diff --git a/.github/agents/QA_Security.agent.md b/.github/agents/QA_Security.agent.md
index f9f26eda..3093f9c9 100644
--- a/.github/agents/QA_Security.agent.md
+++ b/.github/agents/QA_Security.agent.md
@@ -13,12 +13,12 @@ You are a QA AND SECURITY ENGINEER responsible for testing and vulnerability ass
 
 <context>
 
-- **MANDATORY**: Read all relevant instructions in `.github/instructions/` for the specific task before starting.
+- **MANDATORY**: Read all relevant instructions in `.github/instructions/**` for the specific task before starting.
 - Charon is a self-hosted reverse proxy management tool
 - Backend tests: `.github/skills/test-backend-unit.SKILL.md`
 - Frontend tests: `.github/skills/test-frontend-react.SKILL.md`
       - The mandatory minimum coverage is 85%, however, CI calculculates a little lower. Shoot for 87%+ to be safe.
-- E2E tests: `npx playwright test --project=chromium --project=firefox --project=webkit`
+- E2E tests: The entire E2E suite takes a long time to run, so target specific suites/files based on the scope of changes and risk areas. Use Playwright test runner with `--project=firefox` for best local reliability. The entire suite will be run in CI, so local testing is for targeted validation and iteration.
 - Security scanning:
    - GORM: `.github/skills/security-scan-gorm.SKILL.md`
    - Trivy: `.github/skills/security-scan-trivy.SKILL.md`
diff --git a/docs/issues/manual_test_auth_fixture_token_refresh_cache_regressions.md b/docs/issues/manual_test_auth_fixture_token_refresh_cache_regressions.md
new file mode 100644
index 00000000..3bcd961b
--- /dev/null
+++ b/docs/issues/manual_test_auth_fixture_token_refresh_cache_regressions.md
@@ -0,0 +1,93 @@
+---
+title: Manual Test Plan - Auth Fixture Token Refresh/Cache Regressions
+status: Open
+priority: High
+assignee: QA
+labels: testing, auth, regression
+---
+
+## Objective
+
+Validate that recent auth fixture token refresh/cache updates do not introduce login instability, stale session behavior, or parallel test flakiness.
+
+## Preconditions
+
+- Charon test environment is running and reachable.
+- A valid test user account is available.
+- Browser context can be reset between scenarios (clear cookies and site data).
+- Test runner can execute targeted auth fixture scenarios.
+
+## Scenarios
+
+### 1) Baseline Login and Session Reuse
+
+- Step: Sign in once with valid credentials.
+- Step: Run an action that requires authentication.
+- Step: Run a second authenticated action without re-authenticating.
+- Expected outcome:
+  - First action succeeds.
+  - Second action succeeds without unexpected login prompts.
+  - No session-expired message appears.
+
+### 2) Token Refresh Near Expiry
+
+- Step: Start with a session near refresh threshold.
+- Step: Trigger an authenticated action that forces token refresh path.
+- Step: Continue with another authenticated action.
+- Expected outcome:
+  - Refresh occurs without visible interruption.
+  - Follow-up authenticated action succeeds.
+  - No unauthorized or redirect loop behavior occurs.
+
+### 3) Concurrent Authenticated Actions
+
+- Step: Trigger multiple authenticated actions at the same time.
+- Step: Observe completion and authentication state.
+- Expected outcome:
+  - Actions complete without random auth failures.
+  - No intermittent unauthorized responses.
+  - Session remains valid after all actions complete.
+
+### 4) Cache Reuse Across Test Steps
+
+- Step: Complete one authenticated test step.
+- Step: Move to the next step in the same run.
+- Step: Verify auth state continuity.
+- Expected outcome:
+  - Auth state is reused when still valid.
+  - No unnecessary re-login is required.
+  - No stale-token error appears.
+
+### 5) Clean-State Reset Behavior
+
+- Step: Clear session data for a clean run.
+- Step: Trigger an authenticated action.
+- Step: Sign in again when prompted.
+- Expected outcome:
+  - User is correctly prompted to authenticate.
+  - New session works normally after sign-in.
+  - No residual state from previous run affects behavior.
+
+## Bug Capture Template
+
+Use this template for each defect found.
+
+- Title:
+- Date/Time (UTC):
+- Tester:
+- Environment (branch/commit, browser, OS):
+- Scenario ID:
+- Preconditions used:
+- Steps to reproduce:
+  1.
+  2.
+  3.
+- Expected result:
+- Actual result:
+- Frequency (always/intermittent/once):
+- Severity (critical/high/medium/low):
+- Evidence:
+  - Screenshot path:
+  - Video path:
+  - Relevant log snippet:
+- Notes:
diff --git a/docs/plans/current_spec.md b/docs/plans/current_spec.md
index 0224fb31..29bee1fe 100644
--- a/docs/plans/current_spec.md
+++ b/docs/plans/current_spec.md
@@ -465,6 +465,89 @@ Rollback:
 
 - Revert config-only commit; no application runtime risk.
 
