diff --git a/web/src/routes/[username]/[workspace]/library/+page.svelte b/web/src/routes/[username]/[workspace]/library/+page.svelte
index 5793d59a6..7204ba84e 100644
--- a/web/src/routes/[username]/[workspace]/library/+page.svelte
+++ b/web/src/routes/[username]/[workspace]/library/+page.svelte
@@ -1,11 +1,58 @@
 <script lang="ts">
+	import { onDestroy, untrack } from 'svelte';
 	import { page } from '$app/state';
 	import { api } from '$lib/api/client';
+	import { authStore } from '$lib/stores/auth.svelte';
 	import { createScrollRestoration } from '$lib/scroll/restore.svelte';
 	import Chip from '$lib/components/common/Chip.svelte';
 	import { statusColor } from '$lib/utils/fieldColors';
 	import type { LibraryCategory, LibraryConvention, PlaybookCategory, LibraryPlaybook, Item } from '$lib/types';
 
+	/**
+	 * IDENTITY FENCE — surface 3 of 7 (BUG-3084). Every async commit point on
+	 * this page is checked against the signed-in identity, so a response or a
+	 * click that lands after a sign-in or sign-out cannot commit the previous
+	 * session's data. Same shape as the collection page (#1372/#1374), settings
+	 * (#1370) and the roles board (#1375); the rules below are the family's,
+	 * carried here rather than re-derived.
+	 *
+	 * WHAT IS DIFFERENT HERE. The population is 7, not the 3 a function-level
+	 * count sees: four DEFERRED TIMERS (`setTimeout(… , 3000)` clearing the
+	 * toast) are commit points that fire long after their handler returned, and
+	 * the filed survey missed all four (BUG-3084 checkpoint 6).
+	 *
+	 * `activateConvention` / `activatePlaybook` COMPOSE A WRITE from state
+	 * chosen under the previous identity — the `convention` / `playbook` the
+	 * user clicked came from a list `loadData` fetched then. A click after an
+	 * identity change is the current epoch, so every entry capture passes; the
+	 * question that catches it is `pageIdentityHeld()`, exactly as on the roles
+	 * board's drag handlers.
+	 *
+	 * `identityHeld(captured)` takes a handler's own ENTRY capture, because
+	 * `loadData` re-stamps the page epoch and a handler comparing against that
+	 * can be defeated by a concurrent load.
+	 *
+	 * `pageIdentityHeld()` asks whether this PAGE still belongs to the
+	 * signed-in user.
+	 */
+	// `$state` for the same reason the roles board needs it: `pageIdentityHeld()`
+	// is read from an `$effect` below, and an untracked value would leave that
+	// effect with whichever answer it saw first.
+	let identityEpochAtLoad = $state(authStore.identityEpoch);
+
+	/** The epoch as of now — captured at a handler's entry, before its awaits. */
+	function captureIdentity(): number {
+		return authStore.identityEpoch;
+	}
+
+	function identityHeld(captured: number): boolean {
+		return authStore.identityEpoch === captured;
+	}
+
+	function pageIdentityHeld(): boolean {
+		return authStore.identityEpoch === identityEpochAtLoad;
+	}
+
 	let wsSlug = $derived(page.params.workspace ?? '');
 	let username = $derived(page.params.username ?? '');
 
@@ -54,11 +101,66 @@
 		return convention.surfaces?.join(', ') || 'all';
 	}
 
+	/**
+	 * Every piece of TRANSIENT INTERACTION STATE on this page — something a
+	 * click started and a later response or timer would finish. Distinct from
+	 * the page's DATA (the four collections `loadData` replaces) and from its
+	 * identity bookkeeping.
+	 *
+	 * The source guard holds this against the file's own `$state` declarations,
+	 * so a new piece of interaction state cannot arrive without being
+	 * dispositioned here (BUG-3084, the roles board's checkpoint-14 lesson
+	 * carried forward rather than re-learned).
+	 */
+	function resetTransientState() {
+		activatingTitle = null;
+		toast = null;
+	}
+
+	/**
+	 * RE-LOAD ON AN IDENTITY CHANGE. The `$effect` below is keyed on `wsSlug`
+	 * alone, so it does NOT re-run when the identity moves — and
+	 * `routes/+layout.svelte` deliberately does not reload on an anonymous ->
+	 * signed-in transition. Without this the page keeps a dead epoch and every
+	 * `pageIdentityHeld()` is false for ever: both activate handlers go
+	 * silently inert and never recover (#1372's regression, repaired in #1374).
+	 *
+	 * The reset runs FIRST: `activatingTitle` gates both handlers at their very
+	 * first line, so a stale value latches them shut, and `toast` would keep the
+	 * previous session's message on screen for whoever is signed in now.
+	 */
+	const stopIdentityWatch = authStore.onIdentityChange(() => {
+		resetTransientState();
+		if (wsSlug) void loadData(wsSlug);
+	});
+	onDestroy(stopIdentityWatch);
+
 	$effect(() => {
-		if (wsSlug) loadData(wsSlug);
+		// UNTRACKED (codex round 1 [P2]). `loadData` reads `authStore.identityEpoch`
+		// synchronously via `captureIdentity()` before its first await, so
+		// without this the effect takes a dependency on the epoch and re-runs
+		// when the identity moves — on top of the listener above, which already
+		// re-loads for exactly that event. Two loads, eight requests, and
+		// `loadGen` quietly discarding half of them: correct on screen, wasteful
+		// on the wire, and the kind of thing that reads as a mystery in a
+		// network log.
+		//
+		// The key this effect is FOR is the workspace. Settings (#1370) suppresses
+		// the same class the same way; naming the real key is what makes the
+		// suppression safe rather than a blanket silencing.
+		const ws = wsSlug;
+		if (ws) untrack(() => loadData(ws));
 	});
 
+	// Bumped by every `loadData()`. The identity fence and this ask different
+	// questions and neither implies the other: the fence asks whether the
+	// SIGNED-IN USER changed, this asks whether a NEWER LOAD for the same user
+	// already landed. A workspace switch produces exactly the second.
