diff --git a/config/quality/dependency-allowlist.json b/config/quality/dependency-allowlist.json
index c4476f95d1..92e6ef7e8d 100644
--- a/config/quality/dependency-allowlist.json
+++ b/config/quality/dependency-allowlist.json
@@ -1,5 +1,9 @@
 {
   "_comment": "Allowlist anti-slopsquatting (check-deps.mjs). Toda dep nova exige adicao EXPLICITA aqui apos verificar que e legitima.",
+  "_justifications": {
+    "@testing-library/dom": "Peer dep obrigatoria de @testing-library/react v16 (adicionada no PR #11224); Refs #9985.",
+    "@testing-library/user-event": "Utilitario oficial do ecossistema testing-library para testes de UI (adicionada no PR #11224); Refs #9985."
+  },
   "allowed": [
     "@atjsh/llmlingua-2",
     "@aws-sdk/client-bedrock-runtime",
@@ -20,8 +24,10 @@
     "@stryker-mutator/tap-runner",
     "@swc/helpers",
     "@tailwindcss/postcss",
+    "@testing-library/dom",
     "@testing-library/jest-dom",
     "@testing-library/react",
+    "@testing-library/user-event",
     "@toon-format/toon",
     "@types/better-sqlite3",
     "@types/bun",
diff --git a/docs/reference/CLI-TOOLS.md b/docs/reference/CLI-TOOLS.md
index c32b433fbd..79d4a7d5e3 100644
--- a/docs/reference/CLI-TOOLS.md
+++ b/docs/reference/CLI-TOOLS.md
@@ -1,19 +1,19 @@
 ---
 title: "CLI Tools — OmniRoute"
 version: 3.8.50
-lastUpdated: 2026-08-18
+lastUpdated: 2026-08-23
 ---
 
 # CLI Tools — OmniRoute
 
-Last updated: 2026-08-18
+Last updated: 2026-08-23
 
 OmniRoute integrates with three categories of CLI tools spread across three dedicated dashboard pages:
 
 | Page           | Route                   | Concept                                                                   | Count        |
 | -------------- | ----------------------- | ------------------------------------------------------------------------- | ------------ |
 | **CLI Code's** | `/dashboard/cli-code`   | Coding tools you point at OmniRoute (Client → CLI → OmniRoute → Provider) | 26           |
-| **CLI Agents** | `/dashboard/cli-agents` | Autonomous agents you point at OmniRoute (same flow, broader scope)       | 8            |
+| **CLI Agents** | `/dashboard/cli-agents` | Autonomous agents you point at OmniRoute (same flow, broader scope)       | 9            |
 | **ACP Agents** | `/dashboard/acp-agents` | CLIs that OmniRoute spawns as backend via stdio/ACP (reverse flow)        | see registry |
 
