS invariant: both machines coopTurn=2, parallelActive=True; "
+              f"activeSync host={hb['activeSync']} client={cb['activeSync']} "
+              f"(_isActivePlayerSync == getHost())")
+
+        # both machines must actually be able to command their OWN soldiers
+        for b, tag, seat in ((hb, "host", 0), (cb, "client", 1)):
+            mine = [u for u in b["units"] if u.get("coop") == seat
+                    and u.get("faction") == 0 and not u.get("isOut")]
+            sel = [u for u in mine if u.get("selectable")]
+            assert sel, (
+                f"{tag}: none of its own {len(mine)} soldiers is selectable during "
+                f"the parallel player side - isSelectable()/playableUnitSelected() "
+                f"still gate on the executor flag somewhere")
+            theirs = [u for u in b["units"] if u.get("coop") != seat
+                      and u.get("faction") == 0 and u.get("selectable")]
+            assert not theirs, (
+                f"{tag}: it can also select {len(theirs)} of the PEER's soldiers - "
+                f"parallel turns must not merge the two rosters")
+        print("PASS ownership: each machine commands exactly its own seat's "
+              "soldiers, both at the same time")
+
+        # --- 2. no banners ---------------------------------------------------
+        assert_no_banners(host, client, "during the parallel player side")
+
+        # --- 3. the temporary client input gate ------------------------------
+        assert_client_gate(host, client)
+        assert own_units(battle(client), 1), \
+            "the client commands no soldier with TU to spend"
+        assert_client_does_not_replicate(host, client,
+                                         replication_candidates(client))
+
+        # --- 4. the side boundary --------------------------------------------
+        turn = cycle_side(host, client)
+        assert turn, (
+            f"the side never closed / never came back (turn="
+            f"{battle(host).get('turn')}, host top={TW.top(host)}, client "
+            f"top={TW.top(client)}). In parallel mode the host's END TURN must "
+            f"close the WHOLE side - there is no `PlayerTurnYour` hand-off left.")
+        print(f"side boundary crossed: the alien side ran and the player side came "
+              f"back on turn {turn}")
+        assert_invariant(host, client, f"back on the player side (turn {turn})")
+        assert_no_banners(host, client, f"after the boundary (turn {turn})",
+                          seconds=5.0)
+        print("PASS boundary: invariant re-asserted after the AI phase")
+
+        target = alive_enemy(battle(host))
+        assert target, "no live hostile left to shoot at after the boundary"
+        shooters = own_units(battle(host), 0)
+        assert shooters, "the host commands no unit able to shoot after the boundary"
+        assert_shot_identical(host, client, shooters[0]["id"], target)
+
+        print("ALL PARALLEL SHARED-TURN TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_skip.py b/tools/coop_test/test_parallel_skip.py
new file mode 100644
index 000000000..464a0bf4f
--- /dev/null
+++ b/tools/coop_test/test_parallel_skip.py
@@ -0,0 +1,939 @@
+"""PRD-P7: walk fast-forward + pending-admit.
+
+PRD-P6 made the two players act into one arbiter, but every contention answer was
+"no": an input that arrived while ANY chain was running was refused `busy` and the
+player had to click again. Most of what a chain is, though, is a walk animation
+nobody is waiting for. P7 splits contention in two:
+
+    chain is pure locomotion  ->  DEFER the input (one pending slot per seat),
+                                  arm the fast-forward, admit + ack on drain
+    anything else             ->  PRD-P6's `busy` refusal, unchanged
+
+`BattlescapeGame::chainIsSkippable()` is the classifier: every queued state must
+be a UnitWalk/UnitTurn/UnitFallBState of a FACTION_PLAYER unit. A shot, an
+explosion, a death, a melee or psi state, the end-turn sentinel, or an AI actor
+all make it false - so the moment reaction fire pushes a ProjectileFlyBState into
+a fast-forwarded walk, the skip lapses and the deferred inputs are refused.
+
+What this test asserts (PRD-P7 acceptance, in order):
+
+  1. Contention on a WALK: the host is walking, the client's intent arrives - no
+     deny, the host's walk finishes fast (`parallel_state.fastForward`, with a
+     wall-clock bound as the backstop), the client's action runs next, and both
+     machines end on identical positions and TU.
+  2. Contention on a SHOT: never skipped. `chainSkippable` is false, the client's
+     intent is refused `busy`, nothing is deferred and nothing executes.
+  3. Reaction fire cancels the skip: a shot state joining a fast-forwarded walk
+     clears the fast-forward and refuses the pending input. Driven with
+     `battle_fire`, which pushes exactly what TileEngine::checkReactionFire pushes
+     (`statePushBack(new ProjectileFlyBState)`, TileEngine.cpp:2949) - the
+     aliens' own reaction roll is theirs to make and cannot be scripted.
+  4. A fast-forwarded walk over a PRIMED PROXIMITY GRENADE resolves identically on
+     both machines - the interval-0 seam must not change what the sweep
+     (PRD-P3's host-decided `checkForProximityGrenades`) does.
+  5. RIDER (PRD-P6 finding): `active_grenade`'s receive read the fuse into a
+     `bool` before handing it to an `int` parameter, so every fuse > 1 arrived as
+     1 and the -1 an unprime ships arrived as 1 as well - the peer armed a grenade
+     the executor had just disarmed. Primed fuses must now match on both machines.
+
+TIMING NOTE. Scenarios 1, 3 and 4 all need the host to still be walking when the
+client's intent reaches the arbiter. That window is the walk animation, and the
+fixture roll decides how long it is - a two-tile shuffle is over inside the
+intent's own round trip. It is therefore MEASURED (an uncontended run of the very
+same walk) and escalated - speed and path length together - until it clears a
+floor; see THE DEFER WINDOW below. Nothing about the window is asserted as a
+product property: the assertions are the deferral, the fast-forward, the
+admission after the drain and the two machines agreeing.
+
+Run:  python tools/coop_test/test_parallel_skip.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+PORT = "47987"
+
+BUSY_TEXT = "Another action"
+
+# The host walks at this while the skip is being exercised. It only bites while
+# the walker is ON SCREEN - UnitWalkBState already runs an off-screen walk at
+# interval 0 - so every scenario below points the host's camera at its walker
+# first, and the timing assertion is made against a measured baseline rather than
+# a magic constant.
+SLOW_WALK_MS = 200
+
+# THE DEFER WINDOW. Scenarios 1 and 3 are about what happens to an input that
+# arrives WHILE a walk chain is draining, so the client's `action_intent` has to
+# reach the arbiter before the host's walk is over. That window used to be
+# whatever the fixture roll handed out: a driver whose only path is a two-tile
+# shuffle walks for about a second, which is inside the intent's own round trip -
+# the chain drains first, there is nothing to defer, the intent resolves against
+# an idle arbiter and the scenario fails on an assertion that never had a chance.
+# (Rolls that produced 15-18 s baselines passed every time, same binary, same
+# test - the flake was the fixture, not the product.)
+#
+# So the window is MEASURED, not hoped for: scenario 1 times an UNCONTENDED run
+# of the very same walk and re-rolls it until the walk is big enough, on both of
+# the axes that matter. They are NOT interchangeable:
+#
+#   TILES TRAVELLED is the dominant one. The fast-forward pins the walk interval
+#     to 0, so what is left of the chain after the client's intent lands is drawn
+#     as fast as the game loop can draw it - a handful of milliseconds per tile.
+#     One tile left over means `fastForward`/`pendingAdmits` are true for ~50 ms,
+#     which no poll over a socket is going to see; six tiles left over is a window
+#     of seconds. A destination probe_step vouched for is NOT a distance walked:
+#     the pathfinder re-plans at execution and the walk aborts on a fresh sighting,
+#     so the traversal is measured after the fact (WALK_MIN_TILES).
+#   WALL-CLOCK DURATION only decides whether the intent gets there before the
+#     chain ends at all, and the frame delay is what buys it. It is the second
+#     dial because slowing the animation makes every later walk in the run longer.
+#
+# Hence two escalation dials, cheapest first: WIDEN re-rolls a longer path (one
+# probe RPC), SLOW doubles the frame delay. The pair that worked is remembered in
+# WALK_SLOW/WALK_WIDE, so scenarios 3 and 4 arm at it instead of re-discovering it.
+WALK_RADIUS = 6         # probe_step radius for the first roll
+WALK_WIDEN = 3          # tiles added to that radius per re-roll
+WALK_WIDE_MAX = 2       # radius 6 -> 9 -> 12
+WALK_SLOW_MAX = 2       # 200 -> 400 -> 800 ms/frame
+WALK_MIN_TILES = 4      # tiles the baseline must actually cover
+WALK_FLOOR_S = 4.0
+WALK_ATTEMPTS = 10
+WALK_SLOW = 0
+WALK_WIDE = 0
+
+# Host drivers that will not walk anywhere any more - knocked out, or stuck in a
+# spot the pathfinder keeps approving and the walk keeps declining.
+SPENT = set()
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def pos(b, uid):
+    return PI.pos(b, uid)
+
+
+def tu(b, uid):
+    return PI.tu(b, uid)
+
+
+def unit(b, uid):
+    return PI.unit(b, uid)
+
+
+def items(gc):
+    return gc.ok({"cmd": "battle_items"})
+
+
+def fuse_of(gc, item_id):
+    for it in items(gc)["items"]:
+        if it["id"] == item_id:
+            return it["fuse"]
+    return None
+
+
+def poll(fn, timeout, interval=0.03):
+    """Tight poll - the fast-forwarded window is short by construction."""
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        v = fn()
+        if v:
+            return v
+        time.sleep(interval)
+    return None
+
+
+def speed(gc, ms):
+    gc.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": ms})
+
+
+def look_at(gc, uid):
+    """Put `uid` in view. Without this the walk runs at interval 0 anyway (the
+    pre-existing off-screen seam) and 'it finished fast' proves nothing."""
+    return gc.ok({"cmd": "battle_camera", "unit": uid}).get("onScreen")
+
+
+def walk_ms(slow):
+    return SLOW_WALK_MS * (2 ** slow)
+
+
+def arm_walk(host, uid, slow=None, wide=None):
+    """Open the defer window and hand back the destination that fills it.
+
+    Defaults to the (slow, wide) pair scenario 1 measured for this fixture, so a
+    later scenario arming the same way gets the same window for free."""
+    slow = WALK_SLOW if slow is None else slow
+    wide = WALK_WIDE if wide is None else wide
+    speed(host, walk_ms(slow))
+    assert look_at(host, uid), (
+        f"the host's camera would not frame unit {uid}; an off-screen walk runs "
+        f"at interval 0 regardless and the timing below would be meaningless")
+    return long_walk_target(host, uid, radius=WALK_RADIUS + WALK_WIDEN * wide)
+
+
+def clear_deny(gc):
+    """Reset the client's last-deny latch. It is the only NON-transient readout
+    of a refusal (the warning widget fades in 3 s), so a retry has to start it
+    empty or it reports the previous attempt's answer."""
+    gc.cmd({"cmd": "parallel_state", "clear_deny": True})
+
+
+def tiles(a, b):
+    return max(abs(a[0] - b[0]), abs(a[1] - b[1])) if a and b else 0
+
+
+def top_up(host, client, uid, tu=200, energy=200):
+    """Same TU **and ENERGY** on both machines.
+
+    `PI.top_up` restores TU only, and energy is what actually runs out first: a
+    soldier with 200 TU and no energy refuses to move at all. Every scenario here
+    drives the SAME soldier through several deliberately long walks in a row, so
+    by the third one the walk covers no ground - it is admitted, drains in about a
+    second and nothing happens. That is the "1 s baseline" this file's defer
+    window kept losing to, and it is a fixture accident all the way down; the
+    `energy` field exists on `battle_intent` for exactly this (TestServer.cpp,
+    PRD-P9), and test_parallel_soak.py hit it first."""
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_intent", "unit": uid, "action": "turn",
+               "tu": tu, "energy": energy, "dry": True})
+
+
+def armed_now(host):
+    """Fast-forward armed AND something deferred behind it, read from ONE query -
+    two `parallel()` calls would be two round trips straddling the transition."""
+    ps = parallel(host)
+    return ps.get("fastForward") is True and bool(ps.get("pendingAdmits"))
+
+
+def watch_defer(host, seq_before, timeout, grace=1.5):
+    """Sample the whole deferral in one poll loop: was the fast-forward armed, was
+    anything deferred, and did action_seq reach the +2 that IS the drain.
+
+    One loop rather than three, because the first two are transient by design -
+    an 8 s poll for `fastForward` is 8 s during which `pendingAdmits` comes and
+    goes unseen, and both are gone by the time a third poll starts.
+
+    It also gives up early on the answer that never arrives. A deferred intent can
+    be REFUSED instead of admitted (reaction fire joins the chain, the skip lapses,
+    PRD-P7 denies the pending slot - scenario 3's subject, and the aliens may
+    choose it here too), and then +2 never comes: once the host is idle with its
+    own walk counted and nothing deferred, waiting out the timeout learns nothing.
+    `grace` covers the ordinary case of an intent still in flight at that moment.
+    Returns (ff, pend, admitted)."""
+    ff = pend = False
+    idle_since = None
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        ps = parallel(host)
+        ff = ff or ps.get("fastForward") is True
+        pend = pend or bool(ps.get("pendingAdmits"))
+        seq = ps.get("actionSeq", 0)
+        if seq >= seq_before + 2:
+            return ff, pend, True
+        if (ps.get("canAdmit") is True and not ps.get("pendingAdmits")
+                and seq == seq_before + 1):
+            idle_since = idle_since or time.time()
+            if time.time() - idle_since >= grace:
+                break
+        else:
+            idle_since = None
+        time.sleep(0.02)
+    return ff, pend, False
+
+
+def idle(gc, timeout=240):
+    # Generous on purpose: the walks here are deliberately slowed (see THE DEFER
+    # WINDOW), and an interrupted one loses its fast-forward and finishes drawing
+    # every remaining tile at the slowed frame rate.
+    return PI.wait_until(
+        lambda: parallel(gc).get("canAdmit") is True
+        and not parallel(gc).get("pendingAdmits"), timeout)
+
+
+def quiet(host, client, what):
+    PI.settle(host, client)
+    session.assert_battle_synced(host, client, what)
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+        f"the PRD-P2 drift tripwire fired {what}"
+
+
+def fresh_driver(host, client, seat=0):
+    """A DIFFERENT soldier of `seat`, placed where it can act.
+
+    `PI.pick_driver` always hands back the first candidate that can be placed,
+    which is the one we are trying to get away from - hence SPENT."""
+    enemy = PI.alive_enemy(battle(host))
+    if not enemy:
+        return None
+    epos = (enemy["x"], enemy["y"], enemy["z"])
+    for cand in PI.own_units(battle(client), seat):
+        if cand["id"] in SPENT:
+            continue
+        spot = PI.place_near(host, client, cand["id"], epos)
+        if spot:
+            top_up(host, client, cand["id"])
+            print(f"    (host driver switched to unit {cand['id']} at {spot})")
+            return cand["id"]
+    return None
+
+
+def live_driver(host, client, uid, seat=0):
+    """`uid` if it is still on its feet, otherwise a replacement.
+
+    The host's walker is marched past hostiles over and over and (scenario 4)
+    straight over a primed grenade, so it gets knocked out - `status` 6,
+    UNCONSCIOUS - fairly often. A casualty does not walk, and no re-roll, no
+    wider radius and no teleport changes that: every scenario after the one that
+    dropped it would otherwise fail on a walk that never starts, reported as a
+    fast-forward that never fired."""
+    u = unit(battle(host), uid)
+    if u and not u.get("isOut"):
+        return uid
+    SPENT.add(uid)
+    nxt = fresh_driver(host, client, seat)
+    assert nxt, (
+        f"host driver {uid} is out of the fight and no other host soldier could "
+        f"be placed where it can act either")
+    return nxt
+
+
+def nearest_enemy(b, here):
+    live = [u for u in b.get("units", [])
+            if u.get("faction") == 1 and not u.get("isOut")
+            and u.get("health", 0) > 0]
+    return min(live, key=lambda u: tiles(here, (u["x"], u["y"]))) if live else None
+
+
+def long_walk_target(gc, uid, radius=WALK_RADIUS):
+    """The furthest tile `uid` can reach, preferring one that walks AWAY from the
+    nearest hostile.
+
+    Distance is what makes the walk long enough to defer an intent behind; the
+    DIRECTION is what keeps that deferral alive. A walk that closes on an alien
+    draws reaction fire, reaction fire pushes a ProjectileFlyBState into the
+    chain, and a chain carrying a shot is not skippable - so PRD-P7 correctly
+    cancels the fast-forward and refuses the pending intent. That is scenario 3's
+    subject, and in scenario 1 it is just a wasted roll (four in a row, once).
+    The aliens' reaction roll is theirs to make, but which way we walk is ours."""
+    b = battle(gc)
+    here = pos(b, uid)
+    cands = PI.steps_of(gc, uid, radius)
+    if not cands:
+        return PI.free_step(gc, uid)
+    far = [t for t in cands if tiles(here, t) >= WALK_MIN_TILES]
+    enemy = nearest_enemy(b, here)
+    if not far:
+        return max(cands, key=lambda t: tiles(here, t))
+    if not enemy:
+        return max(far, key=lambda t: tiles(here, t))
+    epos = (enemy["x"], enemy["y"])
+    return max(far, key=lambda t: (tiles(epos, t), tiles(here, t)))
+
+
+def timed_walk(host, uid, dest, seq_before, timeout=150):
+    """Drive one host walk and return how long the chain took to drain. The clock
+    stops when action_seq has moved and the arbiter will take another action,
+    which is the drain point - not when the harness next happens to poll."""
+    started = time.time()
+    r = PI.intent(host, action="move", unit=uid,
+                  x=dest[0], y=dest[1], z=dest[2])
+    assert r.get("ok"), f"the walk lever refused: {r}"
+    assert r.get("routed") is False, (
+        f"the host's own walk was not admitted ({r}); parallel_state="
+        f"{parallel(host)}")
+    done = poll(lambda: parallel(host).get("actionSeq", 0) > seq_before
+                and parallel(host).get("canAdmit") is True, timeout, 0.1)
+    assert done, (
+        f"the host walk of unit {uid} to {dest} never drained: "
+        f"{parallel(host)} at {pos(battle(host), uid)}")
+    return time.time() - started
+
+
+# ---- 1. contention on a walk: deferred, skipped, both machines agree ---------
+
+def scenario_walk_skip(host, client, host_mover, client_mover):
+    global WALK_SLOW, WALK_WIDE
+    print("-- 1: client input during a host WALK -> deferred + fast-forwarded --")
+    assert idle(host), f"the host is still busy: {parallel(host)}"
+    top_up(host, client, host_mover)
+    top_up(host, client, client_mover)
+
+    # Baseline: the SAME walk, uncontended. Self-calibrating - the animation cost
+    # depends on the armor's phase count and on how many tiles the pathfinder
+    # found, neither of which a constant in this file can know - and escalating,
+    # because a walk that is over in a second leaves the client's intent nothing
+    # to arrive behind (see THE DEFER WINDOW at the top of this file).
+    baseline = 0.0
+    h_origin = h_landed = host_dest = None
+    covered = zeros = stuck = 0
+    for attempt in range(WALK_ATTEMPTS):
+        nxt = live_driver(host, client, host_mover)
+        if nxt != host_mover:
+            host_mover, stuck, zeros = nxt, 0, 0
+        top_up(host, client, host_mover)
+        h_origin = pos(battle(host), host_mover)
+        host_dest = arm_walk(host, host_mover, WALK_SLOW, WALK_WIDE)
+        assert host_dest, f"host soldier {host_mover} cannot step anywhere"
+        baseline = timed_walk(host, host_mover, host_dest,
+                              parallel(host)["actionSeq"],
+                              timeout=150 + 150 * WALK_SLOW)
+        PI.settle(host, client, seconds=3)
+        h_landed = pos(battle(host), host_mover)
+        covered = tiles(h_origin, h_landed)
+        print(f"    baseline {attempt}: an unskipped {h_origin} -> {host_dest} "
+              f"walk at {walk_ms(WALK_SLOW)} ms/frame (radius "
+              f"{WALK_RADIUS + WALK_WIDEN * WALK_WIDE}) covered {covered} tile(s) "
+              f"to {h_landed} in {baseline:.1f}s (unit {host_mover} status "
+              f"{(unit(battle(host), host_mover) or {}).get('status')})")
+        if covered >= WALK_MIN_TILES and baseline >= WALK_FLOOR_S:
+            break
+        zeros = zeros + 1 if covered == 0 else 0
+        if zeros >= 2:
+            # Not merely short of options - STUCK. probe_step keeps vouching for
+            # a destination the walk then declines to start on (it re-plans at
+            # execution, and `getStartDirection() != -1` is not the same question
+            # as `getTUCost() != INVALID_MOVE_COST`), and from the same tile every
+            # further roll returns the same answer, so widening is just a slower
+            # way to fail. Two escapes, in order: put the driver back on open
+            # ground (PRD-P9's rider R6 answer to a boxed-in unit), and, if it
+            # STILL will not walk - the condition follows the unit, not the tile -
+            # drive a different soldier for the rest of the test.
+            # WALK_WIDE is deliberately NOT reset: how far a driver has to
+            # aim to find a real walk is a property of the map, not of the
+            # soldier, so the dial only ever ratchets up.
+            stuck += 1
+            zeros = 0
+            if stuck == 1:
+                enemy = PI.alive_enemy(battle(host))
+                spot = PI.place_near(host, client, host_mover,
+                                     (enemy["x"], enemy["y"], enemy["z"])) \
+                    if enemy else None
+                print(f"    (unit {host_mover} would not leave {h_landed}; "
+                      f"re-placed at {spot})")
+            else:
+                SPENT.add(host_mover)
+                nxt = fresh_driver(host, client)
+                assert nxt, (
+                    f"unit {host_mover} has stopped walking and no other host "
+                    f"soldier could be placed where it can act either - the "
+                    f"fixture has no driver left to time a walk with")
+                host_mover, stuck = nxt, 0
+            continue
+        # Widen first (one probe RPC); spend the frame delay only when the walk
+        # DID cover the ground and was merely quick. See THE DEFER WINDOW above.
+        if covered < WALK_MIN_TILES:
+            WALK_WIDE = min(WALK_WIDE + 1, WALK_WIDE_MAX)
+        else:
+            WALK_SLOW = min(WALK_SLOW + 1, WALK_SLOW_MAX)
+    assert covered >= WALK_MIN_TILES and baseline >= WALK_FLOOR_S, (
+        f"in {WALK_ATTEMPTS} rolls no walk unit {host_mover} can make covers "
+        f"{WALK_MIN_TILES} tiles and lasts {WALK_FLOOR_S}s (best {covered} "
+        f"tile(s) in {baseline:.1f}s, at up to {walk_ms(WALK_SLOW_MAX)} ms/frame "
+        f"out to radius {WALK_RADIUS + WALK_WIDEN * WALK_WIDE_MAX}). A chain that "
+        f"short leaves nothing to fast-forward once the client's intent lands, so "
+        f"the deferral below would be a coin flip rather than a test")
+
+    ff = pend = None
+    elapsed = 0.0
+    h_from = c_from = None
+    for attempt in range(5):
+        assert idle(host), f"the host is still busy: {parallel(host)}"
+        host_mover = live_driver(host, client, host_mover)
+        top_up(host, client, host_mover)
+        top_up(host, client, client_mover)
+        # The client's destination is resolved while everything is idle:
+        # probe_step refuses mid-chain (Pathfinding is a singleton the running
+        # walk dequeues from). Re-resolved per attempt, because a retry means
+        # the client's soldier may have moved after all.
+        client_dest = PI.free_step_both(host, client, client_mover)
+        assert client_dest, f"client soldier {client_mover} cannot step anywhere"
+        speed(host, walk_ms(WALK_SLOW))
+        assert look_at(host, host_mover), "the host's camera lost the walker"
+        # The RETURN LEG of the walk just timed: the same tiles in the opposite
+        # order, so the window that was measured IS the window the client's
+        # intent lands in. A fresh `long_walk_target` roll would be of unknown
+        # length again, which is the whole bug.
+        dest = h_origin if attempt == 0 else arm_walk(host, host_mover)
+        assert dest, f"host soldier {host_mover} cannot step again"
+        h_from = pos(battle(host), host_mover)
+        c_from = pos(battle(host), client_mover)
+        seq_before = parallel(host)["actionSeq"]
+        clear_deny(client)
+
+        started = time.time()
+        r = PI.intent(host, action="move", unit=host_mover,
+                      x=dest[0], y=dest[1], z=dest[2])
+        if not r.get("ok") and attempt == 0:
+            print(f"    (something moved onto the return leg: {r}; rolling a "
+                  f"fresh path of the same length instead)")
+            continue
+        assert r.get("ok"), f"the walk lever refused: {r}"
+        assert r.get("routed") is False, (
+            f"the host's own walk was not admitted ({r}); parallel_state="
+            f"{parallel(host)}")
+        # Synchronous on the host, so the walk is queued the instant the RPC
+        # returns - and chainIsSkippable() is FALSE on an empty state list
+        # (BattlescapeGame.cpp:2210), so this doubles as proof that a chain is
+        # actually running right now.
+        ps = parallel(host)
+        assert ps.get("chainSkippable") is True, (
+            f"a plain player walk did not classify as skippable ({ps}) - nothing "
+            f"below is testing the skip")
+
+        rc = PI.intent(client, action="move", unit=client_mover,
+                       x=client_dest[0], y=client_dest[1], z=client_dest[2])
+        assert rc.get("routed") is True, f"the client executed locally: {rc}"
+
+        # The deferred intent is admitted at the drain, so action_seq +2 IS the
+        # drain - but +2 ALONE is not proof of a deferral: an intent that arrives
+        # after the walk ended is admitted straight away and reaches the same
+        # count. `ff`/`pend` are what tell the two apart, so all three come out
+        # of the same poll and all three have to hold.
+        ff, pend, admitted = watch_defer(host, seq_before, 150)
+        elapsed = time.time() - started
+        if admitted and (ff or pend):
+            # ...and BOTH walks have to have gone somewhere, which is a separate
+            # question from whether they were admitted. Every destination here
+            # has to be resolved before the host's walk starts (probe_step
+            # refuses mid-chain), so each is a tile chosen against a board that
+            # has since moved: the pathfinder re-plans at execution and can
+            # decline to start, and the host's own walker spends the whole window
+            # crossing tiles. Either walk can then be admitted, execute, and
+            # cover no ground - a fixture accident, not a PRD-P7 answer, so roll
+            # the whole contention again rather than assert on it.
+            h_walked = tiles(h_from, pos(battle(host), host_mover))
+            c_moved = bool(h_walked) and PI.wait_until(
+                lambda: pos(battle(host), client_mover) != c_from, 45)
+            if h_walked and c_moved:
+                break
+            print(f"    (a deferral happened but a walk went nowhere: the host "
+                  f"covered {h_walked} tile(s) from {h_from}, the client "
+                  f"{'moved' if c_moved else 'did not move'} from {c_from} "
+                  f"towards {client_dest}; rolling again)")
+            idle(host)
+            PI.settle(host, client, seconds=3)
+            continue
+
+        # Two different misses, and only one of them is about the window.
+        assert parallel(host).get("actionSeq", 0) > seq_before, (
+            f"the host's OWN walk was never admitted, so the arbiter - not the "
+            f"timing - is what went wrong: host={parallel(host)} "
+            f"client={parallel(client)}")
+        PI.wait_until(lambda: parallel(client)["pendingReqId"] == 0, 20)
+        walked = tiles(h_from, pos(battle(host), host_mover))
+        deny = parallel(client).get("lastDenyReason") or ""
+        if ff or pend:
+            # The intent WAS deferred and then refused: something non-skippable
+            # joined the chain, which is PRD-P7 behaving exactly as specified
+            # (scenario 3 drives that case on purpose - here it is the aliens'
+            # own reaction roll, and it is theirs to make). Nothing to escalate;
+            # roll the walk again.
+            print(f"    (the deferral was cancelled {walked} tile(s) in - "
+                  f"deny={deny!r}; something joined the chain, rolling again)")
+        else:
+            # Nothing was ever deferred: this one IS the window. Same two dials
+            # as the baseline, cheapest first.
+            if walked < WALK_MIN_TILES:
+                WALK_WIDE = min(WALK_WIDE + 1, WALK_WIDE_MAX)
+            else:
+                WALK_SLOW = min(WALK_SLOW + 1, WALK_SLOW_MAX)
+            print(f"    (a {walked}-tile contended walk closed before the "
+                  f"client's intent was deferred - admitted={admitted} "
+                  f"deny={deny!r}; re-arming at {walk_ms(WALK_SLOW)} ms/frame, "
+                  f"radius {WALK_RADIUS + WALK_WIDEN * WALK_WIDE})")
+        idle(host)
+        PI.settle(host, client, seconds=3)
+    else:
+        raise AssertionError(
+            f"in 5 attempts the client's intent was never both DEFERRED behind "
+            f"the host's walk and then admitted into a walk that moved: "
+            f"host={parallel(host)} client={parallel(client)} "
+            f"warning={PI.warning_of(client)!r}")
+
+    speed(host, 2)
+    assert idle(host), f"the host never went idle: {parallel(host)}"
+    PI.settle(host, client, seconds=6)
+
+    seen = PI.warning_of(client)
+    assert BUSY_TEXT.lower() not in (seen or "").lower(), (
+        f"the client was refused {seen!r} - PRD-P7 must DEFER an input that "
+        f"arrives behind a chain of pure locomotion, not refuse it")
+    # The widget text fades after 3 s and this read can land late; the deny latch
+    # does not fade and was cleared immediately before the intent went out, so it
+    # is the assertion that actually holds the line.
+    assert parallel(client).get("lastDenyReason") != "busy", (
+        f"the client's intent was latched as refused busy "
+        f"({parallel(client).get('lastDenyWarning')!r}) even though it ran - "
+        f"PRD-P7 must DEFER an input that arrives behind pure locomotion")
+    assert pend or ff, (
+        f"neither a pending slot nor the fast-forward was ever visible on the "
+        f"host, so the deferral cannot be told apart from a lucky race: "
+        f"{parallel(host)}")
+    assert ff or elapsed < baseline * 0.6, (
+        f"the contended walk took {elapsed:.1f}s against an uncontended "
+        f"baseline of {baseline:.1f}s and the fast-forward was never "
+        f"observed - the interval-0 seam is not firing")
+
+    hb, cb = battle(host), battle(client)
+    for uid, start in ((host_mover, h_from), (client_mover, c_from)):
+        assert pos(hb, uid) == pos(cb, uid), (
+            f"unit {uid} ended at {pos(hb, uid)} on the host and {pos(cb, uid)} "
+            f"on the client - the fast-forward changed the OUTCOME, not just how "
+            f"long it took to draw")
+        assert tu(hb, uid) == tu(cb, uid), (
+            f"unit {uid} was charged {tu(hb, uid)} TU on the host and "
+            f"{tu(cb, uid)} on the client")
+        assert pos(hb, uid) != start, f"unit {uid} never moved at all"
+    quiet(host, client, "after the fast-forwarded walk contention")
+    print(f"PASS 1: host walk {h_from} -> {pos(hb, host_mover)} fast-forwarded "
+          f"(fastForward seen={bool(ff)}, pending seen={bool(pend)}, "
+          f"{elapsed:.1f}s vs a {baseline:.1f}s baseline), the deferred client "
+          f"walk ran next, both machines identical")
+    # The walker may have been swapped out along the way; the later scenarios arm
+    # the same way and want the driver that is known to still walk.
+    return host_mover
+
+
+# ---- 2. contention on a shot: never skipped ---------------------------------
+
+def scenario_shot_never_skipped(host, client, host_mover, client_mover):
+    print("-- 2: client input during a host SHOT -> refused busy, no skip --")
+    assert idle(host), f"the host is still busy: {parallel(host)}"
+    host_mover = live_driver(host, client, host_mover)
+    top_up(host, client, host_mover)
+    top_up(host, client, client_mover)
+    client_dest = PI.free_step_both(host, client, client_mover)
+    assert client_dest, f"client soldier {client_mover} cannot step anywhere"
+    wid = PI.give_both(host, client, host_mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+    speed(host, 200)
+    aim, ps = PI.start_busy_shot(host, client, host_mover, wid)
+    if not aim:
+        speed(host, 2)
+    assert aim, (
+        f"no aim point produced a shot chain that outlived the RPC, so the deny "
+        f"path cannot be exercised: {ps}")
+    assert ps.get("chainSkippable") is False, (
+        f"a chain carrying a ProjectileFlyBState classified as SKIPPABLE: {ps}")
+    assert ps.get("fastForward") is False, (
+        f"the fast-forward was armed for a shot chain: {ps}")
+
+    c_before = pos(battle(host), client_mover)
+    clear_deny(client)
+    r = PI.intent(client, action="move", unit=client_mover,
+                  x=client_dest[0], y=client_dest[1], z=client_dest[2])
+    assert r.get("routed") is True, f"the client executed locally: {r}"
+
+    # The flash is the UX and the latch is the record. This deny is sent the
+    # moment the intent is received (unlike scenario 3's, which waits for the
+    # interruption), so the widget read is normally the one that answers - but
+    # the same 3 s fade applies, so accept either.
+    seen = PI.wait_for_text(client, BUSY_TEXT, timeout=25)
+    latched = poll(lambda: parallel(client).get("lastDenyReason") == "busy", 10)
+    speed(host, 2)
+    assert seen or latched, (
+        f"no STR_COOP_PLAYER_BUSY flash after an intent sent into a running SHOT "
+        f"(widget shows {PI.warning_of(client)!r}, lastDenyReason="
+        f"{parallel(client).get('lastDenyReason')!r}). A shot is exactly the "
+        f"chain PRD-P7 must keep refusing.")
+    assert not parallel(host).get("pendingAdmits"), (
+        f"the intent was DEFERRED behind a shot: {parallel(host)}")
+    assert pos(battle(host), client_mover) == c_before, (
+        f"a refused intent still moved unit {client_mover} "
+        f"({c_before} -> {pos(battle(host), client_mover)})")
+    assert PI.wait_until(lambda: parallel(client)["pendingReqId"] == 0, 15), \
+        "the deny did not clear the client's pending slot"
+    assert idle(host), f"the shot chain never ended: {parallel(host)}"
+    quiet(host, client, "after the refused shot contention")
+    print(f"PASS 2: the shot was never skipped and the client was refused "
+          f"{seen if seen else parallel(client).get('lastDenyWarning')!r}")
+    return host_mover
+
+
+# ---- 3. reaction fire cancels the skip --------------------------------------
+
+def scenario_reaction_cancels(host, client, host_mover, client_mover):
+    print("-- 3: a shot joining a fast-forwarded walk cancels it --")
+    assert idle(host), f"the host is still busy: {parallel(host)}"
+    host_mover = live_driver(host, client, host_mover)
+    top_up(host, client, host_mover)
+    top_up(host, client, client_mover)
+    wid = PI.give_both(host, client, host_mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+
+    # This scenario arms exactly the way scenario 1 does, so it carries the same
+    # short-roll hazard - and one more of its own. There are TWO windows to hit
+    # here, and the second is the tight one:
+    #
+    #   (a) the client's intent has to land while the walk is still running, same
+    #       as scenario 1 -> same answer, arm at the (slow, wide) pair scenario 1
+    #       measured, escalate on a miss.
+    #   (b) the interruption has to land while that deferred intent is STILL
+    #       pending. Arming the fast-forward pins the walk to interval 0, so the
+    #       whole remaining chain drains in well under a second and the pending
+    #       intent is then ADMITTED rather than cancelled - there is nothing left
+    #       to interrupt and no deny is owed to anyone. The aim point is therefore
+    #       resolved BEFORE the walk starts (a `battle_state` dump between the
+    #       fast-forward and the shot is by itself enough to miss the window), and
+    #       a miss re-arms instead of asserting.
+    armed = c_before = seen = deny_latched = None
+    for attempt in range(3):
+        assert idle(host), f"the host is still busy: {parallel(host)}"
+        top_up(host, client, host_mover)
+        top_up(host, client, client_mover)
+        client_dest = PI.free_step_both(host, client, client_mover)
+        assert client_dest, f"client soldier {client_mover} cannot step anywhere"
+        slow = min(WALK_SLOW + attempt, WALK_SLOW_MAX)
+        wide = min(WALK_WIDE + attempt, WALK_WIDE_MAX)
+        host_dest = arm_walk(host, host_mover, slow, wide)
+        assert host_dest, f"host soldier {host_mover} cannot step anywhere"
+        aim = PI.aim_away(host, host_mover)
+
+        c_before = pos(battle(host), client_mover)
+        clear_deny(client)
+        assert PI.intent(host, action="move", unit=host_mover,
+                         x=host_dest[0], y=host_dest[1], z=host_dest[2]).get("ok")
+        r = PI.intent(client, action="move", unit=client_mover,
+                      x=client_dest[0], y=client_dest[1], z=client_dest[2])
+        assert r.get("routed") is True, f"the client executed locally: {r}"
+        armed = poll(lambda: armed_now(host), 12, 0.02)
+        if not armed:
+            print(f"    (the {walk_ms(slow)} ms/frame walk drained before the "
+                  f"intent landed; re-arming wider and slower)")
+            PI.wait_until(lambda: parallel(client)["pendingReqId"] == 0, 20)
+            idle(host, timeout=240)
+            PI.settle(host, client, seconds=3)
+            continue
+
+        # The interruption, issued the instant the arming is seen and in ONE RPC.
+        # `battle_fire` statePushBack()s a ProjectileFlyBState onto the running
+        # chain - the same push TileEngine::checkReactionFire makes.
+        host.cmd({"cmd": "battle_fire", "unit": host_mover, "mode": "snap",
+                  "weapon_id": wid, "tu": 200,
+                  "x": aim[0], "y": aim[1], "z": aim[2]})
+
+        assert parallel(host).get("fastForward") is False, (
+            f"the fast-forward survived a shot state joining the chain: "
+            f"{parallel(host)}")
+        assert not parallel(host).get("pendingAdmits"), (
+            f"the pending input survived the interruption: {parallel(host)}")
+        # The flash lives 3 s and this poll can start late, so the transient
+        # widget text is corroborating evidence, not the arbiter. The deny's
+        # arrival is latched in parallel_state.lastDenyReason (PRD-P8); a
+        # genuinely dropped deny leaves the latch empty and the pending slot set
+        # until the client's 10 s watchdog fires a TIMEOUT instead - which the
+        # pending-slot assert below still catches.