+	let loadGen = 0;
+
 	async function loadData(ws: string) {
+		const epochAtEntry = captureIdentity();
+		const myLoad = ++loadGen;
 		loading = true;
 		try {
 			const [libraryRes, playbookRes, existingConventions, existingPlaybooks] = await Promise.all([
@@ -67,47 +169,121 @@
 				api.items.listByCollection(ws, 'conventions', { all: true }).catch(() => [] as Item[]),
 				api.items.listByCollection(ws, 'playbooks', { all: true }).catch(() => [] as Item[]),
 			]);
+			if (!identityHeld(epochAtEntry)) return;
+			if (myLoad !== loadGen) return;
 			categories = libraryRes.categories;
 			playbookCategories = playbookRes.categories;
+			// THE SHARPEST READS ON THIS PAGE. These two sets are what the
+			// activate handlers consult to decide whether a library entry is
+			// already in the workspace, so a set belonging to the previous
+			// session's workspace makes the NEW user's activate button either
+			// dead or duplicating.
 			activeConventionTitles = new Set(existingConventions.map((item) => item.title));
 			activePlaybookTitles = new Set(existingPlaybooks.map((item) => item.title));
+			// RE-STAMPED HERE, AFTER the data it vouches for has landed — never
+			// before the await (BUG-3084, the roles board's checkpoint-14
+			// lesson). `pageIdentityHeld()` means "this page's DATA belongs to
+			// the signed-in user", and the activate handlers compose writes from
+			// that data. Re-stamping at the top answers yes for the whole
+			// round-trip while the four collections are still the previous
+			// session's, so the guard would vouch for data it has not replaced.
+			identityEpochAtLoad = epochAtEntry;
 		} catch {
+			if (!identityHeld(epochAtEntry)) return;
+			if (myLoad !== loadGen) return;
 			categories = [];
 			playbookCategories = [];
+			// CLEARED here too, because the re-stamp below vouches for whatever
+			// is left and a failed load replaces neither set.
+			activeConventionTitles = new Set();
+			activePlaybookTitles = new Set();
+			// RE-STAMPED ON THE ERROR PATH TOO: omitting it pins the page inert
+			// for ever on a transient network error, which is the outage #1374
+			// was opened to repair, and is the worse failure of the two.
+			identityEpochAtLoad = epochAtEntry;
 		} finally {
-			loading = false;
+			// NOT identity-fenced: this must run on every exit path or the page
+			// is pinned at its skeleton, and the flag discloses nothing about
+			// either user. GENERATION-gated though, so only the NEWEST load may
+			// declare the page loaded.
+			if (myLoad === loadGen) loading = false;
 		}
 	}
 
 	async function activateConvention(convention: LibraryConvention) {
 		if (activeConventionTitles.has(convention.title) || activatingTitle) return;
+		// BOTH QUESTIONS. `pageIdentityHeld()` first, for the reason the roles
+		// board's drag handlers need it: the convention this writes was chosen
+		// from a list `loadData` fetched under the PREVIOUS identity, and a
+		// click after the change is the current epoch, so an entry capture
+		// passes and the previous session's choice is activated into whatever
+		// workspace is on screen now.
+		if (!pageIdentityHeld()) return;
+		const epochAtEntry = captureIdentity();
 		activatingTitle = convention.title;
 		try {
 			await api.library.activate(wsSlug, convention);
+			if (!identityHeld(epochAtEntry)) return;
 			activeConventionTitles = new Set([...activeConventionTitles, convention.title]);
 			toast = `Activated: ${convention.title}`;
-			setTimeout(() => (toast = null), 3000);
+			// FENCED, and the timer is the reason this surface's population is
+			// 7 rather than 3: it commits 3 seconds after the handler returned,
+			// by which time the identity may have moved. Clearing then would
+			// wipe a toast belonging to whoever is signed in NOW. The identity
+			// listener already clears `toast`, so the stale timer has nothing
+			// legitimate left to do.
+			setTimeout(() => {
+				if (!identityHeld(epochAtEntry)) return;
+				toast = null;
+			}, 3000);
 		} catch {
+			if (!identityHeld(epochAtEntry)) return;
 			toast = `Failed to activate: ${convention.title}`;
-			setTimeout(() => (toast = null), 3000);
+			setTimeout(() => {
+				if (!identityHeld(epochAtEntry)) return;
+				toast = null;
+			}, 3000);
 		} finally {
-			activatingTitle = null;
+			// FENCED, unlike `loading` above, and the asymmetry is deliberate.
+			// `activatingTitle` is cleared by `resetTransientState()` on every
+			// identity change, so a stale continuation clearing it again can
+			// only release a gate the NEW user's own click is holding — which
+			// permits a second concurrent activation.
+			if (identityHeld(epochAtEntry)) activatingTitle = null;
 		}
 	}
 
 	async function activatePlaybook(playbook: LibraryPlaybook) {
 		if (activePlaybookTitles.has(playbook.title) || activatingTitle) return;
+		// BOTH QUESTIONS. `pageIdentityHeld()` first, for the reason the roles
+		// board's drag handlers need it: the playbook this writes was chosen
+		// from a list `loadData` fetched under the PREVIOUS identity, and a
+		// click after the change is the current epoch, so an entry capture
+		// passes and the previous session's choice is activated into whatever
+		// workspace is on screen now.
+		if (!pageIdentityHeld()) return;
+		const epochAtEntry = captureIdentity();
 		activatingTitle = playbook.title;
 		try {
 			await api.library.activatePlaybook(wsSlug, playbook);
+			if (!identityHeld(epochAtEntry)) return;
 			activePlaybookTitles = new Set([...activePlaybookTitles, playbook.title]);
 			toast = `Activated: ${playbook.title}`;
-			setTimeout(() => (toast = null), 3000);
+			// See the timer note in activateConvention.
+			setTimeout(() => {
+				if (!identityHeld(epochAtEntry)) return;
+				toast = null;
+			}, 3000);
 		} catch {
+			if (!identityHeld(epochAtEntry)) return;
 			toast = `Failed to activate: ${playbook.title}`;
-			setTimeout(() => (toast = null), 3000);
+			setTimeout(() => {
+				if (!identityHeld(epochAtEntry)) return;
+				toast = null;
+			}, 3000);
 		} finally {
-			activatingTitle = null;
+			// See the note in activateConvention.
+			if (identityHeld(epochAtEntry)) activatingTitle = null;
 		}
 	}
 
diff --git a/web/src/routes/[username]/[workspace]/library/libraryIdentityFence.svelte.test.ts b/web/src/routes/[username]/[workspace]/library/libraryIdentityFence.svelte.test.ts
new file mode 100644
index 000000000..c5610e38c
--- /dev/null
+++ b/web/src/routes/[username]/[workspace]/library/libraryIdentityFence.svelte.test.ts
@@ -0,0 +1,517 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { cleanup, render, waitFor } from '@testing-library/svelte';
+import { tick } from 'svelte';
+
+/**
+ * BUG-3084 surface 3 — the BEHAVIOURAL half. `libraryIdentityFence.test.ts`
+ * beside this file owns the POPULATION; this owns the SEMANTICS.
+ *
+ * THE MOVE EACH TEST MAKES: start a handler, hold its request open, move the
+ * identity, then resolve, and assert the commit did not land.
+ *
+ * ONE CONTROL PER CASE, because "nothing was committed" is satisfied just as
+ * well by a handler that never ran or a mount that failed.
+ *
+ * WHAT THIS SURFACE HAS that the earlier ones did not: a DEFERRED TIMER class.