+### PR-3 Addendum — `js/insecure-temporary-file` in auth token cache
+
+#### Scope and intent
+
+This addendum defines the concrete remediation plan for the CodeQL `js/insecure-temporary-file` pattern in `tests/fixtures/auth-fixtures.ts`, focused on token cache logic that currently persists refreshed auth tokens to temporary files (`token.lock`, `token.json`) under OS temp storage.
+
+#### 1) Root cause analysis
+
+- The fixture stores bearer tokens on disk in a temp location, which is unnecessary for test execution and increases secret exposure risk.
+- Even with restrictive permissions and lock semantics, the pattern still relies on filesystem primitives in a shared temp namespace and is flagged as insecure temporary-file usage.
+- The lock/cache design uses predictable filenames (`token.lock`, `token.json`) and file lifecycle management; this creates avoidable risk and complexity for what is effectively process-local test state.
+- The vulnerability is in the storage approach, not only in file flags/permissions; therefore suppression is not an acceptable fix.
+
+#### 2) Recommended proper fix (no suppression)
+
+- Replace file-based token cache + lock with an in-memory cache guarded by an async mutex/serialization helper.
+- Keep existing behavior contract intact:
+  - cached token reuse while valid,
+  - refresh when inside threshold,
+  - safe concurrent calls to `refreshTokenIfNeeded`.
+- Remove all temp-directory/file operations from the token-cache path.
+- Preserve JWT expiry extraction and fallback behavior when refresh fails.
+
+Design target:
+
+- `TokenCache` remains as a module-level in-memory object.
+- Introduce a module-level promise-queue lock helper (single-writer section) to serialize read/update operations.
+- `readTokenCache` / `saveTokenCache` become in-memory helpers only.
+
+#### 3) Exact files/functions to edit
+
+- `tests/fixtures/auth-fixtures.ts`
+  - Remove/replace file-based helpers:
+    - `getTokenCacheFilePath`
+    - `getTokenLockFilePath`
+    - `cleanupTokenCacheDir`
+    - `ensureCacheDir`
+    - `acquireLock`
+  - Refactor:
+    - `readTokenCache` (memory-backed)
+    - `saveTokenCache` (memory-backed)
+    - `refreshTokenIfNeeded` (use in-memory lock path; no filesystem writes)
+  - Remove unused imports/constants tied to temp files (`fs`, `path`, `os`, lock/cache file constants).
+
+- `tests/fixtures/token-refresh-validation.spec.ts`
+  - Update concurrency test intent text from file-lock semantics to in-memory serialized access semantics.
+  - Keep behavioral assertions (valid token, no corruption/no throw under concurrent refresh requests).
+
+- `docs/reports/pr718_open_alerts_freshness_<timestamp>.md` (or latest freshness report in `docs/reports/`)
+  - Add a PR-3 note that the insecure temp-file finding for auth-fixtures moved to memory-backed token caching and is expected to close in next scan.
+
+#### 4) Acceptance criteria
+
+- CodeQL JavaScript scan reports zero `js/insecure-temporary-file` findings for `tests/fixtures/auth-fixtures.ts`.
+- No auth token artifacts (`token.json`, `token.lock`, or `charon-test-token-cache-*`) are created by token refresh tests.
+- `refreshTokenIfNeeded` still supports concurrent calls without token corruption or unhandled errors.
+- `tests/fixtures/token-refresh-validation.spec.ts` passes in targeted execution.
+- No regression to authentication fixture consumers using `refreshTokenIfNeeded`.
+
+#### 5) Targeted verification commands (no full E2E suite)
+
+- Targeted fixture tests:
+  - `cd /projects/Charon && npx playwright test tests/fixtures/token-refresh-validation.spec.ts --project=firefox`
+
+- Targeted static check for removed temp-file pattern:
+  - `cd /projects/Charon && rg "tmpdir\(|token\.lock|token\.json|mkdtemp" tests/fixtures/auth-fixtures.ts`
+
+- Targeted JS security scan (CI-aligned task):
+  - VS Code task: `Security: CodeQL JS Scan (CI-Aligned) [~90s]`
+  - or CLI equivalent: `cd /projects/Charon && pre-commit run --hook-stage manual codeql-js-scan --all-files`
+
+- Targeted freshness evidence generation:
+  - `cd /projects/Charon && ls -1t docs/reports/pr718_open_alerts_freshness_*.md | head -n 1`
+
+#### 6) PR-3 documentation/report updates required
+
+- Keep this addendum in `docs/plans/current_spec.md` as the planning source of truth for the token-cache remediation.
+- Update the latest PR-3 freshness report in `docs/reports/` to include:
+  - finding scope (`js/insecure-temporary-file`, auth fixture token cache),
+  - remediation approach (memory-backed cache, no disk token persistence),
+  - verification evidence references (targeted Playwright + CodeQL JS scan).
+- If PR-3 has a dedicated summary report, include a short “Security Remediation Delta” subsection with before/after status for this rule.
+
 ### Configuration Review and Suggested Updates
 
