@@ -16,6 +16,11 @@ if [ "${SANITIZE:-0}" = "1" ]; then
   SANITIZE_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g"
 fi
 
+# This is an orchestration test, not a stricter product warning gate. Keep
+# warnings visible without promoting all of them to errors. Unknown Objective-C
+# selectors are the one intentional error: they indicate an incomplete test seam.
+WARNING_FLAGS="-Wall -Wextra -Wno-unused-parameter -Werror=objc-method-access"
+
 build() {
   variant="$1"
   destination="$BUILD_DIR/$variant"
@@ -27,8 +32,7 @@ build() {
   fi
   # Compile the real production bodies and state_core; only their external I/O
   # collaborators live in the test host. No RN, CocoaPods, simulator or network.
-  xcrun clang++ -std=c++17 -fobjc-arc -fblocks -Wall -Wextra -Werror \
-    -Wno-unused-parameter $SANITIZE_FLAGS \
+  xcrun clang++ -std=c++17 -fobjc-arc -fblocks $WARNING_FLAGS $SANITIZE_FLAGS \
     -I"$ROOT_DIR" -I"$destination" \
     "$TEST_DIR/purge_restore_test.mm" "$ROOT_DIR/cpp/patch_core/state_core.cpp" \
     -framework Foundation -o "$destination/purge_restore_test"
@@ -40,6 +44,51 @@ build baseline
 # Negative controls execute only generated test copies. Every original bug must
 # fail its named assertion, not merely fail to compile or time out.
 if [ "${VERIFY_REGRESSIONS:-0}" = "1" ]; then
+  # Compile the same translation unit with narrowly selected contract probes.
+  # Unsupported selectors must fail for that selector, while a benign warning
+  # must compile. No probe modifies product code or the generated baseline.
+  compile_probe() {
+    xcrun clang++ -std=c++17 -fobjc-arc -fblocks $WARNING_FLAGS \
+      -I"$ROOT_DIR" -I"$BUILD_DIR/baseline" -fsyntax-only -D"$1" \
+      "$TEST_DIR/purge_restore_test.mm"
+  }
+  logfile="$BUILD_DIR/baseline/warning-probe.log"
+  if ! compile_probe TEST_HARMLESS_WARNING_PROBE >"$logfile" 2>&1; then
+    cat "$logfile" >&2
+    exit 1
+  fi
+  grep -F 'warning: PUSHY_TEST_HARMLESS_WARNING' "$logfile"
+  echo "[PASS] ordinary compiler warnings are non-fatal"
+
+  for access in read write; do
+    case "$access" in
+      read) probe=TEST_DEFAULTS_READ_PROBE; selector='boolForKey:' ;;
+      write) probe=TEST_DEFAULTS_WRITE_PROBE; selector='setBool:forKey:' ;;
+    esac
+    logfile="$BUILD_DIR/baseline/defaults-$access-compile.log"
+    if compile_probe "$probe" >"$logfile" 2>&1; then
+      echo "ERROR: unsupported defaults $access unexpectedly compiled" >&2
+      exit 1
+    fi
+    if ! grep -F 'error:' "$logfile" | grep -F "no visible @interface for 'TestDefaults'" | grep -F "'$selector'"; then
+      cat "$logfile" >&2
+      echo "ERROR: defaults $access failed compilation for an unexpected reason" >&2
+      exit 1
+    fi
+    testcase="unsupported_defaults_$access"
+    logfile="$BUILD_DIR/baseline/defaults-$access-runtime.log"
+    if "$BUILD_DIR/baseline/purge_restore_test" "$testcase" >"$logfile" 2>&1; then
+      echo "ERROR: unsupported defaults $access unexpectedly succeeded" >&2
+      exit 1
+    fi
+    if ! grep -Fx "[FAIL] $testcase: unsupported TestDefaults selector: $selector" "$logfile"; then
+      cat "$logfile" >&2
+      echo "ERROR: defaults $access failed at runtime for an unexpected reason" >&2
+      exit 1
+    fi
+    echo "[PASS] unsupported defaults $access rejected at compile time and runtime"
+  done
+
   for pair in late-activation:late_commit skip-reresolve:commit_before_signal ignore-reset:reset_wins; do
     variant="${pair%:*}"
     testcase="${pair#*:}"
 
@@ -44,6 +44,30 @@ post-reset filesystem cleanup. Bundle-existence checks use real temporary files.
 The production state lock is real; every defaults mutation asserts ownership of
 that same `os_unfair_lock`.
 