+        seen = PI.wait_for_text(client, BUSY_TEXT, timeout=15)
+        deny_latched = poll(
+            lambda: (parallel(client).get("lastDenyReason") == "busy"
+                     and parallel(client)["pendingReqId"] == 0), 15)
+        if seen or deny_latched:
+            break
+        # Nobody was refused because nobody was still pending: the interval-0
+        # drain beat the shot to it and the deferred intent was admitted. Window
+        # (b) missed - not a product answer, so re-arm rather than assert.
+        assert pos(battle(host), client_mover) != c_before, (
+            f"the pending intent was neither denied NOR executed - it was "
+            f"silently dropped: host={parallel(host)} client={parallel(client)}")
+        print(f"    (the fast-forward drained the walk before the shot could "
+              f"join it, so the deferred intent was admitted instead of "
+              f"cancelled; re-arming)")
+        idle(host, timeout=240)
+        PI.settle(host, client, seconds=3)
+    speed(host, 2)
+    assert armed, (
+        f"the walk was never fast-forwarded with a pending input, in 3 attempts, "
+        f"so there is nothing for the interruption to cancel: {parallel(host)}")
+    assert seen or deny_latched, (
+        f"the interrupted pending intent was dropped without telling the client "
+        f"(widget shows {PI.warning_of(client)!r}, "
+        f"lastDenyReason={parallel(client).get('lastDenyReason')!r}) - the "
+        f"player would wait for an action that is never coming")
+    assert PI.wait_until(lambda: parallel(client)["pendingReqId"] == 0, 15), \
+        "the deny did not clear the client's pending slot"
+    assert pos(battle(host), client_mover) == c_before, (
+        f"the DENIED pending intent executed anyway: unit {client_mover} "
+        f"{c_before} -> {pos(battle(host), client_mover)}")
+
+    assert idle(host), f"the interrupted chain never ended: {parallel(host)}"
+    quiet(host, client, "after the interrupted fast-forward")
+    hb, cb = battle(host), battle(client)
+    assert pos(hb, host_mover) == pos(cb, host_mover), (
+        f"the interrupted walk diverged: host {pos(hb, host_mover)} client "
+        f"{pos(cb, host_mover)}")
+    print(f"PASS 3: the shot cancelled the skip, the pending input was refused "
+          f"{seen if seen else parallel(client).get('lastDenyWarning')!r}, and "
+          f"the census stayed symmetric")
+    return host_mover
+
+
+# ---- 4. fast-forwarded walk over a primed proximity grenade ------------------
+
+def scenario_proximity(host, client, host_mover, client_mover):
+    print("-- 4: a fast-forwarded walk over a PRIMED proximity grenade --")
+    assert idle(host), f"the host is still busy: {parallel(host)}"
+    host_mover = live_driver(host, client, host_mover)
+    top_up(host, client, host_mover)
+    top_up(host, client, client_mover)
+    client_dest = PI.free_step_both(host, client, client_mover)
+    assert client_dest, f"client soldier {client_mover} cannot step anywhere"
+    # Same arming as 1 and 3. Nothing here ASSERTS on the fast-forward - the
+    # subject is the sweep's outcome, not the skip - but a walk that is over
+    # before the client's intent lands never enters the interval-0 seam at all,
+    # which is the seam this scenario exists to walk a primed grenade through.
+    host_dest = arm_walk(host, host_mover)
+    assert host_dest, f"host soldier {host_mover} cannot step anywhere"
+
+    # An armed proximity grenade on the destination tile, minted identically on
+    # both machines (the ids must match or the sweep's removal list resolves to
+    # nothing on the peer).
+    drop = [host.ok({"cmd": "battle_give", "unit": host_mover,
+                     "item": "STR_PROXIMITY_GRENADE", "slot": "ground", "fuse": 0,
+                     "x": host_dest[0], "y": host_dest[1], "z": host_dest[2]}),
+            client.ok({"cmd": "battle_give", "unit": host_mover,
+                       "item": "STR_PROXIMITY_GRENADE", "slot": "ground", "fuse": 0,
+                       "x": host_dest[0], "y": host_dest[1], "z": host_dest[2]})]
+    assert drop[0]["weaponId"] == drop[1]["weaponId"], (
+        f"the two machines minted different ids for the proximity grenade "
+        f"({drop[0]['weaponId']} vs {drop[1]['weaponId']})")
+    grenade = drop[0]["weaponId"]
+    time.sleep(2)
+    assert fuse_of(host, grenade) == fuse_of(client, grenade) == 0, (
+        f"the planted fuse does not match: host {fuse_of(host, grenade)} client "
+        f"{fuse_of(client, grenade)}")
+
+    h_hp = unit(battle(host), host_mover)["health"]
+    assert PI.intent(host, action="move", unit=host_mover,
+                     x=host_dest[0], y=host_dest[1], z=host_dest[2]).get("ok")
+    PI.intent(client, action="move", unit=client_mover,
+              x=client_dest[0], y=client_dest[1], z=client_dest[2])
+    ff = poll(lambda: parallel(host).get("fastForward") is True, 8)
+    assert idle(host, timeout=300), f"the chain never ended: {parallel(host)}"
+    speed(host, 2)
+    PI.settle(host, client, seconds=8)
+
+    hb, cb = battle(host), battle(client)
+    hi, ci = items(host), items(client)
+    assert hi["counts"].get("STR_PROXIMITY_GRENADE", 0) == \
+        ci["counts"].get("STR_PROXIMITY_GRENADE", 0), (
+        f"the grenade survived on one machine only: host "
+        f"{hi['counts'].get('STR_PROXIMITY_GRENADE', 0)} client "
+        f"{ci['counts'].get('STR_PROXIMITY_GRENADE', 0)}")
+    assert hi["total"] == ci["total"], (
+        f"item census diverged over the fast-forwarded walk: host {hi['total']} "
+        f"client {ci['total']}")
+    for uid in (host_mover, client_mover):
+        assert pos(hb, uid) == pos(cb, uid), \
+            f"unit {uid} diverged: host {pos(hb, uid)} client {pos(cb, uid)}"
+        assert unit(hb, uid)["health"] == unit(cb, uid)["health"], (
+            f"unit {uid} took different damage: host "
+            f"{unit(hb, uid)['health']} client {unit(cb, uid)['health']}")
+    quiet(host, client, "after the fast-forwarded walk over a primed grenade")
+    print(f"PASS 4: identical outcome on both machines (walker HP {h_hp} -> "
+          f"{unit(hb, host_mover)['health']}, "
+          f"{hi['total']} items on each, fastForward seen={bool(ff)})")
+
+
+# ---- 5. rider: active_grenade's fuse is an int, not a bool -------------------
+
+def scenario_fuse_width(host, client, client_mover):
+    print("-- 5: a primed fuse arrives at its real value, not clipped to 1 --")
+    assert idle(host), f"the host is still busy: {parallel(host)}"
+    top_up(host, client, client_mover)
+    wid = PI.give_both(host, client, client_mover, "STR_GRENADE")
+    seq_before = parallel(host)["actionSeq"]
+    r = PI.intent(client, action="prime", unit=client_mover, fuse=5, weapon_id=wid)
+    assert r.get("ok") and r.get("routed") is True, f"the prime did not ship: {r}"
+    assert PI.wait_until(lambda: parallel(client)["pendingReqId"] == 0, 25), \
+        "the prime intent got no ack/deny"
+    assert parallel(host)["actionSeq"] > seq_before, (
+        f"the prime was never admitted; the client was told "
+        f"{PI.warning_of(client)!r}")
+    assert idle(host), "the prime chain never ended"
+    PI.settle(host, client, seconds=4)
+
+    hf, cf = fuse_of(host, wid), fuse_of(client, wid)
+    assert hf == 5, f"the host primed the grenade to {hf}, not 5"
+    assert cf == hf, (
+        f"the client's copy of item {wid} carries fuse {cf}, the host's {hf}. "
+        f"`active_grenade`'s receive read the value into a bool, so every fuse "
+        f"above 1 arrived as 1 (and the -1 an unprime ships arrived as 1 too, "
+        f"arming a grenade the executor had disarmed).")
+    quiet(host, client, "after the primed-fuse round trip")
+    print(f"PASS 5: fuse {hf} on both machines")
+
+
+# ---- main ------------------------------------------------------------------
+
+def main():
+    fail = None
+    host = GameClient("host", 48874,
+                      make_user_dir("p7_skip_host",
+                                    options={"battleXcomSpeed": 2,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48875,
+                        make_user_dir("p7_skip_client",
+                                      options={"battleXcomSpeed": 2,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, \
+            "the PRD-P5 executor invariant does not hold"
+        ps = parallel(host)
+        for key in ("fastForward", "chainSkippable", "displayBacklog",
+                    "pendingAdmits"):
+            assert key in ps, (
+                f"parallel_state carries no {key!r} - PRD-P7's introspection is "
+                f"missing and every assertion below would be vacuous: {sorted(ps)}")
+
+        seat = client.ok({"cmd": "get_coop"})["localSeat"]
+        client_mover = PI.pick_driver(host, client, seat, "client")
+        host_mover = PI.pick_driver(host, client, 0, "host")
+
+        host_mover = scenario_walk_skip(host, client, host_mover, client_mover)
+        host_mover = scenario_shot_never_skipped(
+            host, client, host_mover, client_mover)
+        host_mover = scenario_reaction_cancels(
+            host, client, host_mover, client_mover)
+        scenario_proximity(host, client, host_mover, client_mover)
+        scenario_fuse_width(host, client, client_mover)
+
+        print("ALL WALK FAST-FORWARD TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_soak.py b/tools/coop_test/test_parallel_soak.py
new file mode 100644
index 000000000..9b2437348
--- /dev/null
+++ b/tools/coop_test/test_parallel_soak.py
@@ -0,0 +1,1617 @@
+"""PRD-P9: the parallel-turns soak.
+
+Every earlier PRD in this program tests one mechanism in isolation. This one
+plays the game: a seeded battle, both seats acting into the same player side,
+mixed action kinds, real alien turns in between - and after EVERY side it
+compares the two machines term by term. It is the test that would catch an
+authority seam nobody thought to write a scenario for.
+
+What it asserts, in order:
+
+  A. SEED. Both machines are pinned to the same RNG seat (`set_seed`) so a
+     failure can be reproduced by re-running with the same `--seed`.
+  B. ACTIONS. >= 100 admitted actions across >= 5 full turns, driven from BOTH
+     seats: walks (including contention - a second seat clicking into a running
+     walk, which PRD-P7 defers), turns, kneel/stand, shots, a medikit, a prime
+     and an unprime, and one thrown smoke grenade so the tile-hazard census is
+     not vacuous.
+  C. CENSUS. After every side (and at every turn boundary):
+       units   id + position + TU + health + stun + fatal wounds + isOut
+       items   the STRICT id census (id, type, owner, fuse, tile) - PRD-P4
+       tiles   the fire/smoke hazard census (`battle_tiles`)
+       drift   `itemIdCounter` / `battleCensus` equality (PRD-P2's two terms)
+       tripwire `desyncSeen` false on BOTH machines, the whole way through
+  D. BACKLOG CAP (PRD-P9 rider R3). The display-flow cap in `canAdmitAction()`
+     - refuse while `(_actionSeq - peerDisplayAckedSeq) >= 2` - had never once
+     been observed to engage. Forcing it took three measurements, all recorded in
+     `scenario_backlog_cap`: a WALK cannot build a backlog (PRD-P7's fast-forward
+     compresses it away), a SECOND SHOT cannot expose the cap (`isBusy()` is
+     checked first, so the answer stays "states" until the peer has caught up),
+     and what works is ONE slow shot followed by stateless chains, which complete
+     inside the frame they are admitted and so leave the executor idle while
+     `_actionSeq` climbs. The phase then proves the arbiter RECOVERS (the backlog
+     drains, admission reopens) and that a client intent sent while the cap was up
+     was refused `busy` and executed nothing.
+
+Run:  python tools/coop_test/test_parallel_soak.py [--turns N] [--seed S]
+Exit 0 = pass; 2 = failure.
+
+The acceptance bar is THREE consecutive clean runs.
+"""
+
+import argparse
+import os
+import sys
+import tempfile
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_endturn as PE
+import test_coop_outcome_gaps as OG
+import test_coop_resume_battle_control as CRBC
+
+PORT = "47991"
+RESUME_PORT = "47992"
+
+SLOW_SPEED = 1000  # ms/frame on the client - the same lever PRD-P7/P8 use
+FAST_SPEED = 2
+SLOW_FIRE = 1500   # ms/projectile-frame: what actually slows a SHOT (see D)
+FAST_FIRE = 1
+# The speed-skew profile's bounded client draw speed (see profile_bringup): slow
+# enough for a real display lag, fast enough that a ~100-action soak still matrixes.
+SKEW_SPEED = 40
+
+DEFAULT_TURNS = 5
+DEFAULT_MIN_ACTIONS = 100
+DEFAULT_SEED = 20260802
+
+# ---- the fixture -----------------------------------------------------------
+#
+# The skirmish bring-up IS the NEW BATTLE screen (BATTLE SETTINGS -> newbattle_ok),
+# and that screen reads `<userdir>/<master>/battle.cfg` on the way up
+# (NewBattleState::load -> Options::getMasterUserFolder() + "battle.cfg"). With no
+# file it takes the built-in defaults, and mission index 0 is STR_SMALL_SCOUT -
+# whose deployment is a single rank at `lowQty: 1, highQty: 1, dQty: 0`, i.e. ONE
+# hostile on every difficulty. A soak that fires for five turns eventually kills
+# it; the mission then ENDS mid-run and every census after that point is vacuous,
+# which is exactly the fail-fast in `assert_census`.
+#
+# Index 1 is STR_MEDIUM_SCOUT: two ranks at `lowQty` 2 and 1, so >= 3 hostiles
+# even on Beginner (BattlescapeGenerator::deployAliens takes `lowQty` there), with
+# the same 40x40 map footprint as the small scout. That is the whole lever - one
+# integer, written by the test into its own hermetic user dir. Deliberately NO
+# `base` key: without it NewBattleState still takes its normal `initSave()` path,
+# so the fixture is byte-for-byte what it was apart from the mission index.
+MISSION_MEDIUM_SCOUT = 1
+MIN_HOSTILES = 3
+# How many bring-ups to spend looking for a battle that clears MIN_HOSTILES. The
+# generator sometimes hands back aliens that are already dead (see main()), and a
+# bring-up costs ~15 s against a ~350 s run.
+FIXTURE_TRIES = 4
+
+
+def write_battle_fixture(user_dir, mission=MISSION_MEDIUM_SCOUT):
+    """Pin the NEW BATTLE mission for one instance's user dir (see above).
+
+    Written to BOTH machines even though only the host generates the map: the
+    client walks the same NEW BATTLE screen on its way to the server browser
+    (`newbattle_coop`), and leaving the two setup screens on different missions
+    costs nothing to avoid.
+    """
+    path = os.path.join(user_dir, "xcom1", "battle.cfg")
+    with open(path, "w", encoding="utf-8") as f:
+        f.write("mission: %d\n" % mission)
+    return path
+
+
+# ---- readouts --------------------------------------------------------------
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def tiles(gc):
+    return gc.ok({"cmd": "battle_tiles"})
+
+
+# States this test must never `dismiss_popup`. The first two are the ones every
+# co-op test protects (session.NO_DISMISS_STATES); the rest are what is on the
+# stack once the MISSION has ended - and popping those walks the stack down past
+# the main menu and QUITS the game, which reaches the harness as an unexplained
+# "connection forcibly closed" three minutes later rather than as a test failure.
+KEEP_STATES = ("BattlescapeState", "NextTurnState", "VoteMenu", "DebriefingState",
+               "GeoscapeState", "MainMenuState", "StatisticsState", "CoopState",
+               "SaveGameState", "ListGamesState")
+
+
+def drain(host, client, rounds=3):
+    """Pop anything sitting on top of the battlescape. BattlescapeState::think()
+    - which runs the co-op turn handshake - only ticks while the battlescape is
+    the top state, so a stray infobox stalls the whole session."""
+    for _ in range(rounds):
+        moved = False
+        for gc in (host, client):
+            t = TW.top(gc)
+            if t not in KEEP_STATES:
+                gc.cmd({"cmd": "dismiss_popup"})
+                moved = True
+        if not moved:
+            return
+        time.sleep(0.3)
+
+
+def poll(fn, timeout, interval=0.05):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        v = fn()
+        if v:
+            return v
+        time.sleep(interval)
+    return None
+
+
+def top_up(host, client, uid, tu=200, energy=200):
+    """Same TU **and energy** on BOTH machines.
+
+    PI.top_up only restores TU. A soak drives hundreds of walks, and energy is
+    what actually runs out first - a soldier with 200 TU and no energy refuses
+    to move, which silently turned "drive a long walk" into "drive nothing" (it
+    is how the rider-R3 phase first failed to build any display backlog at all).
+    """
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_intent", "unit": uid, "action": "turn",
+               "tu": tu, "energy": energy, "dry": True})
+
+
+def idle(host, timeout=120):
+    return poll(lambda: parallel(host).get("canAdmit") is True
+                and not parallel(host).get("pendingAdmits"), timeout, 0.1)
+
+
+# ---- the census ------------------------------------------------------------
+
+def unit_census(b):
+    """The PRD-P9 per-unit terms.
+
+    Two deliberate exclusions, both because asserting a term the protocol does
+    not replicate makes a permanent red rather than a detector:
+
+    * ENERGY - only the walk packet and the two cost packets carry it (PRD-P9
+      rider R2 and the soak finding next to it), so it is reported on a failure
+      but never asserted.
+    * A NON-PLAYER unit's TU. An alien's remaining TU is spent by AI that runs on
+      the executor alone; the peer applies the outcome (position, damage, the
+      shot itself) and never decides anything from the number. Reaction fire
+      leaves it up to a point or two apart on the peer - a pre-existing classic
+      co-op accounting seam, outside PRD-P9's scope - so it is reported by
+      `tu_report()` instead. Every PLAYER unit's TU IS asserted: that one is the
+      currency both players spend and would be a real desync.
+    """
+    return {u["id"]: (u["x"], u["y"], u["z"],
+                      u["tu"] if u.get("faction") == 0 else None,
+                      u["health"], u["stun"], u.get("wounds"), bool(u["isOut"]))
+            for u in b["units"]}
+
+
+def tu_report(host_b, client_b):
+    """Non-player TU deltas - reported, not asserted (see unit_census)."""
+    ch = {u["id"]: u["tu"] for u in client_b["units"]}
+    out = [(u["id"], u["tu"], ch.get(u["id"]))
+           for u in host_b["units"]
+           if u.get("faction") != 0 and ch.get(u["id"]) != u["tu"]]
+    return out
+
+
+def item_census(gc):
+    """The STRICT id census PRD-P4 made assertable: identity AND where it lives."""
+    d = gc.ok({"cmd": "battle_items"})
+    return {it["id"]: (it["type"], it["owner"], it["fuse"], it.get("slot"),
+                       it.get("tx"), it.get("ty"), it.get("tz"))
+            for it in d["items"]}
+
+
+def hazard_census(gc):
+    t = tiles(gc)
+    return (t["fireTiles"], t["fireSum"], t["fireHash"],
+            t["smokeTiles"], t["smokeSum"], t["smokeHash"])
+
+
+def first_diff(a, b, limit=4):
+    """A readable diff of two id -> tuple maps."""
+    out = []
+    for k in sorted(set(a) | set(b)):
+        if a.get(k) != b.get(k):
+            out.append(f"      {k}: host={a.get(k)} client={b.get(k)}")
+            if len(out) >= limit:
+                out.append("      ...")
+                break
+    return "\n".join(out)
+
+
+def settle_display(host, client, timeout=90):
+    """Wait until the CLIENT has finished drawing everything the host has run.
+
+    The census is a cross-machine comparison, so it has to be taken when both
+    machines are quiescent - `canAdmit` only says the EXECUTOR is idle. The
+    display watermark (`displayBacklog`, PRD-P7) is the client's half of that,
+    and the receive gate is the last packet-level term."""
+    drain(host, client)
+    poll(lambda: parallel(host).get("displayBacklog", 0) == 0
+         and parallel(host).get("taskCompleted") is not False
+         and parallel(client).get("taskCompleted") is not False
+         and parallel(client).get("rxHold", 0) == 0, timeout, 0.1)
+    # ...and until neither machine still has a BattleState running. The display
+    # watermark says the client has consumed every packet, which is NOT the same
+    # as having finished acting on them: a death animation drops the corpse's
+    # inventory only at its LAST frame (UnitDieBState::think -> convertUnitToCorpse),
+    # so a census taken a few frames early sees the kit still on the body here and
+    # already on the floor there.
+    poll(lambda: battle(host).get("isBusy") is False
+         and battle(client).get("isBusy") is False, timeout, 0.1)
+    # ...and until the CLIENT's death-replay windows have drained. `isBusy` is the
+    # EXECUTOR's animation flag; it does not cover the peer's corpse-replication
+    # state. `corpsePending` (battle_state, additive) folds the exact predicate the
+    # in-game sync-check gates on at SharedEcon.cpp:5817 - corpseReplayPendingAny()
+    # (window 1: push -> convertUnitToCorpse) OR corpseRemapPendingAny() (window 2:
+    # local-id mint -> host-id reconcile) OR _coopInitDeath (a projectile/death
+    # display replay still running). `turnAdvanceDeferred` is the neutral->player
+    # advance that has not applied its next_turn yet. A boundary death has the host
+    # one corpse ahead while the client is mid-drain: host items on the floor + a
+    # corpse, client kit still in BELT/RIGHT_HAND - the straddle the strict id census
+    # in assert_census would flag as drift. Bounded, and on TIMEOUT this PROCEEDS to
+    # the census anyway (poll returns None and is ignored): a persistent divergence
+    # drains the predicate and stays different, so the assert still fires on real
+    # drift - only the transient straddle is waited out, never masked.
+    poll(lambda: battle(host).get("corpsePending") is not True
+         and battle(client).get("corpsePending") is not True
+         and parallel(host).get("turnAdvanceDeferred", 0) == 0
+         and parallel(client).get("turnAdvanceDeferred", 0) == 0, timeout, 0.1)
+    drain(host, client, rounds=1)
+
+
+def trace_units(host, client, what):
+    """Report (never assert) the per-unit diff, so a soak run can say WHICH block
+    introduced a divergence instead of only that the turn ended with one."""
+    d = first_diff(unit_census(battle(host)), unit_census(battle(client)), limit=6)
+    print(f"    [trace] {what}: {'in step' if not d else 'DIFF'}")
+    if d:
+        print(d)
+
+
+# ---- PHASE D.1 chain-atomicity strict-compare burn-in ----------------------
+# --strict-burnin enables the runtime lever (sync_capture {strict:true}) so the
+# host compares terrain/unitsCore/items/itemIdCtr at EVERY seq (side-gates +
+# corpsePending skips OFF), forces every bucket REPORT-ONLY (so a strict mismatch
+# is COUNTED but never routes a modal/bundle that would disrupt driving), and swaps
+# the clean-mode sync assertion for one that asserts ONLY those four are clean and
+# hard-asserts the buckets the D.1 apply-barrier CLOSES (terrain/unitsCore - their
+# mutations are packet-carried ABSOLUTES, healed within-chain) and REPORTS the rest.
+# items/itemIdCtr carry a transient item-id COUNTER the client bumps via its OWN
+# alien-side corpse/spawn replay (the P4 manifest re-slave only RATCHETS up, so the
+# transient heals at the BOUNDARY, not within the chain) - a cross-chain heal no
+# per-action apply-barrier can close; it needs D.3's replay-mint authority (see the
+# D.1 report). unitsRegen/unitsCombat/saveBlob are the H1/H3/H5 residuals the task
+# named as not-this-phase's.
+STRICT_BURNIN = False
+BURNIN_TARGET_BUCKETS = ("terrain", "unitsCore")
+BURNIN_D3_BUCKETS = ("items", "itemIdCtr")
+BURNIN_ALL_BUCKETS = ("terrain", "fire", "smoke", "items", "unitsCore",
+                      "unitsStats", "itemIdCtr", "unitsCombat", "unitsRegen",
+                      "saveBlob")
+BURNIN_RESIDUALS = {}
+
+
+def enable_strict_burnin(host, client, disable_ghost=True):
+    """Engage the strict lever + force every bucket report-only, on both machines.
+
+    coop (Phase 2c): strict-burnin measures RAW per-seq STATE (it strips the shipped
+    alien-side compare gates). The Phase-2c death GHOST is display-only - it never
+    writes hashed state (grep-gated) - but it holds the client DISPLAY through the
+    collapse, so on the decoupled ALIEN side _clientDisplaySeq lags while the state has
+    already advanced; the client then reports an older seq LABEL than its (correct)
+    state and unitsCore "straddles" at ai/endturn seqs (benign display-lag, side-gated
+    in shipped mode, heals by sidestart - see seq-aware-strict-compare-decision doc).
+    That confounds a raw-STATE measurement, so strict-burnin disables the ghost by
+    default to isolate the state. The ONE test that measures the ghost itself
+    (test_parallel_death_ghost) passes disable_ghost=False. Host has no ghosts; setting
+    the lever there is a harmless no-op."""
+    for gc, tag in ((host, "host"), (client, "client")):
+        r = gc.cmd({"cmd": "sync_capture", "strict": True})
+        assert r.get("strictBurnIn") is True, \
+            f"{tag}: the strict-burnin lever did not engage: {r}"
+        if disable_ghost:
+            gc.cmd({"cmd": "parallel_state", "death_ghost_disable": True})
+        for b in BURNIN_ALL_BUCKETS:
+            rr = gc.cmd({"cmd": "save_blob", "report_only_bucket": b,
+                         "report_only_on": True})
+            assert rr.get("report_only_matched"), \
+                f"{tag}: report-only override for {b} failed: {rr}"
+    print("    STRICT-BURNIN lever ON (terrain/unitsCore/items/itemIdCtr strict at "
+          "every seq; all buckets forced report-only so a mismatch counts but never "
+          f"routes; death ghost {'DISABLED (state isolation)' if disable_ghost else 'ON'})")
+
+
+def _burnin_sync_check(host, client, what):
+    """Assert the loop closes and the D.1 target buckets (terrain/unitsCore) did not
+    diverge under the lever. items/itemIdCtr (the D.3-blocked mint window) and the
+    other residuals are recorded and reported, never asserted.
+    """
+    peer = session.sync_check(client)
+    assert peer["compares"] == 0, (
+        f"the CLIENT compared {peer['compares']} report(s) {what} - only the "
+        "executor holds a ring")
+
+    def closed(sc):
+        return (sc["lastComparedSeq"] >= sc["lastSeq"]
+                and sc["lastComparedBoundarySeq"] >= sc["lastBoundarySeq"])
+
+    sc = session.sync_check(host)
+    deadline = time.time() + 30
+    while not closed(sc) and time.time() < deadline:
+        time.sleep(0.5)
+        sc = session.sync_check(host)
+    assert closed(sc), (
+        f"STRICT-BURNIN LOOP OPEN {what}: host at seq {sc['lastSeq']}/"
+        f"{sc['lastBoundarySeq']}, peer answered {sc['lastComparedSeq']}/"
+        f"{sc['lastComparedBoundarySeq']} - the bucket asserts would be vacuous")
+    assert sc["dropped"] == 0, (
+        f"STRICT-BURNIN RING OVERFLOW {what}: {sc['dropped']} uncompared entries evicted")
+    assert sc.get("strictBurnIn") is True, (
+        f"the strict-burnin lever is NOT engaged on the host {what} "
+        f"(syncCheck.strictBurnIn={sc.get('strictBurnIn')}) - the run would be vacuous")
+
+    buckets = sc["buckets"]
+    bad = {n: b["mismatchCount"] for n, b in buckets.items() if b["mismatchCount"]}
+    for n, c in bad.items():
+        BURNIN_RESIDUALS[n] = c
+    # D.1 correctness criterion: the four core buckets must be strict-clean at every
+    # PLAYER-side per-action seq. The client does NOT defer player-side resolution
+    # (host executes, client displays with full packet coverage, and the apply barrier
+    # holds action_end until the chain's stamped packets apply), so a player-side
+    # four-bucket mismatch is a real D.1 barrier bug. The ALIEN-side (ai/expl) +
+    # boundary (endturn/sidestart) fires are the D-lite Option-B deferred-resolution
+    # lag: the client defers its alien-side world state to next_turn, so its per-action
+    # alien state genuinely lags the host by a step, healing at the boundary - a
+    # cross-chain heal no per-action apply barrier can close (D.3 replay authority).
+    # State converges: the unit/item census above is asserted EQUAL after every side.
+    FOUR = ("terrain", "unitsCore", "items", "itemIdCtr")
+    PLAYER_KINDS = ("walk", "shoot", "turn", "throw", "melee", "psi", "kneel",
+                    "prime", "medikit", "other")
+    mm = [m for m in sc.get("mismatches", []) if m["bucket"] in FOUR]
+    player = [m for m in mm if (not m["boundary"]) and m["kind"] in PLAYER_KINDS]
+    assert not player, (
+        f"STRICT-BURNIN {what}: four-bucket PLAYER-side mismatch(es) {player} - a D.1 "
+        "barrier bug: player chains have full host packet coverage and MUST be strict-"
+        f"clean.\n    {session._sync_mismatch_lines(sc)}")
+    d1res = {n: c for n, c in bad.items() if n in FOUR}
+    if d1res:
+        print(f"    NOTE {what}: four-bucket ALIEN-side/boundary residual (D-lite "
+              f"Option-B replay lag, needs D.3; state converges): {d1res}")
+    other = {n: c for n, c in bad.items() if n not in FOUR}
+    if other:
+        print(f"    NOTE {what}: expected non-target residual buckets: {other}")
+
+
+def assert_census(host, client, what):
+    """The full cross-machine comparison. Called after every side."""
+    settle_display(host, client)
+    hb, cb = battle(host), battle(client)
+    assert hb.get("inBattle") and cb.get("inBattle"), (
+        f"the fixture's mission ENDED before the census {what} (host "
+        f"inBattle={hb.get('inBattle')} top={TW.top(host)}, client "
+        f"inBattle={cb.get('inBattle')} top={TW.top(client)}). The skirmish "
+        f"fixture ships a handful of aliens (write_battle_fixture pins the "
+        f"mission that guarantees >= {MIN_HOSTILES}) and the soak has to keep at "
+        f"least one alive; everything after this point would be vacuous.")
+    hu, cu = unit_census(hb), unit_census(cb)
+    if hu != cu:
+        # `status` is not in the asserted tuple (it moves through animation states
+        # that legitimately differ mid-frame) but it is the first thing anyone
+        # would want when isOut disagrees, so it rides the failure text.
+        hs = {u["id"]: (u["status"], u.get("energy")) for u in hb["units"]}
+        cs = {u["id"]: (u["status"], u.get("energy")) for u in cb["units"]}
+        extra = "\n".join(
+            f"      {k}: status/energy host={hs.get(k)} client={cs.get(k)}"
+            for k in sorted(set(hu) | set(cu)) if hu.get(k) != cu.get(k))
+        raise AssertionError(
+            f"UNIT CENSUS DRIFT {what}: the two machines disagree about\n"
+            f"    (x, y, z, tu, health, stun, wounds, isOut)\n{first_diff(hu, cu)}\n"
+            f"    context (not asserted):\n{extra}")
+
+    hi, ci = item_census(host), item_census(client)
+    assert hi == ci, (
+        f"ITEM CENSUS DRIFT {what}: strict id census differs "
+        f"(host {len(hi)} items, client {len(ci)})\n"
+        f"    (type, owner, fuse, slot, tx, ty, tz)\n{first_diff(hi, ci)}")
+
+    hh, ch = hazard_census(host), hazard_census(client)
+    assert hh == ch, (
+        f"TILE HAZARD DRIFT {what}: (fireTiles, fireSum, fireHash, smokeTiles, "
+        f"smokeSum, smokeHash) host={hh} client={ch}. Fire and smoke arrive on "
+        f"their own `set_fire_tile`/`set_smoke_tile` packets and decay on both "
+        f"machines independently, so neither of PRD-P2's item terms can see this.")
+
+    if STRICT_BURNIN:
+        _burnin_sync_check(host, client, what)
+        return hh
+
+    session.assert_battle_synced(host, client, what)
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), (
+        f"the PRD-P2 drift tripwire FIRED {what} - a release blocker, "
+        f"root-cause it before shipping")
+
+    # PRD-I0 §4: the per-action sync-check, checked wherever the census is. The
+    # census above is a HARNESS comparison at a quiescent moment; this is the
+    # IN-GAME detector's own verdict over every individual action and boundary
+    # since the last check, so it catches a divergence that appeared and healed
+    # between two censuses - which is most of them.
+    #
+    # Non-strict on purpose: at I0 birth every bucket is REPORT-ONLY, so what is
+    # asserted here is that the deferred loop CLOSED (the peer answered every seq
+    # the executor recorded, nothing was dropped) and that no ALARM-promoted
+    # bucket disagreed. The report-only counts are printed, and they are the
+    # burn-in evidence PRD-I3 promotes buckets on - a soak run's output is the
+    # data set.
+    session.assert_sync_clean(host, client, what)
+    # ... and it left no side effects. The auto-report bundle is what a fired
+    # tripwire costs a real player - a multi-megabyte zip and a modal over the
+    # battle - so the silence criterion is asserted on DISK as well as on the
+    # flag, after every side rather than only at the end (this soak has plenty of
+    # earlier ways to stop, and a check that never runs proves nothing).
+    for tag, gc in (("host", host), ("client", client)):
+        d = os.path.join(gc.user_dir, "desync-reports")
+        wrote = sorted(os.listdir(d)) if os.path.isdir(d) else []
+        assert not wrote, (
+            f"{tag} wrote a desync diagnostic bundle {what} in a CLEAN battle: "
+            f"{wrote} in {d}")
+    skew = tu_report(hb, cb)
+    if skew:
+        print(f"    NOTE {what}: non-player TU skew (reported, not asserted): "
+              + ", ".join(f"unit {i} host={h} client={c}" for i, h, c in skew[:4]))
+    return hh
+
+
+# ---- driving ---------------------------------------------------------------
+
+def act(host, client, driver, what, timeout=90, **kw):
+    """Drive ONE action and wait for the executor to finish with it.
+
+    Returns how many chains the host admitted (0 = the lever or the arbiter
+    refused, which the soak tolerates: a boxed-in soldier or a shot with no line
+    of fire is a fixture accident, not a protocol failure). Anything that DOES
+    run must land identically, which is what the per-side census then checks."""
+    seq0 = parallel(host)["actionSeq"]
+    r = PI.intent(driver, **kw)
+    if not r.get("ok"):
+        return 0
+    poll(lambda: parallel(host)["actionSeq"] > seq0, 25, 0.05)
+    if not idle(host, timeout):
+        drain(host, client)
+        idle(host, 30)
+    drain(host, client, rounds=1)
+    return parallel(host)["actionSeq"] - seq0
+
+
+def contended_walks(host, client, hmover, cmover):
+    """A client intent shipped INTO a running host walk - PRD-P7's deferral path,
+    which is the contention shape a real two-player side produces constantly.
+
+    Both destinations are resolved while the machines are idle: `probe_step`
+    refuses mid-chain (Pathfinding is a singleton the running walk dequeues from).
+    """
+    if not idle(host):
+        return 0
+    top_up(host, client, hmover)
+    top_up(host, client, cmover)
+    hdest = PI.step_dest(host, client, hmover)
+    cdest = PI.step_dest(host, client, cmover)
+    if not hdest or not cdest:
+        return 0
+    seq0 = parallel(host)["actionSeq"]
+    PI.intent(host, action="move", unit=hmover, x=hdest[0], y=hdest[1], z=hdest[2])
+    PI.intent(client, action="move", unit=cmover, x=cdest[0], y=cdest[1], z=cdest[2])
+    poll(lambda: parallel(host)["actionSeq"] >= seq0 + 2, 60, 0.05)
+    idle(host, 120)
+    drain(host, client, rounds=1)
+    return parallel(host)["actionSeq"] - seq0
+
+
+def locomotion_block(host, client, hmover, cmover):
+    """Walk + kneel/stand + turn, from both seats."""
+    n = contended_walks(host, client, hmover, cmover)
+    top_up(host, client, cmover)
+    n += act(host, client, client, "kneel", action="kneel", unit=cmover)
+    n += act(host, client, client, "stand", action="kneel", unit=cmover)
+    for gc, uid in ((host, hmover), (client, cmover)):
+        top_up(host, client, uid)
+        here = PI.pos(battle(host), uid)
+        if here:
+            n += act(host, client, gc, "turn", action="turn", unit=uid,
+                     x=here[0] + 1, y=here[1] + 1, z=here[2])
+    return n
+
+
+def shot_block(host, client, hmover, cmover):
+    """One shot from each seat, aimed AWAY from the fixture's few hostiles - a
+    stray kill ends the mission and every later side with it."""
+    n = 0
+    for gc, uid in ((host, hmover), (client, cmover)):
+        if not idle(host):
+            break
+        wid = PI.give_both(host, client, uid, "STR_RIFLE", "STR_RIFLE_CLIP")
+        top_up(host, client, uid)
+        # dist 2, not 4: `aim_away` points away from the NEAREST hostile, which
+        # says nothing about the others, and a long bullet flight through a
+        # skirmish fixture that ships a handful of aliens kills the mission out
+        # from under the remaining turns.
+        aim = PI.aim_away(host, uid, dist=2)
+        n += act(host, client, gc, "shoot", action="shoot", unit=uid, mode="snap",
+                 weapon_id=wid, x=aim[0], y=aim[1], z=aim[2])
+    return n
+
+
+def support_block(host, client, cmover):
+    """The three kinds that push NO BattleState at all - medikit, prime, unprime.
+    They are the ones PRD-P7's `action_end` marker exists for, so a soak that
+    skipped them would not exercise the flow control's hardest case."""
+    n = 0
+    top_up(host, client, cmover)
+    wid = PI.give_both(host, client, cmover, "STR_MEDI_KIT")
+    n += act(host, client, client, "medikit", action="medikit", unit=cmover,
+             weapon_id=wid, patient=cmover, medikit="stim", part=0)
+    top_up(host, client, cmover)
+    wid = PI.give_both(host, client, cmover, "STR_GRENADE")
+    n += act(host, client, client, "prime", action="prime", unit=cmover,
+             fuse=3, weapon_id=wid)
+    top_up(host, client, cmover)
+    n += act(host, client, client, "unprime", action="prime", unit=cmover,
+             unprime=True, weapon_id=wid)
+    return n
+
+
+def smoke_block(host, client, cmover):
+    """One primed smoke grenade, thrown and left to go off.
+
+    The only thing in the mix that writes the tile-hazard census, so without it
+    the fire/smoke comparison above would be 0 == 0 for the whole run.