+ * Four `setTimeout(…, 3000)` callbacks clear the toast long after their handler
+ * returned, and they are driven here with fake timers rather than reasoned
+ * about — the filed survey missed all four, so they get the sharpest legs.
+ *
+ * And the leg every instrument set in this family was missing until #1374:
+ * one case that moves the identity and then KEEPS USING the page. An
+ * instrument set that only ever asks "did it refuse?" can only measure
+ * under-protection, and the failure on the other side — a fence that latches
+ * shut and never lifts — is invisible to all of it.
+ */
+
+const auth = vi.hoisted(() => {
+	let epoch = 0;
+	return {
+		get identityEpoch() { return epoch; },
+		get userId() { return 'u1'; },
+		get user() { return { id: 'u1', name: 'A', email: 'a@example.com' }; },
+		bumpEpoch() { epoch++; },
+		resetEpoch() { epoch = 0; },
+		identityFence() { const c = epoch; return () => epoch === c; },
+		listeners: [] as Array<() => void>,
+		onIdentityChange(cb: () => void) {
+			this.listeners.push(cb);
+			return () => { this.listeners = this.listeners.filter((l) => l !== cb); };
+		},
+		notify() { for (const l of [...this.listeners]) l(); },
+		clear() {},
+	};
+});
+vi.mock('$lib/stores/auth.svelte', () => ({ authStore: auth }));
+
+const libraryCalls = vi.hoisted(() => [] as Array<(v: unknown) => void>);
+const activateCalls = vi.hoisted(
+	() => [] as Array<{ args: unknown[]; resolve: (v: unknown) => void; reject: (e: unknown) => void }>
+);
+// `activatePlaybook` gets its own driven legs rather than riding on the
+// convention handler's (codex round 1 [P2]). The two are near-identical, which
+// is exactly why source-text assertions alone would not notice one of them
+// going inert.
+const playbookCalls = vi.hoisted(
+	() => [] as Array<{ args: unknown[]; resolve: (v: unknown) => void; reject: (e: unknown) => void }>
+);
+
+vi.mock('$lib/api/client', () => ({
+	api: {
+		library: {
+			get: vi.fn(() => new Promise((resolve) => { libraryCalls.push(resolve as (v: unknown) => void); })),
+			getPlaybooks: vi.fn(async () => ({ categories: [{ name: 'agent-workflows', playbooks: [PLAYBOOK] }] })),
+			activate: vi.fn((...args: unknown[]) => new Promise((resolve, reject) => {
+				activateCalls.push({ args, resolve: resolve as (v: unknown) => void, reject });
+			})),
+			activatePlaybook: vi.fn((...args: unknown[]) => new Promise((resolve, reject) => {
+				playbookCalls.push({ args, resolve: resolve as (v: unknown) => void, reject });
+			})),
+		},
+		items: { listByCollection: vi.fn(async () => []) },
+	},
+}));
+
+vi.mock('$lib/scroll/restore.svelte', () => ({
+	createScrollRestoration: () => ({ snapshot: { capture: () => null, restore: () => {} } }),
+}));
+
+import { api } from '$lib/api/client';
+import { page } from '$app/state';
+import LibraryPage from './+page.svelte';
+
+const PLAYBOOK = {
+	title: 'Ship',
+	description: 'd',
+	content: 'body',
+	category: 'agent-workflows',
+	trigger: 'manual',
+	scope: 'all',
+	invocation_slug: 'ship',
+	arguments: [],
+};
+
+const CONVENTION = {
+	title: 'Use conventional commits',
+	description: 'd',
+	content: 'body',
+	category: 'git',
+	trigger: 'on-commit',
+	priority: 'should',
+	surfaces: ['all'],
+};
+
+async function mountPage() {
+	libraryCalls.length = 0;
+	activateCalls.length = 0;
+	playbookCalls.length = 0;
+	page.params = { username: 'dave', workspace: 'ws' };
+	page.url = new URL('http://localhost/dave/ws/library');
+	const r = render(LibraryPage);
+	const resolveLibrary = await waitFor(() => {
+		if (libraryCalls.length === 0) throw new Error('no library fetch yet');
+		return libraryCalls[0]!;
+	});
+	resolveLibrary({ categories: [{ name: 'git', conventions: [CONVENTION] }] });
+	await waitFor(() => {
+		if (!document.querySelector('.activate-btn')) throw new Error('library not rendered yet');
+	});
+	return r;
+}
+
+function clickActivate(): void {
+	const btn = document.querySelector('.activate-btn') as HTMLButtonElement | null;
+	expect(btn, 'the activate button did not render — nothing to click').not.toBeNull();
+	btn!.click();
+}
+
+function flipIdentity(): void {
+	const before = auth.identityEpoch;
+	auth.bumpEpoch();
+	if (auth.identityEpoch === before) {
+		throw new Error('the identity epoch did not move — this test would pass against an unfenced page');
+	}
+}
+
+describe('the library page stops a commit when the identity moves mid-flight', () => {
+	beforeEach(() => { auth.resetEpoch(); auth.listeners.length = 0; });
+	afterEach(() => { cleanup(); vi.useRealTimers(); });
+
+	it('CONTROL: activating a convention issues the write and shows the toast', async () => {
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		call.resolve({});
+		await waitFor(() => {
+			expect(
+				document.querySelector('.toast')?.textContent,
+				'the control showed no toast — the legs below would measure nothing'
+			).toContain('Activated');
+		});
+	});
+
+	it('a click AFTER an identity move never issues the activation at all', async () => {
+		// The order an entry capture cannot see: the click IS the current epoch,
+		// so every capture passes, while the `convention` it carries came from
+		// the list the PREVIOUS identity loaded.
+		await mountPage();
+		flipIdentity();
+		clickActivate();
+		await tick();
+		await tick();
+		expect(
+			activateCalls.length,
+			"a convention chosen from the previous identity's library was activated into the " +
+				'workspace on screen now'
+		).toBe(0);
+	});
+
+	it('an activation IN FLIGHT when the identity moves commits nothing', async () => {
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		flipIdentity();
+		call.resolve({});
+		await tick();
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			"the previous session's activation reported success to whoever is signed in now"
+		).toBeNull();
+	});
+
+	it('a timer armed by the previous session does not clear the NEW toast', async () => {
+		// THE DEFERRED CLASS, driven rather than reasoned about. The timer is
+		// armed under identity A and fires 3s later; by then the page may belong
+		// to identity B and be showing B's own toast. Clearing it then is a
+		// commit by a session that has ended.
+		vi.useFakeTimers();
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		call.resolve({});
+		await vi.advanceTimersByTimeAsync(0);
+		await tick();
+		expect(
+			document.querySelector('.toast')?.textContent,
+			'no toast was shown, so the timer under test was never armed'
+		).toContain('Activated');
+
+		// Identity moves; the page paints a toast belonging to the NEW session.