 Legacy routes redirect via 308: `/dashboard/cli-tools` → `/dashboard/cli-code`, `/dashboard/agents` → `/dashboard/acp-agents`.
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index a88230d2db..bc17a1e336 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -1221,12 +1221,6 @@
     "consoleLogsSubtitle": "Console output",
     "logsActivitySubtitle": "User activity log",
     "healthSubtitle": "System health check",
-    "healthVerdictReady": "OmniRoute is ready",
-    "healthVerdictActionRequired": "Action required to restore full operation",
-    "healthVerdictCoolingDown": "Cooling down after recent changes",
-    "advancedDiagnosticsTitle": "Advanced diagnostics",
-    "hide": "Hide",
-    "show": "Show",
     "costsPricingSubtitle": "Per-model pricing rules",
     "costsBudgetSubtitle": "Budget limits",
     "costsQuotaShareSubtitle": "Share provider quotas across keys",
@@ -2918,6 +2912,7 @@
       "interpreter": "Open Interpreter autonomous coding agent CLI",
       "omp": "Oh My Pi terminal coding agent",
       "letta": "Letta CLI agent with persistent memory and tool use",
+      "prime-agent": "Prime Agent — self-improving RLM coding harness with OpenAI-compatible provider support",
       "warp": "Warp AI terminal with custom provider support",
       "agent-deck": "Agent Deck multi-agent orchestrator"
     },
@@ -4627,6 +4622,13 @@
     "retry": "Retry",
     "allOperational": "All systems operational",
     "issuesDetected": "System issues detected",
+    "healthVerdictReady": "OmniRoute is ready",
+    "healthVerdictActionRequired": "Action required to restore full operation",
+    "healthVerdictCoolingDown": "Cooling down after recent changes",
+    "healthSubtitle": "System health check",
+    "advancedDiagnosticsTitle": "Advanced diagnostics",
+    "hide": "Hide",
+    "show": "Show",
     "updatedAt": "Updated {time}",
     "latency": "Latency",
     "latencyP50": "p50",
diff --git a/src/i18n/messages/pt-BR.json b/src/i18n/messages/pt-BR.json
index f9b312817e..a331455601 100644
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -970,6 +970,13 @@
     "batchTimelineCancelled": "Cancelado",
     "batchTokenUsage": "Uso de Token",
     "batchMetadata": "Metadados",
+    "batchHeaderSubtitle": "Execute muitas requisições como um único job",
+    "batchStep1": "1 · Enviar JSONL",
+    "batchStep1Desc": "Adicionar requisições",
+    "batchStep2": "2 · Criar lote",
+    "batchStep2Desc": "Executar job",
+    "batchStep3": "3 · Obter resultados",
+    "batchStep3Desc": "Baixar saída",
     "batchFileContents": "Conteúdo do Arquivo",
     "batchFileUsedByCount": "Usado por {count, plural, one {# lote} other {# lotes}}",
     "batchFilePreview": "Prévia",
@@ -2905,6 +2912,7 @@
       "interpreter": "CLI do agente de codificação autônomo Open Interpreter",
       "omp": "Agente de codificação de terminal Oh My Pi",
       "letta": "Agente CLI Letta com memória persistente e uso de ferramentas",
+      "prime-agent": "Prime Agent — harness de codificação RLM autoevolutivo com suporte a API compatível com OpenAI",
       "warp": "Terminal de IA Warp com suporte a provedor personalizado",
       "agent-deck": "Orquestrador multi-agente Agent Deck"
     },
@@ -3831,6 +3839,9 @@
   },
   "endpoint": {
     "title": "Endpoint da API",
+    "subtitle": "Use o endpoint compatível com OpenAI na maioria dos SDKs e ferramentas.",
+    "testEndpoint": "Testar endpoint →",
+    "advancedProtocols": "Protocolos avançados",
     "available": "Endpoints Disponíveis",
     "cloudProxy": "Proxy na Nuvem",
     "disableConfirm": "Tem certeza que deseja desativar o proxy na nuvem?",
@@ -4611,6 +4622,13 @@
     "retry": "Tentar Novamente",
     "allOperational": "Todos os sistemas operacionais",
     "issuesDetected": "Problemas detectados no sistema",
+    "healthVerdictReady": "O OmniRoute está pronto",
+    "healthVerdictActionRequired": "Ação necessária para restaurar a operação plena",
+    "healthVerdictCoolingDown": "Em resfriamento após mudanças recentes",