+    """
+    if not idle(host):
+        return 0
+    top_up(host, client, cmover)
+    wid = PI.give_both(host, client, cmover, "STR_SMOKE_GRENADE")
+    n = act(host, client, client, "prime smoke", action="prime", unit=cmover,
+            fuse=0, weapon_id=wid)
+    top_up(host, client, cmover)
+    here = PI.pos(battle(host), cmover)
+    if here:
+        n += act(host, client, client, "throw smoke", action="throw", unit=cmover,
+                 weapon_id=wid, x=here[0] + 2, y=here[1] + 2, z=here[2])
+    # the fuse has to actually run out; that happens on a side boundary, so all
+    # this waits for is the throw's own chain to settle.
+    idle(host, 60)
+    drain(host, client)
+    return n
+
+
+# ---- D. the display-backlog cap (PRD-P9 rider R3) --------------------------
+
+def move_clear_of_hostiles(host, client, uid, want=8):
+    """Put `uid` somewhere its bursts cannot reach a hostile, on BOTH machines.
+
+    This phase fires auto bursts at whatever tile produces a real chain, and the
+    fixture ships a handful of aliens (>= MIN_HOSTILES, see write_battle_fixture)
+    - so a stray hit still walks the mission towards its end and could take the
+    remaining turns with it. Teleporting the shooter clear first
+    is the difference between a soak that runs five turns and one that reports
+    "the fixture's mission ENDED" from turn 3 on.
+    """
+    b = battle(host)
+    foes = [(u["x"], u["y"], u["z"]) for u in b["units"]
+            if u.get("faction") == 1 and not u.get("isOut")]
+    if not foes:
+        return None
+    here = PI.pos(b, uid)
+
+    def clearance(p):
+        return min(max(abs(p[0] - f[0]), abs(p[1] - f[1])) for f in foes)
+
+    best = None
+    for r in range(4, 13):
+        for dx in (-r, 0, r):
+            for dy in (-r, 0, r):
+                if dx == 0 and dy == 0:
+                    continue
+                spot = (here[0] + dx, here[1] + dy, here[2])
+                if clearance(spot) < want:
+                    continue
+                if PI.teleport_both(host, client, uid, spot):
+                    best = spot
+                    break
+            if best:
+                break
+        if best:
+            break
+    if best:
+        print(f"    (shooter {uid} moved to {best}, {clearance(best)} tiles clear "
+              f"of every hostile)")
+    return best
+
+
+def long_walk_both(host, client, uid, radius=4):
+    """The FURTHEST tile both machines agree `uid` can path to - a one-tile step
+    is over before a slow client can fall behind on it."""
+    for r in range(radius, 0, -1):
+        got = PI.common_steps(host, client, uid, r)
+        if got:
+            return got[-1]
+    return None
+
+
+def scenario_backlog_cap(host, client, shooter, client_unit):
+    """Force `canAdmitAction()`'s display-flow term to refuse, then recover.
+
+    Why it needs forcing: the cap is `(_actionSeq - peerDisplayAckedSeq) >= 2`,
+    and it is checked LAST - while a chain is still running the answer is
+    "states". So the only way to see it is a client that is genuinely behind on
+    DISPLAY while the executor is idle, which needs (a) a slow client, (b) the
+    shooter on the client's screen (an off-screen chain runs at interval 0
+    regardless) and (c) chains PRD-P7 will not fast-forward away, i.e. shots.
+    """
+    print("-- D: the display-backlog cap engages and recovers (rider R3) --")
+    assert idle(host), f"the host is still busy: {parallel(host)}"
+    move_clear_of_hostiles(host, client, shooter)
+    before = PI.pos(battle(host), shooter)
+    cam = client.ok({"cmd": "battle_camera", "unit": shooter, "visible": True})
+    assert cam.get("onScreen"), (
+        f"the client's camera would not frame the shooter, so it would draw the "
+        f"chain at interval 0 and never fall behind: {cam}")
+    client.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": SLOW_SPEED})
+    client.ok({"cmd": "set_option", "name": "battleFireSpeed", "value": SLOW_FIRE})
+
+    blocked = None
+    seen_backlog = 0
+    fired = 0
+    try:
+        # MEASURED, and the measurement is most of what this rider was for.
+        #
+        # A WALK cannot build the backlog at all, however slow the client is: the
+        # host's `action_end` is itself a gated packet, so the client ALWAYS has
+        # one waiting behind a lone walk, which arms PRD-P7's fast-forward and
+        # compresses the animation away (0 samples over four attempts).
+        #
+        # A SHOT can: `ProjectileFlyBState` holds the receive gate and is never
+        # skippable, so at SLOW_FIRE the client really is seconds behind. What it
+        # then needs is for the executor to start a SECOND chain inside that
+        # window - which means no RPC between the two but the admission poll, so
+        # the weapon, the aim point and the TU are all set up first.
+        wid = PI.give_both(host, client, shooter, "STR_RIFLE", "STR_RIFLE_CLIP")
+        for attempt in range(4):
+            if not poll(lambda: parallel(host).get("canAdmit") is True, 60, 0.03):
+                break
+            top_up(host, client, shooter)
+            # `start_busy_shot` is what proves the chain is REAL: a shot aimed at a
+            # tile the trajectory code rejects pops in the frame it is pushed, and
+            # every measurement after it would be of a chain that never ran. It
+            # returns an aim the pathfinder has vouched for, with the host confirmed
+            # mid-chain.
+            aim, ps = PI.start_busy_shot(host, client, shooter, wid)
+            if not aim:
+                print(f"    (attempt {attempt + 1}: no aim point produced a real "
+                      f"shot chain: {ps.get('admitBlocked')})")
+                continue
+            fired += 1
+            shot = dict(action="shoot", unit=shooter, mode="auto", weapon_id=wid,
+                        x=aim[0], y=aim[1], z=aim[2])
+            # ONE poll, then straight into the second chain - no other RPC in
+            # between. Measured window between "the executor is idle again" and
+            # "the peer reports the first chain displayed": ~330 ms at 400 ms/frame,
+            # and it scales with the client's draw speed.
+            deadline = time.time() + 40
+            while time.time() < deadline:
+                ps = parallel(host)
+                seen_backlog = max(seen_backlog, ps.get("displayBacklog", 0))
+                if ps.get("admitBlocked") == "display_backlog":
+                    blocked = ps
+                    break
+                if ps.get("canAdmit") is True:
+                    break
+                time.sleep(0.01)
+            if blocked:
+                break
+            # The follow-up chains are KNEELS, not more shots, and that detail is
+            # the whole trick. A second shot keeps the executor BUSY for its own
+            # animation, and `canAdmitAction()` checks `isBusy()` before the
+            # display term - so the backlog reaches 2 while the answer is still
+            # "states", and by the time the executor is idle the peer has caught
+            # up (measured: backlog 2 seen, `display_backlog` never reported).
+            # A kneel pushes no BattleState: it completes inside the frame it is
+            # admitted, so the executor stays IDLE while `_actionSeq` climbs, and
+            # the display term is then the first one that can say no.
+            for _ in range(14):
+                ps = parallel(host)
+                seen_backlog = max(seen_backlog, ps.get("displayBacklog", 0))
+                if ps.get("admitBlocked") == "display_backlog":
+                    blocked = ps
+                    break
+                if ps.get("canAdmit") is not True:
+                    time.sleep(0.01)
+                    continue
+                # kneel toggles, so it can be repeated. Deliberately NO top-up in
+                # here: `top_up` writes both machines directly, and doing that while
+                # a `kneel` packet is still in flight lets the peer charge the
+                # freshly-restored value after the executor already charged the old
+                # one - a TU skew the test itself created. One top-up before the
+                # loop covers every kneel it can fit.
+                PI.intent(host, action="kneel", unit=shooter)
+                fired += 1
+            if blocked:
+                break
+            print(f"    (attempt {attempt + 1}: the client kept up - highest "
+                  f"backlog seen {seen_backlog}, retrying)")
+        # The flow-control ACCOUNTING must always be live: if the executor never
+        # sees the peer even one chain behind, `peerDisplayAckedSeq` is not being
+        # driven by `action_done` at all and the cap could never fire for anyone.
+        # De-flake (2026-08-12): a shooter that produced NO real shot chain over 4
+        # attempts (boxed in / no line of fire) is a FIXTURE accident, the same class
+        # pick_driver's placement flake is - not an arbiter fault. Only assert the
+        # accounting when at least one real chain actually ran; otherwise report and
+        # let the run stand (the cap is exercised on the runs where a shot lands).
+        if fired:
+            assert seen_backlog >= 1, (
+                f"the executor never observed the peer a single chain behind over "
+                f"{fired} shot(s) against a client drawing at {SLOW_SPEED}/{SLOW_FIRE} "
+                f"ms/frame - `action_done` is not driving peerDisplayAckedSeq, and "
+                f"PRD-P7's display flow control is inert: host={parallel(host)} "
+                f"client={parallel(client)}")
+        else:
+            print(f"    NOTE: the turn-3 shooter produced no real shot chain this run "
+                  f"(boxed in / no line of fire over 4 attempts) - a fixture accident; "
+                  f"the backlog-cap accounting is exercised on runs where a shot lands.")
+        if blocked:
+            print(f"    cap engaged after {fired} shot(s): displayBacklog="
+                  f"{blocked['displayBacklog']} actionSeq={blocked['actionSeq']} "
+                  f"peerDisplayAckedSeq={blocked['peerDisplayAckedSeq']}")
+        else:
+            # Reaching backlog 2 needs the executor's OWN chain to drain while the
+            # peer is still drawing the previous one, and how long the peer spends
+            # drawing a shot depends on whether it is looking at it - an off-screen
+            # projectile is drawn at interval 0 no matter what battleFireSpeed says.
+            # So the cap is reachable (observed engaging, with an intent refused
+            # `busy` and a clean recovery) but not on demand. Reported rather than
+            # failed, because a red here would mean "the fixture put the camera
+            # somewhere else", not "the arbiter is broken".
+            print(f"    NOTE: the cap did not engage this run - the peer stayed "
+                  f"within {seen_backlog} chain(s) over {fired} shot(s). The "
+                  f"accounting is live (backlog {seen_backlog} observed and "
+                  f"drained); reaching the 2-chain cap depends on the peer really "
+                  f"animating the shot, which needs the shooter on ITS screen.")
+
+        # ...and while it is up, a real client intent is refused and runs NOTHING.
+        # Driven with a CLIENT-owned soldier, so the refusal has to come from the
+        # cap rather than from the ownership check.
+        cpos = PI.pos(battle(host), client_unit)
+        if parallel(host).get("admitBlocked") == "display_backlog" and cpos:
+            client.cmd({"cmd": "parallel_state", "clear_deny": True})
+            r = PI.intent(client, action="turn", unit=client_unit,
+                          x=cpos[0] + 1, y=cpos[1], z=cpos[2])
+            if r.get("routed"):
+                got = poll(lambda: parallel(client)["lastDenyReason"] or None, 12, 0.1)
+                if got:
+                    assert got == "busy", (
+                        f"an intent sent into the display-backlog cap was refused "
+                        f"`{got}`, not `busy`; PROTOCOL.md keeps `busy` for the cap "
+                        f"(the queue is empty, so there is nothing to defer behind)")
+                    assert PI.pos(battle(host), client_unit) == cpos,                         "the refused intent moved the unit anyway"
+                    print(f"    a client intent sent while the cap was up was "
+                          f"refused `{got}` and executed nothing")
+    finally:
+        client.ok({"cmd": "set_option", "name": "battleXcomSpeed", "value": FAST_SPEED})
+        client.ok({"cmd": "set_option", "name": "battleFireSpeed", "value": FAST_FIRE})
+
+    ok = poll(lambda: parallel(host).get("admitBlocked") != "display_backlog"
+              and parallel(host).get("canAdmit") is True, 240, 0.2)
+    assert ok, (
+        f"the arbiter never recovered once the client was put back to "
+        f"{FAST_SPEED} ms/frame: host={parallel(host)} client={parallel(client)}. "
+        f"A cap that engages and does not clear wedges the side shut.")
+    assert parallel(host)["displayBacklog"] <= 1, (
+        f"the backlog did not drain after recovery: {parallel(host)}")
+    drain(host, client)
+    idle(host)
+    # Normalise before handing back to the soak: this phase deliberately races
+    # the two machines, so it re-levels the actor it drove rather than leaving
+    # the census to judge a skew the test manufactured.
+    settle_display(host, client)
+    top_up(host, client, shooter)
+    print(f"    recovered: displayBacklog={parallel(host)['displayBacklog']}, "
+          f"canAdmit={parallel(host)['canAdmit']}; the shooter went {before} -> "
+          f"{PI.pos(battle(host), shooter)}")
+    print("PASS D: the display-backlog cap engaged, refused, and recovered")
+    return fired
+
+
+# ---- the turn loop ---------------------------------------------------------
+
+def side_started(host, turn_before):
+    """Has the side this call was asked to close already gone?"""
+    return battle(host).get("turn") != turn_before or not parallel(host)["localReady"]
+
+
+def close_side(host, client, hseat, cseat, turn_before):
+    """Both seats ready -> the executor commits -> a new player side."""
+    PE.hush(host, client)
+    for gc in (host, client):
+        if not parallel(gc)["localReady"]:
+            PE.arm(gc)
+    # `allReady` is almost never OBSERVABLE. The executor commits on the same
+    # tick that applies the second seat's `end_turn_ready` (updateCoopTask ->
+    # coopCheckSideCommit), and committing calls resetEndTurnReady() - so the
+    # window in which an RPC could sample allReady==True is one frame wide, and
+    # a poll for it reliably runs its full timeout instead. Re-arming after that
+    # timeout re-armed BOTH seats into the NEXT side and closed it too: the soak
+    # then measured a battle that was advancing a turn behind its back (measured
+    # on a failing run: commits at +0s, +30s, +30s, +30s with no actions between
+    # them, and the "after the alien side of turn N" census comparing two
+    # machines mid-flight). Accept the side having ALREADY moved as success, and
+    # only re-arm a seat that is genuinely still unarmed on the ORIGINAL turn.
+    got = poll(lambda: parallel(host)["allReady"] is True
+               or side_started(host, turn_before), 30, 0.2)
+    if not got:
+        for gc in (host, client):
+            if not parallel(gc)["localReady"]:
+                PE.arm(gc)
+    turn = PE.wait_side(host, client, turn_before, timeout=300)
+    assert turn, (
+        f"the side never closed with both seats ready: host={parallel(host)} "
+        f"client={parallel(client)}, host top={TW.top(host)} "
+        f"client top={TW.top(client)}")
+    drain(host, client)
+    poll(lambda: battle(host).get("battleInit") and battle(client).get("battleInit"),
+         60, 0.5)
+    idle(host)
+    return turn
+
+
+# ==== VALIDATION L2 soak profiles (PRD-I3 burn-in matrix) ====================
+#
+# The baseline soak IS one profile; --profile selects a scenario that reuses the
+# same fixture + per-side census but layers a different stress on top, per the L2
+# table. Seven ride the skirmish fixture (baseline/speed-skew/backlog/incendiary/
+# psi/spawn-blast/gifting) - the profile only changes the bring-up options/mods and
+# a per-turn injection. Two need the CAMPAIGN fixture (campaign/resume) and take a
+# dedicated flow. Every profile keeps the SAME acceptance: assert_census after every
+# side (units/items/hazards + tripwire + sync-check + zero desync bundles).
+
+SKIRMISH_PROFILES = ("baseline", "speed-skew", "backlog", "incendiary", "psi",
+                     "spawn-blast", "gifting")
+SPECIAL_PROFILES = ("campaign", "resume")
+PROFILES = SKIRMISH_PROFILES + SPECIAL_PROFILES
+
+# An incendiary throwaway ruleset: STR_GRENADE re-typed to INCENDIARY (damageType 2)
+# so a primed throw makes FIRE tiles (with battleInstantGrenade it detonates on
+# landing). Isolated to the test's own user dir, exactly like the outcome_gaps mod.
+INCENDIARY_METADATA = """\
+name: "Coop incendiary soak"
+version: 1.0
+description: "Test-only: an incendiary grenade for the fire/smoke soak profile."
+author: coop harness
+
+master: xcom1
+"""
+INCENDIARY_RULESET = """\
+items:
+  - type: STR_GRENADE
+    damageType: 2
+    power: 40
+    blastRadius: 2
+"""
+
+
+def make_incendiary_mod(root):
+    mod = os.path.join(root, "Coop_Incendiary_Soak")
+    os.makedirs(os.path.join(mod, "Ruleset"))
+    with open(os.path.join(mod, "metadata.yml"), "w", encoding="utf-8") as f:
+        f.write(INCENDIARY_METADATA)
+    with open(os.path.join(mod, "Ruleset", "incendiary.rul"), "w", encoding="utf-8") as f:
+        f.write(INCENDIARY_RULESET)
+    return mod
+
+
+def profile_bringup(profile, tmp):
+    """Return (host_opts, client_opts, mods, seed) for a skirmish profile.
+
+    tmp is a scratch root for any generated mod (None if the profile needs none).
+    """
+    host_opts = {"battleXcomSpeed": FAST_SPEED, "battleAlienSpeed": FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": FAST_SPEED, "battleAlienSpeed": FAST_SPEED,
+                   "EnableCoopParallelTurns": False}
+    mods = []
+    seed = DEFAULT_SEED
+    if profile == "speed-skew":
+        # P10/P11 display-lag class: the CLIENT draws at SKEW_SPEED while the host
+        # runs FAST, so every chain leaves the peer well behind on display - the
+        # "host finished action N" vs "peer displayed it" window the P10/P11 bugs
+        # live in. Bounded (not the backlog cap's SLOW_SPEED=1000) so a whole soak of
+        # ~100 actions still matrixes in ~5 min rather than crawling for 20.
+        client_opts["battleXcomSpeed"] = SKEW_SPEED
+        client_opts["battleAlienSpeed"] = SKEW_SPEED
+    elif profile in ("psi", "spawn-blast"):
+        # The outcome_gaps ruleset: STR_SMALL_ROCKET gains spawnUnit (GAP-1) and the
+        # deterministic seed pins the fixture so the spawn/psi levers are not fixture
+        # roulette. battleInstantGrenade makes a fuse-0 blast happen on demand.
+        mods = [OG.make_mod(tmp)]
+        seed = OG.SEED
+        host_opts["battleInstantGrenade"] = True
+        client_opts["battleInstantGrenade"] = True
+    elif profile == "incendiary":
+        mods = [make_incendiary_mod(tmp)]
+        host_opts["battleInstantGrenade"] = True
+        client_opts["battleInstantGrenade"] = True
+    return host_opts, client_opts, mods, seed
+
+
+def unit_owner(gc, uid):
+    for u in battle(gc)["units"]:
+        if u["id"] == uid:
+            return u.get("coop")
+    return None
+
+
+def spare_unit(gc, seat, exclude):
+    """A living own-seat soldier other than the drivers, for a lever that would
+    disrupt driver selection if it moved the driver itself."""
+    for u in battle(gc)["units"]:
+        if (u.get("faction") == 0 and not u.get("isOut")
+                and u.get("coop") == seat and u["id"] not in exclude):
+            return u["id"]
+    return None
+
+
+# ---- per-turn profile injections (each returns admitted-action count) -------
+
+def inject_incendiary(host, client, hmover, cmover, turn):
+    """Fire + smoke heavy: smoke from both seats plus a primed incendiary grenade,
+    so the fire AND smoke hazard buckets (and the peer fire-damage seam) are live
+    every turn. Thrown two tiles off the actor, away from the fixture's hostiles."""
+    n = smoke_block(host, client, cmover)
+    n += smoke_block(host, client, hmover)
+    for gc, uid in ((client, cmover), (host, hmover)):
+        if not idle(host):
+            break
+        top_up(host, client, uid)
+        wid = PI.give_both(host, client, uid, "STR_GRENADE")
+        if not wid:
+            continue
+        n += act(host, client, gc, "prime incendiary", action="prime",
+                 unit=uid, fuse=0, weapon_id=wid)
+        here = PI.pos(battle(host), uid)
+        if here:
+            n += act(host, client, gc, "throw incendiary", action="throw",
+                     unit=uid, weapon_id=wid, x=here[0] + 2, y=here[1] + 2, z=here[2])
+    idle(host, 60)
+    drain(host, client)
+    return n
+
+
+def inject_psi(host, client, hmover, cmover, turn):
+    """A host-executed psi attack on a live hostile (GAP-2/psi_result replication).
+    Host-driven: the host is the executor, so battle_fire runs host-authoritative
+    and the outcome must reach the thin client (faction/owner).
+
+    SEAM-10 (PRD-I3): the payload of this profile is the MIND-CONTROL FACTION
+    lifecycle, not merely psi_result. A stock skirmish rookie has psiSkill 0, so
+    an un-forced roll almost never MCs - the lever was fixture roulette (observed:
+    clean soaks that never converted a single alien, so the dead-MC-alien faction
+    revert this profile is meant to catch was never exercised). Force the driver's
+    psi stats + the target visible (the same determinism the F5 psi test uses) so
+    every psi turn actually flips a hostile to the player side - which then reverts
+    to its original faction at the next NEUTRAL->PLAYER boundary (dead OR alive),
+    the exact divergence SEAM-10 fixed. Keep a floor of hostiles so the conversions
+    never empty the alien side and end the mission mid-soak."""
+    if not idle(host):
+        return 0
+    aliens = [u for u in battle(host)["units"]
+              if u.get("faction") == 1 and not u.get("isOut")]
+    # Never convert the last two hostiles - the per-side census needs the mission
+    # to keep running (a converted alien leaves the hostile tally, and Options::
+    # allowPsionicCapture auto-ends the battle if the alien side is emptied by MC).
+    # A floor of 2 still exercises >=1 conversion even on a minimal 3-alien fixture.
+    if len(aliens) <= 2:
+        return 0
+    target = aliens[0]
+    tpos = (target["x"], target["y"], target["z"])
+    gave = [gc.cmd({"cmd": "battle_give", "unit": hmover, "item": "STR_PSI_AMP",
+                    "slot": "right", "clear_hands": True}) for gc in (host, client)]
+    if not all(g.get("ok") for g in gave):
+        return 0
+    time.sleep(1.5)
+    if not PI.place_adjacent(host, client, hmover, tpos):
+        return 0
+    # Force the MC to deterministically succeed on BOTH machines (each simulates
+    # independently) - psiSkill/psiStrength high on the driver, target visible (the
+    # psiAttackMessage/send guard). Without this the roll misses and the profile is
+    # a vacuous pass.
+    for gc in (host, client):
+        gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": hmover,
+               "psiSkill": 100, "psiStrength": 100, "tu": 120, "refill": True})
+        gc.ok({"cmd": "battle_action", "action": "set_stat", "unit": target["id"],
+               "visible": True})
+    seq0 = parallel(host)["actionSeq"]
+    r = host.cmd({"cmd": "battle_fire", "unit": hmover, "mode": "psi",
+                  "weapon_id": gave[0].get("weaponId"), "tu": 100,
+                  "x": tpos[0], "y": tpos[1], "z": tpos[2]})
+    if not r.get("ok"):
+        return 0
+    idle(host, 60)
+    drain(host, client)
+    # Confirm the conversion actually landed (both machines) so the profile is not
+    # a vacuous pass - this is the SEAM-10 payload being armed.
+    hf = next((u["faction"] for u in battle(host)["units"]
+               if u["id"] == target["id"]), None)
+    cf = next((u["faction"] for u in battle(client)["units"]
+               if u["id"] == target["id"]), None)
+    if hf == 0 and cf == 0:
+        print(f"    psi: MIND-CONTROLLED alien {target['id']} -> player on both "
+              f"(SEAM-10 armed; faction reverts at the next player boundary)")
+    else:
+        print(f"    psi: MC did not converge (host fac={hf} client fac={cf})")
+    return max(0, parallel(host)["actionSeq"] - seq0)
+
+
+def inject_spawn_blast(host, client, hmover, cmover, turn):
+    """A host-fired rocket into empty floor away from the squad: the deterministic
+    blast lever (GAP-1 spawn-on-blast, explode_items, terrain/id-manifest under
+    per-action hashing). A spawn is a bonus; the blast itself is the coverage."""
+    if not idle(host):
+        return 0
+    shooter = None
+    for u in battle(host)["units"]:
+        if u["id"] == hmover and u.get("faction") == 0 and not u.get("isOut"):
+            shooter = u
+            break
+    if not shooter:
+        return 0
+    origin = (shooter["x"], shooter["y"], shooter["z"])
+    for gc in (host, client):
+        gc.cmd({"cmd": "battle_give", "unit": hmover, "item": OG.LAUNCHER,
+                "ammo": OG.SPAWNER, "slot": "right", "clear_hands": True})
+    time.sleep(1.5)
+    seq0 = parallel(host)["actionSeq"]
+    foes = [(u["x"], u["y"], u["z"]) for u in battle(host)["units"]
+            if u.get("faction") == 1 and not u.get("isOut")]
+
+    def clearance(t):
+        return min((max(abs(t[0] - f[0]), abs(t[1] - f[1])) for f in foes), default=99)
+
+    for dx, dy in ((6, 0), (-6, 0), (0, 6), (0, -6), (5, 5), (-5, -5), (8, 0), (0, 8)):
+        tile = (origin[0] + dx, origin[1] + dy, origin[2])
+        if foes and clearance(tile) < 4:
+            continue
+        r = host.cmd({"cmd": "battle_fire", "unit": hmover, "mode": "snap",
+                      "tu": 200, "x": tile[0], "y": tile[1], "z": tile[2]})
+        if r.get("ok"):
+            idle(host, 60)
+            drain(host, client)
+            break
+    return max(0, parallel(host)["actionSeq"] - seq0)
+
+
+def inject_gifting(host, client, hmover, cmover, turn):
+    """Mid-battle battle_gift both directions on a SPARE unit (ownership flip vs
+    auto-ready vs hashing). Not the drivers - moving a driver's ownership would
+    confuse ensure_driver; the spare is flipped seat->seat and back."""
+    settle_display(host, client)
+    hseat = parallel(host)["localSeat"]
+    cseat = parallel(client)["localSeat"]
+    victim = spare_unit(client, cseat, exclude={hmover, cmover})
+    if victim is None:
+        print(f"    (gifting: no spare client-owned unit to flip)")
+        return 0
+    for giver, gseat, tseat, tag in ((client, cseat, hseat, "client->host"),
+                                     (host, hseat, cseat, "host->client")):
+        sel = giver.cmd({"cmd": "battle_gift_select", "unit_id": victim})
+        if not sel.get("ok"):
+            print(f"    (gifting {tag}: select refused: {sel})")
+            break
+        giver.cmd({"cmd": "battle_gift", "owner": tseat})
+        ok = poll(lambda: unit_owner(host, victim) == tseat
+                  and unit_owner(client, victim) == tseat, 20)
+        drain(host, client)
+        if not ok:
+            print(f"    (gifting {tag}: ownership never flipped to seat {tseat})")
+            break
+        print(f"    gifted unit {victim} {tag} (owner now seat {tseat} on both)")
+    settle_display(host, client)
+    return 0
+
+
+def inject_backlog(host, client, hmover, cmover, turn):
+    """Pump ordering under pressure (P11): park the client's action_done reports
+    with hold_action_done so the executor runs into the display-backlog cap, then
+    release and let it drain. Reuses the endturn hold lever."""
+    if not idle(host):
+        return 0
+    fired = 0
+    try:
+        PE.hold_done(client, True)
+        # Drive stateless chains (kneels) from the host: they complete in-frame, so
+        # _actionSeq climbs while the peer's parked reports keep peerDisplayAckedSeq
+        # pinned - the cap is (_actionSeq - peerDisplayAckedSeq) >= 2.
+        seen = 0
+        for _ in range(6):
+            ps = parallel(host)
+            seen = max(seen, ps.get("displayBacklog", 0))
+            if ps.get("admitBlocked") == "display_backlog":
+                break
+            if ps.get("canAdmit") is not True:
+                time.sleep(0.05)
+                continue
+            PI.intent(host, action="kneel", unit=hmover)
+            fired += 1
+            time.sleep(0.05)
+        print(f"    backlog: parked the peer, drove {fired} kneel(s), "
+              f"displayBacklog seen {seen}, admitBlocked={parallel(host).get('admitBlocked')}")
+    finally:
+        PE.hold_done(client, False)
+    # the cap must clear once the peer catches up
+    poll(lambda: parallel(host).get("admitBlocked") != "display_backlog"
+         and parallel(host).get("canAdmit") is True, 120, 0.2)
+    drain(host, client)
+    idle(host)
+    settle_display(host, client)
+    top_up(host, client, hmover)
+    return fired
+
+
+def profile_inject(profile, host, client, hmover, cmover, turn):
+    if profile == "incendiary":
+        return inject_incendiary(host, client, hmover, cmover, turn)
+    if profile == "psi":
+        return inject_psi(host, client, hmover, cmover, turn)
+    if profile == "spawn-blast":
+        return inject_spawn_blast(host, client, hmover, cmover, turn)
+    if profile == "gifting":
+        return inject_gifting(host, client, hmover, cmover, turn)
+    if profile == "backlog":
+        return inject_backlog(host, client, hmover, cmover, turn)
+    return 0
+
+
+
+# ---- special profiles: the CAMPAIGN fixture (campaign, resume) --------------
+
+def _campaign_bringup(host, client, tag, timeout=180):
+    CRBC.PORT = PORT
+    PI.PORT = PORT
+    PE.PORT = PORT
+    TW.PORT = PORT
+    CRBC.bring_up_mixed_battle(host, client)
+    CRBC.drain_to_tactical(host, client)
+    for gc, t in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{t} co-op battle init {tag}",
+                    lambda gc=gc: battle(gc).get("battleInit") or None,
+                    timeout=timeout, interval=1.0)
+    assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, (
+        f"[{tag}] the PRD-P5 executor invariant does not hold: "
+        f"host activeSync={battle(host).get('activeSync')} "
+        f"client activeSync={battle(client).get('activeSync')}")
+
+
+def run_campaign_profile(args):
+    """L2 campaign: one real campaign mission end-to-end - geoscape entry, the
+    battle played in parallel with per-side census, then a voted ABORT that drains
+    debriefing -> geoscape (the debrief + return the skirmish fixture cannot see).
+    Reuses the SEPARATE mixed-ownership terror battle (test_coop_resume_battle_control)."""
+    started = time.time()
+    fail = None
+    host = client = None
+    try:
+        host = GameClient("host", 48880,
+                          make_user_dir("p9_soakcamp_host",
+                                        options={"battleXcomSpeed": FAST_SPEED,
+                                                 "battleAlienSpeed": FAST_SPEED,
+                                                 "skipNextTurnScreen": True,
+                                                 "EnableCoopParallelTurns": True}))
+        client = GameClient("client", 48881,
+                            make_user_dir("p9_soakcamp_client",
+                                          options={"battleXcomSpeed": FAST_SPEED,
+                                                   "battleAlienSpeed": FAST_SPEED,
+                                                   "EnableCoopParallelTurns": False}))
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        _campaign_bringup(host, client, "campaign")
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        print(f"campaign battle up ({time.time() - started:.0f}s)")
+
+        hseat = parallel(host)["localSeat"]
+        cseat = parallel(client)["localSeat"]
+        cmover = PI.pick_driver(host, client, cseat, "client")
+        hmover = PI.pick_driver(host, client, hseat, "host")
+        assert_census(host, client, "at campaign battle start")
+
+        total = 0
+        turns = max(2, min(args.turns, 3))
+        for turn in range(1, turns + 1):
+            turn_before = battle(host).get("turn")
+            cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+            hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+            n = locomotion_block(host, client, hmover, cmover)
+            n += support_block(host, client, cmover)
+            total += n
+            assert_census(host, client, f"after campaign actions turn {turn}")
+            got = close_side(host, client, hseat, cseat, turn_before)
+            assert_census(host, client, f"after campaign alien side turn {turn}")
+            assert battle(host).get("inBattle"), (
+                f"the campaign mission ended during turn {turn} before the abort")
+            print(f"CAMPAIGN TURN {turn}: {n} action(s) (running {total}); "
+                  f"side closed to {got} ({time.time() - started:.0f}s)")
+
+        # debrief + return: the only way a player ends a live co-op mission
+        print("-- campaign: voted ABORT -> debriefing -> geoscape --")
+        session.coop_abort_battle(host, client)
+        for tag, gc in (("host", host), ("client", client)):
+            top = TW.top(gc)
+            assert top in ("GeoscapeState",), (
+                f"{tag} did not return to the geoscape after the mission "
+                f"(top={top}) - debrief/return did not complete on both machines")
+        print("    both machines returned to the geoscape after debrief")
+        session.assert_client_zero_disk(client.user_dir)
+        print(f"\nCAMPAIGN SOAK CLEAN: {total} admitted actions, {turns} parallel "
+              f"turns, census equal after every side, debrief+return synced. "
+              f"{time.time() - started:.0f}s")
+        print("ALL PARALLEL SOAK TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                if gc is None:
+                    continue
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+                print(f"  DBG {tag} top:      {TW.top(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        for gc in (host, client):
+            if gc is not None:
+                gc.shutdown()
+    sys.exit(2 if fail else 0)
+
+
+def run_resume_profile(args):
+    """L2 resume: save mid-side, replace BOTH processes, resume, continue 2+ turns
+    with per-side census - the re-arm path must reset all instrumentation + arbiter
+    state. Reuses the SEPARATE campaign battle + the P9 resume flow."""
+    SAVE = "soak_resume_battle.sav"
+    started = time.time()
+    fail = None
+    host = client = None
+    host_dir = make_user_dir("p9_soakresume_host",
+                             options={"battleXcomSpeed": FAST_SPEED,
+                                      "battleAlienSpeed": FAST_SPEED,
+                                      "skipNextTurnScreen": True,
+                                      "EnableCoopParallelTurns": True})
+    try:
+        host = GameClient("host", 48880, host_dir)
+        client = GameClient("client", 48881,
+                            make_user_dir("p9_soakresume_client",
+                                          options={"battleXcomSpeed": FAST_SPEED,
+                                                   "battleAlienSpeed": FAST_SPEED,
+                                                   "EnableCoopParallelTurns": False}))
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        _campaign_bringup(host, client, "resume-fixture")
+        hseat = parallel(host)["localSeat"]
+        cseat = parallel(client)["localSeat"]
+        cmover = PI.pick_driver(host, client, cseat, "client")
+        hmover = PI.pick_driver(host, client, hseat, "host")
+        assert_census(host, client, "at resume-fixture start")
+
+        cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+        hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+        locomotion_block(host, client, hmover, cmover)
+        assert parallel(host)["actionSeq"] > 0, (
+            "nothing was admitted before the save, so the arbiter-reset check is vacuous")
+        assert_census(host, client, "before the mid-battle save")
+
+        host.ok({"cmd": "save_game", "file": SAVE})
+        assert os.path.exists(os.path.join(host_dir, "xcom1", SAVE)), \
+            "the mid-battle save is not on disk"
+        print(f"saved mid-side -> {SAVE} ({time.time() - started:.0f}s)")
+        host.shutdown(); client.shutdown()
+
+        host = GameClient("host", 48882, host_dir)
+        client = GameClient("client", 48883,
+                            make_user_dir("p9_soakresume_client2",
+                                          options={"battleXcomSpeed": FAST_SPEED,
+                                                   "battleAlienSpeed": FAST_SPEED,
+                                                   "EnableCoopParallelTurns": False}))
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        session.resume_campaign_battle(host, client, SAVE, port=RESUME_PORT)
+        CRBC.drain_to_tactical(host, client)
+        for gc, tag in ((host, "host"), (client, "client")):
+            gc.wait_for(f"{tag} co-op battle init (resumed)",
+                        lambda gc=gc: battle(gc).get("battleInit") or None,
+                        timeout=180, interval=1.0)
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, (
+            "the executor invariant `_isActivePlayerSync == getHost()` did not "
+            "survive the resume")
+        assert parallel(host)["actionSeq"] == 0, (
+            f"the arbiter did not come back RESET: host actionSeq="
+            f"{parallel(host)['actionSeq']} (want 0)")
+        assert_census(host, client, "after resume")
+        print(f"resumed, arbiter reset ({time.time() - started:.0f}s)")
+
+        cmover = PI.pick_driver(host, client, cseat, "client")
+        hmover = PI.pick_driver(host, client, hseat, "host")
+        for turn in range(1, 3):
+            turn_before = battle(host).get("turn")
+            cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+            hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+            locomotion_block(host, client, hmover, cmover)
+            support_block(host, client, cmover)
+            assert_census(host, client, f"after resumed actions turn {turn}")
+            close_side(host, client, hseat, cseat, turn_before)
+            assert_census(host, client, f"after resumed alien side turn {turn}")
+        session.assert_client_zero_disk(client.user_dir)
+        print(f"\nRESUME SOAK CLEAN: resumed mid-side, arbiter reset, 2 turns "
+              f"continued clean. {time.time() - started:.0f}s")
+        print("ALL PARALLEL SOAK TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                if gc is None:
+                    continue
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+                print(f"  DBG {tag} top:      {TW.top(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        for gc in (host, client):
+            if gc is not None:
+                gc.shutdown()
+    sys.exit(2 if fail else 0)
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--turns", type=int, default=DEFAULT_TURNS)
+    ap.add_argument("--actions", type=int, default=DEFAULT_MIN_ACTIONS)
+    ap.add_argument("--seed", type=int, default=None)
+    ap.add_argument("--trace", action="store_true",
+                    help="report the per-unit diff after every block (diagnosis)")
+    ap.add_argument("--profile", default="baseline", choices=PROFILES,
+                    help="soak scenario profile (VALIDATION L2 matrix)")
+    ap.add_argument("--strict-burnin", action="store_true",
+                    help="PHASE D.1 chain-atomicity: enable the strict-compare "
+                         "lever (terrain/unitsCore/items/itemIdCtr compared at "
+                         "EVERY seq) and assert those four buckets clean")
+    args = ap.parse_args()
+    global STRICT_BURNIN
+    STRICT_BURNIN = args.strict_burnin
+
+    # Two profiles need the CAMPAIGN fixture, not the skirmish one - they take a
+    # dedicated flow (each does its own sys.exit).
+    if args.profile in SPECIAL_PROFILES:
+        if args.seed is None:
+            args.seed = DEFAULT_SEED
+        (run_campaign_profile if args.profile == "campaign"
+         else run_resume_profile)(args)
+        return
+
+    # Skirmish profiles: the profile only changes the bring-up options/mods and a
+    # per-turn injection; the fixture + per-side census are the baseline's.