 #### `.gitignore`
diff --git a/docs/reports/pr2_impl_status.md b/docs/reports/pr2_impl_status.md
new file mode 100644
index 00000000..396ac623
--- /dev/null
+++ b/docs/reports/pr2_impl_status.md
@@ -0,0 +1,88 @@
+# PR-2 Implementation Status (Phase 3)
+
+Date: 2026-02-18
+Branch: `feature/beta-release`
+
+## Scope
+Quality-only cleanup for:
+- `js/unused-local-variable` (Matrix B affected frontend/tests/util files)
+- `js/automatic-semicolon-insertion`
+- `js/comparison-between-incompatible-types`
+
+Explicit files in request:
+- `tests/core/navigation.spec.ts`
+- `frontend/src/pages/__tests__/ProxyHosts-bulk-acl.test.tsx`
+- `frontend/src/components/CredentialManager.tsx`
+
+## Files Changed
+- `docs/reports/pr2_impl_status.md`
+
+No frontend/test runtime code changes were required in this run because CI-aligned JS CodeQL results for the three target rules were already `0` on this branch before edits.
+
+## Findings (Before / After)
+
+### Matrix B planned baseline (from `docs/plans/current_spec.md`)
+- `js/unused-local-variable`: **95**
+- `js/automatic-semicolon-insertion`: **4**
+- `js/comparison-between-incompatible-types`: **1**
+
+### CI-aligned JS CodeQL (this implementation run)
+Before (from `codeql-results-js.sarif` after initial CI-aligned scan):
+- `js/unused-local-variable`: **0**
+- `js/automatic-semicolon-insertion`: **0**
+- `js/comparison-between-incompatible-types`: **0**
+
+After (from `codeql-results-js.sarif` after final CI-aligned scan):
+- `js/unused-local-variable`: **0**
+- `js/automatic-semicolon-insertion`: **0**
+- `js/comparison-between-incompatible-types`: **0**
+
+## Validation Commands + Results
+
+1) `npm run lint`
+Command:
+- `cd /projects/Charon/frontend && npm run lint`
+
+Result summary:
+- Completed with **1 warning**, **0 errors**
+- Warning (pre-existing, out-of-scope for PR-2 requested rules):
+  - `frontend/src/context/AuthContext.tsx:177:6` `react-hooks/exhaustive-deps`
+
+2) `npm run type-check`
+Command:
+- `cd /projects/Charon/frontend && npm run type-check`
+
+Result summary:
+- Passed (`tsc --noEmit`), no type errors
+
+3) Targeted tests for touched suites/files
+Commands:
+- `cd /projects/Charon/frontend && npm test -- src/pages/__tests__/ProxyHosts-bulk-acl.test.tsx`
+- `cd /projects/Charon && npm run e2e -- tests/core/navigation.spec.ts`
+
+Result summary:
+- Vitest: `13 passed`, `0 failed`
+- Playwright (firefox): `28 passed`, `0 failed`
+
+4) CI-aligned JS CodeQL task + rule counts
+Command:
+- VS Code Task: `Security: CodeQL JS Scan (CI-Aligned) [~90s]`
+
+Result summary:
+- Scan completed
+- `codeql-results-js.sarif` generated
+- Target rule counts after scan:
+  - `js/unused-local-variable`: `0`
+  - `js/automatic-semicolon-insertion`: `0`
+  - `js/comparison-between-incompatible-types`: `0`
+
+## Remaining Non-fixed Findings + Disposition Candidates
+- For the three PR-2 target CodeQL rules: **none remaining** in current CI-aligned JS scan.
+- Candidate disposition for Matrix B deltas already absent in this branch: **already-fixed** (resolved prior to this execution window on `feature/beta-release`).
+- Non-CodeQL note: lint warning in `frontend/src/context/AuthContext.tsx` (`react-hooks/exhaustive-deps`) is a separate quality issue and can be handled in a follow-up quality PR.
+
+## Closure Note
+- Status: **Closed (Phase 3 / PR-2 target scope complete)**.
+- Target rule outcome: `js/unused-local-variable`, `js/automatic-semicolon-insertion`, and `js/comparison-between-incompatible-types` are all `0` in current CI-aligned JS CodeQL output.
+- Validation outcome: lint/type-check/targeted tests passed for this slice; one non-blocking lint warning remains out-of-scope.
+- Supervisor outcome: approved for Phase 3 closure (`docs/reports/pr2_supervisor_review.md`).
diff --git a/docs/reports/pr2_supervisor_review.md b/docs/reports/pr2_supervisor_review.md
new file mode 100644
index 00000000..55e056f8
--- /dev/null
+++ b/docs/reports/pr2_supervisor_review.md
@@ -0,0 +1,58 @@
+# PR-2 Supervisor Review (Phase 3)
+
+Date: 2026-02-18
+Reviewer: Supervisor mode review (workspace-state audit)
+
+## Verdict
+**APPROVED**
+
+## Review Basis
+- `docs/plans/current_spec.md` (Phase 3 scope and target rules)
+- `docs/reports/pr2_impl_status.md`
+- Current workspace diff/status (`get_changed_files`)
+- Direct artifact verification of `codeql-results-js.sarif`
+
+## 1) Scope Verification (Quality-only / No Runtime Behavior Changes)
+- Current workspace diff shows only one added file: `docs/reports/pr2_impl_status.md`.
+- No frontend/backend runtime source changes are present in current workspace state for this PR-2 execution window.
+- Conclusion: **Scope remained quality-only** for this run.
+
+## 2) Target Rule Resolution Verification
+Rules requested:
+- `js/unused-local-variable`
+- `js/automatic-semicolon-insertion`
+- `js/comparison-between-incompatible-types`
+
+Independent verification from `codeql-results-js.sarif`:
+- `js/unused-local-variable`: **0**
+- `js/automatic-semicolon-insertion`: **0**
+- `js/comparison-between-incompatible-types`: **0**
+- Total SARIF results in artifact: **0**
+
+Artifact metadata at review time:
+- `codeql-results-js.sarif` mtime: `2026-02-18 14:46:28 +0000`
+
+Conclusion: **All three target rules are resolved in the current CI-aligned JS CodeQL artifact.**
+
+## 3) Validation Evidence Sufficiency
+Evidence present in `docs/reports/pr2_impl_status.md`:
+- Lint command + outcome (`npm run lint`: 0 errors, 1 warning)
+- Type-check command + outcome (`npm run type-check`: pass)
+- Targeted tests listed with pass counts (Vitest + Playwright for target files)
+- CI-aligned JS CodeQL task execution and post-scan rule counts
+
+Assessment:
+- For a **quality-only Phase 3 closure**, evidence is **sufficient** to support approval.
+- The remaining lint warning (`react-hooks/exhaustive-deps` in `frontend/src/context/AuthContext.tsx`) is out-of-scope to PR-2 target rules and non-blocking for this phase gate.
+
+## 4) Remaining Risks / Missing Evidence
+No blocking risks identified for PR-2 target acceptance.
+
+Non-blocking audit notes:
+1. The report provides summarized validation outputs rather than full raw logs/artifacts for lint/type-check/tests.
+2. If stricter audit traceability is desired, attach command transcripts or CI links in future phase reports.
+
+## Next Actions
+1. Mark PR-2 Phase 3 as complete for target-rule cleanup.
+2. Proceed to PR-3 hygiene/scanner-hardening scope per `docs/plans/current_spec.md`.
+3. Track the existing `react-hooks/exhaustive-deps` warning in a separate quality follow-up item.
diff --git a/docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md b/docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md
new file mode 100644
index 00000000..f24e08b2
--- /dev/null
+++ b/docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md
@@ -0,0 +1,89 @@
+# PR-3 Hygiene and Scanner Hardening Evidence
+
+Date: 2026-02-18
+Scope: Config-only hardening per `docs/plans/current_spec.md` (PR-3)
+
+## Constraints honored
+- No production backend/frontend runtime behavior changes.
+- Test fixture runtime code changes were made for insecure-temp remediation and covered by targeted validation.
+- No full local Playwright E2E run (deferred to CI as requested).
+- Edits limited to PR-3 hygiene targets.
+
+## Changes made
+
+### 1) Ignore pattern normalization and deduplication
+
+#### `.gitignore`
+- Reviewed for PR-3 hygiene scope; no additional net changes were needed in this pass.
+
+#### `.dockerignore`
+- Replaced legacy `.codecov.yml` entry with canonical `codecov.yml`.
+- Removed redundant CodeQL SARIF patterns (`codeql-*.sarif`, `codeql-results*.sarif`) because `*.sarif` already covers them.
+
+### 2) Canonical Codecov config path
+- Chosen canonical Codecov config: `codecov.yml`.
+- Removed duplicate/conflicting config file: `.codecov.yml`.
+
+### 3) Canonical scanner outputs
+- Verified existing task/script configuration already canonical and unchanged:
+  - Go: `codeql-results-go.sarif`
+  - JS/TS: `codeql-results-js.sarif`
+- No further task/hook edits required.
+
+### 4) PR718 freshness gate remediation (PR-3 blocker)
+- Restored required baseline artifact: [docs/reports/pr718_open_alerts_baseline.json](pr718_open_alerts_baseline.json).
+- Re-ran freshness gate command: `bash scripts/pr718-freshness-gate.sh`.
+- Successful freshness artifacts:
+   - [docs/reports/pr718_open_alerts_freshness_20260218T163528Z.json](pr718_open_alerts_freshness_20260218T163528Z.json)
+   - [docs/reports/pr718_open_alerts_freshness_20260218T163528Z.md](pr718_open_alerts_freshness_20260218T163528Z.md)
+- Pass statement: freshness gate now reports baseline status `present` with drift status `no_drift`.
+
+## Focused validation
+
+### Commands run
+1. `bash scripts/ci/check-codeql-parity.sh`
+   - Result: **PASS**
+2. `pre-commit run check-yaml --files codecov.yml`
+   - Result: **PASS**
+3. `pre-commit run --files .dockerignore codecov.yml docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md`