+    "healthSubtitle": "Verificação de saúde do sistema",
+    "advancedDiagnosticsTitle": "Diagnósticos avançados",
+    "hide": "Ocultar",
+    "show": "Mostrar",
     "updatedAt": "Atualizado {time}",
     "latency": "Latência",
     "latencyP50": "p50",
@@ -12034,6 +12052,7 @@
       "acp": {
         "title": "ACP Agents",
         "phrase": "CLIs que o OmniRoute spawna como backend de execução (fluxo reverso)",
+        "warning": "A maioria dos usuários pode ignorar isto — use apenas quando uma integração exigir.",
         "flow": "Cliente → OmniRoute → spawn CLI (stdio/ACP) → resposta",
         "seeOther": "Ver →"
       }
@@ -13341,6 +13360,13 @@
   },
   "resilienceConnections": {
     "title": "Resiliência de Conexão",
+    "reassuranceTitle": "Suas conexões se recuperam automaticamente",
+    "reassuranceDetail": "Normalmente nenhuma ação é necessária. O OmniRoute dá uma pausa temporária em uma conexão após falhas e depois a tenta novamente com segurança.",
+    "plainStates": {
+      "healthy": "Requisições podem ser enviadas",
+      "coolingDown": "Tentando novamente em breve",
+      "lockedOut": "Precisa da sua atenção"
+    },
     "table": {
       "status": "Status",
       "provider": "Provedor",
diff --git a/src/i18n/messages/vi.json b/src/i18n/messages/vi.json
index d670c50d20..a414077f72 100644
--- a/src/i18n/messages/vi.json
+++ b/src/i18n/messages/vi.json
@@ -1300,13 +1300,7 @@
       "open": "mở",
       "close": "đóng"
     },
-    "noResults": "Không có kết quả",
-    "healthVerdictReady": "OmniRoute đã sẵn sàng",
-    "healthVerdictActionRequired": "Cần hành động để khôi phục hoạt động đầy đủ",
-    "healthVerdictCoolingDown": "Đang nguội sau các thay đổi gần đây",
-    "advancedDiagnosticsTitle": "Chẩn đoán nâng cao",
-    "hide": "Ẩn",
-    "show": "Hiện"
+    "noResults": "Không có kết quả"
   },
   "webhooks": {
     "title": "Webhook",
@@ -2918,6 +2912,7 @@
       "interpreter": "Tác nhân lập trình tự trị Open Interpreter CLI",
       "omp": "Tác nhân lập trình Oh My Pi trên terminal",
       "letta": "Tác nhân Letta CLI có bộ nhớ lâu dài và khả năng dùng công cụ",
+      "prime-agent": "Prime Agent — bộ khung lập trình RLM tự cải tiến hỗ trợ API tương thích OpenAI",
       "warp": "Terminal Warp AI hỗ trợ nhà cung cấp tùy chỉnh",
       "agent-deck": "Trình điều phối đa tác nhân Agent Deck"
     },
@@ -4627,6 +4622,13 @@
     "retry": "Thử lại",
     "allOperational": "Tất cả hệ thống đang hoạt động bình thường",
     "issuesDetected": "Phát hiện sự cố hệ thống",
+    "healthVerdictReady": "OmniRoute đã sẵn sàng",
+    "healthVerdictActionRequired": "Cần hành động để khôi phục hoạt động đầy đủ",
+    "healthVerdictCoolingDown": "Đang nguội sau các thay đổi gần đây",
+    "healthSubtitle": "Kiểm tra tình trạng hệ thống",
+    "advancedDiagnosticsTitle": "Chẩn đoán nâng cao",
+    "hide": "Ẩn",
+    "show": "Hiện",
     "updatedAt": "Đã cập nhật {time}",
     "latency": "Độ trễ",
     "latencyP50": "p50",
diff --git a/src/shared/schemas/cliCatalog.ts b/src/shared/schemas/cliCatalog.ts
index 27ab19e3c9..bcfefe1700 100644
--- a/src/shared/schemas/cliCatalog.ts
+++ b/src/shared/schemas/cliCatalog.ts
@@ -67,4 +67,5 @@ export const EXPECTED_CODE_COUNT = 21;
 // +2 (#6318): "omp" (Oh My Pi) and "letta" (Letta CLI) added as agent entries.
 // Note: #6318 originally also shipped duplicate "pi"/"jcode"/"codewhale" entries —
 // those tools were already delivered by a separate PR, so only omp+letta landed here.
-export const EXPECTED_AGENT_COUNT = 8;
+// +1 (#11166): "prime-agent" (PrimeIntellect-ai/prime-agent) added as an agent entry.
+export const EXPECTED_AGENT_COUNT = 9;
diff --git a/tests/unit/cli-catalog-counts.test.ts b/tests/unit/cli-catalog-counts.test.ts
index 186a951329..36853fdf99 100644
--- a/tests/unit/cli-catalog-counts.test.ts
+++ b/tests/unit/cli-catalog-counts.test.ts
@@ -41,8 +41,8 @@ test("CLI_TOOLS total code entries (including none) equals 26 (21 visible + 5 no
   assert.equal(codeAll.length, 26, `Expected 26 total code entries, got ${codeAll.length}`);
 });
 