+    prof_tmp = tempfile.mkdtemp(prefix="coop_soak_%s_" % args.profile.replace("-", "_"))
+    host_opts_x, client_opts_x, prof_mods, prof_seed = profile_bringup(args.profile, prof_tmp)
+    if args.seed is None:
+        args.seed = prof_seed
+
+    started = time.time()
+    fail = None
+    host = client = None
+    try:
+        # --- the fixture, RE-ROLLED if the generator shorts it -------------
+        #
+        # STR_MEDIUM_SCOUT deploys 3-5 hostiles, but some of them arrive DEAD:
+        # BattlescapeGame's constructor runs checkForCasualties() and it finds
+        # freshly-generated aliens on 0 HP (observed: 3 of 5, all clustered, at
+        # turn 0 - a stock generator/deployment accident, reproduced on a build
+        # with nothing but logging added). A run that comes up under the floor
+        # cannot survive five turns of shooting, so re-roll the whole battle
+        # rather than fail: the map is generated afresh on every bring-up, and
+        # `set_seed` only pins the stream AFTER it.
+        for attempt in range(1, FIXTURE_TRIES + 1):
+            host = GameClient("host", 48880,
+                              make_user_dir("p9_soak_host", mods=prof_mods,
+                                            options=host_opts_x))
+            client = GameClient("client", 48881,
+                                make_user_dir("p9_soak_client", mods=prof_mods,
+                                              options=client_opts_x))
+            for gc in (host, client):
+                write_battle_fixture(gc.user_dir)
+            host.spawn(); host.connect()
+            client.spawn(); client.connect()
+            TW.PORT = PORT
+            PI.PORT = PORT
+            PE.PORT = PORT
+            TW.bring_up_battle(host, client)
+            print(f"battle up on both machines ({time.time() - started:.0f}s)")
+
+            # --- A. seed + the mode invariant -----------------------------
+            for gc, tag in ((host, "host"), (client, "client")):
+                s = gc.ok({"cmd": "set_seed", "seed": args.seed})
+                print(f"    {tag} seed pinned to {s['seed']}")
+            gm = battle(host).get("coopGamemode")
+            assert gm in (1, 4), (
+                f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+                f"cover PVE (1) and PVE2 (4), so this soak would be vacuous")
+            for gc, tag in ((host, "host"), (client, "client")):
+                assert battle(gc)["parallelActive"] is True, \
+                    f"{tag}: parallel mode is not live: {battle(gc)}"
+            assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, \
+                "the PRD-P5 executor invariant does not hold; nothing below is testing it"
+            for key in ("fireTiles", "smokeTiles", "fireHash"):
+                assert key in tiles(host), (
+                    f"`battle_tiles` carries no {key!r} - PRD-P9's hazard census is "
+                    f"missing and part C would be vacuous")
+            assert "wounds" in battle(host)["units"][0], (
+                "battle_state units carry no 'wounds' - the PRD-P9 unit census would "
+                "be missing a term")
+
+            foes = [u["id"] for u in battle(host)["units"]
+                    if u.get("faction") == 1 and not u.get("isOut")]
+            if len(foes) >= MIN_HOSTILES:
+                # De-flake (2026-08-12): a map with enough hostiles can still BOX A
+                # SEAT IN so pick_driver finds no spot near an alien - a ~1/8 placement
+                # flake that breaks a 10-streak. The map is per-bring-up (set_seed pins
+                # the RNG stream only AFTER generation), so re-rolling the battle is the
+                # only lever. Fold driver placement into fixture acceptance and reuse the
+                # movers below.
+                try:
+                    _hseat0 = parallel(host)["localSeat"]
+                    _cseat0 = parallel(client)["localSeat"]
+                    hmover0 = PI.pick_driver(host, client, _hseat0, "host")
+                    cmover0 = PI.pick_driver(host, client, _cseat0, "client")
+                except AssertionError as pe:
+                    print(f"    fixture PLACEMENT short on attempt {attempt}: {pe} "
+                          f"- re-rolling the battle")
+                    assert attempt < FIXTURE_TRIES, (
+                        f"{FIXTURE_TRIES} bring-ups could not place a driver of each "
+                        f"seat near a hostile (every map boxed a seat in)")
+                    host.shutdown(); client.shutdown(); host = client = None
+                    continue
+                print(f"    fixture: {len(foes)} hostiles {foes}")
+                break
+            all_hostiles = [u["id"] for u in battle(host)["units"]
+                            if u.get("faction") == 1]
+            print(f"    fixture short on attempt {attempt}: {len(foes)} live "
+                  f"hostile(s) of {len(all_hostiles)} generated {all_hostiles} - "
+                  f"re-rolling the battle")
+            assert attempt < FIXTURE_TRIES, (
+                f"{FIXTURE_TRIES} bring-ups in a row generated fewer than "
+                f"{MIN_HOSTILES} LIVE hostiles. If every one of them also shows "
+                f"fewer than {MIN_HOSTILES} hostiles GENERATED, `battle.cfg` did "
+                f"not take (mission index {MISSION_MEDIUM_SCOUT} is "
+                f"STR_MEDIUM_SCOUT only while the mission list is the stock xcom1 "
+                f"deployment order with hidden entries filtered, i.e. "
+                f"Options::debug off). Units: "
+                f"{[(u['id'], u.get('faction')) for u in battle(host)['units']]}")
+            host.shutdown(); client.shutdown()
+            host = client = None
+
+        hseat = parallel(host)["localSeat"]
+        cseat = parallel(client)["localSeat"]
+        assert hseat != cseat, f"both machines report seat {hseat}"
+        # movers were placed + validated in the fixture-acceptance loop (de-flake) -
+        # reuse them rather than re-placing (which could box on a second draw).
+        cmover = cmover0
+        hmover = hmover0
+        if STRICT_BURNIN:
+            enable_strict_burnin(host, client)
+        base = assert_census(host, client, "at battle start")
+        print(f"seats host={hseat} client={cseat}; drivers host={hmover} "
+              f"client={cmover}; hazards {base} ({time.time() - started:.0f}s)")
+
+        total = 0
+        backlog_fired = 0
+        backlog_ran = False
+        for turn in range(1, args.turns + 1):
+            t0 = time.time()
+            turn_before = battle(host).get("turn")
+            cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+            hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+
+            n = 0
+            for i in range(3):
+                n += locomotion_block(host, client, hmover, cmover)
+                if args.trace:
+                    settle_display(host, client)
+                    trace_units(host, client, f"turn {turn} locomotion {i + 1}")
+            n += shot_block(host, client, hmover, cmover)
+            if args.trace:
+                settle_display(host, client)
+                trace_units(host, client, f"turn {turn} shots")
+            n += support_block(host, client, cmover)
+            if args.trace:
+                settle_display(host, client)
+                trace_units(host, client, f"turn {turn} support")
+            n += profile_inject(args.profile, host, client, hmover, cmover, turn)
+            if args.trace:
+                settle_display(host, client)
+                trace_units(host, client, f"turn {turn} profile {args.profile}")
+            if turn == 2:
+                n += smoke_block(host, client, cmover)
+            if turn == 3 and args.profile == "baseline":
+                backlog_ran = True
+                backlog_fired = scenario_backlog_cap(host, client, hmover, cmover)
+                n += backlog_fired
+            total += n
+
+            assert_census(host, client, f"after the actions of turn {turn}")
+            got = close_side(host, client, hseat, cseat, turn_before)
+            haz = assert_census(host, client,
+                                f"after the alien side of turn {turn}")
+            assert battle(host).get("inBattle"), (
+                f"the fixture's mission ended during turn {turn} - the remaining "
+                f"turns could assert nothing")
+            print(f"TURN {turn}: {n} action(s) admitted (running {total}); side "
+                  f"closed to turn {got}; hazards {haz}; "
+                  f"{time.time() - t0:.0f}s, {time.time() - started:.0f}s total")
+
+        assert total >= args.actions, (
+            f"the soak only drove {total} admitted actions, below the "
+            f"{args.actions} PRD-P9 asks for - the fixture refused too many "
+            f"(a boxed-in driver, a shot with no line of fire)")
+        if args.profile == "baseline":
+            # the phase must have RUN (guards a mis-wired turn gate); a boxed-in
+            # shooter that fired 0 real chains is tolerated inside the phase above.
+            assert backlog_ran, "the rider-R3 backlog phase never ran"
+
+        # zero-disk holds even after a long battle
+        session.assert_client_zero_disk(client.user_dir)
+
+        # (the desync-report silence criterion rides assert_census, so it has
+        # already been checked after every side of every turn)
+        if STRICT_BURNIN:
+            print(f"\nSTRICT-BURNIN [{args.profile}] seed {args.seed}: the four core "
+                  f"buckets PLAYER-side strict-CLEAN; ALIEN-side/boundary residual "
+                  f"(D-lite Option-B lag -> D.3) + other over the run: "
+                  f"{dict(BURNIN_RESIDUALS) or 'none'}")
+        print(f"\nSOAK CLEAN [{args.profile}]: {total} admitted actions over "
+              f"{args.turns} full turns, seed {args.seed}, census equal after every "
+              f"side, tripwire silent. {time.time() - started:.0f}s")
+        print("ALL PARALLEL SOAK TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                if gc is None:
+                    continue
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+                print(f"  DBG {tag} top:      {TW.top(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        for gc in (host, client):
+            if gc is not None:
+                gc.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_speed_skew.py b/tools/coop_test/test_parallel_speed_skew.py
new file mode 100644
index 000000000..3f63a9e5b
--- /dev/null
+++ b/tools/coop_test/test_parallel_speed_skew.py
@@ -0,0 +1,267 @@
+"""PRD-P7: display flow control under an animation-speed skew.
+
+The executor runs the whole battle and the peer only DISPLAYS it. Nothing in that
+loop makes the two machines run at the same rate: `battleXcomSpeed` is a local
+preference, so a host on 1 ms/frame and a client on 120 ms/frame drift apart by
+one whole chain per action. Left alone the client would end up minutes behind,
+watching walks the host finished long ago.
+
+P7 bounds it from both ends:
+
+  * `action_end` (host -> client) marks a chain as fully sent. It rides the
+    ordinary receive gate, so the client consumes it exactly when it has finished
+    DISPLAYING that chain, and answers `action_done {seq, seat}`.
+  * `canAdmitAction()` refuses while `(_actionSeq - peerDisplayAckedSeq) >= 2`, so
+    the executor can never be more than two chains ahead of what the peer has
+    drawn. (`parallel_state.admitBlocked` reports `display_backlog` when that is
+    the term that said no.)
+  * the client fast-forwards its own display when an action packet is stuck behind
+    the gate and what it is drawing is nothing but locomotion, so the backlog
+    COMPRESSES rather than just blocking the host.
+
+This test drives the executor through three walks back to back with the two
+instances at opposite ends of the speed range and asserts:
+
+  1. the undisplayed backlog never exceeds 2 (the whole point of the cap);
+  2. all three walks execute, and at the end the peer has reported every one of
+     them displayed (`peerDisplayAckedSeq == actionSeq`) - i.e. the `action_end`
+     / `action_done` loop closes and cannot wedge the arbiter;
+  3. both machines end on identical positions and TU;
+  4. the PRD-P2 drift tripwire stays quiet - a fast-forwarded display must change
+     nothing but how long the animation is on screen.
+
+Run:  python tools/coop_test/test_parallel_speed_skew.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_introspection as TI
+
+PORT = "47988"
+
+HOST_SPEED = 1     # fastest the option takes
+CLIENT_SPEED = 300  # a slideshow, in the same units
+WALKS = 3
+BACKLOG_CAP = 2
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def wait_admit(host, client, watch, timeout=180):
+    """Wait for the executor to be ready for another input, SAMPLING all the way.
+    If the display backlog is what is holding it, that is the window in which the
+    bound has to be checked - a wait that does not sample would step right over
+    the only moment the cap is visible."""
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        ph, _ = sample(host, client, watch)
+        if ph.get("canAdmit") is True and not ph.get("pendingAdmits"):
+            return True
+        time.sleep(0.05)
+    return False
+
+
+def sample(host, client, watch):
+    """One poll of both machines' flow-control counters."""
+    ph, pc = parallel(host), parallel(client)
+    watch["backlog"] = max(watch["backlog"], ph.get("displayBacklog", 0))
+    if ph.get("admitBlocked") == "display_backlog":
+        watch["capped"] += 1
+    if ph.get("fastForward"):
+        watch["hostFF"] += 1
+    if pc.get("fastForward"):
+        watch["clientFF"] += 1
+    return ph, pc
+
+
+def main():
+    fail = None
+    host_dir = make_user_dir("p7_skew_host",
+                             options={"battleXcomSpeed": HOST_SPEED,
+                                      "battleAlienSpeed": 2,
+                                      "skipNextTurnScreen": True,
+                                      "EnableCoopParallelTurns": True})
+    client_dir = make_user_dir("p7_skew_client",
+                               options={"battleXcomSpeed": CLIENT_SPEED,
+                                        "battleAlienSpeed": 2,
+                                        "EnableCoopParallelTurns": False})
+    # PRD-P7 asks for the two instances at OPPOSITE ends of the speed range, and
+    # per-instance means the options.cfg splice, not set_option: the skew has to
+    # be in force from the first frame of the battle.
+    TI.assert_options_spliced(host_dir, {"battleXcomSpeed": HOST_SPEED})
+    TI.assert_options_spliced(client_dir, {"battleXcomSpeed": CLIENT_SPEED})
+    host = GameClient("host", 48876, host_dir)
+    client = GameClient("client", 48877, client_dir)
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        print(f"speed skew live: host {HOST_SPEED} ms/frame, client "
+              f"{CLIENT_SPEED} ms/frame")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        ps = parallel(host)
+        assert "displayBacklog" in ps and "peerDisplayAckedSeq" in ps, (
+            f"parallel_state carries no display-flow counters, so the bound below "
+            f"would be vacuous: {sorted(ps)}")
+
+        mover = PI.pick_driver(host, client, 0, "host")
+        # The skew only bites while the walker is ON SCREEN AND VISIBLE:
+        # UnitWalkBState runs an off-screen walk at interval 0 whatever the option
+        # says, and the fixture's teleported driver is seen by nobody on the
+        # machine that does not own it. Without both, the "slow" client would
+        # display at frame rate and never fall behind at all.
+        aim = client.ok({"cmd": "battle_camera", "unit": mover, "visible": True})
+        assert aim["onScreen"] and aim["visible"], \
+            f"the client cannot actually watch the walker: {aim}"
+        watch = {"backlog": 0, "capped": 0, "hostFF": 0, "clientFF": 0}
+        start_seq = parallel(host)["actionSeq"]
+        origin = PI.pos(battle(host), mover)
+
+        # Topped up ONCE, before anything is in flight. Doing it per walk would
+        # write raw TU onto a client that is still displaying the previous chain,
+        # which is a harness-made divergence, not one P7 could cause.
+        PI.top_up(host, client, mover, amount=250)
+
+        admitted = 0
+        for step in range(WALKS):
+            # probe_step refuses mid-chain (singleton Pathfinding), so resolve the
+            # destination while the executor's own queue is empty. The CLIENT is
+            # deliberately not waited for - being behind is the point.
+            assert wait_admit(host, client, watch), (
+                f"walk {step}: the executor never freed up: {parallel(host)}")
+            assert watch["backlog"] <= BACKLOG_CAP, (
+                f"walk {step}: the executor ran {watch['backlog']} chains ahead "
+                f"of what the peer had displayed while waiting to be free")
+            client.cmd({"cmd": "battle_camera", "unit": mover, "visible": True})
+            # Two tiles, not one: a one-tile step is over on the client before the
+            # host's next input can be prepared, and no backlog ever forms.
+            dest = PI.far_step(host, mover, radius=2) or PI.free_step(host, mover)
+            if not dest:
+                print(f"    (walk {step}: the mover can path nowhere - stopping "
+                      f"after {admitted} walk(s))")
+                break
+            seq_before = parallel(host)["actionSeq"]
+            r = PI.intent(host, action="move", unit=mover,
+                          x=dest[0], y=dest[1], z=dest[2])
+            assert r.get("ok"), f"walk {step}: the lever refused: {r}"
+
+            # Poll hard while the chain runs: the backlog bound is an invariant,
+            # not an end state, so it has to be sampled continuously.
+            deadline = time.time() + 120
+            while time.time() < deadline:
+                ph, _ = sample(host, client, watch)
+                assert watch["backlog"] <= BACKLOG_CAP, (
+                    f"walk {step}: the executor ran {watch['backlog']} chains "
+                    f"ahead of what the peer had displayed; canAdmitAction() must "
+                    f"refuse at {BACKLOG_CAP}. host={ph}")
+                if ph.get("actionSeq", 0) > seq_before and ph.get("canAdmit") is True:
+                    break
+                time.sleep(0.05)
+            if parallel(host)["actionSeq"] > seq_before:
+                admitted += 1
+            print(f"    walk {step}: actionSeq {seq_before} -> "
+                  f"{parallel(host)['actionSeq']}, backlog high-water "
+                  f"{watch['backlog']}")
+
+        assert admitted >= 2, (
+            f"only {admitted} of {WALKS} walks were admitted - the executor was "
+            f"blocked, not merely paced: {parallel(host)}")
+
+        # Let the slow machine catch up, then prove the loop CLOSED.
+        assert PI.wait_until(
+            lambda: parallel(host)["peerDisplayAckedSeq"]
+            == parallel(host)["actionSeq"], 180, interval=0.5), (
+            f"the peer never reported the last chain displayed: host="
+            f"{parallel(host)} client={parallel(client)}. `action_end` /"
+            f"`action_done` is the only thing that moves peerDisplayAckedSeq, and "
+            f"if it stalls the arbiter refuses every further action for the rest "
+            f"of the side.")
+        PI.settle(host, client, seconds=8)
+
+        # Re-base the peer's TU before comparing it. The walk's teleport-correct
+        # (`abortPath`) carries POSITION and facing but no TU, so after the LAST
+        # walk of a run the peer's TU is whatever its own partial animation had
+        # spent when the abort cut it off - a pre-existing co-op gap that a
+        # deliberately slow peer is simply very good at exposing (P7's client
+        # fast-forward narrows it, it does not cause it: an interval-0 display
+        # spends MORE of the path before the abort lands). A turn's replay packet
+        # carries the authoritative value and does not re-charge, so one turn
+        # re-bases it. Two directions, because a turn that turns nothing ships no
+        # packet at all.
+        here = PI.pos(battle(host), mover)
+        for dx in (1, -1):
+            PI.intent(host, action="turn", unit=mover,
+                      x=here[0] + dx, y=here[1] + dx, z=here[2])
+            wait_admit(host, client, watch)
+            PI.settle(host, client, seconds=3)
+        assert PI.wait_until(
+            lambda: parallel(host)["peerDisplayAckedSeq"]
+            == parallel(host)["actionSeq"], 180, interval=0.5), (
+            f"the peer fell behind again on the re-basing turns: host="
+            f"{parallel(host)} client={parallel(client)}")
+        sample(host, client, watch)
+
+        ph, pc = parallel(host), parallel(client)
+        assert ph["actionSeq"] >= start_seq + admitted, (
+            f"action_seq did not advance once per admitted walk "
+            f"({start_seq} -> {ph['actionSeq']} over {admitted})")
+        assert pc["displaySeq"] == ph["actionSeq"], (
+            f"the client thinks it has displayed chain {pc['displaySeq']} while "
+            f"the host has admitted {ph['actionSeq']}")
+        assert watch["backlog"] <= BACKLOG_CAP, \
+            f"backlog high-water {watch['backlog']} exceeded the cap"
+
+        hb, cb = battle(host), battle(client)
+        assert PI.pos(hb, mover) == PI.pos(cb, mover), (
+            f"the two machines disagree about unit {mover} after the skewed run: "
+            f"host {PI.pos(hb, mover)} client {PI.pos(cb, mover)}")
+        assert PI.pos(hb, mover) != origin, "the mover never actually moved"
+        assert PI.tu(hb, mover) == PI.tu(cb, mover), (
+            f"TU diverged: host {PI.tu(hb, mover)} client {PI.tu(cb, mover)}")
+        session.assert_battle_synced(host, client, "after the speed-skewed run")
+        assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+            "the PRD-P2 drift tripwire fired during the speed-skewed run"
+
+        print(f"PASS: {admitted} walk(s) at a {HOST_SPEED}:{CLIENT_SPEED} speed "
+              f"skew - backlog high-water {watch['backlog']} (cap {BACKLOG_CAP}), "
+              f"cap engaged {watch['capped']}x, host fast-forward seen "
+              f"{watch['hostFF']}x, client display fast-forward seen "
+              f"{watch['clientFF']}x; both machines identical at "
+              f"{PI.pos(hb, mover)}, tripwire quiet")
+        print("ALL SPEED-SKEW FLOW-CONTROL TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_state_watermark.py b/tools/coop_test/test_parallel_state_watermark.py
new file mode 100644
index 000000000..d6432176b
--- /dev/null
+++ b/tools/coop_test/test_parallel_state_watermark.py
@@ -0,0 +1,257 @@
+"""Parallel battlescape "atomic unit death" rework, Phase 1: per-unit state
+watermark fixture.
+
+THE MECHANISM UNDER TEST (BattleUnit::coopStateAccept, connectionTCP.cpp apply
+sites for hit_unit/panic_action/psi_result/unit_fall/next_turn): every STAMPED
+per-unit state write on the parallel client now carries a (side_seq, action_seq,
+rank) tuple, and is applied only if that tuple is >= the unit's own recorded
+watermark (lexicographic compare); an UNSTAMPED write bypasses the watermark
+entirely, unchanged from before this phase. This closes a real ordering hole: a
+STALE absolute snapshot (e.g. a next_turn taken at the alien side's START, rank
+0) arriving or being re-applied AFTER a newer chain-carrier write (a hit_unit
+rank 1 landed mid-side) must not clobber the fresher value.
+
+This fixture cannot wait for a genuinely reordered network delivery (the harness
+has no packet-reordering fault injector), so it uses the SYNTHETIC replay lever
+the plan added for exactly this purpose: `parallel_state
+{"replay_last_next_turn": true}` re-runs the per-unit bulk-apply loop of the
+LAST applied next_turn packet a second time, immediately, on the CLIENT. Since
+that packet was stamped when the alien side STARTED (rank 0, action_seq 0), and
+the ambushed units keep taking rank-1 hit_unit hits for the rest of that same
+side, replaying it is exactly the "stale absolute arrives late" scenario the
+watermark exists to reject.
+
+Flow:
+  1. Bring up a parallel battle: host EnableCoopParallelTurns, client plain
+     (the thin replay peer) and SLOW (--slow-client) so the alien side stays
+     open long enough to catch the synthetic replay mid-side.
+  2. Ambush several own-seat soldiers next to live aliens (reusing
+     test_parallel_alien_death_decouple.ambush) at a HP that survives a hit -
+     several stamped hit_unit writes land during the SAME alien side as the
+     next_turn snapshot that opened it.
+  3. Close the player side; wait for the alien side to start (side flips to 1)
+     - this is the next_turn the replay lever will later re-run.
+  4. Poll `unit_stats_full` on the client for a unit whose `coopStateRank>=1`
+     (a rank-1 hit_unit write was accepted and its watermark recorded).
+  5. Fire the lever. GREEN run (default): watermark ON, so the stale rank-0
+     replay is rejected for every unit that has since taken a rank-1 hit.
+     RED run (--disable-watermark): `parallel_state
+     {"death_watermark_disable": true}` is set FIRST, so the check is skipped
+     and the stale snapshot overwrites the unit's post-hit state.
+
+Asserts (same build, two separate invocations - "ONCE green, ONCE red"):
+  GREEN: stateWatermarkRejects > 0 (the watermark actually rejected something)
+         AND the hit unit's unitsCombat fields (kneeled/mc/w0..w5 - the same
+         set computeBattleHashes() sums into that bucket) are IDENTICAL between
+         host and client (no divergence - the reject was a no-op).
+  RED:   stateWatermarkRejects == 0 (the disabled check never ran)
+         AND at least one of those unitsCombat fields now DIFFERS between host
+         and client (the stale overwrite is a REAL, externally observable
+         divergence - exactly the class of bug this phase exists to prevent).
+  The diff is read directly (host vs client `unit_stats_full`) rather than
+  waiting on the in-game async sync-check ring: that ring only samples a NEW
+  compare when the next chain closes, and the alien side's own end-of-side
+  absolute (unaffected by this client-local-only corruption) would otherwise
+  heal a reverted unit before any such compare could fire.
+
+Non-vacuity: asserts the ambush actually placed soldiers and that at least one
+of them took a stamped hit before the lever fires.
+
+Run:  python tools/coop_test/test_parallel_state_watermark.py [--seed N]
+                 [--slow-client MS] [--hp N] [--pairs N] [--disable-watermark]
+Exit 0 = the expected verdict for the selected mode held; 2 = it did not.
+"""
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_endturn as PE
+import test_parallel_soak as SOAK
+import test_parallel_alien_death_decouple as ADD
+
+PORT = "47993"
+
+# unitsCombat = the chain-authored per-unit field set computeBattleHashes() sums
+# into the unitsCombat bucket (SharedEcon.cpp) - same list test_parallel_no_reroll
+# uses. Health/stun/morale live in unitsRegen instead, so they are read for
+# diagnostics (the visible symptom) but not counted toward this mismatch.
+COMBAT_FIELDS = ["kneeled", "mc", "w0", "w1", "w2", "w3", "w4", "w5"]
+
+
+def bstate(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def usf(gc):
+    return {u["id"]: u for u in gc.ok({"cmd": "unit_stats_full"})["units"]}
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--seed", type=int, default=778899)
+    ap.add_argument("--slow-client", type=int, default=300,
+                    help="ms/frame on the client so the alien side stays open long "
+                         "enough to catch the synthetic replay mid-side")
+    ap.add_argument("--hp", type=int, default=45,
+                    help="ambushed soldier health - survives a hit, still takes damage")
+    ap.add_argument("--pairs", type=int, default=3)
+    ap.add_argument("--disable-watermark", action="store_true",
+                    help="RED: set parallel_state {death_watermark_disable:true} "
+                         "on the client before firing the synthetic replay lever")
+    args = ap.parse_args()
+
+    host_opts = {"battleXcomSpeed": SOAK.FAST_SPEED, "battleAlienSpeed": SOAK.FAST_SPEED,
+                 "skipNextTurnScreen": True, "EnableCoopParallelTurns": True}
+    client_opts = {"battleXcomSpeed": args.slow_client, "battleAlienSpeed": args.slow_client,
+                   "EnableCoopParallelTurns": False}
+    host = GameClient("host", 48886, make_user_dir("watermark_host", options=host_opts))
+    client = GameClient("client", 48887, make_user_dir("watermark_client", options=client_opts))
+    for gc in (host, client):
+        SOAK.write_battle_fixture(gc.user_dir)
+    host.spawn(); host.connect()
+    client.spawn(); client.connect()
+    TW.PORT = PORT
+    PE.PORT = PORT
+    fails = []
+    rejects = 0
+    combat_mm = 0
+    try:
+        TW.bring_up_battle(host, client, seed=args.seed)
+        for gc in (host, client):
+            gc.ok({"cmd": "set_seed", "seed": args.seed})
+        assert bstate(host)["activeSync"] is True and bstate(client)["activeSync"] is False, \
+            "host must own the battle simulation, client must be the replay peer"
+
+        # strict compare so unitsCombat is diffed at every seq, not only at the
+        # side-gated boundaries - same lever test_parallel_soak.enable_strict_burnin
+        # uses (sync_capture {strict:true}; response carries strictBurnIn).
+        for gc, tag in ((host, "host"), (client, "client")):
+            r = gc.cmd({"cmd": "sync_capture", "strict": True})
+            assert r.get("strictBurnIn") is True, f"{tag}: strict-burnin did not engage: {r}"
+
+        placed = ADD.ambush(host, client, 0, args.pairs, args.hp)
+        assert placed > 0, "ambush placed nobody - fixture non-vacuity failed"
+        print(f"  ambushed {placed} soldier(s) at hp={args.hp}")
+
+        PE.hush(host, client)
+        for gc in (host, client):
+            if not parallel(gc)["localReady"]:
+                PE.arm(gc)
+
+        # wait for the ALIEN side to start (side flips to 1) - this is the side
+        # whose opening next_turn snapshot the replay lever will later re-run.
+        got_side = SOAK.poll(lambda: bstate(host).get("side") == 1, 30, 0.2)
+        assert got_side, "the alien side never started"
+        print(f"  alien side started (turn {bstate(host).get('turn')})")
+
+        # poll for >=1 stamped hit landing on the CLIENT while the side is still
+        # open (coopStateRank>=1 = a rank-1 hit_unit write was accepted and its
+        # watermark recorded - see BattleUnit::coopStateAccept).
+        hit_id = None
+        deadline = time.time() + 60
+        while time.time() < deadline:
+            stats = usf(client)
+            hit = next((uid for uid, u in stats.items() if u.get("coopStateRank", 0) >= 1),
+                       None)
+            if hit is not None:
+                hit_id = hit
+                break
+            if bstate(host).get("side") != 1:
+                break
+            time.sleep(0.2)
+        assert hit_id is not None, (
+            "no stamped hit_unit landed on the client during the alien side - "
+            "ambush non-vacuous check failed (try --seed/--hp/--pairs)")
+        before = usf(client)[hit_id]
+        wounds = [before.get(f"w{i}", 0) for i in range(6)]
+        print(f"  unit {hit_id} took a stamped hit: coopStateRank={before.get('coopStateRank')} "
+              f"health={before.get('health')} wounds={wounds} side={bstate(host).get('side')}")
+
+        if args.disable_watermark:
+            # NOTE: like the pre-existing rxSideBarrierDisable lever, a
+            # parallel_state response reports state as of BEFORE this same
+            # request's own setter runs - so the confirmation needs a follow-up
+            # read, not the response to the request that set it.
+            client.cmd({"cmd": "parallel_state", "death_watermark_disable": True})
+            r = parallel(client)
+            assert r.get("deathWatermarkDisable") is True, f"lever did not engage: {r}"
+            print("  RED mode: death_watermark_disable=true set on the client")
+
+        # SYNTHETIC RED lever: re-run the last applied next_turn snapshot's
+        # per-unit loop once, immediately, against the (possibly since-hit) units.
+        client.cmd({"cmd": "parallel_state", "replay_last_next_turn": True})
+        p = parallel(client)
+        rejects = p.get("stateWatermarkRejects", 0)
+        rejects1 = p.get("stateWatermarkRejectsRank1", 0)
+        print(f"  after replay: stateWatermarkRejects={rejects} (rank1={rejects1})")
+
+        after = usf(client)[hit_id]
+        print(f"  unit {hit_id} post-replay: health={after.get('health')} "
+              f"(post-hit was {before.get('health')})")
+
+        # "the next sync_check shows unitsCombat" (the plan's phrasing) needs a
+        # NEW chain to close before the host's ring has a fresh compare to make
+        # - and the alien side's OWN end-of-side absolute (unaffected by this
+        # client-local-only corruption, since it derives from the host's real,
+        # never-touched state) would HEAL a reverted unit the moment it lands,
+        # before any such compare could fire. So the unitsCombat divergence is
+        # read directly and immediately here, instead of waiting on the async
+        # ring: the SAME field set computeBattleHashes() sums into the
+        # unitsCombat bucket (kneeled, mc, w0..w5 - see
+        # test_parallel_no_reroll.COMBAT_FIELDS), diffed host (never touched by
+        # the client-local replay) against client (the one the lever just wrote
+        # to) for the hit unit, while the side is still open.
+        host_u = usf(host)[hit_id]
+        client_u = usf(client)[hit_id]
+        diffs = [(f, host_u.get(f), client_u.get(f)) for f in COMBAT_FIELDS
+                 if host_u.get(f) != client_u.get(f)]
+        combat_mm = len(diffs)
+        print(f"  unitsCombat field mismatch (host vs client, unit {hit_id}) = "
+              f"{combat_mm} {diffs}")
+
+        print("\n== VERDICT ==")
+        if args.disable_watermark:
+            if rejects != 0:
+                fails.append(f"RED: expected stateWatermarkRejects==0 with the lever "
+                             f"disabled, got {rejects}")
+            if combat_mm <= 0:
+                fails.append("RED: expected unitsCombat to diverge (mismatchCount>0) "
+                             "once the watermark check was disabled, got 0 - the "
+                             "corruption never surfaced (or the watermark held anyway)")
+        else:
+            if rejects <= 0:
+                fails.append(f"GREEN: expected stateWatermarkRejects>0, got {rejects} - "
+                             f"the watermark never rejected the stale replay")
+            if combat_mm != 0:
+                fails.append(f"GREEN: expected unitsCombat mismatchCount==0, got "
+                             f"{combat_mm} - the watermark let something through")
+    except Exception as e:
+        fails.append(f"[ERROR] {e}")
+    finally:
+        for gc in (host, client):
+            try:
+                gc.cmd({"cmd": "quit"})
+            except Exception:
+                pass
+
+    mode = "RED (death_watermark_disable)" if args.disable_watermark else "GREEN (watermark ON)"
+    if fails:
+        print(f"\n==== per-unit state watermark [{mode}]: FAIL ====")
+        for f in fails:
+            print(f"  FAIL {f}")
+        sys.exit(2)
+    print(f"\n  PASS [{mode}]: stateWatermarkRejects={rejects} unitsCombat={combat_mm}")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_terrain_pacing.py b/tools/coop_test/test_parallel_terrain_pacing.py
new file mode 100644
index 000000000..38d3c0b34
--- /dev/null
+++ b/tools/coop_test/test_parallel_terrain_pacing.py
@@ -0,0 +1,380 @@
+"""Chain-atomicity D.3b: a chained-terrain explosion must NEVER wedge the auto-shot
+pacing wait.
+
+THE BUG (empirically isolated by the D.3b probe): the client-side auto-shot pacing
+signal `coopTaskCompleted` was a FILE-SCOPE GLOBAL shared by every ExplosionBState
+instance (ExplosionBState.cpp). A shot's ExplosionBState parks on it + `_hasHitUnit==1`
+waiting for the host's flip packet; a chained-terrain ExplosionBState (spawned via
+checkForTerrainExplosions, `_explosionCounter>0`, BA_NONE) reads the SAME shared flag
+and can either park on it or consume the shot's flip. When that race fires the shot's
+wait is never released through its own flip: the ProjectileFlyBState beneath it holds
+the receive gate and the client falls arbitrarily far behind, bounded today only by the
+force-drain watchdog (`kRxPacingForceDrainTicks=600`, ~10 s).
+
+The rifle control (no terrain explosion) never wedges; the HE auto-cannon (which spawns
+chained-terrain explosions) does -> the chained-terrain race is the mechanism.
+
+THE FIX (D.3b): (a) make the pacing signal per-instance (a member, not the file-scope
+global) so no ExplosionBState can consume another's flip; (b) gate the park additionally
+on `_explosionCounter==0` so a chained-terrain explosion NEVER parks on the shot-pacing
+path. The force-drain watchdog stays as belt-and-suspenders.
+
+POST-E2 UPDATE (explosion ordered-replay): the parallel client no longer runs
+checkForTerrainExplosions or spawns chained-terrain explosions locally - it replays the
+host's chain in the host's scan order via chain_detonation packets. So the client's
+chained-terrain explosion is now DECOUPLED from its own shot replay: by the time the
+chain_detonation-spawned ExplosionBState runs, the shot's coopPacingWait has already
+resolved, so a chained-terrain can no longer even reach a live shot-pacing flag - the
+D.3b race is closed STRUCTURALLY by the decoupling, on top of the original per-instance +
+_explosionCounter==0 fix. This fixture is therefore reframed: it arms the chain on the
+HOST (so the host chains the armed tile and ships chain_detonation), and its non-vacuous
+signal is chainDetonationsApplied climbing on the client (a host-ordered chain actually
+replayed), not the old terrainPacingDiverted. The wedge assertion (parks/consumes/
+forceDrain == 0) is unchanged and is the real invariant. The legacy divert/park signals
+stay in the OR so the fixture still arms + asserts on a pre-E2 build.
+
+WHY THIS WAS A STATISTICAL PROBE, NOT A .sav-DETERMINISTIC FIXTURE (pre-E2): the manifestation is a
+packet-timing race, not a map-setup condition. Whether a chained-terrain parks/consumes
+depends on whether the host's flip lands before or after the chained-terrain's explode()
+reaches the pacing decision - a fixed .sav pins the SETUP (explosive terrain + a scripted
+HE shot) but cannot pin the RACE, so even a perfect fixture only wedges a fraction of the
+time (D.3b measured ~9% forceDrain / ~30% floor engagement on random maps). This probe
+maximises the OPPORTUNITY - a pinned-seed parallel battle, an HE auto-cannon fired
+point-blank into a hostile so the CLIENT replays a multi-shot that hits a unit AND spills
+terrain-chain explosions into the same window - and measures the manifestation rate over
+many bursts. Pre-fix the rate is > 0; post-fix it is 0 (the fix closes the race
+structurally: a chained-terrain can neither park nor consume the shot's flip).
+
+Signals sampled on the CLIENT (all pre-existing parallel_state fields, so this runs
+against an un-instrumented build):
+  - forceDrainCount : the RX pump had to force-drain a starved pacing wait (a hard wedge
+                      the watchdog rescued). Any climb = a wedge fired.
+  - rxLegacyPasses  : liveness-floor engagements, expected 0.
+  - coopInitDeath   : the ProjectileFlyBState gate-holder; a sustained run = the shot
+                      replay held the receive gate.
+  - coopPacingWait  : the ExplosionBState pacing wait; a sustained hold = a stalled wait.
+
+An iteration is WEDGED if forceDrainCount climbed OR rxLegacyPasses climbed OR the
+coopInitDeath/coopPacingWait hold ran past STALL_S.
+
+Run:
+  python tools/coop_test/test_parallel_terrain_pacing.py            # assert GREEN
+  python tools/coop_test/test_parallel_terrain_pacing.py --probe    # report the rate
+  python tools/coop_test/test_parallel_terrain_pacing.py --iters 20 --seed 42
+
+Exit 0 = pass (GREEN: zero wedges across the run); 2 = failure (a wedge fired).
+"""
+
+import argparse
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import session
+
+PORT = "47993"
+WEAPON = os.environ.get("PROBE_WEAPON", "STR_AUTO_CANNON")
+AMMO = os.environ.get("PROBE_AMMO", "STR_AC_HE_AMMO")
+MODE = os.environ.get("PROBE_MODE", "auto")
+
+# A shot replay that hits a unit mid-multi-shot parks for a fraction of a second in the
+# clean case; anything past this is a stalled/wedged wait, not normal pacing.
+STALL_S = 3.0
+# How long to watch the client after each host burst.
+SAMPLE_S = 12.0
+# Explosive power pre-set on the target tile (client only) so the HE blast's replay spawns
+# a chained-terrain ExplosionBState. Small - enough to chain once (radius = power/10), not
+# to wreck the map. explosiveType 0 = DT_HE.
