diff --git a/.github/CI.md b/.github/CI.md
index 48828db..e799ee7 100644
--- a/.github/CI.md
+++ b/.github/CI.md
@@ -306,12 +306,17 @@ The legacy local `shard-union` stage still requires twelve receipts; explicit Li
 and macOS stages each require exactly six, with no fallback to available platforms.
 
 Qualification remains pending: seven macOS test failures remain unresolved.
-The default owner-service locator also remains broken: the native user temporary
-root plus the full socket key can exceed macOS's 103-byte socket pathname limit.
-A writable database open can succeed while the separate owner service fails to start.
-A repair and independent native owner/reader proof are still pending; prior reader
-authentication results do not prove the default locator. These are open follow-up
-items, not passing evidence. Completion requires identifying and fixing each failure in source, verifying
+The pinned ContextDB macOS default locator now canonicalizes the fixed system
+temporary root `/tmp` and uses a private per-effective-UID directory with the full
+socket key. Focused upstream engine coverage consists of five integration cases
+actually run on the pinned revision and three unchanged library cases carried
+from an older revision, not eight newly executed cases. The only reader
+authentication proof is from a separate earlier ContextDB candidate, not the
+pinned revision; prior reader authentication results do not prove the pinned
+default locator or full Context Graph qualification. Full Context Graph macOS
+consumer qualification, including the integrated default owner/reader locator,
+remains pending. These are open follow-up items, not passing evidence.
+Completion requires identifying and fixing each failure in source, verifying
 locator behavior, running all five macOS jobs with all six valid receipts on the exact
 integrated source, and reviewing the resulting evidence before changing qualification.
 No issue number or hosted green result is claimed.
diff --git a/Cargo.lock b/Cargo.lock
index 4fcd89e..6883019 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -912,7 +912,7 @@ dependencies = [
 [[package]]
 name = "contextdb-core"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "bincode 2.0.1",
  "rand 0.9.4",
@@ -926,7 +926,7 @@ dependencies = [
 [[package]]
 name = "contextdb-engine"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "bao-tree",
  "bincode 2.0.1",
@@ -971,7 +971,7 @@ dependencies = [
 [[package]]
 name = "contextdb-graph"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "contextdb-core",
  "contextdb-tx",
@@ -982,7 +982,7 @@ dependencies = [
 [[package]]
 name = "contextdb-hnsw"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "anndists",
  "anyhow",
@@ -1006,7 +1006,7 @@ dependencies = [
 [[package]]
 name = "contextdb-parser"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "contextdb-core",
  "pest",
@@ -1016,7 +1016,7 @@ dependencies = [
 [[package]]
 name = "contextdb-planner"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "contextdb-core",
  "contextdb-parser",
@@ -1025,7 +1025,7 @@ dependencies = [
 [[package]]
 name = "contextdb-redb"
 version = "4.1.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "libc",
 ]
@@ -1033,7 +1033,7 @@ dependencies = [
 [[package]]
 name = "contextdb-relational"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "contextdb-core",
  "contextdb-tx",
@@ -1044,7 +1044,7 @@ dependencies = [
 [[package]]
 name = "contextdb-server"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "blake3",
  "clap",
@@ -1072,7 +1072,7 @@ dependencies = [
 [[package]]
 name = "contextdb-tx"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "contextdb-core",
  "parking_lot",
@@ -1081,7 +1081,7 @@ dependencies = [
 [[package]]
 name = "contextdb-vector"
 version = "1.0.0"
-source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905"
+source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c"
 dependencies = [
  "anndists",
  "contextdb-core",
diff --git a/Cargo.toml b/Cargo.toml
index dcb918a..67f7a35 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,11 +44,11 @@ candle-core = { path = "vendor/candle-core", version = "=0.10.2" }
 candle-nn = { path = "vendor/candle-nn", version = "=0.10.2" }
 candle-transformers = { path = "vendor/candle-transformers", version = "=0.10.2" }
 criterion = { version = "0.8", features = ["html_reports"] }
-contextdb-core = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-engine = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-parser = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-tx = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
-contextdb-vector = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" }
+contextdb-core = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-engine = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-parser = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-tx = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
+contextdb-vector = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" }
 safetensors = "0.7.0"
 sha2 = "0.10.9"
 tempfile = "3.23.0"
diff --git a/README.md b/README.md
index 519c6b9..2cc49c1 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,7 @@ Use the [download guide](docs/download.md) for wget, receipts and provenance ver
 
 The pinned toolchain in `rust-toolchain.toml` is Rust **1.94.1**. <!-- enforced by: `readme_states_the_rust_version_rust_toolchain_toml_pins` -->
 
