@@ -31,12 +31,15 @@ paths = [
 ]
 
 # The Epic 10 context lists the firmware reference topics ("the eFuse root and HKDF purpose-key
-# hierarchy, ..."); the generic API key rule reads the prose as a key. Only that commit and file are
-# allowed.
+# hierarchy, ..."); the generic API key rule reads the prose as a key. Only those commits and that file
+# are allowed: the story 10-1 commit and the bmad-loop commit that records the story.
 [[allowlists]]
 description = "Epic 10 context names a key hierarchy, not a key"
 condition = "AND"
-commits = ["ee32e273dbf061a62ab15117f464144ea5bce61c"]
+commits = [
+  "ee32e273dbf061a62ab15117f464144ea5bce61c",
+  "41bb2582dd383ae8fb81a19a10d9c5b6bdd4ba1d",
+]
 paths = [
   '''^_bmad-output/implementation-artifacts/epic-10-context\.md$''',
 ]
@@ -198,7 +198,9 @@ else
 fi
 for tag in "${smoke_tags[@]}"; do
   docker save "${tag}" | docker exec -i "${node_container}" ctr --namespace=k8s.io images import -
-  docker exec "${node_container}" ctr --namespace=k8s.io images ls --quiet | grep --quiet --fixed-strings --line-regexp "${tag}" \
+  # grep reads the whole list: with pipefail, "grep --quiet" stopping at the first match can
+  # kill ctr with SIGPIPE and fail the check on an image that is there.
+  docker exec "${node_container}" ctr --namespace=k8s.io images ls --quiet | grep --fixed-strings --line-regexp "${tag}" >/dev/null \
     || fail "image ${tag} is not in the containerd of ${node_container} after the import"
 done
 
@@ -479,7 +481,7 @@ for job in temporal-schema temporal-namespace; do
   succeeded=$(kubectl "${ns[@]}" get job "${job}" -o jsonpath='{.status.succeeded}')
   [[ ${succeeded} == "1" ]] || fail "the ${job} hook Job did not complete on upgrade (succeeded=${succeeded:-0})"
 done
-kubectl "${ns[@]}" logs job/temporal-namespace | grep -q "namespace coldframe exists" \
+kubectl "${ns[@]}" logs job/temporal-namespace | grep "namespace coldframe exists" >/dev/null \
   || fail "the namespace hook Job did not find the existing coldframe namespace"
 echo "ok: re-running the Temporal hooks on a current schema succeeds and keeps the namespace"
 
@@ -590,7 +592,7 @@ kubectl "${ns[@]}" create job advance-replay --from=cronjob/server-partitions --
   | kubectl "${ns[@]}" apply -f -
 kubectl "${ns[@]}" wait job/advance-replay --for=condition=Complete --timeout=300s \
   || fail "the advance-replay Job did not complete: $(kubectl "${ns[@]}" logs job/advance-replay --tail=20 2>&1)"
-kubectl "${ns[@]}" logs job/advance-replay | grep -q "Advanced the replay state" \
+kubectl "${ns[@]}" logs job/advance-replay | grep "Advanced the replay state" >/dev/null \
   || fail "the advance-replay Job did not report what it advanced"
 echo "ok: advance-replay ran on the restored database before the apps started"
 
 
@@ -249,7 +249,9 @@ import_images() {
   # tarball, which leaves the upgrade's pods waiting for images that never arrive.
   for tag in "${tags[@]}"; do
     docker save "${tag}" | docker exec -i "${node_container}" ctr --namespace=k8s.io images import -
-    docker exec "${node_container}" ctr --namespace=k8s.io images ls --quiet | grep --quiet --fixed-strings --line-regexp "${tag}" \
+    # grep reads the whole list: with pipefail, "grep --quiet" stopping at the first match can
+    # kill ctr with SIGPIPE and fail the check on an image that is there.
+    docker exec "${node_container}" ctr --namespace=k8s.io images ls --quiet | grep --fixed-strings --line-regexp "${tag}" >/dev/null \
       || fail "image ${tag} is not in the containerd of ${node_container} after the import"
   done
 }
 
@@ -240,7 +240,7 @@ public async Task AContextLostBeforeASiloRestartIsSentAgainOnceTheDeviceIsActiva
         var soil = node.SensorId(0, Quantity.SoilMoisture);
         var alertId = AlertIds.Uncalibrated(soil, 1);
 