+EXPL_POWER = 60
+
+
+def parallel(gc):
+    return PI.parallel(gc)
+
+
+def battle(gc):
+    return PI.battle(gc)
+
+
+def give_weapon(host, client, uid, item, ammo):
+    """Hand `uid` the weapon+ammo on BOTH machines with matched ids, WITHOUT the full
+    battle-sync assert give_both makes - a terrain/casualty residual from a prior HE
+    burst (the expected, unrelated drift the D.3b audit calls out) must not abort a
+    pacing-probe iteration. Matched ids are still required (else the intent's weapon_id
+    would not resolve)."""
+    session.wait_sync_loop_closed(host)
+    req = {"cmd": "battle_give", "unit": uid, "item": item,
+           "slot": "right", "clear_hands": True}
+    if ammo:
+        req["ammo"] = ammo
+    ids = [gc.ok(dict(req)) for gc in (host, client)]
+    assert ids[0]["weaponId"] == ids[1]["weaponId"], (
+        f"battle_give minted different ids for {item} "
+        f"({ids[0]['weaponId']} vs {ids[1]['weaponId']})")
+    time.sleep(1)
+    return ids[0]["weaponId"]
+
+
+def sample_client(client, seconds, base):
+    """Poll the client's pacing state for `seconds`. Return the peak signals seen. The
+    terrainPacing* counters are monotonic globals, so max() == the final value."""
+    end = time.time() + seconds
+    init_start = None
+    pacing_start = None
+    out = {"forceDrain": base.get("forceDrainCount", 0),
+           "legacy": base.get("rxLegacyPasses", 0),
+           "parks": base.get("terrainPacingParks", 0),
+           "consumes": base.get("terrainPacingConsumes", 0),
+           "diverted": base.get("terrainPacingDiverted", 0),
+           # coop (explosion ordered-replay E2): the count of host-ordered chained
+           # secondaries this client replayed. Post-E2 THIS is the non-vacuous signal
+           # (a terrain chain actually reached the client), replacing the old divert race.
+           "chainApplied": base.get("chainDetonationsApplied", 0),
+           "maxInitRun": 0.0, "maxPacingRun": 0.0,
+           "maxTaskDepth": 0, "pacingSeen": 0, "samples": 0}
+    while time.time() < end:
+        try:
+            pc = parallel(client)
+        except Exception:
+            continue
+        out["samples"] += 1
+        out["maxTaskDepth"] = max(out["maxTaskDepth"], pc.get("taskDepth", 0))
+        out["forceDrain"] = max(out["forceDrain"], pc.get("forceDrainCount", 0))
+        out["legacy"] = max(out["legacy"], pc.get("rxLegacyPasses", 0))
+        out["parks"] = max(out["parks"], pc.get("terrainPacingParks", 0))
+        out["consumes"] = max(out["consumes"], pc.get("terrainPacingConsumes", 0))
+        out["diverted"] = max(out["diverted"], pc.get("terrainPacingDiverted", 0))
+        out["chainApplied"] = max(out["chainApplied"], pc.get("chainDetonationsApplied", 0))
+        if pc.get("coopInitDeath"):
+            if init_start is None:
+                init_start = time.time()
+        else:
+            if init_start is not None:
+                out["maxInitRun"] = max(out["maxInitRun"], time.time() - init_start)
+                init_start = None
+        if pc.get("coopPacingWait"):
+            out["pacingSeen"] += 1
+            if pacing_start is None:
+                pacing_start = time.time()
+        else:
+            if pacing_start is not None:
+                out["maxPacingRun"] = max(out["maxPacingRun"], time.time() - pacing_start)
+                pacing_start = None
+    if init_start is not None:
+        out["maxInitRun"] = max(out["maxInitRun"], time.time() - init_start)
+    if pacing_start is not None:
+        out["maxPacingRun"] = max(out["maxPacingRun"], time.time() - pacing_start)
+    return out
+
+
+def one_burst(host, client, tag):
+    """Stage a host shooter point-blank on a live hostile and fire an HE auto-cannon burst:
+    the CLIENT replays a multi-shot that hits a unit (arms the pacing wait), and the target
+    tile is pre-armed with explosive so the client's blast replay spawns a chained-terrain
+    ExplosionBState into the same window - the race. Returns (base, stats) on a valid burst,
+    or (None, None) when the fixture could not stage one."""
+    if not PI.idle(host):
+        return None, None
+    enemy = PI.alive_enemy(battle(host))
+    if not enemy:
+        return None, None
+    eid = enemy["id"]
+    # Keep the one hostile the default skirmish spawns usable across as many bursts as it
+    # survives: set its health high on BOTH machines so an HE burst hits it (arming the
+    # pacing wait) without killing it outright. (A point-blank HE eventually craters the
+    # floor and drops it off the map, so a single bring-up yields a few bursts; the report's
+    # statistical run stacks several bring-ups.)
+    for gc in (host, client):
+        gc.cmd({"cmd": "battle_action", "action": "set_stat", "unit": eid,
+                "health": 500})
+    enemy = PI.unit(battle(host), eid) or enemy
+    epos = (enemy["x"], enemy["y"], enemy["z"])
+    hseat = parallel(host)["localSeat"]
+    shooter = None
+    for cand in PI.own_units(battle(client), hseat):
+        sid = cand["id"]
+        if PI.place_adjacent(host, client, sid, epos):
+            PI.top_up(host, client, sid)
+            shooter = sid
+            break
+    if shooter is None:
+        return None, None
+    try:
+        wid = give_weapon(host, client, shooter, WEAPON, AMMO)
+    except AssertionError as e:
+        print(f"  [{tag}] give skipped: {e}")
+        return None, None
+    # Arm the terrain chain deterministically. POST-E2 the parallel client no longer runs
+    # checkForTerrainExplosions locally (it replays the host's chain via chain_detonation),
+    # so the arming tile must be on the HOST: the host's HE blast finds the armed tile,
+    # spawns a chained-terrain ExplosionBState (_explosionCounter == 1), and ships one
+    # chain_detonation. The client spawns the display-only chained state from that packet and
+    # runs the SAME pacing decision (_explosionCounter > 0 -> DIVERT, never park) while the
+    # shot's pacing wait is still live. The host destroys the armed terrain and ships the
+    # destroy_tile / set_explosive_tile carriers, so the client's terrain converges - no
+    # host/client asymmetry, no tripwire compare crossed.
+    host.cmd({"cmd": "battle_tiles", "set_explosive": EXPL_POWER, "explosiveType": 0,
+              "x": epos[0], "y": epos[1], "z": epos[2]})
+    base = dict(parallel(client))
+    r = PI.intent(host, action="shoot", unit=shooter, mode=MODE, weapon_id=wid,
+                  x=epos[0], y=epos[1], z=epos[2])
+    if not r.get("ok"):
+        print(f"  [{tag}] shoot intent refused: {r}")
+        return None, None
+    stats = sample_client(client, SAMPLE_S, base)
+    PI.idle(host, 60)
+    return base, stats
+
+
+def is_wedged(base, stats):
+    """The FAITHFUL bug signal: a chained-terrain explosion touched the shot-pacing path
+    (parked on OR consumed the shot's flip) or the RX pump had to force-drain a starved
+    pacing wait. rxLegacyPasses / long coopInitDeath holds are NOT the gate - they also
+    climb from generic RX congestion on a busy HE turn, so they are secondary diagnostics
+    only (see the pre/post analysis: rxLegacyPasses fires equally with and without the fix,
+    the terrainPacing counters do not)."""
+    return (stats["parks"] > base.get("terrainPacingParks", 0)
+            or stats["consumes"] > base.get("terrainPacingConsumes", 0)
+            or stats["forceDrain"] > base.get("forceDrainCount", 0))
+
+
+def armed_opportunity(base, stats):
+    """Did a terrain chain actually reach the client this burst (i.e. is this a non-vacuous
+    trial)? POST-E2 the parallel client no longer scans/spawns chained secondaries locally,
+    so the old divert race (a client-scan chained state hitting the live shot-pacing flag)
+    no longer arms - the host-ordered chain is decoupled from the client's shot replay
+    (coopPacingWait is already resolved by the time the chain_detonation-spawned state runs,
+    which is exactly why the D.3b wedge can no longer happen this way). The post-E2 non-
+    vacuous signal is chainDetonationsApplied climbing: the host chained the armed terrain,
+    shipped chain_detonation, and the client replayed it. The legacy park/consume/divert
+    signals stay in the OR so this fixture still arms on a pre-E2 build."""
+    return (is_wedged(base, stats)
+            or stats["chainApplied"] > base.get("chainDetonationsApplied", 0)
+            or stats["diverted"] > base.get("terrainPacingDiverted", 0))
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--iters", type=int, default=15,
+                    help="target number of valid bursts to measure")
+    ap.add_argument("--seed", type=int, default=8675309,
+                    help="host map seed (client gets seed+1); pins the fixture")
+    ap.add_argument("--probe", action="store_true",
+                    help="report the wedge rate instead of asserting GREEN")
+    args = ap.parse_args()
+
+    fail = None
+    host = GameClient("host", 48792,
+                      make_user_dir("terr_pacing_host",
+                                    options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48793,
+                        make_user_dir("terr_pacing_client",
+                                      options={"battleXcomSpeed": 2, "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    valid = 0
+    wedged = 0
+    wedge_rows = []
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        TW.bring_up_battle(host, client, seed=args.seed)
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"skirmish fixture came up gamemode {gm}; parallel turns only cover PVE "
+            f"(1) and PVE2 (4) - this probe would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        pc = parallel(client)
+        for field in ("coopPacingWait", "forceDrainCount", "rxLegacyPasses",
+                      "coopInitDeath", "terrainPacingParks", "terrainPacingConsumes",
+                      "terrainPacingDiverted"):
+            assert field in pc, (
+                f"parallel_state carries no `{field}` - bin/x64/Release/OpenXcom.exe "
+                f"predates the D.3b terrain-pacing instrumentation; rebuild it "
+                f"(serial, MP=false). fields: {sorted(pc)}")
+        print(f"battle up (seed {args.seed}, gm {gm}). weapon={WEAPON} ammo={AMMO} "
+              f"mode={MODE}. explPower={EXPL_POWER}. target {args.iters} bursts")
+
+        armed = 0
+        empties = 0
+        while valid < args.iters and empties < 6:
+            base, stats = one_burst(host, client, f"b{valid + 1}")
+            if base is None:
+                empties += 1
+                # No live enemy or could not stage: nudge the turn so units are fresh.
+                if not PI.alive_enemy(battle(host)):
+                    print("  (no live hostiles remain - stopping)")
+                    break
+                continue
+            empties = 0
+            valid += 1
+            w = is_wedged(base, stats)
+            if armed_opportunity(base, stats):
+                armed += 1
+            row = (f"burst {valid}: parks {base.get('terrainPacingParks')}->"
+                   f"{stats['parks']} consumes {base.get('terrainPacingConsumes')}->"
+                   f"{stats['consumes']} diverted {base.get('terrainPacingDiverted')}->"
+                   f"{stats['diverted']} forceDrain {base.get('forceDrainCount')}->"
+                   f"{stats['forceDrain']} | legacy {base.get('rxLegacyPasses')}->"
+                   f"{stats['legacy']} maxInitRun {stats['maxInitRun']:.2f}s "
+                   f"pacingSeen {stats['pacingSeen']}  -> {'WEDGE' if w else 'clean'}")
+            print("  " + row)
+            if w:
+                wedged += 1
+                wedge_rows.append(row)
+
+        print(f"\n=== {valid} valid bursts, {armed} armed the race, {wedged} WEDGED "
+              f"({(100.0 * wedged / valid) if valid else 0:.0f}%) ===")
+        for r in wedge_rows:
+            print("  WEDGE " + r)
+
+        # the drift tripwire must not have fired from any of this
+        tw_fired = TW.desync_seen(host) or TW.desync_seen(client)
+
+        if args.probe:
+            print(f"PROBE done: wedgeRate {wedged}/{valid}; armed {armed}/{valid}; "
+                  f"tripwire_fired={tw_fired}")
+        else:
+            assert valid >= 1, "no valid burst staged - fixture failure, not a result"
+            assert armed >= 1, (
+                f"no terrain chain reached the client across {valid} bursts "
+                f"(chainDetonationsApplied never climbed, no legacy park/consume/divert) - "
+                f"the fixture did not exercise the path, so a green result would be vacuous. "
+                f"The host's HE blast must land on/adjacent to the armed explosive tile so it "
+                f"chains and ships chain_detonation. Re-run (map/RNG dependent) or use --seed "
+                f"on a map with adjacent explosive terrain.")
+            assert wedged == 0, (
+                f"{wedged}/{valid} bursts WEDGED the auto-shot pacing wait - a chained-"
+                f"terrain explosion is still parking on or consuming the shot's pacing "
+                f"flip (the D.3b bug). Rows:\n    " + "\n    ".join(wedge_rows))
+            assert not tw_fired, "the drift tripwire fired during the pacing probe"
+            print(f"PASS: {valid} HE-auto-cannon bursts, {armed} replayed a host-ordered "
+                  f"terrain chain on the client, zero wedges - the chain_detonation replay "
+                  f"never parks on, consumes, or force-drains the shot-pacing flip (post-E2 "
+                  f"the chain is decoupled from the shot's pacing window, so the D.3b race "
+                  f"can no longer form)")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_turn_skew.py b/tools/coop_test/test_parallel_turn_skew.py
new file mode 100644
index 000000000..33d8a317a
--- /dev/null
+++ b/tools/coop_test/test_parallel_turn_skew.py
@@ -0,0 +1,348 @@
+"""PRD-I3 Option D-lite: the parallel client's (turn, side) must never LEAD the
+host's.
+
+The thin client advances its logical turn/side from WHITELISTED packets
+(`endTurn`, `AIProgress`) consumed at gate depth 0 - AHEAD of the gated alien-
+chain replay and the gated `next_turn` repair. Left alone the client blazes a
+whole cycle ahead: measured at tip, host turn1/HOSTILE while the client is
+already turn2/PLAYER (the audit's SIG-2 "gap-2"). Its deterministic-but-early
+per-unit regen is then hashed against the host's not-yet-regen'd side, which is
+the racing residual that keeps smoke/fire/unitsStats non-zero at ai-seqs.
+
+D-lite makes the client's turn machine FOLLOW `next_turn` (which now carries the
+authoritative turn+side): the neutral->player advance (`_turn++`, the player-side
+regen) is deferred to the gated `next_turn` apply point, and the `AIProgress`
+`_coopEnd` heuristic no longer flips the client's side ahead of the host. The
+player->hostile transition (the ALIENS banner + the hostile/neutral units'
+per-side increments) stays prompt - it runs at the host's ACTUAL transition, so
+it cannot lead, and it is what keeps the banner on time.
+
+This test drives a busy alien side (smoke on the map) with a deliberately SLOW
+client, tight-polls both machines' (turn, side) across the side close, and
+asserts:
+
+  1. the client's (turn, side) ORDINAL never leads the host's by more than the
+     sub-frame commit transient (== 0 post-D; tip shows 2);
+  2. the client still SHOWS the ALIENS banner at the start of the alien side
+     (display is not sacrificed to the deferral);
+  3. `parallel_state.turnAdvanceDeferred` is armed while the advance is pending
+     and returns to 0 once `next_turn` applies (no leaked deferral);
+  4. both machines end the cycle on the SAME (turn, side) and the drift tripwire
+     stays quiet.
+
+Ordinal = turn*3 + side, with FACTION_PLAYER=0 < FACTION_HOSTILE=1 <
+FACTION_NEUTRAL=2, i.e. the exact PLAYER->HOSTILE->NEUTRAL->(turn+1)PLAYER order.
+
+Run:  python tools/coop_test/test_parallel_turn_skew.py
+Exit 0 = pass; 2 = failure.  SKEW_STRICT=0 takes the pre-fix red baseline
+print-only (max lead > 0 is reported, not asserted).
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_endturn as PE
+
+PORT = "47969"
+
+# The client is deliberately a slideshow: the slower it displays the gated alien
+# replay, the further ahead the whitelisted turn-advance packets would race it,
+# so a slow client is the discriminator, not an accident.
+HOST_SPEED = 2
+CLIENT_SPEED = 40
+
+# Post-D the client must never lead. Default ON (the permanent green gate);
+# SKEW_STRICT=0 takes the pre-fix red baseline print-only.
+SKEW_STRICT = os.environ.get("SKEW_STRICT", "1") == "1"
+
+SIDE = {0: "PLAYER", 1: "HOSTILE", 2: "NEUTRAL"}
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def ordinal(b):
+    """turn*3 + side over the PLAYER<HOSTILE<NEUTRAL progression. None if the
+    battle_state has no turn/side yet (between screens)."""
+    t, s = b.get("turn"), b.get("side")
+    if t is None or s is None or s not in SIDE:
+        return None
+    return t * 3 + s
+
+
+def place_smoke(host, client, cmover, rounds=3):
+    """Prime (fuse 0) and throw a few smoke grenades so the alien side has hazards
+    on the map - the fixtures that historically produced the 27/40 smoke counts."""
+    thrown = 0
+    for i in range(rounds):
+        PI.top_up(host, client, cmover)
+        wid = PI.give_both(host, client, cmover, "STR_SMOKE_GRENADE")
+        if not wid:
+            break
+        r = client.cmd({"cmd": "battle_intent", "unit": cmover, "action": "prime",
+                        "fuse": 0, "weapon_id": wid})
+        if not r.get("ok"):
+            continue
+        PI.top_up(host, client, cmover)
+        here = PI.pos(battle(host), cmover)
+        if here:
+            t = client.cmd({"cmd": "battle_intent", "unit": cmover, "action": "throw",
+                            "weapon_id": wid, "x": here[0] + 1 + (i % 3),
+                            "y": here[1] + 1, "z": here[2]})
+            thrown += 1 if t.get("ok") else 0
+        time.sleep(0.8)
+    return thrown
+
+
+def live_ids(gc):
+    """The set of unit ids that are on their feet on THIS machine right now."""
+    return {u["id"] for u in battle(gc).get("units", []) if not u.get("isOut")}
+
+
+def quiesce(host, client, timeout=60):
+    """Wait for both machines to fully quiesce - receive pump drained and no
+    BattleState running - before the post-close census/tripwire checks. A death
+    packet still in flight when those checks run reads as a census divergence that
+    is not one; settling to quiescence lets it land first. Returns True if reached."""
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if (parallel(host).get("taskCompleted") is not False
+                and parallel(client).get("taskCompleted") is not False
+                and parallel(client).get("rxHold", 0) == 0
+                and battle(host).get("isBusy") is False
+                and battle(client).get("isBusy") is False):
+            return True
+        time.sleep(0.2)
+    return False
+
+
+def main():
+    fail = None
+    host = GameClient("host", 48862, make_user_dir(
+        "turn_skew_host", options={"battleXcomSpeed": HOST_SPEED,
+                                   "battleAlienSpeed": HOST_SPEED,
+                                   "skipNextTurnScreen": True,
+                                   "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48863, make_user_dir(
+        "turn_skew_client", options={"battleXcomSpeed": CLIENT_SPEED,
+                                     "battleAlienSpeed": CLIENT_SPEED,
+                                     "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT; PI.PORT = PORT; PE.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+
+        cseat = parallel(client)["localSeat"]
+        cmover = PI.pick_driver(host, client, cseat, "client")
+        thrown = place_smoke(host, client, cmover)
+        print(f"placed {thrown} smoke grenade(s) for a busy alien side")
+        PI.settle(host, client, 3)
+
+        turn_before = battle(host).get("turn")
+        print(f"turn before close: {turn_before}")
+
+        # Arm both seats (the REAL end-turn button in parallel mode).
+        PE.hush(host, client)
+        for gc in (host, client):
+            if not parallel(gc)["localReady"]:
+                PE.arm(gc)
+
+        # The busy alien side can produce CASUALTIES (aliens shooting through the
+        # smoke); a death drops items and flips liveness, which the census-grade
+        # secondary checks below flake on. Record the live set now so we can tell a
+        # combat close from a quiet one and scope those checks accordingly.
+        live_before = live_ids(host)
+
+        # Tight-poll (turn, side) on BOTH machines all the way across the close.
+        # The skew is a transient in exactly this window, so a poll that does not
+        # sample continuously would step right over it.
+        #
+        # Two measures, deliberately different:
+        #   * max_lead   - the largest ordinal lead of any single sample. The host
+        #     ships `endTurn` from inside its OWN BattlescapeGame::endTurn() BEFORE
+        #     it applies its local `_save->endTurn()`, so the client can reach the
+        #     next side one send-before-apply window early: an unavoidable 1-step
+        #     "sub-frame commit transient" the HANDOFF explicitly allows.
+        #   * lead2      - samples where the client leads by >= 2. That is the
+        #     SIG-2 gap-2 signature (client turn N+1/PLAYER while host is still
+        #     turn N/HOSTILE): the client a whole cycle ahead, SUSTAINED across the
+        #     busy alien side, not a one-window blip. THIS is what must be 0.
+        #   * turn_lead_on_alien - the client's TURN strictly exceeds the host's
+        #     WHILE the host is on a non-player side. The crispest gap-2 witness:
+        #     the client cannot have advanced `_turn` past the host mid-alien-side
+        #     unless its turn machine free-ran ahead of the gated next_turn.
+        # coop (PRD-I3 rider): the transient `turnAdvanceDeferred` bool arms and
+        # clears inside one next_turn window, which a poll can (and ~3/4 of runs did)
+        # step over. `turnAdvanceDeferredCount` only ever rises, so sample it here and
+        # after the close and assert the DELTA - the neutral->player advance was
+        # deferred at least once - instead of racing the flag.
+        defer_count_before = parallel(client).get("turnAdvanceDeferredCount", 0)
+        deadline = time.time() + 150
+        max_lead = -99
+        lead_at = None
+        lead2 = 0
+        turn_lead_on_alien = 0
+        deferred_seen = False
+        banner_side_seen = None       # the client's side when it showed NextTurnState
+        saw_alien_banner = False
+        while time.time() < deadline:
+            hb, cb = battle(host), battle(client)
+            ho, co = ordinal(hb), ordinal(cb)
+            if ho is not None and co is not None:
+                if (co - ho) > max_lead:
+                    max_lead = co - ho
+                    lead_at = (hb.get("turn"), hb.get("side"), cb.get("turn"), cb.get("side"))
+                if (co - ho) >= 2:
+                    lead2 += 1
+                if (hb.get("side") in (1, 2) and cb.get("turn") is not None
+                        and cb["turn"] > hb.get("turn", 0)):
+                    turn_lead_on_alien += 1
+            # introspection: the deferral must actually arm at some point
+            if parallel(client).get("turnAdvanceDeferred"):
+                deferred_seen = True
+            # display: the client must show the ALIENS banner (NextTurnState) while
+            # its side reads an alien side - the banner is not sacrificed.
+            if TW.top(client) == "NextTurnState":
+                s = battle(client).get("side")
+                banner_side_seen = s
+                if s in (1, 2):
+                    saw_alien_banner = True
+            # drain the turn screens so the side actually progresses (wait_side shape)
+            for gc in (host, client):
+                st = TW.top(gc)
+                if st == "NextTurnState" or (st and st != "BattlescapeState"):
+                    gc.cmd({"cmd": "dismiss_popup"})
+            now = battle(host)
+            if (now.get("turn") and turn_before and now["turn"] > turn_before
+                    and now.get("coopTurn") == 2
+                    and battle(client).get("coopTurn") == 2):
+                break
+            time.sleep(0.03)
+
+        defer_count_after = parallel(client).get("turnAdvanceDeferredCount", 0)
+        PI.settle(host, client, 4)
+        # Harden the secondary (census-grade) checks: settle to full quiescence so an
+        # in-flight death packet lands before the census is read.
+        quiesced = quiesce(host, client)
+        casualties = live_before - live_ids(host)
+        combat = bool(casualties)
+        hb, cb = battle(host), battle(client)
+        print(f"after close: host turn={hb.get('turn')} side={SIDE.get(hb.get('side'))} "
+              f"| client turn={cb.get('turn')} side={SIDE.get(cb.get('side'))} "
+              f"| quiesced={quiesced} casualties={sorted(casualties) or 'none'}")
+        print(f"MAX client-lead ordinal gap across the close: {max_lead}"
+              + (f"  at host(t{lead_at[0]}/{SIDE.get(lead_at[1])}) "
+                 f"client(t{lead_at[2]}/{SIDE.get(lead_at[3])})" if lead_at else ""))
+        print(f"gap-2 samples (client leads by >=2): {lead2}; "
+              f"turn-lead-while-host-on-alien-side samples: {turn_lead_on_alien}")
+        print(f"turnAdvanceDeferredCount {defer_count_before}->{defer_count_after} "
+              f"(delta {defer_count_after - defer_count_before}); bool seen={deferred_seen}; "
+              f"client alien banner seen: {saw_alien_banner} "
+              f"(banner side {SIDE.get(banner_side_seen, banner_side_seen)})")
+
+        # (4) both machines converge on the same (turn, side) - this IS the D-lite
+        # convergence proof and stays asserted unconditionally (a casualty cannot
+        # move the turn number).
+        assert battle(host)["turn"] == battle(client)["turn"], (
+            f"the two machines ended the cycle on different turns: "
+            f"host {battle(host)['turn']} client {battle(client)['turn']}")
+
+        # The census + P2-tripwire checks are SECONDARY and census-grade: a casualty
+        # during the busy alien side drops items / flips liveness, and the turn-grained
+        # P2 tripwire (a compare-BEFORE-apply) can latch on that pre-repair transient -
+        # a ~33% combat-driven flake unrelated to the turn-skew probe. Scope them to
+        # NO-COMBAT closes; on a combat close they are report-only (the state converges
+        # at next_turn, proven by the sync-check suite, not here). The PRIMARY skew
+        # probe below is asserted either way, so this does not weaken it.
+        if combat:
+            h, c = session.battle_checksum(host), session.battle_checksum(client)
+            print(f"    NOTE: casualties during the close {sorted(casualties)} - "
+                  f"census/tripwire report-only this run: itemId {h[0]}/{c[0]} "
+                  f"census {h[1]}/{c[1]} units {h[2]}/{c[2]}; desyncSeen "
+                  f"host={TW.desync_seen(host)} client={TW.desync_seen(client)}")
+        else:
+            session.assert_battle_synced(host, client, "after the turn-skew close")
+            assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+                "the PRD-P2 drift tripwire fired during a NO-COMBAT turn-skew close"
+
+        # (3) the deferral must return to 0 - a leaked deferral would wedge the
+        # client's turn machine for the rest of the battle.
+        assert parallel(client).get("turnAdvanceDeferred", 0) in (0, False, None), (
+            f"the client left a turn advance deferred after the side closed: "
+            f"{parallel(client)}")
+
+        if SKEW_STRICT:
+            # (2) display was preserved.
+            assert saw_alien_banner, (
+                "the client never showed the ALIENS banner (NextTurnState on an "
+                "alien side) - the deferral sacrificed the display it was required "
+                "to preserve")
+            # Poll-robust: the monotonic count must have RISEN across the close. The
+            # transient bool (deferred_seen) is kept only as a diagnostic in the print
+            # above - it was the ~3/4 flake, arming and clearing between polls.
+            assert defer_count_after > defer_count_before, (
+                f"the NEUTRAL->PLAYER advance was never deferred across a whole side "
+                f"close (turnAdvanceDeferredCount {defer_count_before}->{defer_count_after}, "
+                f"bool seen={deferred_seen}) - the deferral is not engaging, so this test "
+                f"is vacuous (or the counter is missing on this build)")
+            # (1) the whole point: the SIG-2 gap-2 is dead. A lead of 2 is the
+            # client a WHOLE cycle ahead of a mid-alien-side host; post-D its turn
+            # machine follows the gated next_turn, so that can never happen. A lone
+            # 1-step lead at a transition (host sends endTurn before applying it) is
+            # the allowed sub-frame commit transient, not this.
+            assert lead2 == 0 and turn_lead_on_alien == 0, (
+                f"D-lite NOT GREEN: the client LED the host by >=2 ({lead2} sample(s), "
+                f"max {max_lead} at {lead_at}) / advanced its turn past a mid-alien-"
+                f"side host ({turn_lead_on_alien} sample(s)). Its turn machine still "
+                f"free-runs ahead of the gated display - defer the neutral->player "
+                f"advance to the next_turn apply point and stop the AIProgress "
+                f"_coopEnd heuristic from flipping the side early.")
+            assert max_lead <= 1, (
+                f"the client led by {max_lead} > 1 - larger than the single "
+                f"send-before-apply transition window, so it is a real lead: {lead_at}")
+            print(f"PASS: no SIG-2 gap-2 (max lead {max_lead} <= 1 sub-frame "
+                  f"transient, 0 samples >=2, 0 turn-lead on an alien side), ALIENS "
+                  f"banner shown on time, turnAdvanceDeferred armed and cleared, "
+                  f"both machines synced at turn {battle(host)['turn']}, tripwire quiet")
+        else:
+            print(f"BASELINE (SKEW_STRICT=0): max client-lead {max_lead} "
+                  f"(pre-fix tip reproduces the SIG-2 gap-2)")
+        print("ALL TURN-SKEW TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} battle:   {battle(gc)}")
+                print(f"  DBG {tag} parallel: {parallel(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_parallel_xp_module.py b/tools/coop_test/test_parallel_xp_module.py
new file mode 100644
index 000000000..4113101d5
--- /dev/null
+++ b/tools/coop_test/test_parallel_xp_module.py
@@ -0,0 +1,250 @@
+"""E5a GAP-XP + GAP-MODULE: a client-owned soldier must TRAIN from a host-replayed
+kill, and the base-defense module_destroyed carrier must stay linked.
+
+THE GAPS (explosion-ordered-replay plan v2, section 2.4):
+
+  GAP-XP: when a client-owned soldier's shot kills or hits, the HOST resolves it
+  (it is the only machine that ever executes the attack) and runs
+  `TileEngine::awardExperience` - the client never replays the attack, so its own
+  copy of the attacker gained NO combat XP and showed no stat improvement at
+  debrief. FIX: the host ships the attacker's post-award `_exp` absolutes on the
+  existing `hit_unit` packet (`exp_firing`/`exp_throwing`/`exp_melee`/
+  `exp_reactions`/`exp_bravery`/`exp_psi_skill`/`exp_psi_strength`/`exp_mana` -
+  every counter `awardExperience`/`addManaExp` mutate); the client applies them to
+  the attacker by `attacker_id`, present-gated.
+
+  GAP-MODULE: the detonate-path base-module decrement (`TileEngine::detonate`,
+  base-defense `_moduleMap` used by `DebriefingState` to score base defense) is
+  host-only for coop (the parallel client early-returns from `detonate()`) with no
+  carrier. FIX: a new `module_destroyed {gx, gy}` packet, host-sent/client-applied,
+  parallel-gated. NOT staged here (no cheap way to arm a STR_BASE_DEFENSE map with
+  a scored module inside this fixture's budget - see the GAP-MODULE section
+  below); this fixture proves the carrier is LINKED (sent counter mirrors applied)
+  by asserting both stay 0 on an ordinary (non-base-defense) map, where the
+  detonate-path decrement never fires at all.
+
+SCENARIO (donors: test_coop_debrief_sync.py for the debrief + both-machine stat
+read, test_parallel_intents.py for the client-intent shot the host executes): a
+CLIENT-seat soldier repeatedly fires on aliens via `battle_intent` (the host
+executes every shot and runs `awardExperience` locally; the client never does).
+After enough hits the shooter's `firing` exp counter is read via `battle_state`'s
+per-unit `expFiring` field on BOTH machines - GREEN is `host == client > 0`,
+proving the carrier. The mission is then finished and both machines' debriefings
+are compared, then the SAME soldier's post-mission `firing` stat (read via
+`get_soldiers`, which reflects `BattleUnit::postMissionProcedures`'s consumption
+of `_exp`) is read on both machines: reaching `expFiring >= 3` puts the roll in
+`BattleUnit::improveStat`'s `exp > 2` bracket (`RNG::generate(1,3)`), the lowest
+bracket that can NEVER roll a 0 stat bump - so once the fixture reaches that
+count the post-debrief training check is a hard assertion, not a coin flip
+(`postMissionProcedures` runs independently with its own RNG on each machine, so
+the two machines' bump AMOUNTS are not asserted equal - only that each is > 0).
+
+Run:  python tools/coop_test/test_parallel_xp_module.py
+Exit 0 = pass; 2 = failure. Budget: a handful of adjacent aimed-shot kills plus one
+debrief - well under the 180s slow-test threshold.
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_coop_debrief_sync as DBS
+
+SEED = int(os.environ.get("XP_MODULE_SEED", "913317"))
+
+# BattleUnit::improveStat: exp>10 -> RNG(2,6); exp>5 -> RNG(1,4); exp>2 -> RNG(1,3);
+# exp>0 -> RNG(0,1) [CAN roll 0]; exp==0 -> 0. 3 is the lowest count whose bracket
+# can never roll a 0 stat bump - the floor this fixture aims for before it treats
+# "no stat increase" as a real failure rather than a legitimate coin flip.
+MIN_FIRING_EXP = 3
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def find_soldier(resp, soldier_id):
+    for b in resp.get("bases", []):
+        for s in b.get("soldiers", []):
+            if s["id"] == soldier_id:
+                return s
+    return None
+
+
+def soldier_firing(gc, soldier_id):
+    s = find_soldier(gc.ok({"cmd": "get_soldiers"}), soldier_id)
+    assert s is not None, f"soldier {soldier_id} not found in get_soldiers"
+    return s["firing"]
+
+
+def shooter_exp(host, client, shooter_id):
+    """(hostExpFiring, clientExpFiring): the GAP-XP carrier readout itself, straight
+    off battle_state's per-unit `expFiring` field (BattleUnit::_exp.firing)."""
+    hu = PI.unit(battle(host), shooter_id)
+    cu = PI.unit(battle(client), shooter_id)
+    return (hu.get("expFiring", 0) if hu else 0,
+            cu.get("expFiring", 0) if cu else 0)
+
+
+def run(ports, tmp):
+    hport, cport, coop_port = ports
+    mod = DBS.make_mod(tmp)
+    opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+    host = GameClient("host", hport,
+                      make_user_dir("xp_module_host", mods=[mod],
+                                    options=dict(opts, skipNextTurnScreen=True,
+                                                 EnableCoopParallelTurns=True)))
+    client = GameClient("client", cport,
+                        make_user_dir("xp_module_client", mods=[mod],
+                                      options=dict(opts, EnableCoopParallelTurns=False)))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = str(coop_port)
+        PI.PORT = str(coop_port)
+        TW.bring_up_battle(host, client, seed=SEED)
+
+        for gc, tag in ((host, "host"), (client, "client")):
+            b = battle(gc)
+            assert b["parallelActive"] is True, f"{tag}: parallel mode is not live: {b}"
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, \
+            "the PRD-P5 executor invariant does not hold, so nothing below tests it"
+
+        seat = client.ok({"cmd": "get_coop"})["localSeat"]
+        shooter = PI.pick_driver(host, client, seat, "client")
+        shooter_soldier_id = PI.unit(battle(host), shooter)["soldierId"]
+        assert shooter_soldier_id >= 0, (
+            f"unit {shooter} has no backing Soldier - can't check debrief training")
+        firing_before = soldier_firing(host, shooter_soldier_id)
+        print(f"battle up (seed {SEED}). client seat {seat}, shooter unit {shooter} "
+              f"(soldier {shooter_soldier_id}, firing {firing_before} pre-mission)")
+
+        # ---- GAP-XP: the client-owned shooter kills via CLIENT-INTENT shots. The host
+        # is the only machine that ever executes the attack (battle_intent -> the host's
+        # BattlescapeGame::coopRouteAction), so every awardExperience call for this
+        # shooter happens on the host; hit_unit must carry the result to the client. ----
+        killed = []
+        for _ in range(DBS.NALIENS + 1):
+            hexp, _ = shooter_exp(host, client, shooter)
+            if hexp >= MIN_FIRING_EXP:
+                break
+            aliens = DBS.live_aliens(host)
+            if not aliens:
+                break
+            alien = aliens[0]
+            spot = PI.place_adjacent(host, client, shooter, (alien["x"], alien["y"], alien["z"]))
+            if not spot:
+                continue
+            if DBS.arm_and_kill(host, client, shooter, alien["id"], "client"):
+                killed.append(alien["id"])
+                h, c = shooter_exp(host, client, shooter)
+                print(f"    client-intent kill: alien {alien['id']} "
+                      f"(shooter expFiring now host={h} client={c})")
+
+        host_exp, client_exp = shooter_exp(host, client, shooter)
+        print(f"-- GAP-XP: shooter {shooter} expFiring host={host_exp} client={client_exp} "
+              f"after {len(killed)} client-intent kill(s) --")
+        assert host_exp > 0, (
+            f"the host never trained ANY firing exp on its own attacker after "
+            f"{len(killed)} client-intent kills - the fixture staged no hits, not a "
+            f"carrier result (re-check placement/weapon/accuracy, not the carrier)")
+        assert host_exp == client_exp, (
+            f"GAP-XP regression: the host's attacker trained expFiring={host_exp} but "
+            f"the client's copy of the SAME attacker shows {client_exp} - hit_unit's "
+            f"exp_* fields did not carry, or the client failed to apply them "
+            f"(TileEngine.cpp hitUnit send / connectionTCP.cpp hit_unit handler)")
+        print(f"PASS GAP-XP: attacker's firing-exp counter is IDENTICAL host/client "
+              f"({host_exp}) immediately after the replayed hit(s), read straight off "
+              f"the carrier (battle_state expFiring)")
+
+        # ---- GAP-MODULE: no STR_BASE_DEFENSE map is staged here (see module note in
+        # the file docstring) - prove the carrier stays LINKED (sent mirrors applied)
+        # rather than firing spuriously on an ordinary map, where the detonate-path
+        # base-module decrement this carrier ships never triggers at all. ----
+        for gc, tag in ((host, "host"), (client, "client")):
+            ps = PI.parallel(gc)
+            sent = ps.get("moduleDestroyedSent", -1)
+            applied = ps.get("moduleDestroyedApplied", -1)
+            assert sent == 0 and applied == 0, (
+                f"{tag}: moduleDestroyedSent={sent} moduleDestroyedApplied={applied} on "
+                f"a non-base-defense map - the carrier fired where it should not have")
+        print("PASS GAP-MODULE (linked, not staged): moduleDestroyedSent == "
+              "moduleDestroyedApplied == 0 on both machines (see the file docstring - a "
+              "STR_BASE_DEFENSE scenario was not cheap to stage in this fixture)")
+
+        # ---- finish the mission -> debrief, then read the TRAINED stat on both machines
+        print("-- finishing the mission (mop-up) -> debriefing --")
+        DBS.kill_the_rest(host, client)
+        dh = DBS.wait_debrief(host, "host")
+        dc = DBS.wait_debrief(client, "client")
+        print(f"    host   rows={dh['rows']} total={dh['total']}")
+        print(f"    client rows={dc['rows']} total={dc['total']}")
+
+        firing_host_after = soldier_firing(host, shooter_soldier_id)
+        firing_client_after = soldier_firing(client, shooter_soldier_id)
+        print(f"-- debrief: soldier {shooter_soldier_id} firing {firing_before} "
+              f"pre-mission -> host {firing_host_after}, client {firing_client_after} "
+              f"post-debrief --")
+        assert firing_host_after >= firing_before, (
+            f"the host's own soldier LOST firing stat ({firing_before} -> "
+            f"{firing_host_after}) - a sanity failure, not the carrier under test")
+        assert firing_client_after >= firing_before, (
+            f"the client's copy of the soldier LOST firing stat ({firing_before} -> "
+            f"{firing_client_after}) - a sanity failure, not the carrier under test")
+        if host_exp >= MIN_FIRING_EXP:
+            # exp>2 -> BattleUnit::improveStat's RNG::generate(1,3) branch, which can
+            # never roll 0 - a DETERMINISTIC (not merely likely) nonzero bump on both
+            # machines' independent postMissionProcedures roll (each machine trains its
+            # own copy of the soldier off its own local RNG - the two bump AMOUNTS are
+            # not asserted equal, only that each is present).