+		flipIdentity();
+		const stale = document.querySelector('.toast');
+		expect(stale, 'precondition: a toast is on screen when the timer fires').not.toBeNull();
+
+		await vi.advanceTimersByTimeAsync(3100);
+		await tick();
+
+		// The listener is NOT notified here, deliberately: this leg is about the
+		// timer's own fence, not about the reload clearing up after it.
+		expect(
+			document.querySelector('.toast'),
+			"a timer armed by the previous session cleared a toast belonging to whoever is signed " +
+				'in now — a commit by a session that has ended'
+		).not.toBeNull();
+	});
+
+	it('a LOAD in flight when the identity moves writes none of the previous data', async () => {
+		// The load path had no driven leg at all (codex round 2 [P2]): the source
+		// guard permits the fence to sit AFTER the assignments, and nothing held
+		// a load open across an identity change to notice. The implementation
+		// ordering was right; the instrument could not say so.
+		await mountPage();
+		const before = document.querySelectorAll('.activate-btn').length;
+		expect(before, 'precondition: the first load rendered entries').toBeGreaterThan(0);
+
+		// A second load, held open, whose response belongs to the previous
+		// identity by the time it resolves.
+		auth.notify();
+		await tick();
+		const reload = await waitFor(() => {
+			if (libraryCalls.length < 2) throw new Error('no second load yet');
+			return libraryCalls[1]!;
+		});
+		flipIdentity();
+		reload({
+			categories: [
+				{ name: 'git', conventions: [CONVENTION, { ...CONVENTION, title: 'Second' }] },
+			],
+		});
+		await tick();
+		await tick();
+
+		expect(
+			document.body.textContent,
+			"a load that resolved after the identity moved painted the previous session's library"
+		).not.toContain('Second');
+	});
+
+	it('the FAILURE path arms a fenced timer too, and it clears', async () => {
+		// Only the success timer was driven (codex round 2 [P2]). Two of the four
+		// timers live in catch arms, so a dead branch carrying both
+		// `identityHeld()` and `toast = null` satisfied the source guard and the
+		// whole suite — source text vouching for a path nothing executes.
+		vi.useFakeTimers();
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		call.reject(new Error('nope'));
+		await vi.advanceTimersByTimeAsync(0);
+		await tick();
+		expect(
+			document.querySelector('.toast')?.textContent,
+			'the failure path showed no toast — its timer was never armed, so this leg measures nothing'
+		).toContain('Failed to activate');
+
+		await vi.advanceTimersByTimeAsync(3100);
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			"the failure path's timer never clears its toast"
+		).toBeNull();
+	});
+
+	it('a FAILURE-path timer armed by the previous session does not clear the NEW toast', async () => {
+		vi.useFakeTimers();
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		call.reject(new Error('nope'));
+		await vi.advanceTimersByTimeAsync(0);
+		await tick();
+		expect(document.querySelector('.toast'), 'precondition: a toast is on screen').not.toBeNull();
+
+		flipIdentity();
+		await vi.advanceTimersByTimeAsync(3100);
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			'a failure-path timer armed by the previous session cleared a toast belonging to whoever ' +
+				'is signed in now'
+		).not.toBeNull();
+	});
+
+	it("the PLAYBOOK success path arms a fenced timer too, and it clears", async () => {
+		vi.useFakeTimers();
+		await mountPage();
+		clickActivatePlaybook();
+		await tick();
+		const btn = document.querySelector('.activate-btn') as HTMLButtonElement | null;
+		expect(btn, 'the playbook activate button did not render').not.toBeNull();
+		btn!.click();
+		const call = await waitFor(() => {
+			if (playbookCalls.length === 0) throw new Error('no playbook activate call yet');
+			return playbookCalls[0]!;
+		});
+		call.resolve({});
+		await vi.advanceTimersByTimeAsync(0);
+		await tick();
+		expect(
+			document.querySelector('.toast')?.textContent,
+			'the playbook success path showed no toast — its timer was never armed'
+		).toContain('Activated');
+
+		await vi.advanceTimersByTimeAsync(3100);
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			"the playbook path's timer never clears its toast"
+		).toBeNull();
+	});
+
+	it('a playbook activation IN FLIGHT when the identity moves commits nothing', async () => {
+		// The late-response half of the playbook path (codex round 3 [P2]).
+		// Round 2 gave the playbook handler a control and a click-after-the-change
+		// leg, which between them prove the request STARTS and that a preflight
+		// refusal works — and say nothing about the post-await fence. Removing
+		// that fence left the whole suite passing.
+		await mountPage();
+		clickActivatePlaybook();
+		await tick();
+		const btn = document.querySelector('.activate-btn') as HTMLButtonElement | null;
+		expect(btn, 'the playbook activate button did not render').not.toBeNull();
+		btn!.click();
+		const call = await waitFor(() => {
+			if (playbookCalls.length === 0) throw new Error('no playbook activate call yet');
+			return playbookCalls[0]!;
+		});
+		flipIdentity();
+		call.resolve({});
+		await tick();
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			"the previous session's playbook activation reported success to whoever is signed in now"
+		).toBeNull();
+	});
+
+	it("the PLAYBOOK failure path arms a fenced timer too, and it clears", async () => {
+		// The FOURTH timer, and the one round 2 claimed coverage of without
+		// having it (codex round 3 [P2]). Two of the four live in catch arms;
+		// round 2 drove the convention one and stopped.
+		vi.useFakeTimers();
+		await mountPage();
+		clickActivatePlaybook();
+		await tick();
+		const btn = document.querySelector('.activate-btn') as HTMLButtonElement | null;
+		expect(btn, 'the playbook activate button did not render').not.toBeNull();
+		btn!.click();
+		const call = await waitFor(() => {
+			if (playbookCalls.length === 0) throw new Error('no playbook activate call yet');
+			return playbookCalls[0]!;
+		});
+		call.reject(new Error('nope'));
+		await vi.advanceTimersByTimeAsync(0);
+		await tick();
+		expect(
+			document.querySelector('.toast')?.textContent,
+			'the playbook failure path showed no toast — its timer was never armed'
+		).toContain('Failed to activate');
+
+		await vi.advanceTimersByTimeAsync(3100);
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			"the playbook failure path's timer never clears its toast"
+		).toBeNull();
+	});
+
+	it('CONTROL: the timer DOES clear the toast when the identity is unchanged', async () => {
+		// Pairs with the stale-timer leg above, which on its own is satisfied by
+		// a timer that clears nothing at all (codex round 1 [P2]). Fixing a
+		// stale-write by making the write never happen is the failure this
+		// family already shipped once.