-        identity.SensorFaults.FailNextContexts(int.MaxValue);
+        identity.SensorFaults.FailContexts(SensorsOf(node));
 
         try
         {
@@ -249,7 +249,7 @@ public async Task AContextLostBeforeASiloRestartIsSentAgainOnceTheDeviceIsActiva
         }
         finally
         {
-            identity.SensorFaults.FailNextContexts(0);
+            identity.SensorFaults.RestoreContexts();
         }
 
         // Which Sensor confirmed the context was only in memory. The new silo activates the Device with a read
@@ -615,21 +615,21 @@ public async Task AContextThatDidNotReachTheSensorsIsSentAgainWithTheNextWake()
         var nodeId = node.DeviceId.ToString();
         var soil = node.SensorId(0, Quantity.SoilMoisture);
         var alertId = AlertIds.Uncalibrated(soil, 1);
-        var failedBefore = identity.SensorFaults.FailedContexts;
+        var failedBefore = identity.SensorFaults.FailedContexts(SensorsOf(node));
 
         // No Sensor can be reached while the Node is unassigned: the unassignment answers as it always did.
-        identity.SensorFaults.FailNextContexts(int.MaxValue);
+        identity.SensorFaults.FailContexts(SensorsOf(node));
 
         try
         {
             Assert.Equal(DeviceAssignmentOutcome.Unassigned, (await identity.Device(nodeId).Unassign(site.SiteId, Ct)).Outcome);
-            Assert.Equal(4, identity.SensorFaults.FailedContexts - failedBefore);
+            Assert.Equal(4, identity.SensorFaults.FailedContexts(SensorsOf(node)) - failedBefore);
             Assert.Null((await identity.DeviceStateAsync(nodeId)).LotId);
             Assert.Equal(AlertLifecycle.Open, (await identity.Alert(alertId).Describe(Ct))!.Lifecycle);
         }
         finally
         {
-            identity.SensorFaults.FailNextContexts(0);
+            identity.SensorFaults.RestoreContexts();
         }
 
         // No Reading follows an unassignment: the Device sends the context again when it is next woken.
@@ -641,9 +641,9 @@ public async Task AContextThatDidNotReachTheSensorsIsSentAgainWithTheNextWake()
 
         // Confirmed: another wake sends nothing. No Sensor is called, which its journal alone would not show.
         var journaled = await identity.AliasesAsync($"sensor/{soil}");
-        var sentBefore = identity.SensorFaults.PassedContexts;
+        var sentBefore = identity.SensorFaults.PassedContexts(SensorsOf(node));
         await identity.WakeDeviceAsync(nodeId);
-        Assert.Equal(sentBefore, identity.SensorFaults.PassedContexts);
+        Assert.Equal(sentBefore, identity.SensorFaults.PassedContexts(SensorsOf(node)));
         Assert.Equal(journaled, await identity.AliasesAsync($"sensor/{soil}"));
     }
 
@@ -656,7 +656,7 @@ public async Task AContextThatDidNotReachTheSensorsIsSentAgainWithTheNodesNextRe
         var soil = node.SensorId(0, Quantity.SoilMoisture);
         var alertId = AlertIds.Uncalibrated(soil, 1);
 
-        identity.SensorFaults.FailNextContexts(int.MaxValue);
+        identity.SensorFaults.FailContexts(SensorsOf(node));
 
         try
         {
@@ -665,23 +665,23 @@ public async Task AContextThatDidNotReachTheSensorsIsSentAgainWithTheNodesNextRe
         }
         finally
         {
-            identity.SensorFaults.FailNextContexts(0);
+            identity.SensorFaults.RestoreContexts();
         }
 
         // Nobody wakes the Device and no silo restarts: the Node reports. On no Lot its Readings are not
         // evaluated, so only the context the frame sends again can end the episode.
-        var sentBefore = identity.SensorFaults.PassedContexts;
+        var sentBefore = identity.SensorFaults.PassedContexts(SensorsOf(node));
         await ReadAsync(node);
 