-test("CLI_TOOLS total (code + agent) = 34", () => {
-  assert.equal(all.length, 34, `Expected 34 total entries, got ${all.length}`);
+test("CLI_TOOLS total (code + agent) = 35", () => {
+  assert.equal(all.length, 35, `Expected 35 total entries, got ${all.length}`);
 });
 
 test("All code-none entries have configType mitm OR are legacy excluded entries", () => {
@@ -99,7 +99,7 @@ test("The 21 visible code entries include Qwen Code's rebuilt integration", () =
   }
 });
 
-test("The 8 agent entries match D15 list exactly (+ omp + letta, #6318)", () => {
+test("The 9 agent entries match D15 list exactly (+ omp + letta #6318, + prime-agent #11166)", () => {
   const d15Agents = new Set([
     "hermes-agent",
     "openclaw",
@@ -109,6 +109,7 @@ test("The 8 agent entries match D15 list exactly (+ omp + letta, #6318)", () =>
     "agent-deck",
     "omp",
     "letta",
+    "prime-agent",
   ]);
   const agentIds = new Set(agentAll.map((t) => t.id));
   for (const id of d15Agents) {
diff --git a/tests/unit/cli-tools-schema.test.ts b/tests/unit/cli-tools-schema.test.ts
index ee2354986b..3f01c16de5 100644
--- a/tests/unit/cli-tools-schema.test.ts
+++ b/tests/unit/cli-tools-schema.test.ts
@@ -11,6 +11,7 @@ test("CLI_TOOLS registry contains all expected tools including rebuilt Qwen Code
   //   (CodeWhale is the actively-maintained successor to DeepSeek TUI).
   // omp + letta added by #6318 (agent-category CLI integrations).
   // grok-build added — xAI Grok Build TUI coding agent (ported from upstream decolua/9router#2571).
+  // prime-agent added by #11166 (PrimeIntellect-ai/prime-agent, agent category).
   const expected = [
     "claude",
     "codex",
@@ -46,6 +47,7 @@ test("CLI_TOOLS registry contains all expected tools including rebuilt Qwen Code
     "grok-build",
     "qwen",
     "zcode",
+    "prime-agent",
   ];
   for (const id of expected) {
     assert.ok(id in CLI_TOOLS, `Missing tool: ${id}`);
diff --git a/tests/unit/cli/setup-qwen.test.ts b/tests/unit/cli/setup-qwen.test.ts
index e8086961de..b6140c76d4 100644
--- a/tests/unit/cli/setup-qwen.test.ts
+++ b/tests/unit/cli/setup-qwen.test.ts
@@ -42,6 +42,9 @@ test("setup-qwen writes current V4 settings and only its dedicated env key", asy
       configPath: settingsPath,
       envPath,
       yes: true,
+      // These tests exercise the merge/write logic, not the container guard
+      // (#10057) — keep them hermetic on container devboxes/CI.
+      allowContainerWrite: true,
     });
     assert.equal(code, 0);
 