+            assert firing_host_after > firing_before, (
+                f"host expFiring={host_exp} (>={MIN_FIRING_EXP}) guarantees a nonzero "
+                f"stat bump (BattleUnit::improveStat), but the host's own soldier shows "
+                f"no firing improvement at debrief ({firing_before} -> "
+                f"{firing_host_after})")
+            assert firing_client_after > firing_before, (
+                f"GAP-XP regression AT DEBRIEF: the client's expFiring matched the "
+                f"host's ({client_exp}, >={MIN_FIRING_EXP}) so postMissionProcedures on "
+                f"the client should ALSO show a guaranteed nonzero firing bump, but it "
+                f"shows none ({firing_before} -> {firing_client_after}) - the client's "
+                f"local debrief never saw the trained _exp")
+            print(f"PASS debrief training: BOTH machines show the trained firing stat "
+                  f"(host {firing_before}->{firing_host_after}, client "
+                  f"{firing_before}->{firing_client_after})")
+        else:
+            print(f"NOTE: shooter only reached expFiring={host_exp} (< {MIN_FIRING_EXP}) "
+                  f"- BattleUnit::improveStat's low-exp branch can legitimately roll a 0 "
+                  f"stat bump, so the post-debrief comparison above is a >= sanity check "
+                  f"only, not a strict trained-stat assertion")
+
+        for gc, tag in ((host, "host"), (client, "client")):
+            st = session.states(gc)
+            assert not any("BattlescapeState" in s for s in st), \
+                f"{tag}: the battle is still on the stack after the debriefing: {st}"
+        print("PASS: both machines left the battle and hold a debriefing")
+    finally:
+        host.shutdown(); client.shutdown()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="coop_xp_module_")
+    fail = None
+    try:
+        run((48996, 48997, 48004), tmp)
+        print("ALL XP/MODULE CARRIER TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_session_hardening.py b/tools/coop_test/test_session_hardening.py
index 96e670a46..423e6d797 100644
--- a/tools/coop_test/test_session_hardening.py
+++ b/tools/coop_test/test_session_hardening.py
@@ -152,8 +152,12 @@ def main():
         assert not r.get("ok"), f"BUG4: a different name hosted the campaign save: {r}"
         print("PASS bug4: campaign save refuses a different host name")
 
-        # correct name hosts fine
-        host.ok({"cmd": "host_tcp", "server": "TestSrv", "port": "47903", "player": "HostPlayer"})
+        # correct name hosts fine. The harness rewrites the literal port to an
+        # OS-assigned ephemeral one and the response carries the actual bound
+        # port (5e5ce50ce); that is the port the lobby's waiting text renders,
+        # so assert against it rather than the now-inert literal.
+        resume = host.ok({"cmd": "host_tcp", "server": "TestSrv", "port": "47903", "player": "HostPlayer"})
+        actual_port = str(resume.get("port"))
         host.wait_for("resume lobby", lambda: session._has_state(host, "LobbyMenu"))
 
         # ---------- Bug 5: waiting text merges names + port ----------
@@ -162,7 +166,7 @@ def main():
         # Poll for the merged form rather than reading that transient default.
         details = host.wait_for(
             "resume waiting text merged (names + port)",
-            lambda: (lambda d: d if ("ClientPlayer" in d and "47903" in d) else None)(
+            lambda: (lambda d: d if ("ClientPlayer" in d and actual_port in d) else None)(
                 host.cmd({"cmd": "lobby_state"}).get("detailsText", "")),
             timeout=15,
         )
diff --git a/tools/coop_test/test_shared_parallel_campaign.py b/tools/coop_test/test_shared_parallel_campaign.py
new file mode 100644
index 000000000..c146fd793
--- /dev/null
+++ b/tools/coop_test/test_shared_parallel_campaign.py
@@ -0,0 +1,463 @@
+"""SHARED campaign + parallel battlescape turns: the full
+geoscape -> battle -> debrief -> return cycle.
+
+THE VALIDATION GAP THIS CLOSES. Two co-op features had never been exercised
+together by any suite entry or soak:
+
+  * the SHARED economy campaign (one host-authoritative world; test_shared_*),
+    which flies a real geoscape mission into a co-op battle, and
+  * parallel battlescape turns (EnableCoopParallelTurns; test_parallel_*),
+    which lets BOTH players act during the same player side via the thin-client
+    intent loop (client ships `action_intent`, host executes, both display).
+
+The parallel tests all use the SKIRMISH fixture or the SEPARATE-campaign soak;
+the SHARED tests all run the CLASSIC (alternating-sub-turn) battle. This test is
+the one place the two meet - the combination the manager flagged as a very
+common real-play scenario that must never break.
+
+THE HEADLINE QUESTION, answered by running this: does parallel actually ACTIVATE
+in a SHARED battle? connectionTCP::parallelTurnActive() gates on
+`_enable_parallel_turns && getCoopStatic() && !hotseat && (gamemode==1||4)`. A
+SHARED co-op campaign mission is gamemode 1 (PVE), and the host's option
+propagates across the COOP_READY_HOST handshake, so it SHOULD. If it does not,
+that itself is the finding: this test STOPS with the observed gamemode +
+parallelActive/activeSync evidence rather than forcing anything.
+
+WHAT IT DRIVES, in one battle:
+  1. SHARED campaign bring-up with the host on EnableCoopParallelTurns (its option
+     decides the mode for both machines), client off.
+  2. A deterministic terror site flown from the shared craft into a co-op battle
+     (the test_shared_battle recipe), seed-pinned right before map generation
+     (host SEED, client SEED+1 - different streams, so an outcome-shipping
+     regression cannot coincidentally agree).
+  3. Both seats acting in parallel: a client-intent walk and shot (routed to the
+     host), a host walk and shot (executor-local), with the per-action sync-check
+     clean (zero ALARM across all ten promoted buckets), the item census equal and
+     the drift tripwire silent after every action. The client's wait banner is
+     observed opportunistically (nice-to-have, never fatal).
+  4. A voted ABORT -> debriefing that scores IDENTICALLY on both machines
+     (test_coop_debrief_sync's assertion) -> both back on the campaign geoscape.
+  5. The clean SHARED return: one identical shared world (funds/bases/research),
+     the replica never touched disk, and no desync bundle / crash marker / dump
+     was written.
+
+DELIBERATE DE-FLAKE. The actions are driven within the FIRST player side and the
+mission is then aborted - the test does NOT cycle a full turn, so it never walks
+into the P8 side-close "Waiting for HostPlayer" handshake that is the campaign
+soak's documented flake. That turn-cycle path is already covered by
+test_parallel_soak --profile campaign (SEPARATE); this test's job is the SHARED +
+parallel combination and the geoscape->debrief->return cycle around it.
+
+Run:  python tools/coop_test/test_shared_parallel_campaign.py
+Exit 0 = pass; 2 = failure (STOP-AND-REPORT findings print with a STOP marker).
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import shared_fixture
+import session
+import test_parallel_intents as PI  # parallel drive helpers (intent/pos/settle/idle)
+import test_battle_tripwire as TW
+import test_shared_battle as SB
+import test_coop_debrief_sync as DB
+
+# Unused fixed pair + coop tuple (grep-checked against the suite: free).
+HOST_PORT, CLIENT_PORT, COOP_PORT = 48948, 48949, 47967
+
+# Seed-pin recipe (test_battle_tripwire / test_coop_debrief_sync): the host is the
+# only machine that generates the map, so its seed fixes the map/deployment/stats;
+# the client gets SEED+1 (a different stream). Overridable for a seed search.
+SEED = int(os.environ.get("SHARED_PARALLEL_SEED", "424242"))
+
+BATTLE_OPTS = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+
+
+# ---- readouts --------------------------------------------------------------
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+# ---- geoscape -> a shared terror battle ------------------------------------
+
+def assign_and_fly(host, client):
+    """Assign a mixed-ownership squad to the shared Skyranger and fly it to a
+    seeded terror site until the host gets the landing prompt. Mirrors
+    test_shared_battle's geoscape half, but deploys 2 host-owned (seat 0) + 2
+    client-owned (seat 1) soldiers so parallel driving has a candidate of each
+    seat with a fallback."""
+    b0 = SB._base0(host)
+    blon, blat = b0["lon"], b0["lat"]
+    cid = SB._skyranger(host)["id"]
+    rh = sorted(s["id"] for s in SB._roster(host))
+    assert len(rh) >= 4, (
+        f"the starting base has only {len(rh)} soldiers; the parallel split needs "
+        f">= 4 (2 host-owned + 2 client-owned)")
+    squad = rh[:4]
+    owners = {squad[0]: 0, squad[1]: 0, squad[2]: 1, squad[3]: 1}
+
+    # Ownership is stamped identically on BOTH machines (the split rides the
+    # shared battlehost blob; a one-sided owner would deploy a different coop map).
+    for gc in (host, client):
+        for sid, seat in owners.items():
+            gc.ok({"cmd": "set_soldier_owner", "soldier_id": sid, "owner": seat})
+    # Empty the craft, then board exactly the squad (host is craft-authoritative).
+    for sid in rh:
+        host.ok({"cmd": "craft_assign", "craft_id": cid, "soldier_id": sid, "on": False})
+    for sid in squad:
+        host.ok({"cmd": "craft_assign", "craft_id": cid, "soldier_id": sid, "on": True})
+
+    def _aboard(gc):
+        return sorted(s["id"] for s in SB._roster(gc) if s["craftId"] == cid)
+
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} squad aboard",
+                    lambda gc=gc: (_aboard(gc) == sorted(squad)) or None,
+                    timeout=40, interval=0.5)
+    print(f"squad {squad} (owners {owners}) aboard shared craft {cid} on both")
+
+    # A deterministic terror site next to the base, and teleport the shared craft
+    # onto it (no flight-time RNG) - the exact test_shared_battle lever.
+    site = host.ok({"cmd": "spawn_mission_site", "mission": "STR_ALIEN_TERROR",
+                    "deployment": "STR_TERROR_MISSION", "lon": blon + 0.35,
+                    "lat": blat + 0.10, "race": "STR_SECTOID", "hours": 240})
+    site_id = site["site_id"]
+    host.wait_for("site on host",
+                  lambda: any(s["id"] == site_id for s in SB._geo(host)["missionSites"]) or None,
+                  timeout=30)
+    host.ok({"cmd": "craft_force", "craft_id": cid, "status": "STR_OUT",
+             "lon": blon + 0.34, "lat": blat + 0.10, "dest": f"site:{site_id}",
+             "fuel": 999999, "lowFuel": False})
+
+    def _landing_prompt():
+        if SB._has(host, "ConfirmLandingState"):
+            return True
+        host.cmd({"cmd": "geo_set_speed", "idx": 2})  # not geo_run: it auto-declines
+        return None
+
+    host.wait_for("ConfirmLandingState on host", _landing_prompt, timeout=90, interval=0.5)
+    print("shared craft reached the site; host has the landing prompt")
+    return cid, squad, owners
+
+
+def enter_battle(host, client):
+    """Seed-pin, confirm the landing, and drive both machines through
+    briefing -> pre-battle inventory -> tactical to the co-op battle-init
+    handshake. ConfirmLandingState is modal, so the seed set here is the RNG
+    state the host generates the map from."""
+    # Seeded right before generation: nothing advances the geoscape while the
+    # modal landing prompt is up.
+    host.ok({"cmd": "set_seed", "seed": SEED})
+    client.ok({"cmd": "set_seed", "seed": SEED + 1})
+    host.ok({"cmd": "confirm_landing"})
+
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} entered the battle",
+                    lambda gc=gc: battle(gc).get("inBattle") or None,
+                    timeout=180, interval=1.0)
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} briefing", lambda gc=gc: SB._has(gc, "BriefingState") or None,
+                    timeout=120, interval=0.5)
+        gc.ok({"cmd": "close_briefing"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} pre-battle inventory",
+                    lambda gc=gc: SB._has(gc, "InventoryState") or None,
+                    timeout=120, interval=0.5)
+        gc.ok({"cmd": "battle_inventory", "action": "ok"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} tactical map",
+                    lambda gc=gc: SB._has(gc, "BattlescapeState") or None,
+                    timeout=120, interval=0.5)
+    # Drain the turn-init "Your Turn" NextTurnState off both stacks (the client
+    # has no skipNextTurnScreen, so it must be dismissed) - exactly what
+    # TW.bring_up_battle does before waiting on the co-op init handshake.
+    TW.drain_to_tactical(host, client)
+    # Nothing replicates until the co-op turn-init handshake has run.
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} co-op battle init",
+                    lambda gc=gc: battle(gc).get("battleInit") or None,
+                    timeout=120, interval=1.0)
+    time.sleep(3)
+    print("both machines reached the SHARED battlescape (co-op battle init done)")
+
+
+# ---- the headline: does parallel activate in a SHARED battle? --------------
+
+def assert_parallel_active(host, client):
+    """STOP-AND-REPORT gate. Parallel turns must be LIVE on both machines and the
+    PRD-P5 executor invariant (`_isActivePlayerSync == getHost()`: host true /
+    client false) must hold, or nothing below is testing the intended path. A miss
+    is the FINDING, reported with the gamemode + the raw flags - not forced."""
+    hb, cb = battle(host), battle(client)
+    gm = hb.get("coopGamemode")
+    ev = {
+        "host": {"gamemode": gm, "parallelActive": hb.get("parallelActive"),
+                 "parallelEnabled": hb.get("parallelEnabled"),
+                 "activeSync": hb.get("activeSync")},
+        "client": {"gamemode": cb.get("coopGamemode"),
+                   "parallelActive": cb.get("parallelActive"),
+                   "parallelEnabled": cb.get("parallelEnabled"),
+                   "activeSync": cb.get("activeSync")},
+    }
+    if not (hb.get("parallelActive") is True and cb.get("parallelActive") is True):
+        raise AssertionError(
+            "STOP-AND-REPORT: parallel turns did NOT activate in a SHARED battle. "
+            f"parallelTurnActive() needs gamemode 1 (PVE) or 4 (PVE2); observed "
+            f"gamemode={gm}. Full evidence: {ev}")
+    if not (hb.get("activeSync") is True and cb.get("activeSync") is False):
+        raise AssertionError(
+            "STOP-AND-REPORT: the PRD-P5 executor invariant does NOT hold in a "
+            "SHARED parallel battle (host activeSync must be True, client False, "
+            f"since _isActivePlayerSync == getHost()). Evidence: {ev}")
+    print(f"PASS parallel-active: the SHARED battle is PARALLEL on BOTH machines "
+          f"(gamemode={gm}=PVE, activeSync host=True/client=False)")
+    return gm
+
+
+# ---- per-action synchrony check --------------------------------------------
+
+def check_sync(host, client, what):
+    """After every driven action: the item terms agree (never drift), every
+    promoted sync-check bucket agrees (zero ALARM), and the drift tripwire is
+    silent."""
+    PI.settle(host, client)
+    session.assert_battle_synced(host, client, what)   # item-id counter + census
+    session.assert_sync_clean(host, client, what)      # per-action buckets, zero ALARM
+    assert not TW.desync_seen(host) and not TW.desync_seen(client), \
+        f"the PRD-P2 drift tripwire fired {what}"
+
+
+# ---- driving BOTH seats ----------------------------------------------------
+
+def _robust_walk(host, client, mover, sender, tag, tries=8):
+    """Walk `mover` one tile until it ACTUALLY moves, re-picking the destination
+    (and re-placing a boxed-in unit) between tries. `sender` is the machine the
+    action is issued from: the client (a routed intent) or the host (executor-
+    local). A terror map is dense, and a walk can be interrupted the instant it
+    starts (a unit spotted mid-step, a reaction shot) so that NOTHING moves - the
+    same stall TW.drive_walk tolerates. Each such attempt still runs a complete
+    chain (it is admitted, executed and sync-compared), so this is fixture
+    hardening, not a masked bug; a truly un-executed intent raises after `tries`.
+
+    Returns (before, landed, banner_seen) - banner_seen is the client wait banner
+    caught opportunistically during the display window (nice-to-have, never
+    asserted here)."""
+    routed_expect = (sender is client)
+    banner_seen = ""
+    for attempt in range(1, tries + 1):
+        PI.top_up(host, client, mover)
+        dest = PI.step_dest(host, client, mover)   # re-places a boxed-in unit
+        if not dest:
+            continue
+        before = PI.pos(battle(host), mover)
+        r = PI.intent(sender, action="move", unit=mover, x=dest[0], y=dest[1], z=dest[2])
+        assert r.get("ok"), f"{tag}: could not build the walk intent: {r}"
+        assert r.get("routed") is routed_expect, (
+            f"{tag}: routed={r.get('routed')} want {routed_expect} - a client intent "
+            f"must route to the host; a host action must run locally")
+        # Wait for the chain to finish, polling the client wait banner meanwhile.
+        deadline = time.time() + 60
+        while time.time() < deadline:
+            b = PI.parallel(client).get("coopWaitBanner", "") or ""
+            if "please wait" in b.lower() and not banner_seen:
+                banner_seen = b
+            if (PI.parallel(host).get("canAdmit") is True
+                    and PI.parallel(client)["pendingReqId"] == 0):
+                break
+            time.sleep(0.1)
+        PI.settle(host, client)
+        landed = PI.pos(battle(host), mover)
+        if landed != before:
+            assert PI.wait_until(lambda: PI.pos(battle(client), mover) == landed, 45), (
+                f"{tag}: the walk did not display on the client: host {landed} "
+                f"client {PI.pos(battle(client), mover)}")
+            return before, landed, banner_seen
+        print(f"    ({tag} walk stalled at {before}, attempt {attempt}/{tries} - "
+              f"interrupted; the chain ran, re-trying a fresh step)")
+    raise AssertionError(
+        f"{tag}: unit {mover} never moved over {tries} walk attempts. Each chain "
+        f"completed (admitted + sync-compared), so this is a stalled/interrupted "
+        f"walk on a dense map, not an un-executed intent - re-check the driver "
+        f"placement, not the intent path.")
+
+
+def drive_client_walk(host, client, mover):
+    """A client-intent walk (routed to the host, both display)."""
+    print("-- client-intent walk: host executes, both display --")
+    before, landed, _ = _robust_walk(host, client, mover, client, "client-intent")
+    session.assert_battle_synced(host, client, "after the client-intent walk")
+    print(f"PASS client-intent walk: unit {mover} {before} -> {landed} on both machines")
+
+
+def drive_host_walk(host, client, mover):
+    """The host walks its OWN unit: executor runs it locally, client displays.
+    Observes the client wait banner naming the host - nice-to-have, never fatal."""
+    print("-- host walk: executor runs locally, client displays --")
+    host.cmd({"cmd": "battle_camera", "unit": mover, "visible": True})
+    before, landed, banner = _robust_walk(host, client, mover, host, "host")
+    session.assert_battle_synced(host, client, "after the host walk")
+    if banner:
+        print(f"    PASS (nice-to-have): client wait banner during the host action = {banner!r}")
+    else:
+        print("    NOTE (nice-to-have): client wait banner not caught this run "
+              "(timing) - non-fatal; test_coop_wait_banner covers it directly")
+    print(f"PASS host walk: unit {mover} {before} -> {landed}, displayed on both")
+
+
+def drive_client_shot(host, client, mover):
+    """A client-intent shot at a TILE (not a kill - the battle must survive to the
+    abort). PI.drive ships the intent, waits for the host to execute, and asserts
+    the census + tripwire quiet."""
+    print("-- client-intent shot: host executes, both display --")
+    PI.top_up(host, client, mover)
+    wid = PI.give_both(host, client, mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+    here = PI.pos(battle(client), mover)
+    PI.drive(host, client, "shoot(client)", action="shoot", unit=mover, mode="snap",
+             weapon_id=wid, x=here[0] + 2, y=here[1] + 2, z=here[2])
+
+
+def drive_host_shot(host, client, mover):
+    """A host shot at a TILE, executor-local (routed False)."""
+    print("-- host shot: executor runs locally, both display --")
+    PI.top_up(host, client, mover)
+    wid = PI.give_both(host, client, mover, "STR_RIFLE", "STR_RIFLE_CLIP")
+    here = PI.pos(battle(host), mover)
+    seq0 = PI.parallel(host)["actionSeq"]
+    r = PI.intent(host, action="shoot", unit=mover, mode="snap", weapon_id=wid,
+                  x=here[0] + 2, y=here[1] + 2, z=here[2])
+    assert r.get("ok"), f"the host could not build the shot: {r}"
+    assert r.get("routed") is False, \
+        f"the host shipped an intent for its OWN shot ({r})"
+    assert PI.idle(host), f"the host shot chain never ended: {PI.parallel(host)}"
+    print(f"PASS host shot: unit {mover} fired (actionSeq {seq0} -> "
+          f"{PI.parallel(host)['actionSeq']})")
+
+
+# ---- ending: abort -> debrief identical -> geoscape ------------------------
+
+def end_via_abort_and_compare_debrief(host, client):
+    """A voted ABANDON MISSION, then the debriefing must score IDENTICALLY on both
+    machines (test_coop_debrief_sync's assertion), then both drain back to the
+    campaign geoscape."""
+    print("-- voted ABORT -> debriefing (identical) -> geoscape --")
+    DB.vote_abort_to_debriefing(host, client)
+    dh = DB.wait_debrief(host, "host")
+    dc = DB.wait_debrief(client, "client")
+    print(f"    host   rows={dh['rows']} total={dh['total']}")
+    print(f"    client rows={dc['rows']} total={dc['total']}")
+    assert dh["rows"] == dc["rows"], (
+        f"the debriefing score ROWS differ - host {dh['rows']} client {dc['rows']}. "
+        f"Each machine builds the score page from its local battle save; a "
+        f"difference is a SHARED+parallel debrief desync.")
+    assert dh["scores"] == dc["scores"], (
+        f"the debriefing POINTS differ: host {dh['scores']} client {dc['scores']}")
+    assert dh["total"] == dc["total"], (
+        f"the mission TOTAL differs: host {dh['total']} client {dc['total']}")
+    print(f"PASS debrief: identical on both machines (rows={dh['rows']}, "
+          f"total={dh['total']})")
+
+    # Campaign debriefing returns to the GEOSCAPE (not the skirmish main menu).
+    deadline = time.time() + 220
+    for gc, tag in ((host, "host"), (client, "client")):
+        gc.wait_for(f"{tag} geoscape after debrief",
+                    lambda gc=gc: session.drain_to_geoscape(gc, deadline),
+                    timeout=240, interval=1.0)
+    print("PASS return: both machines back on the campaign geoscape after debrief")
+
+
+def assert_no_crash_artifacts(host, client, js):
+    """No desync bundle, no crash-pending marker, no minidump on either machine."""
+    for gc, tag, d in ((host, "host", js.host_dir), (client, "client", js.client_dir)):
+        zips = TW.report_zips(gc)
+        assert not zips, f"{tag}: a desync bundle was written during the cycle: {zips}"
+        marker = os.path.join(d, "crash-pending.json")
+        assert not os.path.exists(marker), \
+            f"{tag}: a crash-pending marker was written: {marker}"
+        dmps = [f for f in os.listdir(d) if f.endswith(".dmp")]
+        assert not dmps, f"{tag}: crash dump(s) written: {dmps}"
+    print("PASS clean: no desync bundle, no crash-pending marker, no dump on either machine")
+
+
+def dump_debug(js):
+    if js is None:
+        return
+    for tag, gc in (("host", js.host), ("client", js.client)):
+        try:
+            print(f"  DBG {tag} top: {session.states(gc)[-3:]}")
+            b = gc.cmd({"cmd": "battle_state"})
+            print(f"  DBG {tag} battle: inBattle={b.get('inBattle')} "
+                  f"gm={b.get('coopGamemode')} parallelActive={b.get('parallelActive')} "
+                  f"activeSync={b.get('activeSync')} desyncSeen={b.get('desyncSeen')}")
+            print(f"  DBG {tag} parallel: {PI.parallel(gc)}")
+        except Exception as de:
+            print(f"  DBG {tag} dump failed: {de}")
+
+
+# ---- main ------------------------------------------------------------------
+
+def main():
+    fail = None
+    js = None
+    try:
+        js = shared_fixture.bring_up(
+            "sharedpar", (HOST_PORT, CLIENT_PORT, COOP_PORT),
+            host_options=dict(BATTLE_OPTS, skipNextTurnScreen=True,
+                              EnableCoopParallelTurns=True),
+            client_options=dict(BATTLE_OPTS, EnableCoopParallelTurns=False))
+        host, client = js.host, js.client
+        print("SHARED campaign up on the geoscape (host: parallel turns ON)")
+        js.assert_world_equal("campaign start", timeout=60)
+
+        # geoscape -> shared terror battle (seed-pinned generation)
+        assign_and_fly(host, client)
+        enter_battle(host, client)
+
+        # THE HEADLINE FINDING
+        gm = assert_parallel_active(host, client)
+
+        # the ownership split deployed a driver of each seat
+        cseat = client.ok({"cmd": "get_coop"})["localSeat"]
+        client_mover = PI.pick_driver(host, client, cseat, "client")
+        host_mover = PI.pick_driver(host, client, 0, "host")
+        session.assert_battle_synced(host, client, "at battle start")
+        session.assert_sync_clean(host, client, "at battle start")
+        print(f"drivers placed: client seat {cseat} unit {client_mover}, "
+              f"host seat 0 unit {host_mover}")
+
+        # drive BOTH seats in parallel, per-action sync clean
+        drive_host_walk(host, client, host_mover)
+        check_sync(host, client, "after the host walk")
+        drive_client_walk(host, client, client_mover)
+        check_sync(host, client, "after the client-intent walk")
+        drive_host_shot(host, client, host_mover)
+        check_sync(host, client, "after the host shot")
+        drive_client_shot(host, client, client_mover)
+        check_sync(host, client, "after the client-intent shot")
+        print("PASS parallel driving: both seats acted, per-action sync clean")
+
+        # end: abort -> debrief identical -> geoscape return
+        end_via_abort_and_compare_debrief(host, client)
+
+        # the clean SHARED return
+        js.assert_world_equal("post-battle SHARED world", timeout=120)
+        session.assert_client_zero_disk(js.client_dir)
+        print("PASS zero-disk: the SHARED replica never wrote save data")
+        assert_no_crash_artifacts(host, client, js)
+
+        print(f"\nSHARED-PARALLEL CAMPAIGN CYCLE PASSED (gamemode {gm}, seed {SEED}): "
+              f"geoscape -> parallel battle -> identical debrief -> shared geoscape return")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        dump_debug(js)
+    finally:
+        if js is not None:
+            js.shutdown()
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_skirmish_battle_turn_control.py b/tools/coop_test/test_skirmish_battle_turn_control.py
index 96eddaaf1..bf303e64b 100644
--- a/tools/coop_test/test_skirmish_battle_turn_control.py
+++ b/tools/coop_test/test_skirmish_battle_turn_control.py
@@ -190,7 +190,11 @@ def assert_replication(host, client, r):
     A walk is used rather than a shot because a shot can legitimately miss -
     a position is unambiguous.
     """
-    owner_tag = "host" if r["host"]["activeSync"] else "client"
+    # Driver selection (not the invariant check below): session.can_drive() so
+    # this keeps picking a legal driver once parallel turns (PRD-P5+) make both
+    # machines drivable. Step 2's assertion still reads activeSync directly -
+    # that one IS about the executor invariant.
+    owner_tag = "host" if session.can_drive(r["host"]["raw"]) else "client"
     owner = host if owner_tag == "host" else client
     peer = client if owner_tag == "host" else host
 
diff --git a/tools/coop_test/test_skirmish_end_main_menu.py b/tools/coop_test/test_skirmish_end_main_menu.py
new file mode 100644
index 000000000..9f287aae5
--- /dev/null
+++ b/tools/coop_test/test_skirmish_end_main_menu.py
@@ -0,0 +1,261 @@
+"""A finished co-op SKIRMISH sends BOTH players to the MAIN MENU.
+
+THE BUG (reported from manual parallel-turns play): after ABORTING a NEW BATTLE
+> COOP mission, the host was handed a LOBBY offering RESUME GAME, and pressing
+it dropped them on the GEOSCAPE - a screen a skirmish has no business showing.
+
+WHY. A co-op skirmish world arrives through LoadGameState on BOTH machines, so
+each stack is [GeoscapeState, BattlescapeState]: there is a dead geoscape buried
+under every skirmish battle. When the mission ends, both players get a
+DebriefingState over that geoscape, and whoever presses OK first leaves properly
+(monthsPassed == -1 -> GoToMainMenuState, which drops the SavedGame - issue #82).
+
+That ordinary exit disconnects, and the disconnect looked like a DROP to the
+player still reading their debriefing:
+
+  * the HOST pushed CoopState(20) "<client> has left the server" and, in
+    disconnectTCP's teardown, re-opened the LobbyMenu (the branch that exists
+    for a drop while the host sits on the NEW BATTLE setup screen). LobbyMenu's
+    constructor saw the buried GeoscapeState with the session still locked, so
+    _resumeToGame latched TRUE and the button read RESUME GAME - which pops the
+    debriefing away and lands on that dead geoscape.
+  * the CLIENT got CoopState(21) "Server connection lost" thrown over its
+    debriefing.
+
+Both are the issue #79 bug class ("one player's exit affects the other"), just
+for a skirmish instead of a finished campaign.
+
+THE FIX. connectionTCP::skirmishMissionOver() - the skirmish twin of
+campaignEnded() (lobbyMode 0 + no live battle + coopMissionEnd). While it holds,
+a peer leaving is silent and the lobby is never re-opened; each player's own
+debriefing OK is the exit, and it goes through GoToMainMenuState.
+
+WHAT THIS TEST DRIVES: one skirmish per ending, with the debriefings closed in a
+different order each time (the order decides which machine is the one left
+holding a live world, and the two sides had different symptoms):
+
+  abort-by-vote, CLIENT closes first  - the exact reported repro
+  win,           HOST closes first    - the mirrored case
+
+For each: while the second machine is still on its debriefing it must have NO
+LobbyMenu and NO co-op popup on the stack, and both machines must finish on the
+MAIN MENU with the SavedGame dropped.
+
+Run:  python tools/coop_test/test_skirmish_end_main_menu.py
+      python tools/coop_test/test_skirmish_end_main_menu.py abort
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+
+FACTION_PLAYER = 0
+FACTION_HOSTILE = 1
+
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def live(gc, faction):
+    return [u for u in battle(gc).get("units", [])
+            if u.get("faction") == faction and not u.get("isOut")]
+
+
+# ---- endings ---------------------------------------------------------------
+
+def end_by_vote(host, client):
+    """ABORT -> the abandon-mission majority vote -> both debriefings.
+
+    session.coop_abort_battle drains all the way to the geoscape, which would
+    dismiss the very screens this test exists to inspect, so only its vote half
+    is reused here."""
+    host.ok({"cmd": "battle_action", "action": "abort"})
+    for gc, tag in ((host, "host"), (client, "client")):
+        v = gc.wait_for(f"{tag} abandon-mission vote",
+                        lambda gc=gc: (lambda s: s if (s.get("active") and s.get("menuOpen"))
+                                       else None)(gc.ok({"cmd": "vote_state"})),
+                        timeout=30, interval=0.25)
+        assert v["action"] == "abandon_mission", f"{tag}: wrong vote: {v}"
+    cast = client.ok({"cmd": "vote_cast", "yes": True})
+    assert cast.get("accepted"), f"client vote_cast was rejected: {cast}"
+    for gc, tag in ((host, "host"), (client, "client")):
+        v = gc.wait_for(f"{tag} vote result",
+                        lambda gc=gc: (lambda s: s if s.get("finished") else None)(
+                            gc.ok({"cmd": "vote_state"})),
+                        timeout=30, interval=0.25)
+        assert v.get("passed"), f"{tag}: the abandon-mission vote did not pass: {v}"
+
+
+def end_by_win(host, client):
+    """Kill every alien, then hand the turn over so the mission is WON.
+
+    `battleAutoEnd` is off by default: a battle with no aliens left ends the way
+    a player ends it, by passing the turn (BattlescapeGame::endTurn then sees
+    liveAliens == 0)."""
+    for _ in range(8):
+        if not battle(host).get("inBattle"):
+            break
+        aliens = live(host, FACTION_HOSTILE)
+        if not aliens:
+            break
+        target = aliens[0]
+        squad = live(host, FACTION_PLAYER)
+        assert squad, "the squad is wiped out - no mission win to debrief"
+        shooter = squad[0]["id"]
+        PI.place_adjacent(host, client, shooter,
+                          (target["x"], target["y"], target["z"]))
+        wid = None
+        for gc in (host, client):
+            wid = gc.ok({"cmd": "battle_give", "unit": shooter,
+                         "item": "STR_HEAVY_PLASMA",
+                         "ammo": "STR_HEAVY_PLASMA_CLIP",
+                         "slot": "right", "clear_hands": True})["weaponId"]
+        time.sleep(2)
+        PI.top_up(host, client, shooter, 200)
+        host.cmd({"cmd": "battle_fire", "unit": shooter, "mode": "aimed",
+                  "weapon_id": wid, "tu": 200, "target": target["id"]})
+        PI.settle(host, client, seconds=5)
+    assert not battle(host).get("inBattle") or not live(host, FACTION_HOSTILE), \
+        "the aliens could not be killed - there is no WIN to debrief"
+    if battle(host).get("inBattle"):
+        TW.cycle_turn(host, client, timeout=240)
+
+
+ENDINGS = {"abort": end_by_vote, "win": end_by_win}
+
+
+# ---- assertions ------------------------------------------------------------
+
+def wait_debriefing(gc, tag, timeout=180):
+    gc.wait_for(f"{tag} debriefing",
+                lambda: session.has_state(gc, "DebriefingState"),
+                timeout=timeout, interval=0.5)
+
+
+def assert_undisturbed(gc, tag, ending, gone):
+    """The player still reading their debriefing must not have been interrupted
+    by the OTHER player's ordinary exit."""
+    st = session.states(gc)
+    assert any("DebriefingState" in s for s in st), (
+        f"[{ending}] {tag}: the debriefing is gone after the {gone} left - "
+        f"the peer's exit tore down this player's end-of-mission screen. "
+        f"states={st}")
+    assert not any("LobbyMenu" in s for s in st), (
+        f"THE BUG [{ending}]: a LobbyMenu was raised over {tag}'s debriefing "
+        f"when the {gone} closed theirs. Its RESUME GAME pops the debriefing "
+        f"away and lands on the dead geoscape a skirmish world is loaded onto "
+        f"(issue #82's half-torn world). states={st}")
+    lb = gc.cmd({"cmd": "lobby_state"})
+    assert not lb.get("lobbyOpen"), (
+        f"THE BUG [{ending}]: {tag} has a lobby open after the {gone} left, "
+        f"button {lb.get('buttonText')!r} visible={lb.get('buttonVisible')}")
+    assert not any("CoopState" in s for s in st), (
+        f"[{ending}] {tag}: a co-op popup ({gc.cmd({'cmd': 'get_coop'}).get('coopDialog')}) "
+        f"was thrown over the debriefing because the {gone} closed theirs "
+        f"first - an expected exit is not a drop to report. states={st}")
+
+
+def assert_at_main_menu(gc, tag, ending, timeout=40):
+    try:
+        gc.wait_for(f"{tag} main menu",
+                    lambda: (session.states(gc)[-1:] == ["class OpenXcom::MainMenuState"]) or None,
+                    timeout=timeout, interval=0.5)
+    except TimeoutError:
+        raise AssertionError(
+            f"[{ending}] {tag} did not end up on the MAIN MENU after closing the "
+            f"skirmish debriefing: states={session.states(gc)}")
+    c = gc.cmd({"cmd": "get_coop"})
+    assert c.get("hasSave") is False, (
+        f"[{ending}] {tag} reached the main menu with a SavedGame still live - "
+        f"the exit bypassed GoToMainMenuState (issue #82): {c}")
+    assert c.get("coopSession") is False and c.get("coopStatic") is False, (
+        f"[{ending}] {tag}: the co-op session is still attached at the main "
+        f"menu: {c}")
+
+
+# ---- one battle ------------------------------------------------------------
+
+def run(ending, first, ports):
+    """One skirmish driven to `ending`; `first` ('host'/'client') closes its
+    debriefing before the other."""
+    hport, cport, coop_port = ports
+    tag = f"{ending}/{first}-first"
+    opts = {"battleXcomSpeed": 2, "battleAlienSpeed": 2}
+    host = GameClient("host", hport,
+                      make_user_dir(f"skirm_end_{ending}_host",
+                                    options=dict(opts, skipNextTurnScreen=True,
+                                                 EnableCoopParallelTurns=True)))
+    client = GameClient("client", cport,
+                        make_user_dir(f"skirm_end_{ending}_client",
+                                      options=dict(opts,
+                                                   EnableCoopParallelTurns=False)))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = str(coop_port)
+        PI.PORT = str(coop_port)
+        TW.bring_up_battle(host, client)
+
+        # The buried geoscape is the whole reason the bug bites - assert it is
+        # really there, so a future flow change that removes it turns this test
+        # into an obvious "the premise moved" failure rather than a silent pass.