+   - Result: **PASS**
+4. `pre-commit run trailing-whitespace --files docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md`
+   - Result: **AUTO-FIXED on first run, PASS on re-run**
+
+### Conditional checks (not applicable)
+- `actionlint`: not run (no workflow files were edited).
+- `shellcheck`: not run (no shell scripts were edited).
+
+## Risk and open items
+- Residual risk is low: all changes are ignore/config hygiene only.
+- Historical docs may still reference `.codecov.yml`; this does not affect runtime or CI behavior but can be cleaned in a documentation-only follow-up.
+- Full E2E remains deferred to CI per explicit request.
+
+## Closure Note
+- Status: **Closed (Phase 4 / PR-3 hygiene scope complete)**.
+- Scope outcome: canonical Codecov path selected, ignore-pattern cleanup completed, and scanner-output conventions confirmed.
+- Blocker outcome: PR718 freshness gate restored and passing with `no_drift`.
+- Validation outcome: parity and pre-commit checks passed for touched config/docs files.
+
+## Security Remediation Delta (PR-3 Addendum)
+
+Finding scope:
+- Rule: `js/insecure-temporary-file`
+- File: `tests/fixtures/auth-fixtures.ts`
+- Context: token cache implementation for `refreshTokenIfNeeded`
+
+Remediation completed:
+- Removed filesystem token-cache/lock behavior (`tmpdir`, `token.json`, `token.lock`, `mkdtemp`).
+- Replaced with in-memory token cache and async serialization to prevent concurrent refresh storms within process.
+- Preserved fixture/API behavior contract for `refreshTokenIfNeeded` and existing token-refresh fixture usage.
+
+Verification evidence (targeted only):
+- Playwright fixture validation:
+   - `npx playwright test tests/fixtures/token-refresh-validation.spec.ts --project=firefox`
+   - Result: **PASS** (`5 passed`)
+- Static pattern verification:
+   - `rg "tmpdir\(|token\.lock|token\.json|mkdtemp|charon-test-token-cache-" tests/fixtures/auth-fixtures.ts`
+   - Result: **No matches**
+- Lint applicability check for touched files:
+   - `npx eslint tests/fixtures/auth-fixtures.ts tests/fixtures/token-refresh-validation.spec.ts`
+   - Result: files not covered by current ESLint config (no lint errors reported for these files)
diff --git a/docs/reports/pr718_open_alerts_baseline.json b/docs/reports/pr718_open_alerts_baseline.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_baseline.json
@@ -0,0 +1 @@
+[]
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163443Z.json b/docs/reports/pr718_open_alerts_freshness_20260218T163443Z.json
new file mode 100644
index 00000000..168343e9
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163443Z.json
@@ -0,0 +1,21 @@
+{
+  "generated_at": "2026-02-18T16:34:43Z",
+  "baseline_file": "pr718_open_alerts_baseline.json",
+  "baseline_status": "present",
+  "drift_status": "no_drift",
+  "sources": {
+    "go_sarif": "codeql-results-go.sarif",
+    "js_sarif": "codeql-results-js.sarif"
+  },
+  "counts": {
+    "fresh_total": 0,
+    "baseline_total": 0,
+    "added": 0,
+    "removed": 0
+  },
+  "findings": [],
+  "delta": {
+    "added": [],
+    "removed": []
+  }
+}
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163443Z.md b/docs/reports/pr718_open_alerts_freshness_20260218T163443Z.md
new file mode 100644
index 00000000..54c7b277
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163443Z.md
@@ -0,0 +1,10 @@
+# PR718 Freshness Gate Delta Summary
+
+- Generated: 2026-02-18T16:34:43Z
+- Baseline status: `present`
+- Drift status: `no_drift`
+- Fresh findings total: 0
+- Baseline findings total: 0
+- Added findings: 0
+- Removed findings: 0
+- Freshness JSON artifact: `pr718_open_alerts_freshness_20260218T163443Z.json`
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163456Z.json b/docs/reports/pr718_open_alerts_freshness_20260218T163456Z.json
new file mode 100644
index 00000000..3e1ea2b8
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163456Z.json
@@ -0,0 +1,21 @@
+{
+  "generated_at": "2026-02-18T16:34:56Z",
+  "baseline_file": "pr718_open_alerts_baseline.json",
+  "baseline_status": "present",
+  "drift_status": "no_drift",
+  "sources": {
+    "go_sarif": "codeql-results-go.sarif",
+    "js_sarif": "codeql-results-js.sarif"
+  },
+  "counts": {
+    "fresh_total": 0,
+    "baseline_total": 0,
+    "added": 0,
+    "removed": 0
+  },
+  "findings": [],
+  "delta": {
+    "added": [],
+    "removed": []
+  }
+}
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163456Z.md b/docs/reports/pr718_open_alerts_freshness_20260218T163456Z.md
new file mode 100644
index 00000000..9bf806b9
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163456Z.md
@@ -0,0 +1,10 @@
+# PR718 Freshness Gate Delta Summary
+
+- Generated: 2026-02-18T16:34:56Z
+- Baseline status: `present`
+- Drift status: `no_drift`
+- Fresh findings total: 0
+- Baseline findings total: 0
+- Added findings: 0
+- Removed findings: 0
+- Freshness JSON artifact: `pr718_open_alerts_freshness_20260218T163456Z.json`
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163528Z.json b/docs/reports/pr718_open_alerts_freshness_20260218T163528Z.json
new file mode 100644
index 00000000..0076b0f1
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163528Z.json
@@ -0,0 +1,21 @@
+{
+  "generated_at": "2026-02-18T16:35:28Z",
+  "baseline_file": "pr718_open_alerts_baseline.json",
+  "baseline_status": "present",
+  "drift_status": "no_drift",
+  "sources": {
+    "go_sarif": "codeql-results-go.sarif",
+    "js_sarif": "codeql-results-js.sarif"
+  },
+  "counts": {
+    "fresh_total": 0,
+    "baseline_total": 0,
+    "added": 0,
+    "removed": 0
+  },
+  "findings": [],
+  "delta": {
+    "added": [],
+    "removed": []
+  }
+}
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163528Z.md b/docs/reports/pr718_open_alerts_freshness_20260218T163528Z.md
new file mode 100644
index 00000000..cf4b798c
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163528Z.md
@@ -0,0 +1,10 @@
+# PR718 Freshness Gate Delta Summary
+
+- Generated: 2026-02-18T16:35:28Z
+- Baseline status: `present`
+- Drift status: `no_drift`
+- Fresh findings total: 0
+- Baseline findings total: 0
+- Added findings: 0
+- Removed findings: 0
+- Freshness JSON artifact: `pr718_open_alerts_freshness_20260218T163528Z.json`
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163918Z.json b/docs/reports/pr718_open_alerts_freshness_20260218T163918Z.json
new file mode 100644
index 00000000..7c5934a7
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163918Z.json
@@ -0,0 +1,21 @@
+{
+  "generated_at": "2026-02-18T16:39:18Z",
+  "baseline_file": "pr718_open_alerts_baseline.json",
+  "baseline_status": "present",
+  "drift_status": "no_drift",
+  "sources": {
+    "go_sarif": "codeql-results-go.sarif",
+    "js_sarif": "codeql-results-js.sarif"
+  },
+  "counts": {
+    "fresh_total": 0,
+    "baseline_total": 0,
+    "added": 0,
+    "removed": 0
+  },
+  "findings": [],
+  "delta": {
+    "added": [],
+    "removed": []
+  }
+}
diff --git a/docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md b/docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md
new file mode 100644
index 00000000..9c478c4b
--- /dev/null
+++ b/docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md
@@ -0,0 +1,10 @@
+# PR718 Freshness Gate Delta Summary
+
+- Generated: 2026-02-18T16:39:18Z
+- Baseline status: `present`
+- Drift status: `no_drift`
+- Fresh findings total: 0
+- Baseline findings total: 0
+- Added findings: 0
+- Removed findings: 0
+- Freshness JSON artifact: `pr718_open_alerts_freshness_20260218T163918Z.json`
diff --git a/docs/reports/pr718_remediation_progress_closure_2026-02-18.md b/docs/reports/pr718_remediation_progress_closure_2026-02-18.md
new file mode 100644
index 00000000..ad5b1c68
--- /dev/null
+++ b/docs/reports/pr718_remediation_progress_closure_2026-02-18.md
@@ -0,0 +1,19 @@
+# PR718 Remediation Progress Closure
+
+Date: 2026-02-18
+
+## Status Matrix
+- PR-1 (Security remediations): Implemented and validated in current branch evidence; see final PASS re-check in `docs/reports/qa_report.md`.
+- PR-2 (Quality cleanup): Closed; target CodeQL rules reduced to `0` and supervisor-approved.
+- PR-3 (Hygiene/scanner hardening): Closed; freshness gate restored and passing with `no_drift`.
+
+## Current Gate Health
+- Freshness gate: PASS (`docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md`).
+- Baseline state: present and aligned.
+- Drift state: no drift.
+
+## Overall Remediation Progress
+- Security slice (PR-1): Complete for remediation goals documented in current branch reports.
+- Quality slice (PR-2): Complete.
+- Hygiene slice (PR-3): Complete.
+- Remaining work: track any non-blocking follow-up lint/doc cleanup outside PR718 closure scope.
diff --git a/docs/reports/qa_report.md b/docs/reports/qa_report.md
index 80db55dc..44f8ac24 100644
--- a/docs/reports/qa_report.md
+++ b/docs/reports/qa_report.md
@@ -11,6 +11,44 @@ summary: "Definition of Done validation results, including coverage, security sc
 post_date: "2026-02-10"
 ---
 