@@ -76,6 +79,8 @@ test("setup-qwen does not overwrite an invalid settings file", async () => {
       model: "model-id",
       configPath: settingsPath,
       yes: true,
+      // See above — hermetic regardless of container detection (#10057).
+      allowContainerWrite: true,
     });
     assert.equal(code, 1);
     assert.equal(await fs.readFile(settingsPath, "utf8"), "{ invalid JSON");
diff --git a/tests/unit/models-catalog-combo-metadata.test.ts b/tests/unit/models-catalog-combo-metadata.test.ts
index b4fc629bad..c80253c314 100644
--- a/tests/unit/models-catalog-combo-metadata.test.ts
+++ b/tests/unit/models-catalog-combo-metadata.test.ts
@@ -98,7 +98,11 @@ test("single-target Codex combo advertises a larger model context override", asy
     assert.equal(response.status, 200);
     assert.equal(direct?.context_length, contextWindow);
     assert.equal(combo?.context_length, contextWindow);
-    assert.equal(combo?.max_input_tokens, 272000);
+    // #11179 raised the static codex catalog cap to maxInputTokens=872000 (the real
+    // usable window; the old 272000 was just the first pricing tier). The input cap
+    // can never exceed the total window, so with the 500K override it clamps to it:
+    // min(872000, 500000) = 500000.
+    assert.equal(combo?.max_input_tokens, 500000);
   } finally {
     contextOverrides.removeModelContextOverride("codex", modelId);
   }
diff --git a/tests/unit/provider-models-route-codex.test.ts b/tests/unit/provider-models-route-codex.test.ts
index 0a3ad6f757..0d4587218d 100644
--- a/tests/unit/provider-models-route-codex.test.ts
+++ b/tests/unit/provider-models-route-codex.test.ts
@@ -181,10 +181,11 @@ test("provider models route merges live Codex models with the local catalog then
   // merge conservatively — the smaller of live vs. pinned wins, never the
   // larger, so a stale/inflated live number can never make OmniRoute promise
   // more context than the account can actually serve (#7012). Here the pinned
-  // GPT-5.6 Codex contract (272000/128000, see GPT_5_6_CODEX_CAPABILITIES)
+  // GPT-5.6 Codex contract (872000/128000, see GPT_5_6_CODEX_CAPABILITIES — raised
+  // from the old 272K pricing tier to the real usable window by #11179)
   // is smaller than the live payload's 999999/999999, so the pinned value wins.
   assert.equal(liveModel?.name, "GPT 5.6 Sol Live");
-  assert.equal(liveModel?.inputTokenLimit, 272000);
+  assert.equal(liveModel?.inputTokenLimit, 872000);
   assert.equal(liveModel?.outputTokenLimit, 128000);
   assert.equal(liveModel?.apiFormat, "responses");
   assert.deepEqual(liveModel?.supportedEndpoints, ["responses"]);
diff --git a/tests/unit/search-route.test.ts b/tests/unit/search-route.test.ts
index 9f3c67eca1..bdcfde1892 100644
--- a/tests/unit/search-route.test.ts
+++ b/tests/unit/search-route.test.ts
@@ -420,25 +420,24 @@ test("v1 search POST preserves stored SearXNG baseUrl for authless providers", a
   }
 });
 
-test("v1 search POST returns 400 when auto-select finds no configured provider (searxng-search is now fallbackOnly)", async () => {
+test("v1 search POST falls back to duckduckgo-free when no provider is configured (#11097)", async () => {
+  // Contract changed by PR #11097 ("fix(search): fall back to duckduckgo-free when
+  // no search provider is configured"): zero-credential /v1/search no longer returns
+  // 400 — it promotes the fallback-only duckduckgo-free provider so out-of-the-box
+  // search works. This test pins the NEW contract.
   const originalFetch = globalThis.fetch;
   let capturedUrl = "";
 
+  // DuckDuckGo lite HTML shape: result link + snippet cell (see
+  // open-sse/services/freeWebSearch.ts parseDuckDuckGoLite).
+  const liteHtml = `<html><body>
+    <a href="https://example.com/auto-result" class='result-link'>Auto-selected DuckDuckGo result</a>
+    <td class='result-snippet'>Fallback free search snippet</td>
+  </body></html>`;
+
   globalThis.fetch = async (url) => {
     capturedUrl = String(url);
-    return new Response(
-      JSON.stringify({
-        results: [
-          {
-            title: "Auto-selected SearXNG result",
-            url: "https://searx.example/auto",
-            content: "Auto-selected self-hosted response",
-            engines: ["duckduckgo"],
-          },
-        ],
-      }),
-      { status: 200, headers: { "content-type": "application/json" } }
-    );
+    return new Response(liteHtml, { status: 200, headers: { "content-type": "text/html" } });
   };
 
   try {
@@ -454,14 +453,15 @@ test("v1 search POST returns 400 when auto-select finds no configured provider (
     );
     const body = (await response.json()) as any;
 