+		vi.useFakeTimers();
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		call.resolve({});
+		await vi.advanceTimersByTimeAsync(0);
+		await tick();
+		expect(document.querySelector('.toast'), 'no toast to clear').not.toBeNull();
+
+		await vi.advanceTimersByTimeAsync(3100);
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			'the toast never clears under an unchanged identity — the fence removed the behaviour ' +
+				'instead of conditioning it'
+		).toBeNull();
+	});
+
+	// ── activatePlaybook, driven rather than asserted about ────────────────
+
+	function clickActivatePlaybook(): void {
+		const tab = [...document.querySelectorAll('button')].find(
+			(b) => b.textContent?.trim().toLowerCase().includes('playbook')
+		) as HTMLButtonElement | undefined;
+		expect(tab, 'the playbooks tab did not render').toBeDefined();
+		tab!.click();
+	}
+
+	it('CONTROL: activating a playbook issues its own write', async () => {
+		await mountPage();
+		clickActivatePlaybook();
+		await tick();
+		const btn = document.querySelector('.activate-btn') as HTMLButtonElement | null;
+		expect(btn, 'the playbook activate button did not render').not.toBeNull();
+		btn!.click();
+		await waitFor(() => {
+			expect(
+				playbookCalls.length,
+				'the playbook control issued no write — the leg below would measure nothing'
+			).toBe(1);
+		});
+	});
+
+	it('a playbook click AFTER an identity move never issues the activation', async () => {
+		await mountPage();
+		clickActivatePlaybook();
+		await tick();
+		flipIdentity();
+		const btn = document.querySelector('.activate-btn') as HTMLButtonElement | null;
+		expect(btn, 'the playbook activate button did not render').not.toBeNull();
+		btn!.click();
+		await tick();
+		await tick();
+		expect(
+			playbookCalls.length,
+			"a playbook chosen from the previous identity's library was activated into the workspace " +
+				'on screen now'
+		).toBe(0);
+	});
+
+	it('recovers after an identity change and activates under the NEW identity', async () => {
+		// "Did it ever resume?" — the opposite of every leg above. A fence that
+		// latches shut and never lifts is not a safe guard, it is an outage with
+		// good intentions, and it is harder to notice than what it replaced.
+		await mountPage();
+
+		flipIdentity();
+		auth.notify();
+		await tick();
+
+		const reload = await waitFor(() => {
+			if (libraryCalls.length < 2) throw new Error('the identity change did not trigger a reload');
+			return libraryCalls[1]!;
+		});
+		reload({ categories: [{ name: 'git', conventions: [CONVENTION] }] });
+
+		await waitFor(() => {
+			if (!document.querySelector('.activate-btn')) {
+				throw new Error('the library never came back after the identity change');
+			}
+		});
+
+		const before = activateCalls.length;
+		clickActivate();
+		await waitFor(() => {
+			expect(
+				activateCalls.length,
+				'the library is rendered but activating commits nothing — the fence latched shut and ' +
+					'never lifted'
+			).toBe(before + 1);
+		});
+	});
+
+	it('CONTROL: the identity-change reload clears the previous toast', async () => {
+		// Pairs with the timer leg: that one proves the stale TIMER must not
+		// clear the new toast; this proves the listener DOES clear the old one,
+		// so "the toast survived" can never be read as the page doing nothing.
+		await mountPage();
+		clickActivate();
+		const call = await waitFor(() => {
+			if (activateCalls.length === 0) throw new Error('no activate call yet');
+			return activateCalls[0]!;
+		});
+		call.resolve({});
+		await waitFor(() => {
+			if (!document.querySelector('.toast')) throw new Error('no toast yet');
+		});
+		flipIdentity();
+		auth.notify();
+		await tick();
+		expect(
+			document.querySelector('.toast'),
+			"the previous session's toast is still on screen after the identity changed"
+		).toBeNull();
+	});
+});
diff --git a/web/src/routes/[username]/[workspace]/library/libraryIdentityFence.test.ts b/web/src/routes/[username]/[workspace]/library/libraryIdentityFence.test.ts
new file mode 100644
index 000000000..5ef5ced53
--- /dev/null
+++ b/web/src/routes/[username]/[workspace]/library/libraryIdentityFence.test.ts
@@ -0,0 +1,406 @@
+/**
+ * BUG-3084 surface 3 — the SOURCE half. `libraryIdentityFence.svelte.test.ts`
+ * beside this file owns the SEMANTICS; this owns the POPULATION.
+ *
+ * Separating the two is the reusable part of this family. The behavioural suite
+ * can only speak for the handlers it drives; this one enumerates every commit
+ * point on the page and fails when a new member arrives, which is what stops a
+ * later handler being added without a fence and nobody noticing.
+ *
+ * Every rule here is the family's, carried from surfaces 1 and 2 rather than
+ * re-derived — including the two that were learned the hard way:
+ *   - the re-stamp must come AFTER the state it vouches for, and on every path
+ *     that leaves the page usable (roles board checkpoint 14);
+ *   - a continuation that has LOST the identity writes no shared interaction
+ *     state, because the identity listener already reset it and someone else
+ *     owns it now (roles board, codex round 4).
+ */
+import { describe, it, expect } from 'vitest';
+import { readFenceSource, withoutCatchArms } from '../../../../test/identityFenceSource';
+
+const src = readFenceSource(new URL('./+page.svelte', import.meta.url));
+const CODE = src.code;
+
+describe('the library page fences every async commit point', () => {
+	it('declares the page-level fence helpers, re-stamped after the load lands', () => {
+		expect(
+			CODE,
+			'identityEpochAtLoad is not $state, so the $effect reading pageIdentityHeld() would not ' +
+				're-run when the epoch is re-stamped'
+		).toMatch(/let\s+identityEpochAtLoad\s*=\s*\$state\(authStore\.identityEpoch\)/);
+		expect(CODE).toMatch(
+			/function captureIdentity\(\)\s*:\s*number\s*\{[\s\S]*?return authStore\.identityEpoch/
+		);
+		expect(CODE).toMatch(
+			/function identityHeld\(captured: number\)\s*:\s*boolean\s*\{[\s\S]*?authStore\.identityEpoch === captured/
+		);
+		expect(CODE).toMatch(
+			/function pageIdentityHeld\(\)\s*:\s*boolean\s*\{[\s\S]*?authStore\.identityEpoch === identityEpochAtLoad/
+		);
+
+		// THE RE-STAMP POSITION, bounded on BOTH sides because each bound has
+		// its own failure mode: too early and the guard vouches for data it has
+		// not replaced; missing on a path and a transient error pins the fence
+		// shut for ever.