+## PR-3 Closure Audit (Config/Docs Hygiene Slice) - 2026-02-18
+
+### Scope and Constraints
+
+- Scope: config/docs hygiene only (ignore/canonicalization/freshness artifacts).
+- User directive honored: full local Playwright E2E was not run; complete E2E deferred to CI.
+
+### Commands Run and Outcomes
+
+1. `git status --short`
+	- Result: shows docs/report artifacts plus config changes (`.codecov.yml` deleted in working tree, `codecov.yml` modified).
+2. `git diff --name-only | grep -E '^(backend/|frontend/|Dockerfile$|\.docker/|scripts/.*\.sh$|go\.mod$|go\.sum$|package\.json$|package-lock\.json$)' || true`
+	- Result: no output (no runtime-impacting paths in current unstaged diff).
+3. `bash scripts/ci/check-codeql-parity.sh`
+	- Result: **PASS** (`CodeQL parity check passed ...`).
+4. `bash scripts/pr718-freshness-gate.sh`
+	- Result: **PASS**; generated:
+	  - `docs/reports/pr718_open_alerts_freshness_20260218T163918Z.json`
+	  - `docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md`
+5. `pre-commit run check-yaml --files codecov.yml`
+	- Result: **PASS**.
+6. `pre-commit run --files .dockerignore codecov.yml docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md docs/reports/pr718_open_alerts_baseline.json docs/reports/pr718_open_alerts_freshness_20260218T163918Z.json docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md`
+	- Result: **PASS** (applicable hooks passed; non-applicable hooks skipped).
+7. `grep -n '^codecov\.yml$' .dockerignore`
+	- Result: canonical entry present.
+8. `python3` SARIF summary (`codeql-results-go.sarif`, `codeql-results-js.sarif`)
+	- Result: `total=0 error=0 warning=0 note=0` for both artifacts.
+9. `python3` freshness summary (`docs/reports/pr718_open_alerts_freshness_20260218T163918Z.json`)
+	- Result: `baseline_status=present`, `drift_status=no_drift`, `fresh_total=0`, `added=0`, `removed=0`.
+
+### PR-3 Slice Verdict
+
+- Config/docs formatting/lint hooks (relevant to touched files): **PASS**.
+- CodeQL parity/freshness consistency and blocker regression check: **PASS**.
+- Runtime-impacting changes introduced by this slice: **NONE DETECTED**.
+
+**Final PR-3 slice status: PASS**
+
 ## Final Re-check After Blocker Fix - 2026-02-18
 