-ContextDB is pinned to `bc9cce955eb85fb1488f5304426eedeb6d97e905` in the manifests and lockfile. <!-- enforced by: `manifests_lockfile_and_readme_name_the_same_exact_contextdb_revision` -->
+ContextDB is pinned to `db9d067f291c0add0922713936a63f51f24e9f1c` in the manifests and lockfile. <!-- enforced by: `manifests_lockfile_and_readme_name_the_same_exact_contextdb_revision` -->
 
 Linux is required by `PR checks`; macOS runs in the separate, nonblocking `macOS advisory` workflow. See the [macOS qualification follow-up](.github/CI.md#macos-qualification-follow-up). <!-- enforced by: `cg_github_actions_workflow_runs_on_matrix_of_macos_latest_ubuntu_latest_and_documents_the_deliberate_windows_exclusion` -->
 
diff --git a/crates/cg-cli/Cargo.toml b/crates/cg-cli/Cargo.toml
index 00d0068..d73e97a 100644
--- a/crates/cg-cli/Cargo.toml
+++ b/crates/cg-cli/Cargo.toml
@@ -43,7 +43,7 @@ cg-cli-conventions.workspace = true
 context-graph = { path = "../context-graph", features = ["fabric-sync"] }
 contextdb-core.workspace = true
 contextdb-engine.workspace = true
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh"] }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh"] }
 fs4.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
@@ -63,6 +63,6 @@ context-graph-cli = { path = ".", features = ["status-fault-injection"] }
 # compiled behind contextdb-engine's `test-seams` feature. This is a test-only activation — the
 # `cg` binary's own dependency edge on contextdb-engine does not enable it.
 contextdb-engine = { workspace = true, features = ["test-seams"] }
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh", "test-seams"] }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh", "test-seams"] }
 libc = "0.2"
 tempfile.workspace = true
diff --git a/crates/cg-cli/tests/cli_acceptance.rs b/crates/cg-cli/tests/cli_acceptance.rs
index 3f32bad..e533afd 100644
--- a/crates/cg-cli/tests/cli_acceptance.rs
+++ b/crates/cg-cli/tests/cli_acceptance.rs
@@ -2690,25 +2690,19 @@ fn reply_extraction_engine_matches_recorded_envelopes() {
     let claude = extract_reply("claude", "json", CLAUDE_SUCCESS, None);
     assert_eq!(
         claude.as_deref(),
-        Ok(
-            "Host session proof received. I can answer through the logged-in Claude CLI; turn capture should stay off until ingestion ships."
-        ),
+        Ok("The logged-in Claude CLI returned this completion."),
         "claude JSON framing must extract /result"
     );
     let codex = extract_reply("codex", "file", "", Some(&codex_file));
     assert_eq!(
         codex.as_deref(),
-        Ok(
-            "Host session proof received. I can answer through this logged-in Codex CLI; no turn capture should begin until ingestion ships.\n"
-        ),
+        Ok("The logged-in Codex CLI returned this completion.\n"),
         "codex file framing must read --output-last-message"
     );
     let agy = extract_reply("agy", "text", AGY_PLAIN, None);
     assert_eq!(
         agy.as_deref(),
-        Ok(
-            "Host session proof received. I can answer through the local Agy CLI; capture remains disabled until ingestion ships.\n"
-        ),
+        Ok("The local Agy CLI returned this completion.\n"),
         "text framing returns the whole stdout"
     );
     let missing = extract_reply("claude", "json", "{\"type\":\"result\"}", None);
diff --git a/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt b/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt
index 632b64b..5840b76 100644
--- a/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt
+++ b/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt
@@ -1 +1 @@
-Host session proof received. I can answer through the local Agy CLI; capture remains disabled until ingestion ships.
+The local Agy CLI returned this completion.
diff --git a/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json b/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json
index b46321f..33649b1 100644
--- a/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json
+++ b/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json
@@ -6,7 +6,7 @@
   "duration_ms": 2427,
   "duration_api_ms": 1896,
   "num_turns": 1,
-  "result": "Host session proof received. I can answer through the logged-in Claude CLI; turn capture should stay off until ingestion ships.",
+  "result": "The logged-in Claude CLI returned this completion.",
   "session_id": "6d8b4cb2-7f16-4c84-9e7f-9a43d7a51c30",
   "total_cost_usd": 0.000278,
   "usage": {
diff --git a/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt b/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt
index 1d1e4d4..80791f0 100644
--- a/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt
+++ b/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt
@@ -1 +1 @@
-Host session proof received. I can answer through this logged-in Codex CLI; no turn capture should begin until ingestion ships.
+The logged-in Codex CLI returned this completion.
diff --git a/crates/context-graph/Cargo.toml b/crates/context-graph/Cargo.toml
index b570cfd..42a51e1 100644
--- a/crates/context-graph/Cargo.toml
+++ b/crates/context-graph/Cargo.toml
@@ -44,7 +44,7 @@ chrono = { workspace = true, features = ["serde"] }
 contextdb-core.workspace = true
 contextdb-engine.workspace = true
 contextdb-parser.workspace = true
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh"], optional = true }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh"], optional = true }
 fs4.workspace = true
 pollster.workspace = true
 rayon.workspace = true
@@ -71,7 +71,7 @@ candle-nn.workspace = true
 candle-transformers.workspace = true
 cg-catalog = { path = "../cg-catalog", features = ["embeddinggemma-test-support"] }
 cg-connector-claude-code.workspace = true
-contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh", "test-seams"] }
+contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh", "test-seams"] }
 contextdb-engine = { workspace = true, features = ["test-seams"] }
 contextdb-tx.workspace = true
 contextdb-vector = { workspace = true, features = ["test-seams"] }
diff --git a/crates/context-graph/tests/common/ci_stages.rs b/crates/context-graph/tests/common/ci_stages.rs
index e654169..61870f7 100644
--- a/crates/context-graph/tests/common/ci_stages.rs
+++ b/crates/context-graph/tests/common/ci_stages.rs
@@ -262,7 +262,7 @@ fn model_contract_matches(
         && format!("{:x}", Sha256::digest(core.0))
             == "9feafef445a5364998c90178048e781f08b9840595a311f9f7bf620b2c0798d9"
         && format!("{:x}", Sha256::digest(core.1))
-            == "125356acd39f98d17aa3806ea4e94d3ae7ad7ba4d00e9399e6a184cf8cd70867"
+            == "175554cfa8b78e96def6645acce2ef8d6eea899ad3826d2f2355593d5df05c62"
 }
 
