diff --git a/beehive/CHECKPOINT.md b/beehive/CHECKPOINT.md
index e885bd1386..edb762838d 100644
--- a/beehive/CHECKPOINT.md
+++ b/beehive/CHECKPOINT.md
@@ -2124,3 +2124,17 @@ preserved. Trace row emission measured separately. CPU/wall gaps cannot establis
 kernel service or fully measure all instrumentation/descheduling overhead. No
 payloads, async durability redesign, policy/deadline/assertion changes or blind run.
 Evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/DATABRICKS_BFCE. Final full not yet run.
+
+## Databricks bfce — final full outcome
+
+Executable `2ea103d74`: strict PASS, ONE FULL DEFAULT concurrent installed-enabled
+run 116/117, zero skips/cancels, natural289.084s. Three new installed journeys all
+PASS: Databricks token, external-OAuth-local-config fixture, Anthropic diagnostic
+→ local-add OpenRouter → public selection → normal conversion/replacement →
+Start/Restart. Full gate OPEN: conflicting-id aggregate2646ms vs unchanged<2500.
+598-row failure trace/zero dropped preserved; relay async rename await766.413ms
+before Start batch durability differs from prior journal-dominant observation.
+No kernel/scheduling root cause proven, historical2572/2612 remain unresolved.
+No rerun or speculative fix. DATABRICKS_BFCE_RESULT.md records exact contracts,
+source-only variants, installed/source hashes, raw evidence and limits. This final
+record is documentation-only after tested executable; no real OAuth/provider calls.
diff --git a/beehive/DATABRICKS_BFCE_RESULT.md b/beehive/DATABRICKS_BFCE_RESULT.md
new file mode 100644
index 0000000000..fea1edb859
--- /dev/null
+++ b/beehive/DATABRICKS_BFCE_RESULT.md
@@ -0,0 +1,115 @@
+# Databricks v2 local provider — bfce
+
+Tested executable candidate: `2ea103d74` (full SHA in final-pins.txt).
+Source contracts read at pinned `051c3a270be9c73da9ab06700bcab7d5552fceaa`
+in buzz-reference, via git show (not its working tree).
+
+## Behavior and source contracts
+
+Normal/diagnostic wizard option **8**, provider **databricks_v2**, and existing
+**local-setup → add-buzz-provider** now accept explicit **token** or
+**external-oauth**. Token requires an absolute owner-only local secret file; the
+existing provider security owner checks canonical regular file, service UID,
+permissions, bounded nonempty token. Credentials are never public fields.
+External OAuth forbids a token file/fallback and does not read a cache or claim
+credential presence. Both accept operator-approved exact models and HTTPS
+workspace origins (no credentials/path/query/fragment/custom port). Unsupported
+combinations fail; no catalog/model fallback. Historical serialized
+`buzz-agent-api-key` mode is retained, not a new universal credential registry.
+Legacy normal option 2 remains compatible; explicit auth choice is option 8.
+
+Config source `config.rs:631–691,922–960`: DATABRICKS_HOST is required;
+DATABRICKS_TOKEN is optional, empty selects native OAuth; BUZZ_AGENT_PROVIDER is
+`databricks_v2`, BUZZ_AGENT_MODEL overrides DATABRICKS_MODEL. Launch environment
+is closed; no Goose/Claude/Codex auth stores or ambient provider keys inherited.
+Token binding supplies DATABRICKS_TOKEN only from the protected file. External
+OAuth supplies no DATABRICKS_TOKEN. Existing service HOME and config directory
+remain local and fixed in the immutable binding.
+
+`lib.rs:151–200`: native `buzz-agent auth databricks_v2` alias is supported,
+reads DATABRICKS_HOST, requires a browser on that machine. Setup and auth-info
+print shell-quoted manual env context under the actual service OS user:
+HOME, BUZZ_AGENT_CONFIG_DIR, DATABRICKS_HOST and installed executable. They do
+not run auth or inspect credentials. `auth.rs:1287–1392`: later native runtime
+bearer acquisition/refresh is headless; cache is workspace-discovery/client/scopes
+specific under BUZZ_AGENT_CONFIG_DIR/buzz-agent/oauth/databricks, default
+~/.config/buzz-agent/oauth/databricks without override. Guidance explicitly says
+not to copy personal caches. Locally configured != credential present != verified
+login/refresh/model readiness. Actual ACP errors remain fail-closed; no claim
+of rich native auth error-code classification from these fixtures.
+
+Same host/identity/tool/relay/trust owners, immutable binding replacement/retirement,
+lock/snapshot fencing, public model/workspace/profile selection and explicit
+Start/Restart reused. No automatic binding selection, Restart, sibling mutation,
+key recreation, or standby permission. No real vendor/native login/probe performed.
