diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8b1890..6752cdb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: omdsh-dev/deepseek-harness
-          ref: dsh-v0.1.7-alpha.1-a11y.2
+          ref: dsh-v0.1.7-alpha.1-a11y.4
           path: .assembled/dsh
       - uses: pnpm/action-setup@v6
         with:
diff --git a/COMPATIBILITY-0.1.7-alpha.1.md b/COMPATIBILITY-0.1.7-alpha.1.md
index bc0996f..ebfbc27 100644
--- a/COMPATIBILITY-0.1.7-alpha.1.md
+++ b/COMPATIBILITY-0.1.7-alpha.1.md
@@ -14,7 +14,11 @@ The core migration is committed as `b11b37b065` on `feat/a11y-core-0.1.7-alpha.1
 
 The companion's [first remote run](https://github.com/omdsh-dev/dsh-accessibility/actions/runs/35708472204) passed all six macOS/Windows/Linux × Node 22/24 matrix jobs and its assembled-browser contract against core `b11b37b065`. Core browser-accessibility contracts, Node compatibility, native builds, and packaging also passed remotely. These results do not mean the entire core CI passed.
 
-Core follow-up `41074ff082`, tagged `dsh-v0.1.7-alpha.1-a11y.2`, fixes the failures identified in that first run: retired Windows suite paths, upstream-only Project policy credentials, forbidden test casts, and a heartbeat fixture whose configured idle window had not followed its test migration. It retains assertions and historical evidence. The 124 focused tests passed; a separate final terminal run passed 20 tests, and the corrected headless heartbeat scenario passed. Of 59 local static gates, 57 passed in the aggregate run; the other two passed individual rechecks after repair. Host/client type checks passed. Companion CI now pins this follow-up tag; its new run and the complete core remote gates are pending. Do not publish or describe pending gates as passing.
+Core follow-up `41074ff082`, tagged `dsh-v0.1.7-alpha.1-a11y.2`, fixes the failures identified in that first run: retired Windows suite paths, upstream-only Project policy credentials, forbidden test casts, and a heartbeat fixture whose configured idle window had not followed its test migration. It retains assertions and historical evidence. The 124 focused tests passed; a separate final terminal run passed 20 tests, and the corrected headless heartbeat scenario passed. Of 59 local static gates, 57 passed in the aggregate run; the other two passed individual rechecks after repair. Host/client type checks passed. The [companion follow-up run](https://github.com/omdsh-dev/dsh-accessibility/actions/runs/35710243579) passed all six platform/runtime jobs, assembled checks, and its aggregate check; [PR #27](https://github.com/omdsh-dev/dsh-accessibility/pull/27) merged into `main`. The [second core run](https://github.com/omdsh-dev/deepseek-harness/actions/runs/35710192223) still failed coverage and Web checks, so it was not treated as merge-ready.
+
+Core candidate `dsh-v0.1.7-alpha.1-a11y.3` is pinned at `2f7eaf7865`. This candidate fixes duplicate ArrowUp/ArrowDown handling at the subagent catalog trigger and adds missing focus/JSON-conflict coverage. Test fixtures follow the current PowerShell prompt protocol, keep relative paths relative across Windows drives, own their ACL inheritance, and observe Client registry readiness independently of a populated session tree. Local validation passed 279 focused tests with 100% coverage of the five affected coverage owners, 7,398 GUI tests with one skip, and 486 read-only Web tests with 15 conditional skips. Three real PowerShell tests passed on macOS using a checksum-verified temporary PowerShell runtime. An initial Firefox focus check failed during overlapping local validation; its diagnostic reruns and the final isolated three-engine run passed. The isolated result is Chromium 14 passed, Firefox/WebKit 13 passed plus one unsupported forced-colors skip each. These results do not certify real assistive-technology use. [Core PR #4](https://github.com/omdsh-dev/deepseek-harness/pull/4) owns the current remote verdict and targets `baseline/dsh-v0.1.7-alpha.1`, not the older `master`; merge requires all remote checks, including Windows coverage, to pass. npm publication is separate and remains unperformed.
+
+The [third core run](https://github.com/omdsh-dev/deepseek-harness/actions/runs/35715728279) passed 24 checks, including Linux coverage, Web replay, and the Windows ACL runner tests, but Windows coverage failed two unrelated test constraints. The account cookie test required a fixed arrival order for concurrent profile/balance requests, and the full compiler inventory took 65 seconds under a 60-second test override despite the lane's existing 90-second budget. Core `0f8480ec06`, tagged `dsh-v0.1.7-alpha.1-a11y.4`, preserves exact request counts, serial login/logout order, cookies, token/privacy assertions, and schema rejection checks while allowing the two concurrent requests in either order and restoring the compiler test to the lane budget. Its 112 focused local tests passed. Companion CI now pins this fourth candidate; the earlier tags and failed runs remain unchanged. The same full remote merge requirements and pending real-AT validation still apply.
 