+		const load = src.asyncFunctions().get('loadData');
+		expect(load, 'loadData() was renamed — re-point this guard').toBeDefined();
+
+		const firstAwait = load!.indexOf('await');
+		expect(firstAwait, 'loadData no longer awaits — this guard measures nothing').toBeGreaterThan(-1);
+		expect(
+			load!.slice(0, firstAwait),
+			'loadData re-stamps identityEpochAtLoad BEFORE its await: every fence reading it then ' +
+				"vouches for the previous session's data for the whole round-trip"
+		).not.toMatch(/identityEpochAtLoad\s*=/);
+
+		const tail = load!.slice(firstAwait);
+		const restamp = tail.indexOf('identityEpochAtLoad =');
+		expect(restamp, 'loadData never re-stamps — the fence can never recover').toBeGreaterThan(-1);
+		expect(
+			tail.slice(0, restamp),
+			'the epoch is re-stamped before the sets the activate handlers read are replaced'
+		).toContain('activeConventionTitles = new Set(');
+		expect(
+			(tail.match(/identityEpochAtLoad\s*=/g) ?? []).length,
+			'identityEpochAtLoad is re-stamped on only one path out of loadData — the other leaves ' +
+				'the page permanently fenced against its own user'
+		).toBe(2);
+	});
+
+	it('subscribes to identity changes, re-loads, resets, and unsubscribes', () => {
+		expect(
+			CODE,
+			'the page does not subscribe to authStore.onIdentityChange. Its $effect is keyed on wsSlug ' +
+				'alone, so nothing re-runs the load when the identity moves and pageIdentityHeld() ' +
+				'refuses for ever after a sign-in'
+		).toMatch(/authStore\.onIdentityChange\(/);
+
+		const sub = CODE.slice(CODE.indexOf('authStore.onIdentityChange('));
+		const listener = sub.slice(0, sub.indexOf('\t});'));
+		expect(listener, 'the identity-change listener does not re-run loadData').toMatch(/loadData\(/);
+		expect(
+			listener,
+			'the listener does not reset transient interaction state: activatingTitle gates both ' +
+				'activate handlers at their first line, so a stale value latches them shut'
+		).toMatch(/resetTransientState\(\)/);
+		expect(CODE).toMatch(/onDestroy\(stopIdentityWatch\)/);
+	});
+
+	it('the recovery never leaves a fence vouching for state it has not replaced', () => {
+		// THE FAMILY PROPERTY, satisfied two ways. Surface 1 (#1374) and
+		// settings (#1370) clear before re-loading; the roles board and this
+		// page re-stamp late. Asserted as a disjunction so a later surface may
+		// hold it either way — but NEITHER is the failure this catches.
+		const sub = CODE.slice(CODE.indexOf('authStore.onIdentityChange('));
+		const listener = sub.slice(0, sub.indexOf('\t});'));
+		const clearsFirst =
+			/activeConventionTitles\s*=\s*new Set\(\)/.test(listener) &&
+			listener.indexOf('activeConventionTitles') < listener.indexOf('loadData(');
+
+		const load = src.asyncFunctions().get('loadData')!;
+		const firstAwait = load.indexOf('await');
+		const tail = firstAwait > -1 ? load.slice(firstAwait) : '';
+		const restamp = tail.indexOf('identityEpochAtLoad =');
+		const restampsLate =
+			firstAwait > -1 &&
+			!/identityEpochAtLoad\s*=/.test(load.slice(0, firstAwait)) &&
+			restamp > -1 &&
+			tail.slice(0, restamp).includes('activeConventionTitles = new Set(');
+
+		expect(
+			clearsFirst || restampsLate,
+			'the identity-change reload neither clears the state the page-level fence vouches for nor ' +
+				'defers the re-stamp until the new data lands. Either is fine; neither means every ' +
+				"pageIdentityHeld() during the reload answers TRUE over the previous session's data."
+		).toBe(true);
+	});
+
+	it('fences the handlers that WRITE state the previous identity chose', () => {
+		// The roles board's handleDndFinalize class. An entry capture asks "has
+		// the identity moved since this work started"; these handlers' work
+		// starts with a CLICK, always the current epoch, over a library entry
+		// chosen against the list the PREVIOUS identity loaded.
+		const MUST_HOLD_THE_PAGE = {
+			activateConvention: 'activates a convention chosen from the previous list',
+			activatePlaybook: 'activates a playbook chosen from the previous list',
+		};
+		const missing: string[] = [];
+		for (const [name, why] of Object.entries(MUST_HOLD_THE_PAGE)) {
+			const body = src.asyncFunctions().get(name);
+			expect(body, `${name}() was renamed — re-point this guard`).toBeDefined();
+			const head = body!.indexOf('await') > -1 ? body!.slice(0, body!.indexOf('await')) : body!;
+			if (!head.includes('pageIdentityHeld()')) missing.push(`${name} (${why})`);
+		}
+		expect(
+			missing,
+			'these handlers write state the PREVIOUS identity chose but check only an entry capture, ' +
+				'which a click after the identity change always passes'
+		).toEqual([]);
+	});
+
+	it('fences every DEFERRED TIMER, which is why this population is 7 and not 3', () => {
+		// The four timers are the members a function-level count cannot see, and
+		// the filed survey missed all four (BUG-3084 checkpoint 6). Each fires
+		// three seconds after its handler returned and writes `toast` — a commit
+		// point whose whole nature is to land late.
+		const timers = src.deferredTimers();
+		expect(timers.length, 'the timer population changed — disposition the new member').toBe(4);
+		const unfenced = timers
+			.filter((t) => !/identityHeld\(/.test(t.body))
+			.map((t) => t.body.slice(0, 60).replace(/\s+/g, ' '));
+		expect(
+			unfenced,
+			'these deferred callbacks commit without checking the identity, so a timer armed by the ' +
+				"previous session clears a toast belonging to whoever is signed in now"
+		).toEqual([]);
+
+		// AND THEY MUST STILL DO THEIR JOB (codex round 1 [P2]). A fence is only
+		// half the requirement: a callback that checks the identity and then
+		// clears nothing satisfies the assertion above while leaving the toast
+		// on screen for ever. Fixing a stale-write bug by making the write never
+		// happen is the failure this family already shipped once, in the shape
+		// of a fence that latched shut (#1372).
+		const inert = timers
+			.filter((t) => !/toast = null/.test(t.body))
+			.map((t) => t.body.slice(0, 60).replace(/\s+/g, ' '));
+		expect(
+			inert,
+			'these deferred callbacks no longer clear the toast at all — a fence that removes the ' +
+				'behaviour instead of conditioning it'
+		).toEqual([]);
+	});
+
+	it('the identity-change listener resets every piece of transient interaction state', () => {
+		// ENUMERATED rather than sampled (CONVE-35). On the roles board this
+		// class produced findings in two consecutive review rounds before it was
+		// enumerated; carried here so this surface does not repeat that.