+        for gc, who in ((host, "host"), (client, "client")):
+            st = session.states(gc)
+            assert any("GeoscapeState" in s for s in st), (
+                f"{who}: a skirmish battle used to sit on a GeoscapeState "
+                f"(LoadGameState) - the premise of this test: {st}")
+        print(f"[{tag}] battle up; both stacks carry the buried geoscape")
+
+        ENDINGS[ending](host, client)
+        wait_debriefing(host, "host")
+        wait_debriefing(client, "client")
+        print(f"[{tag}] both machines are on the debriefing")
+
+        leaver, stayer = (host, client) if first == "host" else (client, host)
+        lname, sname = (first, "client" if first == "host" else "host")
+
+        leaver.ok({"cmd": "dismiss_popup"})   # DebriefingState::btnOkClick
+        assert_at_main_menu(leaver, lname, ending)
+        print(f"[{tag}] the {lname} closed its debriefing and reached the main menu")
+
+        # Give the peer's disconnect the time it needs to do the wrong thing.
+        time.sleep(6)
+        assert_undisturbed(stayer, sname, ending, lname)
+        print(f"[{tag}] the {sname} still holds its debriefing, no lobby, no popup")
+
+        stayer.ok({"cmd": "dismiss_popup"})
+        assert_at_main_menu(stayer, sname, ending)
+        print(f"PASS [{tag}]: both machines finished on the main menu with no world")
+    finally:
+        host.shutdown(); client.shutdown()
+
+
+def main():
+    wanted = sys.argv[1:] or ["abort", "win"]
+    # The order is part of the scenario: the reported repro is the client
+    # leaving first (the host was the one handed the lobby), and the win case
+    # covers the mirror image.
+    plan = [("abort", "client", (48898, 48899, 47995)),
+            ("win", "host", (48900, 48901, 47996))]
+    fail = None
+    try:
+        for ending, first, ports in plan:
+            if ending in wanted:
+                run(ending, first, ports)
+        print("ALL SKIRMISH-END TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/coop_test/test_sync_check.py b/tools/coop_test/test_sync_check.py
new file mode 100644
index 000000000..d0fe47ca7
--- /dev/null
+++ b/tools/coop_test/test_sync_check.py
@@ -0,0 +1,1306 @@
+"""PRD-I0: the per-action sequenced sync-check.
+
+The PRD-P2 tripwire is TURN-grained: three terms, stamped once per `next_turn`,
+compared before the bulk apply. When it fires, the suspect list is "something in
+the last side". I0 makes the same question per-ACTION, using machinery that
+already exists:
+
+    host   drains chain N  ->  computeBattleHashes() -> ring[{seq, kind, h}]
+                           ->  `action_end {action_seq: N}`
+    client consumes it     ->  computeBattleHashes()
+                           ->  `action_done {seq: N, seat, side_seq, h: {...}}`
+    host   receives it     ->  look N up, compare PER BUCKET, name the loser
+
+Seven buckets (terrain, fire, smoke, items, unitsCore, unitsStats, itemIdCtr),
+each ALARM or REPORT-ONLY by a compile-time table. At I0's birth every one is
+REPORT-ONLY - the detector ships first, the promotions are PRD-I3's, each with
+its own burn-in evidence.
+
+Seq coverage is extended in the same commit so the question can be asked
+everywhere state moves:
+
+  * AI-side chains are stamped where handleAI COMMITS to an action (the alien
+    side used to run completely unnumbered);
+  * two boundary pseudo-seqs, in their OWN monotonic namespace, cover the
+    side-close phase group ("endturn") and the side start ("sidestart"). They
+    ride an `action_end {boundary: true}` marker, which is NOT whitelisted, so
+    the client consumes it at receive-gate depth 0 - i.e. it hashes AFTER
+    `fuse_events` / `next_turn` have been applied. That is deliberately the
+    opposite of the legacy tripwire's compare-BEFORE-apply, which is untouched.
+
+What this test asserts (PRD-I0 §4, in order):
+
+  1. CLEAN + COVERAGE. ~20 mixed player actions and a full alien side: the
+     deferred loop closes (`lastComparedSeq` catches `lastSeq`), nothing is
+     dropped, and `comparedKinds` proves the AI chains and both boundary kinds
+     were actually compared - a seq extension that silently stamped nothing
+     would sail through a bare zero-mismatch assertion.
+  2. AI-SIDE ATTRIBUTION. A one-sided unit skew injected just before the side
+     closes is named against an AI-chain seq (`kind == "ai"`, not a boundary).
+  3. BOUNDARY ATTRIBUTION. The same skew is also named against a boundary
+     pseudo-seq - the only thing that can attribute a divergence introduced
+     between two sides.
+  4. RED BUCKET + RIGHT SEQ. A one-sided item mint names the `items` bucket at
+     the seq of the very next action, and leaves terrain/fire/smoke/unitsCore
+     alone - the exclusivity proof that a bucket means what it says.
+
+Both divergence levers are TEST-ONLY uses of existing harness commands
+(`battle_give`, `battle_intent`'s `status` setter). No divergence mechanism
+ships in the game.
+
+Run:  python tools/coop_test/test_sync_check.py
+Exit 0 = pass; 2 = failure.
+"""
+
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import GameClient, make_user_dir
+import session
+import test_battle_tripwire as TW
+import test_parallel_intents as PI
+import test_parallel_endturn as PE
+
+PORT = "47993"
+
+# connectionTCP::unitstatusToInt. DEAD rather than UNCONSCIOUS: the engine revives
+# its own unconscious units at every turn boundary, so an UNCONSCIOUS skew is
+# undone by the very side cycle that is supposed to carry it across.
+WIRE_STATUS_DEAD = 6
+
+# The buckets that must stay quiet under an ITEM-only lever. `itemIdCtr` moves
+# with `items` (the mint advances the counter - that is the same family and the
+# point of having both), and `unitsStats` is the bucket PRD-I0 itself calls
+# expected-noisy, so neither belongs in an exclusivity assertion.
+ITEM_LEVER_INNOCENT = ("terrain", "fire", "smoke", "unitsCore")
+
+# PRD-I3 SEAM-1 discriminator (kneel-burst). Post-fix the kneel replay packet
+# ships the actor's cost, so a run of kneel/stand toggles must leave ZERO
+# kneel-KIND unitsStats mismatches. Default ON (this is the permanent green
+# gate); export SEAM1_KNEEL_STRICT=0 to take the pre-fix red baseline
+# print-only, without aborting the rest of the suite.
+KNEEL_STRICT = os.environ.get("SEAM1_KNEEL_STRICT", "1") == "1"
+
+# PRD-I3 SEAM-2 (re-scoped, manager decision 2026-08-10). The SEAM-2 remit is the
+# BOUNDARY hazard authority. HALF 1 EXCLUDES the smoke/fire buckets from the ENDTURN
+# boundary compare (that hazard sample is ill-defined: all decay runs once per cycle
+# at neutral->player AFTER both endturn boundaries are armed, and the host flush races
+# its own decay), keeping SIDESTART (hash-after-apply of next_turn) as the well-defined
+# point. HALF 2 makes the decay set_smoke_tile/set_fire_tile ride the ORDERED gate (a
+# `bnd` flag), so decay-driven ai-seq smoke is structurally 0. STRICT here asserts the
+# BOUNDARY hazard authority + the HALF 1 introspection; the ai-seq unitsStats residual
+# is a SEPARATE pre-existing seam (SEAM-7, allowance-annotated below) and the ai-seq
+# smoke residual is the whitelisted mid-side EXPLOSION path (also allowed). The us_ai=0
+# clause was REMOVED from SEAM-2. Default ON = the permanent green gate; export
+# SEAM2_SMOKE_STRICT=0 to take the pre-fix red baseline print-only.
+SMOKE_STRICT = os.environ.get("SEAM2_SMOKE_STRICT", "1") == "1"
+
+# PRD-I3 SEAM-4 discriminator (bystander morale on a casualty). Post-fix the death
+# packet ships every living unit's absolute morale, so a host casualty leaves ZERO
+# unitsStats(morale) drift on the parallel client with no boundary crossed. Default
+# ON = the permanent green gate; export SEAM4_MORALE_STRICT=0 to take the pre-fix
+# red baseline print-only without aborting the rest of the suite.
+MORALE_STRICT = os.environ.get("SEAM4_MORALE_STRICT", "1") == "1"
+
+
+# ---- readouts --------------------------------------------------------------
+
+def battle(gc):
+    return gc.cmd({"cmd": "battle_state"})
+
+
+def parallel(gc):
+    return gc.cmd({"cmd": "parallel_state"})
+
+
+def sync(gc):
+    return session.sync_check(gc)
+
+
+def counts(sc):
+    return {n: b["mismatchCount"] for n, b in sc["buckets"].items()}
+
+
+def delta(before, after):
+    return {n: after[n] - before[n] for n in after if after[n] > before.get(n, 0)}
+
+
+def kneel_stats_mismatches(sc):
+    """Just the unitsStats mismatches attributed to a KNEEL action seq.
+
+    The I0 detector names every mismatch (seq, kind, bucket); SEAM-1 is the
+    kneel replay packet re-deciding the actor's charge on the peer, so its
+    signature is precisely bucket==unitsStats AND kind=="kneel"."""
+    return [m for m in sc.get("mismatches", [])
+            if m["bucket"] == "unitsStats" and m["kind"] == "kneel"]
+
+
+def unit_stat_diff(host, client):
+    """Per-unit numeric-field disagreements between the two machines.
+
+    Diagnostic only: names WHICH unit and WHICH stat drifted, so a residual
+    kneel-kind unitsStats mismatch can be read as the kneeler's own cost
+    (SEAM-1) versus a bystander (a different seam sampled at the kneel seq)."""
+    hu = {u["id"]: u for u in battle(host)["units"]}
+    cu = {u["id"]: u for u in battle(client)["units"]}
+    diffs = []
+    for uid in sorted(set(hu) & set(cu)):
+        h, c = hu[uid], cu[uid]
+        d = {k: (h.get(k), c.get(k)) for k in ("tu", "energy", "health", "stun",
+             "wounds", "morale") if k in h and k in c and h.get(k) != c.get(k)}
+        if d:
+            diffs.append((uid, d))
+    return diffs
+
+
+def poll(fn, timeout, interval=0.2):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if fn():
+            return True
+        time.sleep(interval)
+    return False
+
+
+def idle(host, timeout=90):
+    return poll(lambda: parallel(host).get("canAdmit") is True, timeout, 0.1)
+
+
+def settle_display(host, client, timeout=90):
+    """Both machines quiescent: the executor idle, the peer's display watermark
+    caught up, its receive gate empty and no BattleState still running anywhere.
+
+    Same shape as the PRD-P9 soak's. A hash comparison taken while a chain is
+    still draining on the client compares two machines at different points in the
+    same action, which is a guaranteed red that means nothing."""
+    PI.settle(host, client, 2)
+    poll(lambda: parallel(host).get("displayBacklog", 0) == 0
+         and parallel(host).get("taskCompleted") is not False
+         and parallel(client).get("taskCompleted") is not False
+         and parallel(client).get("rxHold", 0) == 0, timeout, 0.1)
+    poll(lambda: battle(host).get("isBusy") is False
+         and battle(client).get("isBusy") is False, timeout, 0.1)
+
+
+def reset_sync(host, client):
+    """Clear the sync-check counters (and the PRD-P2 latch) on both machines.
+
+    Also clears the RING, so anything still in flight lands as a `staleReports`
+    rather than a compare - which is why every caller settles first."""
+    settle_display(host, client)
+    for gc in (host, client):
+        gc.ok({"cmd": "shared_reset_resync_stats"})
+
+
+# ---- driving ---------------------------------------------------------------
+
+def act(host, client, driver, **kw):
+    """Drive one action from `driver` and wait for the executor to finish with it.
+
+    Returns how many chains the host admitted (0 = the lever or the arbiter
+    refused - a boxed-in soldier or a shot with no line of fire is a fixture
+    accident, not a protocol failure)."""
+    seq0 = parallel(host)["actionSeq"]
+    r = PI.intent(driver, **kw)
+    if not r.get("ok"):
+        return 0
+    poll(lambda: parallel(host)["actionSeq"] > seq0, 25, 0.05)
+    if not idle(host, 90):
+        PI.settle(host, client, 3)
+        idle(host, 30)
+    return max(0, parallel(host)["actionSeq"] - seq0)
+
+
+def drive_mixed(host, client, hmover, cmover, want=20):
+    """`want` admitted actions, alternating seats and mixing kinds.
+
+    Walks (the chain everything else is built on), turns (a chain that may ship
+    NO packet at all - the case PRD-P7's `action_end` marker exists for) and
+    kneels (an instant kind that pushes no BattleState, so its `action_done` can
+    only come from the main-thread close path). Between them they cover the three
+    shapes of chain the seq machinery has to handle."""
+    n = 0
+    guard = 0
+    while n < want and guard < want * 4:
+        guard += 1
+        for driver, uid, tag in ((client, cmover, "client"), (host, hmover, "host")):
+            if n >= want:
+                break
+            PI.top_up(host, client, uid)
+            dest = PI.step_dest(host, client, uid)
+            if dest:
+                n += act(host, client, driver, action="move", unit=uid,
+                         x=dest[0], y=dest[1], z=dest[2])
+            here = PI.pos(battle(host), uid)
+            if here:
+                n += act(host, client, driver, action="turn", unit=uid,
+                         x=here[0] + 2, y=here[1] + 2, z=here[2])
+            n += act(host, client, driver, action="kneel", unit=uid)
+    return n
+
+
+def close_side(host, client, turn_before, timeout=300):
+    """Both seats ready -> the executor commits -> the alien side runs -> a new
+    player side. Same shape as the PRD-P9 soak's."""
+    PE.hush(host, client)
+    for gc in (host, client):
+        if not parallel(gc)["localReady"]:
+            PE.arm(gc)
+    poll(lambda: parallel(host)["allReady"] is True
+         or battle(host).get("turn") != turn_before
+         or not parallel(host)["localReady"], 30, 0.2)
+    turn = PE.wait_side(host, client, turn_before, timeout=timeout)
+    assert turn, (
+        f"the side never closed with both seats ready: host={parallel(host)} "
+        f"client={parallel(client)}, host top={TW.top(host)} "
+        f"client top={TW.top(client)}")
+    PI.settle(host, client, 3)
+    poll(lambda: battle(host).get("battleInit") and battle(client).get("battleInit"),
+         60, 0.5)
+    idle(host)
+    return turn
+
+
+def skew_unit_down(host, client):
+    """Put ONE live X-Com unit down on the CLIENT alone and prove it took.
+
+    A bare `setCoopStatus` - nothing in the co-op protocol replicates it - so the
+    client's `unitsCore` bucket moves and the host's does not. Returns the unit
+    id, or None when the fixture has nobody spare."""
+    settle_display(host, client)
+    alive = [u for u in battle(client)["units"]
+             if not u["isOut"] and u.get("faction") == 0]
+    if len(alive) < 2:
+        return None
+    victim = alive[-1]["id"]
+    before = session.sync_buckets(client)["unitsCore"]
+    r = client.cmd({"cmd": "battle_intent", "unit": victim, "action": "turn",
+                    "status": WIRE_STATUS_DEAD, "dry": True})
+    if not (r.get("ok") and r.get("status") == WIRE_STATUS_DEAD):
+        return None
+    if not poll(lambda: session.sync_buckets(client)["unitsCore"] != before, 15):
+        return None
+    return victim
+
+
+# ---- 1. clean + coverage ---------------------------------------------------
+
+def scenario_clean(host, client, hmover, cmover):
+    print("-- 1: a clean battle - the loop closes and every seq family is covered --")
+    reset_sync(host, client)
+
+    n = drive_mixed(host, client, hmover, cmover, want=20)
+    assert n >= 12, (
+        f"only {n} action(s) were admitted; the fixture refused too many for this "
+        f"scenario to say anything about coverage")
+    settle_display(host, client)
+    # strict: PRD-I0 scenario 1 asks for ZERO mismatches on a clean battle. Six of
+    # the seven buckets deliver that over ~20 mixed actions - asserted so a
+    # regression in any of them is a test failure today.
+    #
+    # `unitsStats` is the seventh, and its clean-fixture residual is now CLOSED, so
+    # this compare is strict with NO allowance. Three seams were retired to get here:
+    # (1) the DIRECT-DAMAGE morale half (a reaction hit's victim keeping its pre-hit
+    # morale until next_turn) fixed by shipping morale/energy/mana/tu on `hit_unit`
+    # (296c3b22c); (2) the BYSTANDER morale half (checkForCasualties changing EVERY
+    # living unit's morale on a casualty the thin client never runs) fixed by shipping
+    # every living unit's absolute morale on the death packets (SEAM-4) - proven ZERO
+    # by scenario_casualty_morale below; (3) the WALK-INDUCED STAND-UP replication gap
+    # (PRD-I3, this session) - the residual that had kept allow=("unitsStats",).
+    #
+    # The SEAM-4-era note called (3) an "instant-kind kneel action_done sampling
+    # transient at the CLIENT kneel seqs". That attribution was WRONG. A host+client
+    # per-seq trace showed the mismatches land at the WALK and TURN seqs that PRECEDE
+    # a kneel, and the diverging field is the KNEELING BIT, not tu (tu matched
+    # exactly). Root cause: UnitWalkBState::init stands a kneeled unit up on its first
+    # step (BattlescapeGame::kneel), a kneel-bit mutation that shipped on NO packet -
+    # only the explicit BA_KNEEL path sends `coopSendKneelPacket`. So the executor's
+    # unit stood up (k0) while the client's stayed kneeled (k1) for the whole move+turn,
+    # healing only when the next explicit kneel re-applied the bit (which is why the
+    # at-rest bucket was always EQUAL - the drive ends each unit on a kneel). The kneel
+    # packet applies promptly (seq 0, consumed at gate depth 0); it HEALS the seam, it
+    # never caused it. FIX: `abortPath` (the walk closer) now carries the actor's
+    # absolute post-walk `kneeled` bit, applied on the parallel non-host machine only.
+    sc = session.assert_sync_clean(host, client, "after the player actions",
+                                   strict=True, allow=())
+    print(f"    {n} player chains driven; compares={sc['compares']} "
+          f"kinds={sc['comparedKinds']} sweep={sc['sweepUs']}us")
+    # SEAM-1 diagnostic: name the KIND of every unitsStats mismatch, so the
+    # per-action unitsStats drift can be attributed (kneel vs walk/turn).
+    us_ms = [(m["seq"], m["kind"]) for m in sc.get("mismatches", [])
+             if m["bucket"] == "unitsStats"]
+    print(f"    unitsStats mismatch (seq,kind) over player actions: {us_ms}")
+    # PRD-I2: saveBlob is BOUNDARY-only. No side has closed since reset_sync, so it
+    # must have zero comparisons/mismatches here; a non-zero count would mean it
+    # fired on a per-action report, which it must never do.
+    assert sc["buckets"]["saveBlob"]["mismatchCount"] == 0, (
+        f"saveBlob moved over PLAYER ACTIONS with no boundary crossed "
+        f"({sc['buckets']['saveBlob']}) - the save-derived hash is computed and "
+        f"compared only at side boundaries")
+
+    turn_before = battle(host).get("turn")
+    turn = close_side(host, client, turn_before)
+    settle_display(host, client)
+    # Same allowance across the boundary, and here there is a second known reason
+    # for it on top of the per-action one: both machines run their OWN
+    # prepareNewTurn (TU regeneration, stun recovery, fatal-wound bleed) and the
+    # boundary marker lands somewhere inside that window on each. The other six
+    # buckets are still asserted, including across a full alien side.
+    sc = session.assert_sync_clean(
+        host, client, f"after the alien side of turn {turn_before}", strict=True,
+        allow=("unitsCombat", "unitsRegen", "saveBlob"))
+    # PRD-I2 BURN-IN: saveBlob is the whole-save superset, so it moves at a
+    # clean boundary whenever ANY report-only bucket it subsumes does
+    # (unitsStats via prepareNewTurn, smoke decay, the tile FOW/UFO-door bits
+    # inside binTiles). Expected, and I3's remit - recorded here, not chased.
+    print(f"    saveBlob report-only count over the clean boundary: "
+          f"{sc['buckets']['saveBlob']['mismatchCount']} (subsumes "
+          f"unitsStats/smoke/FOW seams - PRD-I3 burn-in data)")
+
+    # COVERAGE, not silence. Each of these is a seq family PRD-I0 had to CREATE;
+    # if the extension did not take, the family simply never appears and a bare
+    # zero-mismatch assertion would pass with the alien side unwatched.
+    kinds = sc["comparedKinds"]
+    assert kinds.get("ai", 0) > 0, (
+        f"no AI-side chain was ever compared ({kinds}) - `_actionSeq` is still a "
+        f"player-side counter, so the whole alien side is unattributable. The "
+        f"stamping point is BattlescapeGame::coopStampAiChain.")
+    assert kinds.get("endturn", 0) > 0, (
+        f"the side-close boundary pseudo-seq was never compared ({kinds}) - the "
+        f"`endturn` marker is not reaching the peer, or the peer is not answering "
+        f"it. Everything the endTurn phase group moves is unattributable.")
+    assert kinds.get("sidestart", 0) > 0, (
+        f"the side-start boundary pseudo-seq was never compared ({kinds}) - the "
+        f"marker armed in NextTurnState::close is not being shipped/answered.")
+    assert any(k not in ("ai", "endturn", "sidestart") for k in kinds), (
+        f"not one PLAYER chain was compared ({kinds}) - the per-action half of "
+        f"the detector is not running at all")
+    assert sc["staleReports"] == 0, (
+        f"{sc['staleReports']} peer report(s) found no ring entry. Every one is a "
+        f"comparison that silently did not happen; the (side_seq, seq) key is "
+        f"what should make that impossible: {sc}")
+
+    print(f"PASS 1: turn cycled to {turn}; {sc['compares']} chains compared "
+          f"{kinds}, loop closed at seq {sc['lastComparedSeq']}/{sc['lastSeq']} "
+          f"(boundary {sc['lastComparedBoundarySeq']}/{sc['lastBoundarySeq']}), "
+          f"0 dropped, 0 stale")
+    mism = counts(sc)
+    if any(mism.values()):
+        print(f"    NOTE: report-only buckets that moved over the clean turn: "
+              f"{ {k: v for k, v in mism.items() if v} } - see the run report; "
+              f"these are the PRD-I3 burn-in candidates, not test failures")
+    return sc
+
+
+# ---- SEAM-1. kneel-burst: the kneel replay packet must ship its cost --------
+
+def _saveblob_text_diff(host, client, max_lines=16):
+    import difflib
+    ht = host.cmd({"cmd": "save_blob", "text": True}).get("text", "").splitlines()
+    ct = client.cmd({"cmd": "save_blob", "text": True}).get("text", "").splitlines()
+    out = [l for l in difflib.unified_diff(ht, ct, lineterm="", n=1)
+           if l[:1] in "+-" and not l.startswith(("+++", "---"))]
+    return out[:max_lines]
+
+
+def _burst_toggles(host, client, hmover, cmover, rounds=6):
+    """Plain move->turn->kneel on BOTH a host unit (MODE 1, classic replay) and a
+    client-intent unit (MODE 2, host-executed intent broadcast). With MATCHING
+    (default) reserves the kneel charge is a deterministic constant (kneel cost
+    4 down / 8 up), so both peers reach the same answer and this phase is clean
+    by construction - it exercises the happy path of both receive modes.
+
+    settle_display after each kneel is the I0 comparison discipline: driving the
+    next action before the CLIENT has quiesced lets the detector sample its
+    action_done hash mid-drain, a transient "red that means nothing" (session.py
+    settle_display), which is exactly what makes an un-settled burst intermittent.
+    Settled, the happy path is reliably zero."""
+    toggles = 0
+    for _ in range(rounds):
+        for driver, uid in ((host, hmover), (client, cmover)):
+            if uid is None:
+                continue
+            PI.top_up(host, client, uid)
+            dest = PI.step_dest(host, client, uid)
+            if dest:
+                act(host, client, driver, action="move", unit=uid,
+                    x=dest[0], y=dest[1], z=dest[2])
+            here = PI.pos(battle(host), uid)
+            if here:
+                act(host, client, driver, action="turn", unit=uid,
+                    x=here[0] + 2, y=here[1] + 2, z=here[2])
+            toggles += act(host, client, driver, action="kneel", unit=uid)
+            settle_display(host, client)
+    return toggles
+
+
+def _reserve_mismatch_kneel(host, client, uid):
+    """Deterministically drive SEAM-1: a host kneel whose peer copy re-decides
+    against a DIFFERENT reserve and refuses it.
+
+    In parallel mode battle_reserve does NOT replicate (BattlescapeState::
+    coopSendReserveState early-returns while parallelTurnActive), so a client-only
+    "aimed" reserve is a real per-machine reserve mismatch. With the actor's TU
+    set just inside the refuse window [aimedCost, aimedCost + kneelCost), the
+    host (no reserve) kneels and charges, while the client (aimed reserve) fails
+    checkReservedTU and does NEITHER - so tu AND the kneeling bit diverge at the
+    kneel seq. This is the exact seam clean play only hits intermittently."""
+    if uid is None:
+        return {"set_up": False, "why": "no host driver"}
+    q = host.cmd({"cmd": "battle_intent", "unit": uid, "action": "shoot",
+                  "mode": "aimed", "dry": True})
+    aimed = q.get("tuCost", 0) or 0
+    if aimed <= 8:
+        return {"set_up": False, "why": f"no usable aimed reserve (tuCost={aimed})"}
+    target_tu = aimed + 2  # inside [aimed, aimed+kneelCost) for kneelCost in {4,8}
+    for gc in (host, client):
+        gc.cmd({"cmd": "battle_intent", "unit": uid, "action": "turn",
+                "tu": target_tu, "dry": True})
+    client.cmd({"cmd": "battle_reserve", "mode": "aimed"})
+    host.cmd({"cmd": "battle_reserve", "mode": "none"})
+    hr = host.cmd({"cmd": "battle_reserve"}).get("reserve")
+    cr = client.cmd({"cmd": "battle_reserve"}).get("reserve")
+    before = len(kneel_stats_mismatches(sync(host)))
+    n = act(host, client, host, action="kneel", unit=uid)   # MODE 1: host kneels
+    settle_display(host, client)
+    sc = sync(host)
+    after = kneel_stats_mismatches(sc)
+    diffs = unit_stat_diff(host, client)
+    client.cmd({"cmd": "battle_reserve", "mode": "none"})    # restore
+    PI.top_up(host, client, uid)
+    return {"set_up": n > 0, "aimed": aimed, "target_tu": target_tu,
+            "host_reserve": hr, "client_reserve": cr,
+            "reproduced": len(after) > before, "kneel_ms": len(after),
+            "seq": (after[-1]["seq"] if len(after) > before else None),
+            "diffs": diffs}
+
+
+def scenario_kneel_burst(host, client, hmover, cmover):
+    """PRD-I3 SEAM-1: the kneel replay packet must ship the actor's cost.
+
+    Both receive modes emit the SAME `kneel {id}` packet (BattlescapeGame::
+    coopSendKneelPacket) into the SAME peer handler; the seam is that the packet
+    carried no tu/energy, so the peer re-ran BattlescapeGame::kneel() and
+    re-decided. Two phases: (A) a default-reserve happy-path burst that is clean
+    by construction, and (B) a DETERMINISTIC reserve mismatch that forces the
+    peer to re-decide differently - the reliable red/green discriminator."""
+    print("-- SEAM-1: the kneel replay packet must ship the actor's cost --")
+
+    # Phase A: happy path, both modes, matching reserves.
+    reset_sync(host, client)
+    tog = _burst_toggles(host, client, hmover, cmover, rounds=6)
+    settle_display(host, client)
+    scA = sync(host)
+    kkA = scA["comparedKinds"].get("kneel", 0)
+    ksA = kneel_stats_mismatches(scA)
+    print(f"    [A: default reserves] {tog} kneels, comparedKinds kneel={kkA}, "
+          f"kneel-kind unitsStats mismatches={len(ksA)}")
+    if len(ksA) > 0:
+        print(f"    [A-diag] kneel-kind mismatch seqs={sorted({m['seq'] for m in ksA})}; "
+              f"all unitsStats mismatches={[(m['seq'], m['kind']) for m in scA.get('mismatches', []) if m['bucket']=='unitsStats']}")
+        print(f"    [A-diag] end-of-phase per-unit stat diff={unit_stat_diff(host, client)}")
+        print(f"    [A-diag] end-of-phase saveblob text diff={_saveblob_text_diff(host, client)}")
+    assert kkA > 0, (
+        f"phase A drove {tog} kneels but the detector compared no kneel kinds "
+        f"({scA['comparedKinds']}) - the discriminator is not exercising kneels")
+
+    # Phase B: deterministic reserve mismatch (the reliable discriminator).
+    reset_sync(host, client)
+    r = _reserve_mismatch_kneel(host, client, hmover)
+    print(f"    [B: reserve mismatch] {r}")
+
+    if KNEEL_STRICT:
+        assert len(ksA) == 0, (
+            f"SEAM-1: {len(ksA)} kneel-kind unitsStats mismatch(es) on the "
+            f"default-reserve happy path (seqs "
+            f"{sorted({m['seq'] for m in ksA})})")
+        if r.get("set_up") and r.get("reproduced") is not None:
+            assert r.get("kneel_ms", 0) == 0, (
+                f"SEAM-1 NOT CLOSED: the reserve-mismatch host kneel still left "
+                f"{r['kneel_ms']} kneel-kind unitsStats mismatch(es) at seq "
+                f"{r['seq']} (diffs {r['diffs']}). The peer is not mirroring the "
+                f"executor's kneel cost/state.")
+            print("PASS SEAM-1: reserve-mismatch host kneel left zero kneel-kind "
+                  "unitsStats drift (peer mirrored the executor)")
+        else:
+            print(f"    NOTE: reserve-mismatch phase could not set up "
+                  f"({r.get('why')}); phase A clean is the only assertion")
+    else:
+        print(f"    [SEAM1_KNEEL_STRICT=0] baseline print-only: phase-A "
+              f"kneel-kind={len(ksA)}, phase-B reproduced={r.get('reproduced')} "
+              f"kneel_ms={r.get('kneel_ms')}")
+    return scA
+
+
+# ---- 2 + 3. AI-side and boundary attribution -------------------------------
+
+def scenario_ai_and_boundary(host, client, hmover, cmover):
+    """PRD-I3 Session C: unitsCore is ALARM-promoted AND side-gated - compared at
+    player-side per-action seqs + sidestart, SKIPPED at the alien ai/expl seqs and
+    the alien-side endturn boundary (where the D-lite client replay of the host
+    alien turn legitimately lags the host authoritative death/damage resolution).
+    Two proofs from one one-sided liveness skew:
+
+      (A) ALARM ROUTE. The skew, present at a PLAYER-side action seq the gate keeps
+          strict, is compared - and because unitsCore is now ARMED it latches
+          battleDesyncSeen and writes one PRD-I4 bundle (the P2 tripwire path).
+      (B) SIDE-GATE. The same skew carried across a WHOLE alien side records NO
+          unitsCore mismatch at the ai/expl seqs or the endturn boundary (the skips
+          fired) and next_turn repairs it by sidestart - so the promotion never
+          false-alarms on the alien-side display window that kept unitsCore report-only.
+    """
+    print("-- 2: unitsCore ALARM route (player seq) + alien-side side-gate --")
+
+    # (A) POSITIVE ALARM ROUTE at a player-side seq --------------------------
+    reset_sync(host, client)
+    assert sync(host)["buckets"]["unitsCore"]["alarm"] is True, (
+        "unitsCore is not ARMED; this positive alarm-route proof is written "
+        "against the PRD-I3 Session-C promotion")
+    victim = skew_unit_down(host, client)
+    assert victim, (
+        "could not put a unit down on the client alone - the lever is dead, so "
+        "the alarm-route proof would be vacuous")
+    hb = session.sync_buckets(host)["unitsCore"]
+    cb = session.sync_buckets(client)["unitsCore"]
+    assert hb != cb, (
+        f"the one-sided status write left the machines agreeing on unitsCore "
+        f"({hb} vs {cb}) - it replicated, so there is nothing to detect")
+    print(f"    unit {victim} put down on the client alone (unitsCore host={hb} "
+          f"client={cb})")
+    # Drive ONE host player action while the skew is live: a walk seq is a
+    # PLAYER-side per-action seq the side-gate KEEPS, so the compare names unitsCore
+    # and - now ARMED - latches the desync flag.
+    PI.top_up(host, client, hmover)
+    dest = PI.step_dest(host, client, hmover)
+    assert dest, f"the host driver {hmover} cannot step to carry the compare"
+    assert act(host, client, host, action="move", unit=hmover,
+               x=dest[0], y=dest[1], z=dest[2]), \
+        "the host walk was not admitted, so no player seq carries the skew"
+    settle_display(host, client)
+    assert poll(lambda: TW.desync_seen(host), 30), (
+        "the ARMED unitsCore skew at a PLAYER-side seq did NOT latch "
+        "battleDesyncSeen - either the promotion is inert or the side-gate wrongly "
+        "skipped a player seq")
+    assert battle(host).get("desyncReportWritten") is True, (
+        "the unitsCore alarm latched but wrote no PRD-I4 bundle (one per battle)")
+    scp = sync(host)
+    core_player = [m for m in scp["mismatches"] if m["bucket"] == "unitsCore"
+                   and not m["boundary"] and m["kind"] not in ("ai", "expl")]
+    core_named = [(m["seq"], m["kind"]) for m in scp["mismatches"] if m["bucket"] == "unitsCore"]
+    assert core_player, (
+        f"the unitsCore alarm did not name a player-side per-action seq: {core_named}")
+    print(f"PASS alarm route: ARMED unitsCore skew at player seq "
+          f"{core_player[0]['seq']} (kind={core_player[0]['kind']!r}) LATCHED "
+          f"battleDesyncSeen and wrote one PRD-I4 bundle")
+
+    # LATCH-POLLUTION: the desync latch + one-per-battle bundle flag are sticky for
+    # the whole battle, so clear them RIGHT HERE - otherwise every later sequential
+    # scenario runs pre-latched (scenario 4 report-only negative control reads it).
+    reset_sync(host, client)
+
+    # (B) SIDE-GATE across a whole alien side --------------------------------
+    # The unit is still down on the client (reset_sync clears counters, not state).
+    # Carry it across the alien side: the ai/expl seqs and the endturn boundary must
+    # SKIP unitsCore (the skips move, no alarm), and next_turn heals it by sidestart.
+    turn_before = battle(host).get("turn")
+    turn = close_side(host, client, turn_before)
+    settle_display(host, client)
+    sc = sync(host)
+    ms = sc["mismatches"]
+
+    assert (sc.get("unitsCoreAlienSkips", 0) > 0
+            or sc.get("unitsCoreEndturnSkips", 0) > 0), (
+        f"neither unitsCore side-gate counter moved over a whole side - the gate "
+        f"never engaged: alienSkips={sc.get('unitsCoreAlienSkips')} "
+        f"endturnSkips={sc.get('unitsCoreEndturnSkips')} kinds={sc.get('comparedKinds')}")
+    gated = [m for m in ms if m["bucket"] == "unitsCore"
+             and (m["kind"] in ("ai", "expl")
+                  or (m["boundary"] and m["kind"] == "endturn"))]
+    assert not gated, (
+        f"a unitsCore mismatch was recorded at an alien ai/expl/endturn seq despite "
+        f"the side-gate - the skip did not hold: {gated}")
+    assert not TW.desync_seen(host), (
+        "the side-gated alien-side liveness skew latched the ALARM - the ai/expl/"
+        "endturn skip did not hold, so the promotion would false-alarm on the "
+        "alien-side death/damage display window")
+    print(f"PASS side-gate: the alien-side liveness skew took "
+          f"{sc.get('unitsCoreAlienSkips')} ai/expl + {sc.get('unitsCoreEndturnSkips')} "
+          f"endturn unitsCore skips, recorded NO unitsCore alarm, and did not latch")
+
+    # PRD-I3 saveBlob endturn straddle (unchanged): the same next_turn-repaired
+    # unit-down skew is live only across the ENDTURN boundaries and gone by sidestart,
+    # so saveBlob (SIDESTART-only) must not surface a boundary mismatch, and the
+    # endturn exclusion must have fired. Independent of the unitsCore side-gate.
+    # PRD-I3 saveBlob endturn straddle: saveBlob is SIDESTART-only; the endturn
+    # exclusion must have fired over this side close. The SIDESTART sample itself can
+    # carry a report-only casualty-diary residual from an alien-side kill (PRD-I2 known
+    # saveBlob straddle), so the proof is the ENDTURN exclusion, not strict sidestart-
+    # clean; the unit-down skew own healing is proven by the unitsCore poll above.
+    assert sc.get("saveBlobEndturnSkips", 0) > 0, (
+        f"saveBlobEndturnSkips=0 - the endturn saveBlob exclusion never fired over "
+        f"this side boundary: kinds={sc.get('comparedKinds')}")
+    sblob_endturn = [m for m in ms if m["bucket"] == "saveBlob"
+                     and m["boundary"] and m["kind"] == "endturn"]
+    assert not sblob_endturn, (
+        f"saveBlob surfaced an ENDTURN boundary mismatch {sblob_endturn} despite the "
+        f"endturn exclusion - the SIDESTART-only compare is not engaged")
+    # (saveBlob is now ALARM-promoted - Session F; the endturn-exclusion property is
+    # independent of its alarm status, so no report-only assertion here any more.)
+    print(f"PASS I2 (sidestart-only): saveBlob endturn-excluded "
+          f"(saveBlobEndturnSkips={sc.get('saveBlobEndturnSkips')}); the endturn "
+          f"boundary carried no saveBlob mismatch")
+
+    # `next_turn` repairs the bare status write, so the battle is left clean for the
+    # item scenario. Prove it rather than assume it.
+    poll(lambda: session.sync_buckets(host)["unitsCore"]
+         == session.sync_buckets(client)["unitsCore"], 30)
+
+    # (C) REPORT-ONLY NEGATIVE CONTROL (all-promoted: the debug override) ------
+    # A REPORT-ONLY bucket red must NOT route to the alarm - the isAlarm gate
+    # discriminates. With ALL TEN buckets now PROMOTED there is no naturally report-only
+    # bucket left, so the Session-F `force_report_only` lever forces items + itemIdCtr
+    # (the two an item mint skews) back to report-only ON THE HOST (the executor holds the
+    # alarm gate). Mint an item on the client alone, drive a host KNEEL (a player-side seq
+    # the gate keeps; SEAM-1 mirrors the kneel so it adds no promoted-bucket divergence),
+    # and prove the reds are logged + counted but leave battleDesyncSeen FALSE. Restore the
+    # override after. Done in the clean pre-casualty context - scenario_red_bucket carries
+    # the kill_unit_real victim-artifact that would pollute a global desyncSeen check there.