+## Harness contracts
+
+This executable is not a stricter warning gate for the extracted product code.
+`-Wall -Wextra` keeps warnings visible, without a blanket `-Werror`. The only
+explicit warning promoted to an error is `objc-method-access`: an undeclared
+selector means the test host no longer models a collaborator it needs.
+
+`TestDefaults` inherits from `NSObject`, **not** `NSUserDefaults`. Its six explicit
+accessors use a private, per-instance dictionary. A test-only type substitution,
+after importing Foundation, makes the extracted `NSUserDefaults *` declarations
+refer to this narrow interface. A newly used accessor such as `setBool:forKey:`
+or `boolForKey:` must be implemented deliberately; it cannot silently inherit a
+path into the test process's real preferences. Dynamic calls that erase the
+static type hit a fatal `doesNotRecognizeSelector:` backstop, which production
+exception handlers cannot swallow.
+
+Every test process runs `defaults_isolation` before the ordering cases, verifying
+fresh-instance isolation, the supported accessors and snapshot independence.
+With `VERIFY_REGRESSIONS=1`, compile probes prove that an ordinary warning remains
+non-fatal and both unsupported typed selectors are rejected. Separate subprocess
+probes send the same messages through `id` and require the exact fail-fast runtime
+diagnostic. No probe instantiates a real `NSUserDefaults` object or writes a real
+preferences domain.
+
 ## Orderings
 
 | Test | Enforced ordering | Assertions |
 
@@ -62,11 +62,19 @@ static void Await(dispatch_semaphore_t gate, const char *description) {
 static int64_t waitBudget;
 static NSString *root;
 
-// In-memory NSUserDefaults collaborator. Every production defaults mutation must
-// still hold the REAL production os_unfair_lock. Pausing one write inside that
-// lock lets the opposing operation start without relying on OS scheduling.
-@interface TestDefaults : NSUserDefaults
-@property(nonatomic, strong) NSMutableDictionary<NSString *, id> *values;
+// In-memory collaborator, deliberately NOT an NSUserDefaults subclass: inherited
+// accessors could otherwise reach real preferences without ObserveWrite(). Only
+// explicitly modelled selectors are supported. Every mutation still holds the
+// REAL production lock; pausing one write fixes the competing operation's order.
+@interface TestDefaults : NSObject {
+    NSMutableDictionary<NSString *, id> *_values;
+}
+- (void)setObject:(id)value forKey:(NSString *)key;
+- (void)removeObjectForKey:(NSString *)key;
+- (id)objectForKey:(NSString *)key;
+- (NSString *)stringForKey:(NSString *)key;
+- (NSDictionary *)dictionaryForKey:(NSString *)key;
+- (NSDictionary<NSString *, id> *)dictionaryRepresentation;
 @end
 
 static void ObserveWrite(void) {
@@ -83,20 +91,46 @@ - (instancetype)init {
     if (self) { _values = [NSMutableDictionary new]; }
     return self;
 }
-- (void)setObject:(id)value forKey:(NSString *)key { ObserveWrite(); self.values[key] = value; }
-- (void)removeObjectForKey:(NSString *)key { ObserveWrite(); [self.values removeObjectForKey:key]; }
-- (id)objectForKey:(NSString *)key { return self.values[key]; }
+- (void)setObject:(id)value forKey:(NSString *)key { ObserveWrite(); _values[key] = value; }
+- (void)removeObjectForKey:(NSString *)key { ObserveWrite(); [_values removeObjectForKey:key]; }
+- (id)objectForKey:(NSString *)key { return _values[key]; }
 - (NSString *)stringForKey:(NSString *)key {
-    id value = self.values[key];
+    id value = _values[key];
     return [value isKindOfClass:NSString.class] ? value : nil;
 }
 - (NSDictionary *)dictionaryForKey:(NSString *)key {
-    id value = self.values[key];
+    id value = _values[key];
     return [value isKindOfClass:NSDictionary.class] ? value : nil;
 }
-- (NSDictionary<NSString *, id> *)dictionaryRepresentation { return [self.values copy]; }
+- (NSDictionary<NSString *, id> *)dictionaryRepresentation { return [_values copy]; }
+- (void)doesNotRecognizeSelector:(SEL)selector {
+    // Fail even if product code catches Objective-C exceptions. Dynamic sends
+    // must not fall through to a real defaults domain or turn into a passed test.
+    std::string message = "unsupported TestDefaults selector: ";
+    message += NSStringFromSelector(selector).UTF8String;
+    Expect(false, message.c_str());
+}
 @end
 