+		const reset = CODE.slice(CODE.indexOf('function resetTransientState()'));
+		const resetBody = reset.slice(0, reset.indexOf('\n\t}'));
+
+		const NOT_TRANSIENT: Record<string, string> = {
+			identityEpochAtLoad: 'identity bookkeeping — only loadData may write it',
+			categories: 'page DATA — loadData replaces it on both arms',
+			playbookCategories: 'page DATA — loadData replaces it on both arms',
+			activeConventionTitles: 'page DATA — loadData replaces it on both arms',
+			activePlaybookTitles: 'page DATA — loadData replaces it on both arms',
+			loading: "owned by loadData's generation-guarded finally",
+			activeTab:
+				'a view preference read from the URL, not interaction state: it belongs to the ' +
+				'viewer and carries nothing about either identity',
+		};
+
+		const declared = [...CODE.matchAll(/^\s*let\s+(\w+)\s*(?::[^=]*)?=\s*\$state/gm)].map((m) => m[1]!);
+		expect(declared.length, 'no $state declarations found — re-point this guard').toBeGreaterThan(5);
+
+		const undispositioned = declared.filter(
+			(n) => !(n in NOT_TRANSIENT) && !new RegExp(`\\b${n}\\s*=`).test(resetBody)
+		);
+		expect(
+			undispositioned,
+			'these $state values are neither page data nor reset by resetTransientState(). Each is ' +
+				'transient interaction state that survives an identity change: decide which it is and ' +
+				'either reset it or name it in this guard.'
+		).toEqual([]);
+	});
+
+	it('a lost-identity exit writes no shared interaction state', () => {
+		// The roles board's round-4 reversal, carried here so this surface never
+		// acquires the defect it corrected. `resetTransientState()` owns these;
+		// a stale continuation writing them again can only clobber what the NEW
+		// user is doing.
+		const SHARED = ['activatingTitle', 'toast'];
+		const offenders: string[] = [];
+		for (const [name, body] of src.asyncFunctions()) {
+			if (name === 'loadData') continue;
+
+			for (const m of body.matchAll(/if \(!(?:page)?[Ii]dentityHeld\([^)]*\)\)\s*\{([\s\S]*?)\}/g)) {
+				const arm = m[1] ?? '';
+				for (const v of SHARED) {
+					if (new RegExp(`\\b${v}\\s*=`).test(arm)) offenders.push(`${name}: ${v} (lost-identity arm)`);
+				}
+			}
+
+			// A continuation — after an await — must be checked SINCE that await.
+			// "Since the last await", not "on the same line": both spellings are
+			// correct and the family uses both (CONVE-30).
+			for (const m of body.matchAll(
+				new RegExp(`\\b(${SHARED.join('|')})\\s*=\\s*(?:null|false|true)`, 'g')
+			)) {
+				const at = m.index ?? 0;
+				const before = body.slice(0, at);
+				const lastAwait = before.lastIndexOf('await ');
+				if (lastAwait === -1) continue;
+				if (/identityHeld\(/.test(body.slice(lastAwait, at + m[0].length))) continue;
+				offenders.push(`${name}: ${m[1]} (continuation with no identity check since its await)`);
+			}
+		}
+		expect(
+			offenders,
+			'these lost-identity exits write shared interaction state that the identity listener has ' +
+				'already reset, so they can clobber what the NEW user is doing'
+		).toEqual([]);
+	});
+
+	it("a stale activation does not release the new identity's activate gate", () => {
+		// The `finally` counterpart, and it needs its own assertion because the
+		// continuation rule above CANNOT see it: that rule asks whether an
+		// identity check appears between the last await and the write, and a
+		// `finally` always has the success-path check somewhere in that window.
+		// The window is wide enough to be satisfied by a check that does not
+		// govern this write. Rather than pretend a regex can express "which
+		// check governs which statement", the two `finally` arms are named.
+		// (Found by mutant L6 surviving the first version of these assertions —
+		// the same way the roles board's M22 was found.)
+		//
+		// A deliberate ASYMMETRY with `loading` in loadData, which stays
+		// unconditional: nothing else clears `loading` and pinning the page at
+		// its skeleton is the worse failure, whereas `activatingTitle` IS
+		// cleared by `resetTransientState()` on every identity change — so a
+		// stale continuation clearing it again can only release a gate the NEW
+		// user's own click is holding, permitting a second concurrent activation.
+		for (const name of ['activateConvention', 'activatePlaybook']) {
+			const body = src.asyncFunctions().get(name);
+			expect(body, `${name}() was renamed — re-point this guard`).toBeDefined();
+			const fin = body!.indexOf('} finally {');
+			expect(fin, `${name} no longer has a finally arm — re-point this guard`).toBeGreaterThan(-1);
+			expect(
+				body!.slice(fin),
+				`${name} clears activatingTitle unconditionally, so a stale request releases the ` +
+					"new user's activate gate behind their back"
+			).toMatch(/if \(identityHeld\(epochAtEntry\)\) activatingTitle = null/);
+		}
+	});
+
+	it('the load effect is keyed on the workspace, not on the identity', () => {
+		// `loadData` reads `authStore.identityEpoch` synchronously before its
+		// first await, so an un-untracked effect takes a dependency on the epoch
+		// and re-runs on every identity change — on top of the listener that
+		// already re-loads for that event (codex round 1 [P2]). Correct on
+		// screen, double on the wire.
+		const eff = CODE.slice(CODE.indexOf('$effect(() => {'));
+		const body = eff.slice(0, eff.indexOf('\t});'));
+		expect(
+			body,
+			'the load effect calls loadData tracked, so it re-runs on an identity change as well as ' +
+				'a workspace change and every load is issued twice'
+		).toMatch(/untrack\(\(\) => loadData\(/);
+	});
+
+	it('a stale load may not write the page it no longer owns', () => {
+		// Different question from the identity fence, and neither implies the
+		// other: both loads can belong to the SAME user, which is exactly what a
+		// workspace switch produces on this page.
+		const load = src.asyncFunctions().get('loadData')!;
+		expect(load, 'loadData does not take a load generation').toMatch(/const myLoad = \+\+loadGen/);
+		expect(
+			(load.match(/if \(myLoad !== loadGen\) return;/g) ?? []).length,
+			'loadData does not gate its state writes on the load generation, so a stale load can ' +
+				'overwrite a newer one for the same user'
+		).toBeGreaterThanOrEqual(2);
+		expect(load.indexOf('if (myLoad !== loadGen) return;')).toBeLessThan(
+			load.indexOf('categories = libraryRes.categories')
+		);
+		expect(
+			load,
+			'loadData clears `loading` unconditionally, so a stale load can declare a newer one finished'
+		).toMatch(/if \(myLoad === loadGen\) loading = false/);
+	});
+
+	it('the error path clears the state its own re-stamp will vouch for', () => {
+		const load = src.asyncFunctions().get('loadData')!;
+		const cat = load.indexOf('} catch {');
+		expect(cat, 'loadData no longer has a catch arm — re-point this guard').toBeGreaterThan(-1);
+		const arm = load.slice(cat, load.indexOf('} finally {', cat));
+		expect(arm, 'a failed load leaves the previous identity\'s convention set in place').toMatch(
+			/activeConventionTitles = new Set\(\)/
+		);
+		expect(arm, 'a failed load leaves the previous identity\'s playbook set in place').toMatch(
+			/activePlaybookTitles = new Set\(\)/
+		);
+		expect(arm, 'a failed load never re-stamps, pinning the fence shut for ever').toMatch(
+			/identityEpochAtLoad\s*=/
+		);
+		expect(arm.indexOf('activeConventionTitles = new Set()')).toBeLessThan(
+			arm.indexOf('identityEpochAtLoad =')
+		);
+	});
+
+	it('enumerates the population it claims to cover', () => {
+		// COUNTS ASSERTED so a new member cannot arrive unnoticed. These are the
+		// widened instrument's four populations; the originally filed survey saw
+		// only the first and reported 3 (BUG-3084 checkpoint 6).