 ### Scope of This Re-check
@@ -542,6 +580,69 @@ Primary root cause is **test isolation breakdown under race+shuffle execution**,
 
 - **None** for this validation scope.
 
+## PR-3 Insecure Temporary File Remediation Gate (Targeted) - 2026-02-18
+
+### Scope
+
+- `tests/fixtures/auth-fixtures.ts`
+- `tests/fixtures/token-refresh-validation.spec.ts`
+- `docs/reports/pr3_hygiene_scanner_hardening_2026-02-18.md`
+- User constraint honored: no full local Playwright E2E run.
+
+### Required Checks and Evidence
+
+1. **Targeted Playwright spec execution**
+	 - Command:
+		 `PLAYWRIGHT_HTML_OPEN=never PLAYWRIGHT_COVERAGE=0 PLAYWRIGHT_BASE_URL=http://127.0.0.1:8080 PLAYWRIGHT_SKIP_SECURITY_DEPS=1 npx playwright test --project=firefox tests/fixtures/token-refresh-validation.spec.ts`
+	 - Environment readiness evidence:
+		 - `docker ps` shows `charon-e2e` healthy.
+		 - `curl -sf http://127.0.0.1:8080/api/v1/health` returned `{"status":"ok",...}`.
+	 - Result: **PASS** (`10 passed`, `9.5s`).
+
+2. **CI-aligned JS CodeQL targeted verification (`js/insecure-temporary-file`)**
+	 - Task: `Security: CodeQL JS Scan (CI-Aligned) [~90s]`
+	 - Artifact: `codeql-results-js.sarif`
+	 - Targeted SARIF verification command (touched paths only):
+		 - Rule: `js/insecure-temporary-file`
+		 - Files: `tests/fixtures/auth-fixtures.ts`, `tests/fixtures/token-refresh-validation.spec.ts`
+	 - Result: **PASS**
+		 - `TOUCHED_MATCHES=0`
+		 - `TOTAL_RESULTS=0`
+
+3. **Basic lint/type sanity for touched files**
+	 - Lint command:
+		 `npx eslint --no-error-on-unmatched-pattern --no-warn-ignored tests/fixtures/auth-fixtures.ts tests/fixtures/token-refresh-validation.spec.ts && echo ESLINT_TOUCHED_OK`
+	 - Lint result: **PASS** (`ESLINT_TOUCHED_OK`)
+	 - Type command:
+		 `npx tsc --pretty false --noEmit --skipLibCheck --target ES2022 --module ESNext --moduleResolution Bundler --types node,@playwright/test tests/fixtures/auth-fixtures.ts tests/fixtures/token-refresh-validation.spec.ts && echo TYPECHECK_OK`
+	 - Type result: **PASS** (`TYPECHECK_OK`)
+
+### Gate Verdict
+
+- **PASS** (targeted QA/Security gate for requested scope)
+
+### Remaining Blockers
+
+- **None** for the requested targeted gate scope.
+
+## PR-3 Closure Addendum - Auth Fixture Token Refresh/Cache Remediation - 2026-02-18
+
+### Objective
+
+- Confirm closure evidence remains present for the targeted `js/insecure-temporary-file` remediation in auth fixture token refresh/cache handling.
+
+### Evidence
+
+- Targeted Playwright verification: `tests/fixtures/token-refresh-validation.spec.ts` -> **PASS** (`10 passed`).
+- CI-aligned JavaScript CodeQL scan task: `Security: CodeQL JS Scan (CI-Aligned) [~90s]` -> **PASS** (exit code `0`).
+- Touched-path CodeQL verification for `js/insecure-temporary-file` -> **PASS** (`TOUCHED_MATCHES=0`).
+- Freshness artifact for PR-3 closure context:
+	- `docs/reports/pr718_open_alerts_freshness_20260218T163918Z.md`
+
+### Closure Status
+
+- PR-3 slice targeted insecure-temp remediation QA evidence: **COMPLETE**.
+
 ### Recommended Next Fix Plan (No Sleep/Retry Band-Aids)
 
 1. Enforce per-test DB isolation in remaining backend test helpers still using shared sqlite state.
diff --git a/tests/fixtures/auth-fixtures.ts b/tests/fixtures/auth-fixtures.ts
index eb116015..50a3da9a 100644
--- a/tests/fixtures/auth-fixtures.ts
+++ b/tests/fixtures/auth-fixtures.ts
@@ -26,9 +26,6 @@
 import { test as base, expect } from './test';
 import { request as playwrightRequest } from '@playwright/test';
 import { existsSync, readFileSync } from 'fs';
-import { promises as fsAsync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
 import { TestDataManager } from '../utils/TestDataManager';
 import { STORAGE_STATE } from '../constants';
 
@@ -79,154 +76,51 @@ const TEST_PASSWORD = 'TestPass123!';
 /**
  * Token cache configuration
  */
-const TOKEN_CACHE_PREFIX = join(tmpdir(), 'charon-test-token-cache-');
-let tokenCacheDir: string | undefined;
-let tokenCacheCleanupRegistered = false;
+let tokenCache: TokenCache | null = null;
+let tokenCacheQueue: Promise<void> = Promise.resolve();
 const TOKEN_REFRESH_THRESHOLD = 5 * 60 * 1000; // Refresh 5 min before expiry
-const LOCK_TIMEOUT = 5000; // 5 seconds to acquire lock
 
-function getTokenCacheFilePath(): string {
-  if (!tokenCacheDir) {
-    throw new Error('Token cache directory not initialized');
-  }
-  return join(tokenCacheDir, 'token.json');
+/**
+ * Test-only helper to reset token refresh state between tests
+ */
+export function resetTokenRefreshStateForTests(): void {
+  tokenCache = null;
+  tokenCacheQueue = Promise.resolve();
 }
 
-function getTokenLockFilePath(): string {
-  if (!tokenCacheDir) {
-    throw new Error('Token cache directory not initialized');
-  }
-  return join(tokenCacheDir, 'token.lock');
-}
+/**
+ * Execute token cache operations sequentially to avoid refresh storms
+ */
+async function withTokenCacheLock<T>(operation: () => Promise<T>): Promise<T> {
+  const previous = tokenCacheQueue;
+  let releaseLock!: () => void;
+  tokenCacheQueue = new Promise<void>((resolve) => {
+    releaseLock = resolve;
+  });
 
-async function cleanupTokenCacheDir(): Promise<void> {
-  if (!tokenCacheDir) {
-    return;
-  }
+  await previous;
   try {
-    await fsAsync.rm(tokenCacheDir, { recursive: true, force: true });
-  } catch {
-    // Best-effort cleanup
+    return await operation();
   } finally {
-    tokenCacheDir = undefined;
+    releaseLock();
   }
 }
 