+
+## Executed workflows
+
+- Databricks token: normal wizard → real host CLI → actual TUI Start/Restart →
+  real installed buzz-acp/Buzz CLI with source-shaped TS harness.
+- Databricks external-OAuth **configuration fixture**: same journey. Fixture
+  permits conversation without native cache access and separately denies auth and
+  simulates missing refresh. This is NOT authenticated Databricks evidence.
+- Provider switch/conversion: initial diagnostic **Anthropic** → immutable local
+  add **OpenRouter B** → public binding selection → Stop → immutable normal
+  conversion B-normal/replacement → public selection → Start/Restart. Same key.
+
+Each new journey verifies four actual signed same-agent replies, two channels and
+later owner turn, fresh-session Restart/exact model/native profile, history and Y
+unchanged. Wrong model/native capability/auth denial preserves actual; token wrong
+or missing key preserves actual; Stop remains neutral. Public inventory excludes
+private key, file, endpoint and HOME. OAuth configured/missing-refresh/denied are
+fixture states, not claims about native login outcomes. New journeys focused 3/3
+(65.616s), provider units 5/5, strict PASS. All also pass in the final full run.
+
+**Source-only variants:** Databricks local add/conversion; Anthropic and OpenAI-
+compatible conversion; custom conversion. OpenRouter's add/conversion is executed,
+not inferred from initial setup. Databricks real vendor OAuth/model access,
+`databricks-claude-haiku-4-5` live acceptance, mesh/compute and production admission
+remain separate and unauthorized here. The installed binaries are Buzz's runtime
+and CLI, NOT installed Databricks/Buzz Agent inference (TS fixture instead).
+
+## One final FULL DEFAULT gate: OPEN
+
+Node 24.15.0 / pnpm 11.4.0, existing standalone lock/dependencies unchanged.
+Strict PASS; ONE default concurrent installed-enabled package run on `2ea103d74`:
+**116/117**, zero skip/cancel, natural **289.084s**. No rerun, serial masking,
+forced exit, deadline/assertion change or speculative fix. Failure:
+`admission-cancel.test.ts:136`, conflicting-id aggregate **2646ms** vs unchanged
+<2500ms. Correct accepted Start/conflict rejection/accepted Stop receipts precede
+the failed aggregate assertion. Historical 2572ms and 2612ms remain independently
+unresolved, not explained away by current provider success.
+
+Fixture-activated storage diagnostics preserve original fsync trace, adding
+post-operation JSON, UTF8, write, open/close, rename, mkdir/permission-mode spans,
+monotonic and process CPU, plus row-emission timing. No payloads. Process CPU is
+not kernel service time; async await spans include scheduling/threadpool effects.
+No synchronous trace-file output inside measured regions; bounded capture flushes
+at test completion/failure. Existing permission modes/atomic durability unchanged.
+
+Failure capture: `89238-conflicting-id.json`, **598 rows, zero dropped**. Unlike
+prior Start-journal-dominant recurrence, this capture includes **766.413ms async
+relay rename await** before the Start/conflicting-Stop batch becomes durable.
+The fixture event loop continues ticking during that wait; this is NOT proof of
+766ms disk/kernel execution. Start handler begins 938.466ms after aggregate timer;
+conflicting Stop handler 1458.180ms; valid Stop handler 1731.714ms. Owned Stop is
+525.619ms. Timer ends 2646.336ms (wall elapsed2646). Largest new synchronous detail
+span is rename71.973ms with process CPU user20us/system1388us; another rename
+69.024ms/user23us/system906us. These separate operation-associated observations,
+not underlying filesystem/scheduling causes. Total measured row emission0.600ms
+excludes caller, clock/CPU measurement and unmeasured instrumentation overhead.
+No causal claim about earlier captures; no governing semantic defect demonstrated.
+
+Evidence directory: workspace
+`WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/DATABRICKS_BFCE/`:
+`focused-installed.log`, `strict-final.log`, `full-default.log`, `final-pins.txt`,
+`trace-analysis.txt`, `traces/89238-{wrong-authority,conflicting-id}.json`.
+Installed read-only hashes:
+- buzz-acp `10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea`
+- buzz `147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5`
+
+Self-review covered private/public env boundary, explicit OAuth no-file branch,
+shared wizard, existing immutable ownership, fixture authenticity and storage
+measurement scope. No independent approval of this delta claimed. Prior scoped
+reviews remain scoped. No repo CI, production provider access, native/Rust/client
+changes, release or merge. Full gate remains an explicit unresolved handoff item.