+// Type substitution is confined to this test translation unit, AFTER Foundation
+// is imported. The extracted bodies stay unchanged, but a newly used defaults
+// selector must be explicitly implemented here rather than inherited silently.
+#define NSUserDefaults TestDefaults
+
+// Compile-only contract probes, enabled individually by the runner. Ordinary
+// warnings must remain non-fatal; unmodelled selectors must fail compilation.
+#if defined(TEST_DEFAULTS_READ_PROBE)
+static BOOL DefaultsReadProbe(NSUserDefaults *defaults) {
+    return [defaults boolForKey:@"probe"];
+}
+#elif defined(TEST_DEFAULTS_WRITE_PROBE)
+static void DefaultsWriteProbe(NSUserDefaults *defaults) {
+    [defaults setBool:YES forKey:@"probe"];
+}
+#elif defined(TEST_HARMLESS_WARNING_PROBE)
+#warning PUSHY_TEST_HARMLESS_WARNING
+#endif
+
 static TestDefaults *testDefaults;
 static NSUserDefaults *PushyDefaults(void) { return testDefaults; }
 static NSTimeInterval PushyMonotonicNow(void) { return 100; }
@@ -413,8 +447,45 @@ static void CompleteInTime(void) {
     Finish();
 }
 
+// This contract test deliberately does not call SetUp: a new collaborator must
+// start empty on its own, not only because the fixture reset some known keys.
+static void DefaultsIsolation(void) {
+    TestDefaults *first = [TestDefaults new];
+    TestDefaults *second = [TestDefaults new];
+    Expect(![first isKindOfClass:NSClassFromString(@"NSUserDefaults")],
+           "test defaults must not inherit real preferences storage");
+    PushyWithStateLock(^{
+        [first setObject:@"value" forKey:@"key"];
+        [first setObject:@{@"nested": @YES} forKey:@"dictionary"];
+        Expect([[first stringForKey:@"key"] isEqual:@"value"], "string accessor uses memory");
+        Expect([[first dictionaryForKey:@"dictionary"][@"nested"] boolValue],
+               "dictionary accessor uses memory");
+        NSDictionary *snapshot = [first dictionaryRepresentation];
+        [first removeObjectForKey:@"key"];
+        Expect([first objectForKey:@"key"] == nil, "remove accessor uses memory");
+        Expect([snapshot[@"key"] isEqual:@"value"], "dictionary snapshot is independent");
+        Expect([second dictionaryRepresentation].count == 0, "instances must not share defaults");
+    });
+}
+
 int main(int argc, char **argv) {
     @autoreleasepool {
+        // These intentional failures run in separate processes. Erasing the
+        // static type also checks the runtime backstop, not just the compiler.
+        if (argc > 1 && (std::string(argv[1]) == "unsupported_defaults_read" ||
+                         std::string(argv[1]) == "unsupported_defaults_write")) {
+            testName = argv[1];
+            id defaults = [TestDefaults new];
+            if (std::string(argv[1]) == "unsupported_defaults_read") {
+                (void)[defaults boolForKey:@"probe"];
+            } else {
+                PushyWithStateLock(^{ [defaults setBool:YES forKey:@"probe"]; });
+            }
+            Expect(false, "unsupported defaults call unexpectedly returned");
+        }
+        testName = "defaults_isolation";
+        DefaultsIsolation();
+        std::printf("[PASS] defaults_isolation\n");
         struct Case { const char *name; void (*run)(); };
         const Case cases[] = {
             {"late_commit", LateCommit},