Live-port-only injections on vpn3, vpn4, vpn5 and vpn1. Verify every full-binding repair, counter progression 1->2->3->4->5, then observe watcher-owned --run-if-due full refresh, new generation and counter reset.