 ## Exact upstream target
 
diff --git a/COMPATIBILITY-0.1.7-alpha.1.zh.md b/COMPATIBILITY-0.1.7-alpha.1.zh.md
index 154288e..267f9a5 100644
--- a/COMPATIBILITY-0.1.7-alpha.1.zh.md
+++ b/COMPATIBILITY-0.1.7-alpha.1.zh.md
@@ -14,7 +14,11 @@
 
 插件的[首轮远端验证](https://github.com/omdsh-dev/dsh-accessibility/actions/runs/35708472204)已通过 macOS/Windows/Linux × Node 22/24 六组矩阵，以及基于核心 `b11b37b065` 的组装浏览器检查。核心无障碍浏览器检查、Node 兼容、原生构建和打包也已在远端通过。这不代表核心完整 CI 已通过。
 
-核心后续提交 `41074ff082` 使用新标签 `dsh-v0.1.7-alpha.1-a11y.2`，修复首轮发现的旧 Windows 测试路径、仅属于上游的 Project 策略凭据、被新版规范禁止的测试类型断言，以及空闲窗口未随测试迁移的心跳夹具，保留断言和历史证据。124 项定向测试通过；最终单独终端回归通过 20 项，修正后的 headless 心跳场景通过。本地 59 项静态门禁中，57 项在整轮通过，另外两项修复后单独复查通过；主机端/客户端类型检查通过。插件 CI 已改为固定此后续标签，新一轮验证和核心完整远端门禁仍待完成。尚不发布，也不将待完成检查描述为通过。
+核心后续提交 `41074ff082` 使用新标签 `dsh-v0.1.7-alpha.1-a11y.2`，修复首轮发现的旧 Windows 测试路径、仅属于上游的 Project 策略凭据、被新版规范禁止的测试类型断言，以及空闲窗口未随测试迁移的心跳夹具，保留断言和历史证据。124 项定向测试通过；最终单独终端回归通过 20 项，修正后的 headless 心跳场景通过。本地 59 项静态门禁中，57 项在整轮通过，另外两项修复后单独复查通过；主机端/客户端类型检查通过。插件的[后续验证](https://github.com/omdsh-dev/dsh-accessibility/actions/runs/35710243579)已通过六组平台/运行时检查、组装检查和汇总检查，[PR #27](https://github.com/omdsh-dev/dsh-accessibility/pull/27)已合入 `main`。[第二轮核心检查](https://github.com/omdsh-dev/deepseek-harness/actions/runs/35710192223)的覆盖率与 Web 检查仍失败，因此没有将核心视为可合入状态。
+
+核心候选 `dsh-v0.1.7-alpha.1-a11y.3` 固定在 `2f7eaf7865`。此候选修复子代理目录触发器重复处理 ArrowUp/ArrowDown 的问题，并补齐焦点与 JSON 模式冲突的覆盖率测试。测试夹具遵循当前 PowerShell 提示符协议，确保 Windows 跨盘符情况下仍使用相对路径，自行控制 ACL 继承，并独立于会话树是否有内容来判断客户端注册表就绪。本地通过 279 项定向测试，五个对应源码文件覆盖率均为 100%；GUI 通过 7,398 项、跳过一项；只读 Web 回放通过 486 项、按条件跳过 15 项。使用校验和核验后的临时 PowerShell 运行时，在 macOS 上通过三项真实 PowerShell 测试。最初一次 Firefox 焦点检查在本地验证交叠期间失败，随后诊断复跑与最终独立三浏览器检查通过；独立结果为 Chromium 通过 14 项，Firefox/WebKit 各通过 13 项、各跳过一项不受支持的强制颜色检查。这些结果不是真实辅助技术使用认证。当前远端结果以[核心 PR #4](https://github.com/omdsh-dev/deepseek-harness/pull/4)为准，合入目标是 `baseline/dsh-v0.1.7-alpha.1`，不是较旧的 `master`；包括 Windows 覆盖率在内的全部远端检查通过后才可合入。npm 发布是独立步骤，本次尚未执行。
+
+在[第三轮核心检查](https://github.com/omdsh-dev/deepseek-harness/actions/runs/35715728279)中，24 项检查通过，包括 Linux 覆盖率、Web 回放；Windows ACL 运行器测试也已通过，但 Windows 覆盖率因另外两处测试约束失败。账户 Cookie 测试要求并发的资料和余额请求按固定顺序到达；全仓编译器扫描耗时 65 秒，超过测试自行设置的 60 秒上限，而该任务已有 90 秒预算。核心 `0f8480ec06` 使用新标签 `dsh-v0.1.7-alpha.1-a11y.4`，保留精确请求数量、登录/退出的串行顺序、Cookie、令牌/隐私断言及模式拒绝检查，只允许两条并发请求以任意顺序到达，并将编译器测试恢复到任务预算。本地 112 项定向测试通过。插件 CI 现固定到第四个候选，之前的标签和失败记录保持不变；完整远端合入条件和真实辅助技术待验证状态不变。
 
 ## 固定上游目标