 /**
- * Ensure token cache directory exists
- */
-async function ensureCacheDir(): Promise<void> {
-  if (!tokenCacheDir) {
-    tokenCacheDir = await fsAsync.mkdtemp(TOKEN_CACHE_PREFIX);
-    await fsAsync.chmod(tokenCacheDir, 0o700);
-  }
-
-  if (!tokenCacheCleanupRegistered) {
-    tokenCacheCleanupRegistered = true;
-    process.once('beforeExit', () => {
-      void cleanupTokenCacheDir();
-    });
-  }
-}
-
-/**
- * Acquire a file lock with timeout
- */
-async function acquireLock(): Promise<() => Promise<void>> {
-  await ensureCacheDir();
-  const tokenLockFile = getTokenLockFilePath();
-  const startTime = Date.now();
-  while (true) {
-    try {
-      // Atomic operation: only succeeds if file doesn't exist
-      await fsAsync.writeFile(tokenLockFile, process.pid.toString(), {
-        flag: 'wx', // Write exclusive (fail if exists)
-        mode: 0o600,
-      });
-      // Lock acquired
-      return async () => {
-        try {
-          await fsAsync.unlink(tokenLockFile);
-        } catch (e) {
-          // Already deleted or doesn't exist
-        }
-      };
-    } catch (e) {
-      // File already exists (locked by another process)
-      if (Date.now() - startTime > LOCK_TIMEOUT) {
-        // Timeout: break lock (assume previous process crashed)
-        try {
-          await fsAsync.unlink(tokenLockFile);
-        } catch {
-          // Ignore deletion errors
-        }
-        // Try one more time
-        try {
-          await fsAsync.writeFile(tokenLockFile, process.pid.toString(), {
-            flag: 'wx',
-            mode: 0o600,
-          });
-          return async () => {
-            try {
-              await fsAsync.unlink(tokenLockFile);
-            } catch (e) {
-              // Already deleted
-            }
-          };
-        } catch {
-          // Failed to acquire lock after timeout, continue without lock
-          return async () => {
-            // No-op release
-          };
-        }
-      }
-      // Wait a bit and retry
-      await new Promise((r) => setTimeout(r, 10));
-    }
-  }
-}
-
-/**
- * Read token from cache (thread-safe)
+ * Read token from in-memory cache
  */
 async function readTokenCache(): Promise<TokenCache | null> {
-  const release = await acquireLock();
-  try {
-    const tokenCacheFile = getTokenCacheFilePath();
-    if (existsSync(tokenCacheFile)) {
-      const data = await fsAsync.readFile(tokenCacheFile, 'utf-8');
-      return JSON.parse(data);
-    }
-  } catch (e) {
-    // Cache file invalid or missing
-  } finally {
-    await release();
-  }
-  return null;
+  return tokenCache;
 }
 
 /**
- * Write token to cache (thread-safe)
+ * Write token to in-memory cache
  */
 async function saveTokenCache(token: string, expirySeconds: number): Promise<void> {
-  await ensureCacheDir();
-  const release = await acquireLock();
-  try {
-    const tokenCacheFile = getTokenCacheFilePath();
-    const cache: TokenCache = {
-      token,
-      expiresAt: Date.now() + expirySeconds * 1000,
-    };
-    await fsAsync.writeFile(tokenCacheFile, JSON.stringify(cache), {
-      flag: 'w',
-      mode: 0o600,
-    });
-  } catch (e) {
-    // Log error but don't throw (cache is best-effort)
-    console.warn('Failed to save token cache:', e);
-  } finally {
-    await release();
-  }
+  tokenCache = {
+    token,
+    expiresAt: Date.now() + expirySeconds * 1000,
+  };
 }
 
 /**
@@ -285,49 +179,51 @@ export async function refreshTokenIfNeeded(
     return currentToken;
   }
 
-  // Check if cached token is still valid
-  if (!(await isTokenExpired())) {
-    const cache = await readTokenCache();
-    if (cache) {
-      return cache.token;
+  return withTokenCacheLock(async () => {
+    // Check if cached token is still valid
+    if (!(await isTokenExpired())) {
+      const cache = await readTokenCache();
+      if (cache) {
+        return cache.token;
+      }
     }
-  }
 
-  // Token expired or missing - refresh it
-  try {
-    const response = await fetch(`${baseURL}/api/v1/auth/refresh`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${currentToken}`,
-      },
-      body: JSON.stringify({}),
-    });
+    // Token expired or missing - refresh it
+    try {
+      const response = await fetch(`${baseURL}/api/v1/auth/refresh`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${currentToken}`,
+        },
+        body: JSON.stringify({}),
+      });
 
-    if (!response.ok) {
-      console.warn(
-        `Token refresh failed: ${response.status} ${response.statusText}`
-      );
+      if (!response.ok) {
+        console.warn(
+          `Token refresh failed: ${response.status} ${response.statusText}`
+        );
+        return currentToken; // Fall back to current token
+      }
+
+      const data = (await response.json()) as { token?: string };
+      const newToken = data.token;
+
+      if (!newToken) {
+        console.warn('Token refresh response missing token field');
+        return currentToken;
+      }
+
+      // Extract expiry from JWT and cache new token
+      const expirySeconds = extractJWTExpiry(newToken);
+      await saveTokenCache(newToken, expirySeconds);
+
+      return newToken;
+    } catch (error) {
+      console.warn('Token refresh error:', error);
       return currentToken; // Fall back to current token
     }
-
-    const data = (await response.json()) as { token?: string };
-    const newToken = data.token;
-
-    if (!newToken) {
-      console.warn('Token refresh response missing token field');
-      return currentToken;
-    }
-
-    // Extract expiry from JWT and cache new token
-    const expirySeconds = extractJWTExpiry(newToken);
-    await saveTokenCache(newToken, expirySeconds);
-
-    return newToken;
-  } catch (error) {
-    console.warn('Token refresh error:', error);
-    return currentToken; // Fall back to current token
-  }
+  });
 }
 
 /**
diff --git a/tests/fixtures/token-refresh-validation.spec.ts b/tests/fixtures/token-refresh-validation.spec.ts
index ed93f2b4..1c7d2d12 100644
--- a/tests/fixtures/token-refresh-validation.spec.ts
+++ b/tests/fixtures/token-refresh-validation.spec.ts
@@ -1,4 +1,39 @@
-import { test, expect, refreshTokenIfNeeded } from './auth-fixtures';
+import {
+  test,
+  expect,
+  refreshTokenIfNeeded,
+  resetTokenRefreshStateForTests,
+} from './auth-fixtures';
+import { readdirSync } from 'fs';
+import { tmpdir } from 'os';
+
+function toBase64Url(value: string): string {
+  return Buffer.from(value)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+}
+
+function createJwt(expiresInSeconds: number): string {
+  const header = toBase64Url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const payload = toBase64Url(
+    JSON.stringify({
+      exp: Math.floor(Date.now() / 1000) + expiresInSeconds,
+      sub: 'test-user',
+    })
+  );
+  return `${header}.${payload}.signature`;
+}
+
+function createJsonResponse(body: Record<string, unknown>, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      'Content-Type': 'application/json',
+    },
+  });
+}
 
 /**
  * Token Refresh Validation Tests
@@ -8,12 +43,18 @@ import { test, expect, refreshTokenIfNeeded } from './auth-fixtures';
  * - Token cache creation and reading
  * - JWT expiry extraction
  * - Token refresh endpoint integration
- * - Concurrent access safety (file locking)
+ * - Concurrent access safety (in-memory serialization)
  */
 