+		expect(src.asyncFunctions().size, 'a top-level async function was added or removed').toBe(3);
+		expect(src.markupAsyncArrows(), 'an inline async arrow appeared in the markup').toHaveLength(0);
+		expect(src.nestedAsyncCallbacks(), 'an async callback arrived').toHaveLength(0);
+		expect(src.deferredTimers(), 'a setTimeout/setInterval arrived or left').toHaveLength(4);
+	});
+
+	it('captures the identity at ENTRY in every async handler, before its first await', () => {
+		const missing: string[] = [];
+		for (const [name, body] of src.asyncFunctions()) {
+			if (!body.includes('await')) continue;
+			if (!body.slice(0, body.indexOf('await')).includes('captureIdentity()')) missing.push(name);
+		}
+		expect(
+			missing,
+			'these async handlers do not capture the identity before their first await. A fence ' +
+				'comparing against anything else can be defeated by a concurrent load re-stamping it.'
+		).toEqual([]);
+	});
+
+	it('never lets a handler compare against the PAGE load epoch after an await', () => {
+		// `pageIdentityHeld()` is legitimate BEFORE the await — it is the
+		// "does this page's data belong to the signed-in user" question. After
+		// an await it is the wrong instrument, because a concurrent load can
+		// re-stamp the value it reads to exactly what the handler expects.
+		const offenders: string[] = [];
+		for (const [name, body] of src.asyncFunctions()) {
+			if (name === 'loadData') continue;
+			const first = body.indexOf('await');
+			if (first === -1) continue;
+			if (body.slice(first).includes('pageIdentityHeld()')) offenders.push(name);
+		}
+		expect(
+			offenders,
+			'these handlers compare against the PAGE load epoch after an await, which a concurrent ' +
+				'load can re-stamp to the value the handler is about to read'
+		).toEqual([]);
+	});
+
+	it('checks the fence at least once per await in every async handler', () => {
+		const short: string[] = [];
+		for (const [name, body] of src.asyncFunctions()) {
+			const awaits = body.split('await ').length - 1;
+			if (awaits === 0) continue;
+			const checks =
+				body.split('identityHeld(').length - 1 + body.split('pageIdentityHeld()').length - 1;
+			if (checks < awaits) short.push(`${name} (${checks} checks for ${awaits} awaits)`);
+		}
+		expect(
+			short,
+			'these async handlers have fewer identity checks than awaits, so at least one continuation ' +
+				'commits unguarded'
+		).toEqual([]);
+	});
+
+	it('guards the SUCCESS continuation, not merely the failure one', () => {
+		// The window is the body with every CATCH ARM EXCISED. Splitting at the
+		// first `} catch` reports correct code as unguarded when a handler
+		// commits after its try/catch; balancing arms separately does the same
+		// for an await in a nested try. Both were tried on surface 1.
+		const unguarded: string[] = [];
+		for (const [name, body] of src.asyncFunctions()) {
+			const successOnly = withoutCatchArms(body);
+			const firstAwait = successOnly.indexOf('await ');
+			if (firstAwait === -1) continue;
+			if (!/identityHeld\(|pageIdentityHeld\(\)/.test(successOnly.slice(firstAwait))) {
+				unguarded.push(name);
+			}
+		}
+		expect(
+			unguarded,
+			'these handlers have no identity check between their first await and the end of their try ' +
+				'block, so the path a SUCCESSFUL request takes commits unguarded'
+		).toEqual([]);
+	});
+});
diff --git a/web/src/test/identityFenceSource.ts b/web/src/test/identityFenceSource.ts
index 921393e48..2a3aac1e1 100644
--- a/web/src/test/identityFenceSource.ts
+++ b/web/src/test/identityFenceSource.ts
@@ -24,6 +24,41 @@
 // worse than one that is red.
 import { readFileSync } from 'node:fs';
 
+/**
+ * REFUSAL IS NOT ABSENCE — the rule every surface in this family has now paid
+ * for at least once, placed here so surfaces 4-7 meet it before they write
+ * their first assertion (lead's ruling, BUG-3084 day 68).
+ *
+ * Every rule in this file asks a REFUSAL question: is a fence present, is it
+ * positioned before the commit, is there one per await, does it read the right
+ * epoch. Not one of them can tell a commit that was correctly REFUSED from a
+ * commit that never existed — and the second is a defect, not a fix.
+ *
+ * What that has actually cost, three times, in three costumes:
+ *   - #1372 shipped a fence that could detect the bad state and never leave it.
+ *     Ten guard assertions, nine behavioural legs and a 10/10 mutation matrix,
+ *     and not one asked whether the page still WORKED afterwards. Every mutant
+ *     weakened a fence, so the matrix could only ever measure under-protection.
+ *   - Surface 3's deferred timers: a callback that checked the identity and
+ *     then cleared nothing satisfied the guard AND the whole behavioural suite.
+ *     "Fix the stale write by making the write never happen" was passing.
+ *   - Surface 3's `activatePlaybook`: a handler near-identical to its sibling
+ *     was vouched for by source text alone, because every leg clicked the
+ *     sibling's button. Near-identical is exactly when a source assertion feels
+ *     sufficient and is not.
+ *
+ * So a surface using this core owes, alongside its refusal rules:
+ *   1. one case that moves the identity and then KEEPS USING the page;
+ *   2. for each fenced commit, one case under an UNCHANGED identity proving the
+ *      commit still happens;
+ *   3. a driven leg per handler, not per handler SHAPE — including the failure
+ *      arms, whose code a source guard reads and nothing executes.
+ *
+ * A guard that latches into the safe state is not a safe guard; it is an outage
+ * with good intentions, and it is harder to notice than the flapping it
+ * replaced, precisely because nothing looks wrong.
+ */
+
 export interface EnumeratedBlock {
 	/** How this block is named in a failure message. */
 	label: string;