-    assert.equal(response.status, 400);
-    assert.equal(capturedUrl, "", "fallback-only SearXNG must not receive an upstream request");
-    assert.ok(body.error?.message || body.error);
-    assert.match(
-      String(body.error?.message ?? body.error),
-      /provider|configured/i,
-      "the response must explain that no provider was selected"
+    assert.equal(response.status, 200);
+    assert.equal(
+      capturedUrl,
+      "https://lite.duckduckgo.com/lite/",
+      "the fallback must call the DuckDuckGo lite endpoint"
     );
+    assert.equal(body.provider, "duckduckgo-free");
+    assert.equal(body.results[0].title, "Auto-selected DuckDuckGo result");
+    assert.equal(body.results[0].url, "https://example.com/auto-result");
   } finally {
     globalThis.fetch = originalFetch;
   }
diff --git a/tests/unit/vscode-token-routes-gpt56.test.ts b/tests/unit/vscode-token-routes-gpt56.test.ts
index 64daae58c4..c68a85a6b7 100644
--- a/tests/unit/vscode-token-routes-gpt56.test.ts
+++ b/tests/unit/vscode-token-routes-gpt56.test.ts
@@ -128,9 +128,11 @@ test("vscode raw models route exposes native GPT-5.6 IDs and effort tiers", asyn
   assert.equal(typeof defaultModel.created, "number");
   assert.equal(defaultModel.owned_by, "codex");
   assert.equal(defaultModel.name, "Codex GPT 5.6 Sol");
-  assert.equal(defaultModel.context_length, 272000);
+  // #11179: codex static catalog advertises the usable 872K window (max_context_window),
+  // not the old 272K pricing tier.
+  assert.equal(defaultModel.context_length, 872000);
   assert.equal(defaultModel.max_output_tokens, 128000);
-  assert.equal(defaultModel.max_input_tokens, 272000);
+  assert.equal(defaultModel.max_input_tokens, 872000);
   assert.deepEqual(defaultModel.capabilities, {
     vision: true,
     tool_calling: true,
diff --git a/tests/unit/vscode-token-routes.test.ts b/tests/unit/vscode-token-routes.test.ts
index 5a292b4600..d66118b3f2 100644
--- a/tests/unit/vscode-token-routes.test.ts
+++ b/tests/unit/vscode-token-routes.test.ts
@@ -255,7 +255,9 @@ test("vscode combos route resolves combo names through Ollama api/show", async (
   assert.equal(body.model, "show-combo");
   assert.equal(body.modelfile, "FROM show-combo");
   assert.equal(body.details.family, "show-combo");
-  assert.equal(body.model_info.context_length, 272000);
+  // #11179: codex static catalog advertises the usable 872K window (max_context_window),
+  // not the old 272K pricing tier.
+  assert.equal(body.model_info.context_length, 872000);
   assert.deepEqual(body.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
   assert.equal(body.model_info.capabilities.reasoning, true);
 });
@@ -290,7 +292,8 @@ test("vscode tokenized combos root route exposes importable combo metadata", asy
   assert.equal(response.status, 200);
   assert.ok(combo, "expected balanced-load in combo root response");
   assert.equal(combo.url.includes("/responses#models.ai.azure.com"), true);
-  assert.equal(combo.maxInputTokens, 272000);
+  // #11179: codex static catalog maxInputTokens is now the usable 872K window.
+  assert.equal(combo.maxInputTokens, 872000);
   assert.equal(combo.toolCalling, true);
   assert.deepEqual(combo.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
 });
@@ -1073,7 +1076,9 @@ test("vscode tokenized api/show route exposes explicit reasoning effort metadata
   assert.equal(body.configurationSchema?.properties?.reasoningEffort?.default, "low");
   assert.equal(body.model_info["general.basename"], "Codex GPT 5.6 Sol (Default)");
   assert.equal(body.model_info["general.architecture"], "codex");
-  assert.equal(body.model_info["codex.context_length"], 272000);
+  // #11179: codex static catalog advertises the usable 872K window (max_context_window),
+  // not the old 272K pricing tier.
+  assert.equal(body.model_info["codex.context_length"], 872000);
   assert.deepEqual(body.model_info.supports_reasoning_effort, [
     "low",
     "medium",