 fn shard_contract_is_frozen(script: &str) -> bool {
@@ -362,11 +362,11 @@ fn shard_contract_is_frozen(script: &str) -> bool {
         && format!(
             "{:x}",
             Sha256::digest(include_bytes!("../../../../Cargo.toml"))
-        ) == "ab995589c0159a218d0fd370a539c2994b6008e7e64b0d3e171062e6e0b11e85"
+        ) == "120776aefc6ae100986f4b51e837a64012df52604c3a2b59b14d3d0021a01520"
         && format!(
             "{:x}",
             Sha256::digest(include_bytes!("../../../../Cargo.lock"))
-        ) == "3d835eba6e63d7839a0eb78ca6715fb805a95509a8dcaf0df7fdc699907a9b84"
+        ) == "d08e10eb22f8394b21522c2d19b85d1a27b05bc7c3892a072acb8ef1167c02ec"
         && format!(
             "{:x}",
             Sha256::digest(include_bytes!(
diff --git a/scripts/tests/test_ci_model_seed.py b/scripts/tests/test_ci_model_seed.py
index 99bfd25..322a2e7 100644
--- a/scripts/tests/test_ci_model_seed.py
+++ b/scripts/tests/test_ci_model_seed.py
@@ -19,7 +19,7 @@ class SeedArtifact(unittest.TestCase):
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory()
         self.addCleanup(self.temp.cleanup)
-        self.root = Path(self.temp.name)
+        self.root = Path(self.temp.name).resolve()
         self.patch = mock.patch.object(seed, 'ROOT', self.root)
         self.patch.start()
         self.addCleanup(self.patch.stop)
diff --git a/scripts/tests/test_ci_shards.py b/scripts/tests/test_ci_shards.py
index 8156fa8..da60767 100644
--- a/scripts/tests/test_ci_shards.py
+++ b/scripts/tests/test_ci_shards.py
@@ -542,7 +542,7 @@ def test_isolated_audit_manifest_lock_and_source_boundary(self):
         lock_digest = 'e6a98ee802ad0f1e9e3696f87daa40c6b7a78c6bb9424f6472f1afd4a798a55f'
         def valid(body, lock_bytes, root_manifest):
             return (body == expected and hashlib.sha256(lock_bytes).hexdigest() == lock_digest
-                    and hashlib.sha256(root_manifest).hexdigest() == 'ab995589c0159a218d0fd370a539c2994b6008e7e64b0d3e171062e6e0b11e85')
+                    and hashlib.sha256(root_manifest).hexdigest() == '120776aefc6ae100986f4b51e837a64012df52604c3a2b59b14d3d0021a01520')
         self.assertTrue(valid(expected, lock.read_bytes(), (ROOT / 'Cargo.toml').read_bytes()))
         for key, value in [('edition', '2021'), ('autotests', True), ('publish', True)]:
             changed = copy.deepcopy(expected); changed['package'][key] = value