-        Assert.Equal(4, identity.SensorFaults.PassedContexts - sentBefore);
+        Assert.Equal(4, identity.SensorFaults.PassedContexts(SensorsOf(node)) - sentBefore);
         var closed = (await identity.Alert(alertId).Describe(Ct))!;
         Assert.Equal((AlertLifecycle.Closed, AlertCloseReason.Unassigned), (closed.Lifecycle, closed.Reason));
         Assert.Empty(await identity.Site(site.SiteId).OpenAlerts(Ct));
         Assert.Equal(new SensorContext(site.SiteId, null, false, 2), (await SensorStateAsync(soil)).Context);
 
         // Confirmed: the next report sends nothing.
         await ReadAsync(node);
-        Assert.Equal(4, identity.SensorFaults.PassedContexts - sentBefore);
+        Assert.Equal(4, identity.SensorFaults.PassedContexts(SensorsOf(node)) - sentBefore);
     }
 
     [Fact]
@@ -694,22 +694,22 @@ public async Task ASensorThatHoldsNoContextTakesItsFirstOneFromAReading()
 
         // No context the Device sends reaches the Sensors, from the frame that declares them on: the Sensor is
         // as one journaled before Story 7.4, declared and without a context, when that frame's Reading arrives.
-        var failedBefore = identity.SensorFaults.FailedContexts;
-        var sentBefore = identity.SensorFaults.PassedContexts;
-        identity.SensorFaults.FailNextContexts(int.MaxValue);
+        var failedBefore = identity.SensorFaults.FailedContexts(SensorsOf(node));
+        var sentBefore = identity.SensorFaults.PassedContexts(SensorsOf(node));
+        identity.SensorFaults.FailContexts(SensorsOf(node));
 
         try
         {
             await DeclareAsync(node);
         }
         finally
         {
-            identity.SensorFaults.FailNextContexts(0);
+            identity.SensorFaults.RestoreContexts();
         }
 
         // The Reading said the Site, the Lot and the epoch.
-        Assert.Equal(4, identity.SensorFaults.FailedContexts - failedBefore);
-        Assert.Equal(sentBefore, identity.SensorFaults.PassedContexts);
+        Assert.Equal(4, identity.SensorFaults.FailedContexts(SensorsOf(node)) - failedBefore);
+        Assert.Equal(sentBefore, identity.SensorFaults.PassedContexts(SensorsOf(node)));
         Assert.Equal(new SensorContext(site.SiteId, lotId, false, 1), (await SensorStateAsync(soil)).Context);
         var open = Assert.Single(await identity.Site(site.SiteId).OpenAlerts(Ct));
         Assert.Equal((AlertIds.Uncalibrated(soil, 1), AlertKind.Uncalibrated, lotId), (open.AlertId, open.Kind, open.LotId));
@@ -727,7 +727,7 @@ public async Task AMoveWhoseContextWasLostHealsWithTheNextReadingBecauseReadings
         var soil = node.SensorId(0, Quantity.SoilMoisture);
         var peppers = await SeedLotAsync(site.SiteId, "Peppers");
 
-        identity.SensorFaults.FailNextContexts(int.MaxValue);
+        identity.SensorFaults.FailContexts(SensorsOf(node));
 
         try
         {
@@ -739,7 +739,7 @@ public async Task AMoveWhoseContextWasLostHealsWithTheNextReadingBecauseReadings
         }
         finally
         {
-            identity.SensorFaults.FailNextContexts(0);
+            identity.SensorFaults.RestoreContexts();
         }
 
         var open = Assert.Single(await identity.Site(site.SiteId).OpenAlerts(Ct));
@@ -957,6 +957,15 @@ private static SpecificationSet Specifications(bool calibration)
     }
 
     // An Active Site created by its Owner, whose User grain therefore holds the Site and is told of its Alerts.
+    // The Node's four Sensors, whose evaluation contexts the Device sends.
+    private static Guid[] SensorsOf(SimulatedDevice node) =>
+    [
+        node.SensorId(0, Quantity.SoilMoisture),
+        node.SensorId(1, Quantity.AirTemperature),
+        node.SensorId(2, Quantity.RelativeHumidity),
+        node.SensorId(3, Quantity.GasResistance),
+    ];
+
     private async Task<(string SiteId, string OwnerId)> SiteAsync()
     {
         var ownerId = Guid.NewGuid().ToString();
 