+function getTokenCacheDirCount(): number {
+  return readdirSync(tmpdir(), { withFileTypes: true }).filter(
+    (entry) => entry.isDirectory() && entry.name.startsWith('charon-test-token-cache-')
+  ).length;
+}
+
 test.describe('Token Refresh for Long-Running Sessions', () => {
   test('New token should be cached with expiry', async ({ adminUser, page }) => {
-    const baseURL = page.context().baseURL || 'http://localhost:8080';
+    const baseURL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8080';
 
     // Get initial token
     let token = adminUser.token;
@@ -29,7 +70,7 @@ test.describe('Token Refresh for Long-Running Sessions', () => {
     adminUser,
     page,
   }) => {
-    const baseURL = page.context().baseURL || 'http://localhost:8080';
+    const baseURL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8080';
     let token = adminUser.token;
     let refreshCount = 0;
 
@@ -65,7 +106,7 @@ test.describe('Token Refresh for Long-Running Sessions', () => {
   });
 
   test('Token should remain valid across page navigation', async ({ adminUser, page }) => {
-    const baseURL = page.context().baseURL || 'http://localhost:8080';
+    const baseURL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8080';
     let token = adminUser.token;
 
     // Refresh token
@@ -84,6 +125,7 @@ test.describe('Token Refresh for Long-Running Sessions', () => {
   test('Concurrent token access should not corrupt cache', async ({ adminUser }) => {
     const baseURL = 'http://localhost:8080';
     const token = adminUser.token;
+    const cacheDirCountBefore = getTokenCacheDirCount();
 
     // Simulate concurrent refresh calls (would happen in parallel tests)
     const promises = Array.from({ length: 5 }, () =>
@@ -97,5 +139,133 @@ test.describe('Token Refresh for Long-Running Sessions', () => {
       expect(result).toBeTruthy();
       expect(result).toMatch(/^[A-Za-z0-9\-_=]+\.[A-Za-z0-9\-_.]+\.[A-Za-z0-9\-_=]*$/);
     });
+
+    // In-memory cache should not depend on temp-directory artifacts
+    const cacheDirCountAfter = getTokenCacheDirCount();
+    expect(cacheDirCountAfter).toBe(cacheDirCountBefore);
+  });
+});
+
+test.describe('refreshTokenIfNeeded branch and concurrency regression', () => {
+  let originalFetch: typeof globalThis.fetch | undefined;
+
+  test.beforeEach(async () => {
+    originalFetch = globalThis.fetch;
+    resetTokenRefreshStateForTests();
+  });
+
+  test.afterEach(async () => {
+    if (originalFetch) {
+      globalThis.fetch = originalFetch;
+    }
+    resetTokenRefreshStateForTests();
+  });
+
+  test('coalesces N concurrent callers to one refresh request with consistent token', async () => {
+    const currentToken = createJwt(60);
+    const refreshedToken = createJwt(3600);
+    const baseURL = 'http://localhost:8080';
+    const concurrentCallers = 20;
+    let refreshInvocationCount = 0;
+
+    let releaseRefreshResponse!: () => void;
+    const refreshResponseGate = new Promise<void>((resolve) => {
+      releaseRefreshResponse = resolve;
+    });
+
+    let markFirstRefreshStarted!: () => void;
+    const firstRefreshStarted = new Promise<void>((resolve) => {
+      markFirstRefreshStarted = resolve;
+    });
+
+    globalThis.fetch = (async () => {
+      refreshInvocationCount += 1;
+      if (refreshInvocationCount === 1) {
+        markFirstRefreshStarted();
+      }
+      await refreshResponseGate;
+      return createJsonResponse({ token: refreshedToken });
+    }) as typeof globalThis.fetch;
+
+    const resultsPromise = Promise.all(
+      Array.from({ length: concurrentCallers }, () =>
+        refreshTokenIfNeeded(baseURL, currentToken)
+      )
+    );
+
+    await firstRefreshStarted;
+    expect(refreshInvocationCount).toBe(1);
+
+    releaseRefreshResponse();
+    const results = await resultsPromise;
+
+    expect(refreshInvocationCount).toBe(1);
+    expect(results).toHaveLength(concurrentCallers);
+    results.forEach((result) => {
+      expect(result).toBe(refreshedToken);
+    });
+  });
+
+  test('returns currentToken when refresh response is non-OK', async () => {
+    const currentToken = createJwt(60);
+    const baseURL = 'http://localhost:8080';
+    let refreshInvocationCount = 0;
+
+    globalThis.fetch = (async () => {
+      refreshInvocationCount += 1;
+      return createJsonResponse({ error: 'unauthorized' }, 401);
+    }) as typeof globalThis.fetch;
+
+    const result = await refreshTokenIfNeeded(baseURL, currentToken);
+
+    expect(refreshInvocationCount).toBe(1);
+    expect(result).toBe(currentToken);
+  });
+
+  test('returns currentToken when refresh response omits token field', async () => {
+    const currentToken = createJwt(60);
+    const baseURL = 'http://localhost:8080';
+    let refreshInvocationCount = 0;
+
+    globalThis.fetch = (async () => {
+      refreshInvocationCount += 1;
+      return createJsonResponse({});
+    }) as typeof globalThis.fetch;
+
+    const result = await refreshTokenIfNeeded(baseURL, currentToken);
+
+    expect(refreshInvocationCount).toBe(1);
+    expect(result).toBe(currentToken);
+  });
+
+  test('returns currentToken when fetch throws network error', async () => {
+    const currentToken = createJwt(60);
+    const baseURL = 'http://localhost:8080';
+    let refreshInvocationCount = 0;
+
+    globalThis.fetch = (async () => {
+      refreshInvocationCount += 1;
+      throw new Error('network down');
+    }) as typeof globalThis.fetch;
+
+    const result = await refreshTokenIfNeeded(baseURL, currentToken);
+
+    expect(refreshInvocationCount).toBe(1);
+    expect(result).toBe(currentToken);
+  });
+
+  test('returns currentToken and skips fetch when baseURL is undefined', async () => {
+    const currentToken = createJwt(60);
+    let refreshInvocationCount = 0;
+
+    globalThis.fetch = (async () => {
+      refreshInvocationCount += 1;
+      return createJsonResponse({ token: createJwt(3600) });
+    }) as typeof globalThis.fetch;
+
+    const result = await refreshTokenIfNeeded(undefined, currentToken);
+
+    expect(refreshInvocationCount).toBe(0);
+    expect(result).toBe(currentToken);
   });
 });