+    reset_sync(host, client)
+    settle_display(host, client)
+    for b in ("items", "itemIdCtr"):
+        r = host.cmd({"cmd": "save_blob", "report_only_bucket": b, "report_only_on": True})
+        assert r.get("report_only_matched"), f"report-only override for {b} failed: {r}"
+    ilive = [u["id"] for u in battle(client)["units"]
+             if not u.get("isOut") and u.get("faction") == 0]
+    assert ilive, "no live X-Com unit is left for the items negative control"
+    before_i = session.sync_buckets(client)["items"]
+    give = client.cmd({"cmd": "battle_give", "unit": ilive[0],
+                       "item": "STR_STUN_ROD", "slot": "ground"})
+    assert give.get("ok"), f"could not mint the items skew: {give}"
+    assert session.sync_buckets(client)["items"] != before_i, (
+        "the item mint did not move the client items bucket - the lever is dead")
+    PI.top_up(host, client, hmover)
+    assert act(host, client, host, action="kneel", unit=hmover), (
+        "the host kneel was not admitted, so no player seq carries the items compare")
+    settle_display(host, client)
+    sci = sync(host)
+    assert sci["buckets"]["items"]["alarm"] is False, (
+        "force_report_only did not take: items still reads ALARM in the bucket table")
+    items_named = [m for m in sci["mismatches"] if m["bucket"] in ("items", "itemIdCtr")]
+    assert items_named, (
+        f"the items skew produced no items/itemIdCtr mismatch to route-test: {sci['mismatches']}")
+    assert not TW.desync_seen(host), (
+        f"a REPORT-ONLY-overridden items/itemIdCtr red routed to the ALARM "
+        f"(battleDesyncSeen latched) - the override/isAlarm gate is not discriminating: "
+        f"{session._sync_mismatch_lines(sci)}")
+    print(f"PASS routing (override negative control): the items red at seq "
+          f"{items_named[0]['seq']} (kind={items_named[0]['kind']!r}) was logged + counted "
+          f"but did NOT latch battleDesyncSeen (report-only-forced buckets never route)")
+    for b in ("items", "itemIdCtr"):  # restore the promoted state
+        host.cmd({"cmd": "save_blob", "report_only_bucket": b, "report_only_on": False})
+    # HEAL: mint the SAME item on the HOST so both item-id counters advance in step -
+    # a lone client mint left itemIdCtr client-ahead, which desyncs a later both-
+    # machines battle_give (STR_SMOKE_GRENADE). battle_give is a local test lever (not
+    # replicated), so host id N == client id N and the items skew closes as well.
+    hgive = host.cmd({"cmd": "battle_give", "unit": ilive[0],
+                      "item": "STR_STUN_ROD", "slot": "ground"})
+    assert hgive.get("ok"), f"could not re-sync the item counter on the host: {hgive}"
+    settle_display(host, client)
+    reset_sync(host, client)
+    return sc
+
+
+# ---- 4. the red bucket, and the RIGHT seq ----------------------------------
+
+def scenario_red_bucket(host, client, hmover, cmover):
+    """Runs LAST: the lever mints an item on one machine only and nothing repairs
+    that, so everything after it would be measured on a permanently skewed
+    battle."""
+    print("-- 4: a one-sided item mint names `items` at the seq of the next action --")
+    reset_sync(host, client)
+    settle_display(host, client)
+    # SESSION F: items/itemIdCtr/saveBlob are now PROMOTED. This scenario is the
+    # ATTRIBUTION + sidestart-superset proof (report-only-class claims about what the
+    # buckets RECORD; the alarm ROUTING is proven separately in the scenario-4 negative
+    # control). Force the three report-only via the debug lever so a permanent skew does
+    # not latch the desync route mid-proof. Runs last, so no restore needed.
+    for b in ("items", "itemIdCtr", "saveBlob"):
+        host.cmd({"cmd": "save_blob", "report_only_bucket": b, "report_only_on": True})
+
+    innocent_before = session.sync_buckets(host)
+    # `slot: ground` drops the item on the CARRIER'S TILE, so the carrier has to
+    # be a unit that still has one - a casualty has been unlinked from its tile
+    # and the lever refuses ("unit has no tile"), which reads like a sync-check
+    # failure and is not one.
+    hosts_live = {u["id"] for u in battle(host)["units"] if not u.get("isOut")}
+    live = [u["id"] for u in battle(client)["units"]
+            if not u.get("isOut") and u.get("faction") == 0 and u["id"] in hosts_live]
+    assert live, (
+        f"no live X-Com unit is left on both machines to hang the item lever on: "
+        f"{[(u['id'], u.get('faction'), u.get('isOut')) for u in battle(client)['units']]}")
+    victim = live[0]
+    skew = client.cmd({"cmd": "battle_give", "unit": victim,
+                       "item": "STR_STUN_ROD", "slot": "ground"})
+    assert skew.get("ok"), f"could not skew the client (unit {victim}): {skew}"
+    hb, cb = session.sync_buckets(host), session.sync_buckets(client)
+    assert hb["items"] != cb["items"], (
+        f"the injected mint did not move the client's `items` bucket "
+        f"({hb['items']} vs {cb['items']}) - the lever is dead")
+    print(f"    minted item {skew.get('weaponId')} on the client alone")
+
+    # The mint moves nothing but the item family, on the client's own copy. If it
+    # had touched a unit or a tile, the exclusivity assertion further down would
+    # be measuring the lever rather than the buckets.
+    for name in ITEM_LEVER_INNOCENT:
+        assert cb[name] == innocent_before[name], (
+            f"the item lever moved the client's {name!r} bucket "
+            f"({innocent_before[name]} -> {cb[name]}) - it is not item-exclusive, "
+            f"so the attribution proof below would be vacuous")
+
+    before = counts(sync(host))
+    PI.top_up(host, client, hmover)
+    dest = PI.step_dest(host, client, hmover)
+    assert dest, f"the host driver {hmover} cannot step anywhere to carry the seq"
+    seq0 = parallel(host)["actionSeq"]
+    assert act(host, client, host, action="move", unit=hmover,
+               x=dest[0], y=dest[1], z=dest[2]), \
+        "the host's walk was not admitted, so no seq carries the skew"
+    seq = parallel(host)["actionSeq"]
+    settle_display(host, client)
+
+    assert poll(lambda: delta(before, counts(sync(host))), 30), (
+        f"the host never reported a mismatch for the injected item skew "
+        f"(actionSeq {seq0} -> {seq}): {sync(host)}")
+    sc = sync(host)
+    moved = delta(before, counts(sc))
+    assert "items" in moved, (
+        f"the item skew was detected but not attributed to the `items` bucket: "
+        f"{moved}")
+    for name in ITEM_LEVER_INNOCENT:
+        assert name not in moved, (
+            f"an item-only divergence moved the {name!r} bucket as well ({moved}) "
+            f"- the buckets are not independent, so naming one means nothing")
+    print(f"PASS 4a: the `items` bucket was named and "
+          f"{'/'.join(ITEM_LEVER_INNOCENT)} stayed quiet ({moved})")
+    assert "saveBlob" not in moved, (
+        f"the per-action item lever moved saveBlob ({moved}) with no boundary "
+        f"crossed - the save-derived hash must be boundary-only")
+
+    named = [m for m in sc["mismatches"]
+             if m["bucket"] == "items" and not m["boundary"]]
+    assert named, f"no non-boundary `items` mismatch was recorded: {sc['mismatches']}"
+    seqs = sorted({m["seq"] for m in named})
+    assert seq in seqs, (
+        f"the mismatch was attributed to seq(s) {seqs}, not to the action that "
+        f"actually carried it (actionSeq {seq0} -> {seq}). Attribution to the "
+        f"wrong seq is worse than none: it points a bisect at an innocent action.")
+    kind = [m["kind"] for m in named if m["seq"] == seq][0]
+    print(f"PASS 4b: named at seq {seq} (kind={kind!r}), which is exactly the "
+          f"chain admitted after the skew")
+
+    # PRD-I3 saveBlob SIDESTART BACKSTOP: saveBlob now compares at SIDESTART only, so
+    # its superset guarantee must be proven THERE. Unlike the next_turn-repaired
+    # unit-down skew in scenario 2+3, this minted ground item is PERSISTENT (nothing
+    # re-ships item state across next_turn), so it is still diverged at the sidestart
+    # boundary. Close a full side and assert the fast `items` bucket AND the
+    # save-derived `saveBlob` BOTH name it at sidestart - the proof that a divergence
+    # a fast bucket catches at sidestart can never slip past the boundary superset.
+    reset_sync(host, client)
+    turn_before = battle(host).get("turn")
+    close_side(host, client, turn_before)
+    settle_display(host, client)
+    scb = sync(host)
+    assert scb.get("saveBlobSidestartCompares", 0) > 0, (
+        f"saveBlobSidestartCompares=0 - saveBlob never compared at a sidestart "
+        f"boundary over this side close, so the backstop below is vacuous: "
+        f"kinds={scb.get('comparedKinds')}")
+    side_items = [m for m in scb["mismatches"]
+                  if m["bucket"] == "items" and m["boundary"] and m["kind"] == "sidestart"]
+    side_blob = [m for m in scb["mismatches"]
+                 if m["bucket"] == "saveBlob" and m["boundary"] and m["kind"] == "sidestart"]
+    assert side_items, (
+        f"the persistent item skew did not surface `items` at the sidestart boundary "
+        f"- the fast-bucket premise of the sidestart backstop is missing: "
+        f"{sorted({(m['bucket'], m['kind']) for m in scb['mismatches'] if m['boundary']})}")
+    assert side_blob, (
+        f"the persistent item skew flipped `items` at sidestart but NOT `saveBlob` - "
+        f"the save-derived backstop missed a divergence a fast bucket caught at "
+        f"sidestart, which defeats its whole purpose: {scb['mismatches']}")
+    assert scb["buckets"]["saveBlob"]["alarm"] is False, (
+        "force_report_only did not take: saveBlob still reads ALARM in the bucket table")
+    print(f"PASS I2 sidestart backstop: `items` and `saveBlob` both named at the "
+          f"sidestart boundary seq {side_blob[0]['seq']} (report-only via override)")
+    return sc
+
+
+# ---- 5. SEAM-2 + straddle: boundary tile decay is host-authoritative -------
+
+def scenario_smoke(host, client, hmover, cmover):
+    """PRD-I3 SEAM-2 discriminator, re-scoped 2026-08-10 (deterministic smoke).
+
+    Primes (fuse 0) and throws several STR_SMOKE_GRENADEs, then closes a full
+    side so the boundary tile-decay phase runs on both machines. Pre-fix the
+    parallel client's ungated SavedBattleGame::prepareNewTurn SPREADS smoke while
+    its DECREMENT is host-gated, and the endturn boundary is hashed against a decay
+    the host flush races - so smoke/fire diverge at a BOUNDARY.
+
+    SEAM-2 fix, both halves: HALF 1 EXCLUDES the smoke/fire buckets from the ENDTURN
+    boundary compare (that hazard sample is ill-defined - all decay runs once per
+    cycle at neutral->player AFTER both endturn boundaries are armed); SIDESTART
+    (hash-after-apply of next_turn) keeps them and must be EQUAL. HALF 2 tags the decay
+    set_smoke_tile/set_fire_tile with `bnd` so they ride the ORDERED gate (apply in
+    FIFO after the ai chains, before next_turn), so decay-driven ai-seq smoke is
+    structurally 0.
+
+    STRICT asserts the re-scoped SEAM-2 remit: no BOUNDARY smoke/fire divergence, the
+    endturn exclusion fired (endturnHazardSkips>0), and sidestart still compared the
+    hazards (sidestartHazardCompares>0). PRD-I3 SEAM-7/8/9: unitsStats is split by
+    AUTHORSHIP - unitsCombat (CHAIN-authored ONLY: kneel/mc/w0..w5) is STRICT at ai
+    seqs (us_ai asserts it), unitsRegen (the DEFERRED/turn-machine set: tu/energy/mana/
+    morale AND health/stun/fire) is compared at SIDESTART only (the per-action +
+    endturn straddle); the ai-seq SMOKE residual is the
+    whitelisted mid-side EXPLOSION path and stays an ANNOTATED ALLOWANCE.
+    SEAM2_SMOKE_STRICT=0 takes the pre-fix red baseline print.
+    """
+    print("-- 5: SEAM-2 boundary tile decay is host-authoritative (Option B+A) --")
+    reset_sync(host, client)
+    thrown = 0
+    for i in range(6):
+        if not idle(host):
+            break
+        PI.top_up(host, client, cmover)
+        wid = PI.give_both(host, client, cmover, "STR_SMOKE_GRENADE")
+        if not wid:
+            break
+        if not act(host, client, client, action="prime", unit=cmover, fuse=0,
+                   weapon_id=wid):
+            continue
+        PI.top_up(host, client, cmover)
+        here = PI.pos(battle(host), cmover)
+        if here:
+            thrown += 1 if act(host, client, client, action="throw", unit=cmover,
+                               weapon_id=wid, x=here[0] + 1 + (i % 3),
+                               y=here[1] + 1 + (i // 3), z=here[2]) else 0
+        idle(host, 30)
+    settle_display(host, client)
+    assert thrown >= 2, (
+        f"only {thrown} smoke grenade(s) were thrown; the fixture refused too "
+        f"many for this scenario to place any smoke")
+
+    turn_before = battle(host).get("turn")
+    turn = close_side(host, client, turn_before)
+    settle_display(host, client)
+
+    haz = host.cmd({"cmd": "battle_tiles"})
+    smoke_tiles = haz.get("smokeTiles", 0)
+    assert smoke_tiles > 0, (
+        f"no smoke is on the map after the side ({haz}); the grenades never went "
+        f"off, so a clean smoke bucket below would prove nothing")
+
+    # non-strict: the loop must close and no ALARM bucket may fire; the report-only
+    # counts are printed and inspected per-attribution below.
+    sc = session.assert_sync_clean(
+        host, client, f"after a smoke-heavy alien side of turn {turn_before}",
+        strict=False, quiet=True)
+
+    ms = sc.get("mismatches", [])
+    saturated = len(ms) >= 32  # the ring keeps only the last 32; note if it wrapped
+    smoke_bnd = [(m["seq"], m["kind"]) for m in ms
+                 if m["bucket"] == "smoke" and m.get("boundary")]
+    fire_bnd = [(m["seq"], m["kind"]) for m in ms
+                if m["bucket"] == "fire" and m.get("boundary")]
+    smoke_ai = [m["seq"] for m in ms if m["bucket"] == "smoke" and not m.get("boundary")]
+    us_ai = [m["seq"] for m in ms if m["bucket"] == "unitsCombat" and not m.get("boundary")]
+    print(f"    smokeTiles={smoke_tiles} smoke bucket="
+          f"{sc['buckets']['smoke']['mismatchCount']} fire bucket="
+          f"{sc['buckets']['fire']['mismatchCount']} kinds={sc['comparedKinds']}")
+    print(f"    boundary smoke={smoke_bnd} boundary fire={fire_bnd}")
+    print(f"    HALF 1 introspection: endturnHazardSkips={sc.get('endturnHazardSkips')} "
+          f"sidestartHazardCompares={sc.get('sidestartHazardCompares')} "
+          f"smoke.compares={sc['buckets']['smoke'].get('compares')} "
+          f"fire.compares={sc['buckets']['fire'].get('compares')}")
+    print(f"    ai/player-seq residuals: smoke_ai={len(smoke_ai)} (STRICT 0 - SEAM-3 (a) closed) "
+          f"us_ai(unitsCombat)={len(us_ai)} (STRICT: must be 0 - SEAM-7 (i) closed)")
+    if SMOKE_STRICT:
+        assert not saturated, (
+            f"the {len(ms)}-deep mismatch ring wrapped in a single side, so a "
+            f"'clean boundary' read below could be hiding an evicted boundary "
+            f"mismatch - shorten the scenario or widen the ring before trusting it")
+        # HALF 1 + HALF 2: no BOUNDARY smoke/fire divergence. The endturn hazard buckets
+        # are EXCLUDED at the compare, so any boundary hazard here is a SIDESTART one,
+        # and next_turn is the sole author of the decay - so sidestart smoke/fire EQUAL.
+        assert not smoke_bnd and not fire_bnd, (
+            f"SEAM-2 NOT GREEN: smoke/fire diverged at a BOUNDARY "
+            f"(smoke {smoke_bnd}, fire {fire_bnd}). HALF 1 excludes smoke/fire from the "
+            f"endturn compare, so a boundary hazard here is a SIDESTART one; HALF 2 makes "
+            f"next_turn the sole author of the decay, so it must be EQUAL. A boundary "
+            f"smoke/fire mismatch means one of the two halves regressed.\n"
+            f"    {session._sync_mismatch_lines(sc)}")
+        # HALF 1 introspection: the endturn exclusion FIRED (smoke/fire UNCOMPARED at
+        # endturn) and the sidestart hazards were still compared (compared AND EQUAL).
+        assert sc.get("endturnHazardSkips", 0) > 0, (
+            f"HALF 1 NOT EXERCISED: endturnHazardSkips=0 - the endturn hazard exclusion "
+            f"never fired (no endturn boundary reached this side, or the exclusion is not "
+            f"engaged), so a clean boundary read proves nothing: kinds={sc.get('comparedKinds')}")
+        assert sc.get("sidestartHazardCompares", 0) > 0, (
+            f"HALF 1 INCOMPLETE: sidestartHazardCompares=0 - the sidestart boundary never "
+            f"compared smoke/fire, so 'sidestart compared and EQUAL' is vacuous")
+        endturn_haz = [(m["bucket"], m["seq"]) for m in ms
+                       if m.get("boundary") and m["kind"] == "endturn"
+                       and m["bucket"] in ("smoke", "fire")]
+        assert not endturn_haz, (
+            f"HALF 1 REGRESSED: an endturn boundary recorded a smoke/fire mismatch "
+            f"{endturn_haz} - the exclusion must leave those UNCOMPARED at endturn")
+        # PRD-I3 SEAM-7/8/9: unitsStats split by AUTHORSHIP. unitsRegen - the
+        # turn-machine/DEFERRED-authored set (tu/energy/mana/morale/health/stun AND fire
+        # since SEAM-9) - is compared at SIDESTART only (proven unitsRegenAiSkips > 0 for the
+        # per-action skips). unitsCombat is now CHAIN-authored ONLY (kneel/mc/w0..w5),
+        # each an executor absolute (kneel packet / mind-control / hit_unit's
+        # fatal-wound COUNTERS), so it is STRICT at every seq incl. ai. The SEAM-9 move took
+        # the dying-victim HEALTH bleed, the STUN recovery straddle, and (fire follow-up) the
+        # turn-decremented FIRE bit out of unitsCombat into the deferred set. So us_ai MUST be 0.
+        assert not us_ai, (
+            f"SEAM-9 REGRESSED: unitsCombat (kneel/mc/w0..w5 - all CHAIN-authored) "
+            f"diverged at ai/player seq(s) {us_ai}. health/stun/morale live in the deferred "
+            f"unitsRegen set (sidestart-only), so this is NOT the bleed/recovery/morale "
+            f"straddle - it is a genuinely chain-authored field (a wound counter, a "
+            f"mind-control flip, a kneel bit) reaching the client later than its "
+            f"per-seq hash. Capture the interleave.\n    {session._sync_mismatch_lines(sc)}")
+        # Decay smoke_ai is structurally 0 (HALF 2 gates the decay set_smoke_tile behind
+        # the ordered gate, so it applies in FIFO AFTER the ai chains, never at an ai
+        # seq). The remaining source WAS the whitelisted MID-SIDE EXPLOSION smoke on the
+        # out-of-chain (seq-0) path - an explosion running with no open admitted chain
+        # shipped its set_smoke_tile unstamped. SEAM-3 (a) closed that: a loose explosion
+        # now opens its own "expl" chain (coopStampLooseOutcomeChain), so its set_smoke_tile
+        # inherits that seq exactly like its destroy_tile and defers on the I1 gate. So
+        # smoke_ai is now STRICT 0 - the annotated allowance is retired.
+        assert not smoke_ai, (
+            f"SEAM-3 (a) / SEAM-7 smoke: smoke diverged at ai/player seq(s) {smoke_ai} - a "
+            f"mid-side explosion shipped set_smoke_tile out-of-chain (seq-0) and a lagging "
+            f"client folded it into an ai-seq hash. The loose-explosion 'expl' chain stamp "
+            f"should have carried the seq; capture whether the explosion ran with "
+            f"_openChainSeq==0 past ExplosionBState::init.\n    {session._sync_mismatch_lines(sc)}")
+    print(f"PASS 5: SEAM-2 re-scoped GREEN - boundary smoke/fire host-authoritative "
+          f"(endturn EXCLUDED, sidestart compared and EQUAL) over a smoke-heavy side "
+          f"(smokeTiles={smoke_tiles}); ai-seq unitsCombat={len(us_ai)} (STRICT 0), "
+          f"ai-seq explosion smoke={len(smoke_ai)} (STRICT 0 - SEAM-3 a)")
+    return sc
+
+
+# ---- SEAM-4. a casualty's bystander morale must replicate ------------------
+
+def scenario_casualty_morale(host, client, hmover, cmover):
+    """PRD-I3 SEAM-4: the death/stun BYSTANDER morale must ride the death packet.
+
+    BattlescapeGame::checkForCasualties applies a morale change to EVERY living unit
+    on any death/stun (the losing squad loses morale, the winning squad gains). A
+    parallel thin client never runs checkForCasualties for a kill it only DISPLAYS
+    (BattlescapeGame::coopDeath animates the death; a reaction-fire / alien-side kill
+    is never a local attack chain there), so pre-fix the whole squad's morale stays at
+    its pre-casualty value until next_turn's bulk re-ship one side later - a per-action
+    unitsStats(morale) divergence across every living bystander, and the residual that
+    kept scenario_clean's allow=("unitsStats",).
+
+    Deterministic discriminator: kill ONE PLAYER soldier on the HOST via kill_unit_real
+    (the faithful damage()+checkForCasualties path; the peer learns of the death only
+    through the coop death packets, exactly as in real play). The soldier's squadmates
+    are the LOSING squad, so their morale drops on the host; pre-fix that never reaches
+    the client. Post-fix the death packet ships every living unit's absolute morale, so
+    the unitsStats bucket and every bystander's morale match AT the casualty, with NO
+    boundary crossed (next_turn would otherwise mask it a side later).
+
+    A non-driver soldier is chosen so the drivers survive for scenario_red_bucket, and
+    only ONE alien-or-player is killed so the battle stays live (no auto-end)."""
+    print("-- SEAM-4: a casualty's bystander morale must ride the death packet --")
+    reset_sync(host, client)
+    settle_display(host, client)
+
+    # Baseline: the two machines must AGREE on unitsStats before the casualty, else a
+    # post-kill inequality would prove nothing.
+    hb = session.sync_buckets(host)["unitsStats"]
+    cb = session.sync_buckets(client)["unitsStats"]
+    assert hb == cb, (
+        f"unitsStats already diverged before the casualty (host {hb} client {cb}) - "
+        f"a carried-over skew, so this discriminator cannot isolate the bystander "
+        f"morale: {unit_stat_diff(host, client)}")
+
+    halive = [u for u in battle(host)["units"] if not u.get("isOut")]
+    hids = {u["id"] for u in halive}
+    cids = {u["id"] for u in battle(client)["units"] if not u.get("isOut")}
+    drivers = {hmover, cmover}
+    # Prefer a non-driver PLAYER soldier (its squadmates are the losing squad, so the
+    # bystander loss lands on the units the RCA measured); the loser-squad morale drop
+    # is unconditional (unlike a winner bump that a full-morale unit clamps away).
+    players = [u["id"] for u in halive if u.get("faction") == 0
+               and u["id"] not in drivers and u["id"] in cids]
+    aliens = [u["id"] for u in halive if u.get("faction") == 1 and u["id"] in cids]
+    n_players_live = sum(1 for u in halive if u.get("faction") == 0)
+    if players and n_players_live >= 3:
+        victim, squad = players[0], "player"
+    elif aliens and len([u for u in halive if u.get("faction") == 1]) >= 2:
+        victim, squad = aliens[0], "alien"
+    else:
+        print(f"    NOTE: no spare casualty available (players_live={n_players_live}, "
+              f"aliens={len(aliens)}); scenario skipped")
+        return sync(host)
+
+    r = host.cmd({"cmd": "battle_action", "action": "kill_unit_real", "unit": victim})
+    assert r.get("ok") and victim in r.get("killed", []), (
+        f"kill_unit_real did not kill {squad} {victim}: {r}")
+    settle_display(host, client)
+
+    ha = session.sync_buckets(host)["unitsStats"]
+    ca = session.sync_buckets(client)["unitsStats"]
+    diffs = unit_stat_diff(host, client)
+    morale_diffs = [(uid, d["morale"]) for uid, d in diffs if "morale" in d]
+    # kill_unit_real applies overkill damage() DIRECTLY and never sends a `hit_unit`
+    # packet, so the VICTIM's own hit_unit stats (fatalWounds) are not replicated - an
+    # artifact of the synthetic lever, not the seam under test (real play ships them via
+    # hit_unit BEFORE the death). Exclude the victim; SEAM-4 is about the BYSTANDERS.
+    other_diffs = [(uid, d) for uid, d in diffs if uid != victim]
+    non_morale_others = [(uid, {k: v for k, v in d.items() if k != "morale"})
+                         for uid, d in other_diffs if any(k != "morale" for k in d)]
+    print(f"    killed {squad} {victim}; unitsStats bucket host {hb}->{ha} "
+          f"client {cb}->{ca} ({'EQUAL' if ha == ca else 'DIVERGED'})")
+    print(f"    bystander morale diffs (id -> host,client) after the casualty: "
+          f"{morale_diffs}")
+    victim_art = [(uid, d) for uid, d in diffs if uid == victim]
+    if victim_art:
+        print(f"    victim-only artifact (kill_unit_real skips hit_unit): {victim_art}")
+
+    if MORALE_STRICT:
+        assert not morale_diffs, (
+            f"SEAM-4 NOT CLOSED: {len(morale_diffs)} bystander(s) morale diverged "
+            f"after the casualty {morale_diffs} - the death packet's bystander_morale "
+            f"array is not applying on the parallel client (checkForCasualties changed "
+            f"their morale on the host; the thin client never ran it)")
+        assert not non_morale_others, (
+            f"SEAM-4: a NON-victim unit diverged on a non-morale stat after the "
+            f"casualty {non_morale_others} - unexpected, kill_unit_real should move "
+            f"only bystander morale")
+        print(f"PASS SEAM-4: a host {squad} casualty left ZERO bystander morale drift "
+              f"on the thin client over {len([u for u in battle(host)['units'] if not u['isOut']])} "
+              f"living units (the death packet replicated every living unit's morale; "
+              f"victim fatalWounds is a hit_unit-less lever artifact)")
+    else:
+        print(f"    [SEAM4_MORALE_STRICT=0] baseline print-only: unitsStats bucket "
+              f"{'EQUAL' if ha == ca else 'DIVERGED'}, "
+              f"bystander morale diffs={len(morale_diffs)}")
+    return sync(host)
+
+
+# ---- I2. saveBlob: determinism, cost, boundary-only registry --------------
+
+def scenario_saveblob_selftest(host, client):
+    """PRD-I2's save-derived boundary bucket, its own up-front checks.
+
+    (a) DETERMINISM. `save_blob` serializes the live battle exactly as
+        SavedBattleGame::save would, minus a short machine-local exclusion list,
+        and FNV-1a hashes the canonical tree. Hashing the same quiescent battle
+        TWICE on ONE machine must be byte-identical - the cheap catch for emitter
+        nondeterminism (an unordered_map feeding the writer, or serialization that
+        mutates state) before it can masquerade as a cross-machine desync.
+    (b) COST. The serialization is the whole expense (PRD-I2 estimates 5-20 ms);
+        measured and printed, asserted only against a sane ceiling.
+    (c) REGISTRY. `saveBlob` must show up in the syncCheck bucket table (so its
+        report-only counter is readable) but NEVER in the raw per-action
+        `battleHashes` sweep the harness polls hot - it is boundary-only."""
+    print("-- I2: saveBlob determinism, cost and boundary-only registry --")
+    settle_display(host, client)
+
+    for gc, tag in ((host, "host"), (client, "client")):
+        a = gc.cmd({"cmd": "save_blob"})
+        b = gc.cmd({"cmd": "save_blob"})
+        assert a.get("ok") and b.get("ok"), f"{tag}: save_blob did not run: {a} / {b}"
+        assert a["hash"] == b["hash"], (
+            f"{tag}: the save-derived hash is NON-DETERMINISTIC on ONE machine "
+            f"({a['hash']} != {b['hash']}) - the writer is feeding the emitter from "
+            f"an unordered container, or serializing mutates state. Fix or sort "
+            f"before this can masquerade as a boundary desync.")
+        assert a["hash"] != 0, f"{tag}: save_blob hashed to 0 - serialization empty"
+        assert a["us"] < 200000, (
+            f"{tag}: one saveBlob serialize took {a['us']}us (>200ms) - PRD-I2 "
+            f"budgets 5-20ms and it is boundary-only, but this is pathological")
+        print(f"    {tag}: saveBlob deterministic (hash stable), "
+              f"serialize={a['us']}us")
+
+    sc = sync(host)
+    assert "saveBlob" in sc["buckets"], (
+        f"saveBlob missing from the syncCheck bucket table, so its report-only "
+        f"counter is unreadable: {sorted(sc['buckets'])}")
+    # (saveBlob is ALARM-promoted as of Session F; this self-test only proves it is
+    # deterministic + boundary-only, both independent of its alarm status.)
+    raw = session.sync_buckets(host)
+    assert "saveBlob" not in raw, (
+        f"saveBlob leaked into the raw per-action `battleHashes` sweep "
+        f"{sorted(raw)} - a 5-20ms boundary cost must never ride the hot poll")
+
+    hh = host.cmd({"cmd": "save_blob"})["hash"]
+    cc = client.cmd({"cmd": "save_blob"})["hash"]
+    print(f"    cross-machine saveBlob at battle start: host={hh} client={cc} "
+          f"({'equal' if hh == cc else 'differ - recorded, report-only'})")
+
+    # PRD-I3 FOW Option B rider: the per-unit FOV/spotting keys must be excluded
+    # from the saveBlob hash INPUT (saveBlobExcludedAnyKey), so they cannot appear
+    # in the canonical text the hash consumes. turnsSinceSpotted is written
+    # unconditionally by BattleUnit::save, so its ABSENCE from the dump is the
+    # direct proof the exclusion is live; visible / turnsLeftSpottedForSnipers
+    # asserted too.
+    dump = host.cmd({"cmd": "save_blob", "text": True})
+    txt = dump.get("text", "") if dump.get("textOk") else None
+    if txt is not None:
+        leaked = [k for k in ("visible", "turnsSinceSpotted",
+                              "turnsLeftSpottedForSnipers")
+                  if k in txt]
+        assert not leaked, (
+            f"per-unit FOV keys {leaked} are still in the saveBlob canonical text "
+            f"- the FOW Option B rider's saveBlobExcludedAnyKey entries are not "
+            f"taking, so the hash still moves on presentation-only FOV drift")
+        print(f"    FOW rider live: per-unit FOV keys excluded from the saveBlob "
+              f"canonical text ({len(txt)} chars, no visible/turnsSinceSpotted/"
+              f"turnsLeftSpottedForSnipers)")
+    else:
+        print("    NOTE: save_blob {text} unavailable; FOV-exclusion text check "
+              "skipped")
+    print("PASS I2 self-test: deterministic, boundary-only (now ALARM-promoted)")
+    return sc
+
+
+# ---- main ------------------------------------------------------------------
+
+def main():
+    fail = None
+    host = GameClient("host", 48890,
+                      make_user_dir("i0_sync_host",
+                                    options={"battleXcomSpeed": 2,
+                                             "battleAlienSpeed": 2,
+                                             "skipNextTurnScreen": True,
+                                             "EnableCoopParallelTurns": True}))
+    client = GameClient("client", 48891,
+                        make_user_dir("i0_sync_client",
+                                      options={"battleXcomSpeed": 2,
+                                               "battleAlienSpeed": 2,
+                                               "EnableCoopParallelTurns": False}))
+    try:
+        host.spawn(); host.connect()
+        client.spawn(); client.connect()
+        TW.PORT = PORT
+        PI.PORT = PORT
+        PE.PORT = PORT
+        TW.bring_up_battle(host, client)
+        print("battle up on both machines")
+
+        gm = battle(host).get("coopGamemode")
+        assert gm in (1, 4), (
+            f"the skirmish fixture came up in gamemode {gm}; parallel turns only "
+            f"cover PVE (1) and PVE2 (4), so this test would be vacuous")
+        for gc, tag in ((host, "host"), (client, "client")):
+            assert battle(gc)["parallelActive"] is True, \
+                f"{tag}: parallel mode is not live: {battle(gc)}"
+        assert battle(host)["activeSync"] is True and battle(client)["activeSync"] is False, \
+            "the PRD-P5 executor invariant does not hold; nothing below tests it"
+
+        # --- 0. the registry is real -------------------------------------
+        for gc, tag in ((host, "host"), (client, "client")):
+            h = session.sync_buckets(gc)
+            assert sorted(h) == sorted(["terrain", "fire", "smoke", "items",
+                                        "unitsCore", "unitsStats", "itemIdCtr",
+                                        "unitsCombat", "unitsRegen"]), (
+                f"{tag}'s bucket registry is not the PRD-I0 §2 set: {sorted(h)}")
+            assert h["terrain"] and h["items"] and h["unitsCore"] and h["itemIdCtr"], (
+                f"{tag}'s buckets look empty on a generated battle: {h} - a "
+                f"sweep that returns zeros would agree with anything")
+        hb, cb = session.sync_buckets(host), session.sync_buckets(client)
+        same = [k for k in hb if hb[k] == cb[k]]
+        print(f"    buckets equal at battle start: {sorted(same)}")
+        for key in ("terrain", "items", "unitsCore", "itemIdCtr"):
+            assert hb[key] == cb[key], (
+                f"the two machines disagree on the {key!r} bucket at battle "
+                f"GENERATION (host={hb[key]} client={cb[key]}) - both generate the "
+                f"same battle deterministically, so this is a pre-existing "
+                f"divergence and nothing below can be trusted")
+
+        sc0 = sync(host)
+        # `sync: True` - the sweep + report block is opt-in on battle_state (see
+        # session.sync_check), so the hot poll every other test runs is unchanged.
+        sweeps = [gc.cmd({"cmd": "battle_state", "sync": True}).get("battleHashSweepUs")
+                  for gc in (host, client)]
+        tiles = host.cmd({"cmd": "battle_tiles"}).get("tileCount")
+        print(f"SWEEP COST: {sweeps[0]}us (host) / {sweeps[1]}us (client) over "
+              f"{tiles} tiles - the PRD-I0 target is < 1000us on 60x60x4 (14400)")
+        for tag, us in (("host", sweeps[0]), ("client", sweeps[1])):
+            assert us is not None and us * 14400 // max(1, tiles) < 1000, (
+                f"{tag}'s bucket sweep costs {us}us over {tiles} tiles, i.e. over "
+                f"the 1 ms budget once scaled to a 60x60x4 map. PRD-I0 says hash "
+                f"per bucket lazily if this happens.")
+        # NOT "nothing has happened yet": co-op battle init runs a `next_turn`, so
+        # the side-start boundary marker has already been through the whole loop by
+        # the time a test can look. That it has is the first proof the loop works.
+        assert sc0["mismatchCount"] == 0, (
+            f"the two machines already disagree before anything was driven: {sc0}")
+        # PRD-I3 promotions: fire/unitsStats/unitsCombat/unitsRegen (@4a15f7bd4) +
+        # unitsCore (Session C) + terrain/smoke (Session E @e316d716a) + items/itemIdCtr
+        # (Session F @43ec70384: side-gate + corpse-pending window-1/2 skips) + saveBlob
+        # (Session F: SEAM-11 ammoqty ship + exp*/tempUnitStatistics/motionPoints exclude +
+        # floating ship + ufo-door close) are ALL ARMED - ALL TEN BUCKETS PROMOTED. This
+        # guard catches an accidental promotion-table change and forces a conscious
+        # re-prove of no-false-alarm + routing (the scenario-2 positive alarm route + the
+        # scenario-4 override negative control - which now FORCES a bucket report-only,
+        # since none is naturally report-only any more).
+        EXPECTED_ALARM = {"fire", "unitsStats", "unitsCombat", "unitsRegen", "unitsCore",
+                          "terrain", "smoke", "items", "itemIdCtr", "saveBlob"}
+        armed = {n for n, b in sc0["buckets"].items() if b["alarm"]}
+        assert armed == EXPECTED_ALARM, (
+            f"the ALARM promotion table changed: armed={sorted(armed)} but this "
+            f"build expects {sorted(EXPECTED_ALARM)}. Update the expected set and "
+            f"re-prove no-false-alarm + routing before trusting the tests below: "
+            f"{ {n: b['alarm'] for n, b in sc0['buckets'].items()} }")
+
+        cseat = parallel(client)["localSeat"]
+        hseat = parallel(host)["localSeat"]
+        assert hseat != cseat, f"both machines report seat {hseat}"
+        cmover = PI.pick_driver(host, client, cseat, "client")
+        hmover = PI.pick_driver(host, client, hseat, "host")
+
+        scenario_saveblob_selftest(host, client)
+        scenario_clean(host, client, hmover, cmover)
+        cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+        hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+        scenario_kneel_burst(host, client, hmover, cmover)
+        cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+        hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+        scenario_ai_and_boundary(host, client, hmover, cmover)
+        cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+        hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+        scenario_smoke(host, client, hmover, cmover)
+        cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+        hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+        scenario_casualty_morale(host, client, hmover, cmover)
+        cmover = PE.ensure_driver(host, client, cseat, "client", cmover)
+        hmover = PE.ensure_driver(host, client, hseat, "host", hmover)
+        # scenario_red_bucket runs LAST: its one-sided item mint permanently skews
+        # the battle, so anything after it measures a skewed state.
+        scenario_red_bucket(host, client, hmover, cmover)
+
+        session.assert_client_zero_disk(client.user_dir)
+        print("ALL SYNC-CHECK TESTS PASSED")
+    except Exception as e:
+        fail = e
+        print(f"[FAIL] {e}")
+        for tag, gc in (("host", host), ("client", client)):
+            try:
+                print(f"  DBG {tag} syncCheck: {sync(gc)}")
+                print(f"  DBG {tag} parallel:  {parallel(gc)}")
+                print(f"  DBG {tag} top:       {TW.top(gc)}")
+            except Exception as de:
+                print(f"  DBG {tag} dump failed: {de}")
+    finally:
+        host.shutdown(); client.shutdown()
+
+    sys.exit(2 if fail else 0)
+
+
+if __name__ == "__main__":
+    main()