@@ -502,27 +502,41 @@ protected override async Task CommitTransactionAsync(NpgsqlTransaction transacti
 public sealed class SensorFaults : IIncomingGrainCallFilter
 {
     private readonly System.Collections.Concurrent.ConcurrentDictionary<string, bool> _failing = new(StringComparer.Ordinal);
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<string, bool> _failingContexts = new(StringComparer.Ordinal);
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<string, int> _failedContexts = new(StringComparer.Ordinal);
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<string, int> _passedContexts = new(StringComparer.Ordinal);
     private int _evaluationFailures;
-    private int _contextFailures;
 
     /// <summary>
-    /// How many evaluation contexts were failed (Story 7.4).
+    /// How many evaluation contexts for <paramref name="sensorIds"/> were failed (Story 7.4). Counted per Sensor:
+    /// the Devices of earlier tests on the same cluster send their own contexts again when they are activated.
     /// </summary>
-    public int FailedContexts => _failedContexts;
+    public int FailedContexts(IEnumerable<Guid> sensorIds) => Count(_failedContexts, sensorIds);
 
     /// <summary>
-    /// How many evaluation contexts reached a Sensor grain (Story 7.4): what the Device sent and nothing failed.
+    /// How many evaluation contexts for <paramref name="sensorIds"/> reached their Sensor grain (Story 7.4): what
+    /// the Device sent and nothing failed.
     /// </summary>
-    public int PassedContexts => _passedContexts;
+    public int PassedContexts(IEnumerable<Guid> sensorIds) => Count(_passedContexts, sensorIds);
 
-    private int _failedContexts;
-    private int _passedContexts;
+    /// <summary>
+    /// Makes every evaluation context for <paramref name="sensorIds"/> fail until <see cref="RestoreContexts"/>
+    /// (Story 7.4). The contexts of other Sensors pass, so another test's Device is left alone.
+    /// </summary>
+    public void FailContexts(IEnumerable<Guid> sensorIds)
+    {
+        ArgumentNullException.ThrowIfNull(sensorIds);
+
+        foreach (var sensorId in sensorIds)
+        {
+            _failingContexts[sensorId.ToString("D")] = true;
+        }
+    }
 
     /// <summary>
-    /// Makes the next <paramref name="calls"/> evaluation contexts fail, whichever Sensor they are for (Story 7.4);
-    /// 0 lets them through again.
+    /// Lets every evaluation context through again.
     /// </summary>
-    public void FailNextContexts(int calls) => Interlocked.Exchange(ref _contextFailures, calls);
+    public void RestoreContexts() => _failingContexts.Clear();
 
     /// <summary>
     /// Makes the next <paramref name="calls"/> evaluations fail, whichever Sensor they are for.
@@ -552,17 +566,15 @@ public Task Invoke(IIncomingGrainCallContext context)
 
         if (context.Grain is ISensorGrain && string.Equals(context.MethodName, nameof(ISensorGrain.SetContext), StringComparison.Ordinal))
         {
-            int left;
-            while ((left = Volatile.Read(ref _contextFailures)) > 0)
+            var sensorId = context.TargetId.Key.ToString()!;
+
+            if (_failingContexts.ContainsKey(sensorId))
             {
-                if (Interlocked.CompareExchange(ref _contextFailures, left - 1, left) == left)
-                {
-                    Interlocked.Increment(ref _failedContexts);
-                    throw new InvalidOperationException("The test failed this evaluation context.");
-                }
+                _failedContexts.AddOrUpdate(sensorId, 1, static (_, count) => count + 1);
+                throw new InvalidOperationException("The test failed this evaluation context.");
             }
 
-            Interlocked.Increment(ref _passedContexts);
+            _passedContexts.AddOrUpdate(sensorId, 1, static (_, count) => count + 1);
         }
 
         if (context.Grain is ISensorGrain && string.Equals(context.MethodName, nameof(ISensorGrain.Evaluate), StringComparison.Ordinal))
@@ -580,6 +592,13 @@ public Task Invoke(IIncomingGrainCallContext context)
 
         return context.Invoke();
     }
+
+    private static int Count(System.Collections.Concurrent.ConcurrentDictionary<string, int> counts, IEnumerable<Guid> sensorIds)
+    {
+        ArgumentNullException.ThrowIfNull(sensorIds);
+
+        return sensorIds.Sum(sensorId => counts.GetValueOrDefault(sensorId.ToString("D")));
+    }
 }
 
 /// <summary>