@@ -96,9 +96,9 @@ settles. NVIDIA doesn't document this; measured on an RTX 5090 under sustained l
 `GpuTuning.BuildCurvePlan` therefore writes the cap→flat segment as a straight line through
 (settle voltage, requested clock) with a fixed 16 MHz rise: the smallest the driver keeps, and a
 bound on the realized miss at half of it, with the post-write refinement absorbing the bin
-rounding. On a 10 mV gap this operates the card 5 mV above the
-named cap (`--mv 900` runs at 905 mV); keeping the voltage at or under the cap would cost a
-stock-slope step of clock, the worse side of the trade.
+rounding. On a 10 mV gap this operates the card 5 mV above the named cap (`--mv 900` runs at
+905 mV); keeping the voltage at or under the cap would cost a stock-slope step of clock, the
+worse side of the trade.
 
 ## Generations
 
 
@@ -97,16 +97,18 @@ public void TelemetryUnderLoad_ReportsARealOperatingPoint()
     /// actually holds: no lower than the cap point (a flatten-at-the-cap shape settles one step
     /// BELOW the cap, which is what the lower bound exists to catch) and no higher than one boost
     /// step below the effective top plateau's first anchor. The upper bound comes from the
-    /// read-back rather than the written shape because the driver can round the written flat's
-    /// tail a bin up, moving the plateau — and the settle — one or more anchors above the written
-    /// flat start (the post-apply report carries a note when it does). The clock assertion beside
-    /// each call bounds the plateau's height, so a wrong written shape can't vouch for itself
-    /// through its own wrong plateau.</summary>
+    /// read-back rather than the written shape because anchors step with temperature between the
+    /// apply and the loaded settle, moving the plateau — and the settle — a step or two up (the
+    /// post-apply report carries a note when the write itself staircased). The plateau inference
+    /// can walk far up a tilted read, so the ceiling is also clamped absolutely at three anchors
+    /// above the cap — beyond every step measured — keeping the bound real; the clock assertion
+    /// beside each call bounds the plateau's height the rest of the way.</summary>
     private void AssertSettledOnTheEffectiveCap(IReadOnlyList<(int Mv, int Mhz)> stock, int k, int settleMv)
     {
         (int Mv, int Mhz)? point = GpuTuning.EffectiveOperatingPoint(NvApi.GetVfCurve(_gpu.Gpu));
         Skip.If(point is null, "the effective curve didn't read back cleanly - retry.");
-        Assert.InRange(settleMv, stock[k].Mv - 2, point!.Value.Mv + 2);
+        int ceilingMv = Math.Min(point!.Value.Mv, stock[Math.Min(k + 3, stock.Count - 1)].Mv);
+        Assert.InRange(settleMv, stock[k].Mv - 2, ceilingMv + 2);
     }
 
     /// <summary>The point the boost settled on: after a warm-up pause, samples the live telemetry
 
@@ -41,9 +41,14 @@ public void PlainCap_WritesTheStraddle_AndFlattensAbove()
         long capAnchorKhz = stock[k].Mhz * 1000L + deltas[k];
         long flatTopKhz = stock[k + 1].Mhz * 1000L + deltas[k + 1];
         Assert.InRange(flatTopKhz - capAnchorKhz, 8_000, 24_000);
+        // The written flat is exactly level relative to the curve the plan was built from; this
+        // measures it against a fresh live read, and anchors step individually by a bin with
+        // temperature between the two reads (see DEVELOPMENT.md), so each anchor gets one bin of
+        // slack. A stock-slope-continued shape still fails - its clocks keep climbing across the
+        // whole flat.
         for (int i = k + 2; i < deltas.Length; i++)
         {
-            Assert.Equal(flatTopKhz, stock[i].Mhz * 1000L + deltas[i]);
+            Assert.InRange(stock[i].Mhz * 1000L + deltas[i], flatTopKhz - 8_000, flatTopKhz + 8_000);
         }
 
         Assert.True(deltas[^1] < -15_000,
@@ -110,8 +115,8 @@ public void Status_WhileCapped_ReportsTheOperatingPoint()
         // against the read-back until the realized point is the plan's settle (one boost step
         // below the flat start, floored at the cap), so a same-power-state status read moments
         // later reports that point - one boost step of slack each way covers an anchor stepping
-        // with temperature between the two reads, and a refinement that ran out of probes on a
-        // knife-edge write. The settle-law physics itself is LoadTests' subject.
+        // with temperature between the two reads. A kept-closest refinement whose miss exceeds a
+        // step fails here by design. The settle-law physics itself is LoadTests' subject.
         Assert.Equal(0, exitCode);
         Match m = Regex.Match(output, @"operating point (\d+) mV");
         Assert.True(m.Success, $"no 'operating point' report in: {output}");
 
@@ -8,23 +8,39 @@ namespace SimpleNvidiaUndervolt;
 /// rounding, but it is deterministic at a fixed thermal state and readable back in milliseconds,
 /// so the exact write is found by probing: when the plan's own write misses its operating point,
 /// nearby (cap, flat) pairs are written and judged against their read-backs, keeping the best
-/// realization — measured, never modeled, so it carries no constants from any one card. The
-/// budget is small and the values move by less than a bin, and a probe sequence that never lands
-/// keeps the closest attempt: the refinement can only improve on the plan's write, and the
-/// realized point is reported from the final read-back either way. What it cannot beat is the
-/// thermal slice: anchors step with temperature, so a point landed at apply time can still sit a
-/// step away at operating temperature — physics the report's notes carry, not error.
+/// realization. The candidate heuristics are tuned on measured hardware, but correctness never
+/// rests on them: every pair is judged by its own read-back, every pair stays within
+/// <see cref="MaxCapAdjustMhz"/>/<see cref="MinRiseMhz"/>..<see cref="MaxRiseMhz"/> of the plan's
+/// shape, and a probe sequence that never lands keeps the closest attempt — the refinement can
+/// only improve on the plan's write, and the realized point is reported from the final read-back
+/// either way. What it cannot beat is the thermal slice: anchors step with temperature, so a
+/// point landed at apply time can still sit a step away at operating temperature — physics the
+/// report's notes carry, not error.
 /// </summary>
 internal static class CurveRefinement
 {
-    /// <summary>Extra writes the probing may spend after the plan's own. The measured cases
-    /// converge in one or two; the budget covers a full bin of flat values either way.</summary>
+    /// <summary>Extra writes the probing may spend after the plan's own — the measured cases
+    /// converge in one or two — plus at most one landing re-write when the best pair isn't the
+    /// last one probed.</summary>
     internal const int MaxExtraWrites = 8;
 
     /// <summary>The clock slack an on-target realization may keep: half a read-back bin — the
     /// resolution the effective curve reports at, so probing below it chases noise.</summary>
     internal const int ClockToleranceMhz = 4;
 
+    /// <summary>How far a probed cap may sit from the plan's (MHz): about a bin — the refinement
+    /// absorbs bin rounding, so a candidate further out is chasing something else.</summary>
+    internal const int MaxCapAdjustMhz = 8;
+
+    /// <summary>The written cap→flat rise a probe may carry (MHz). Below the minimum the pair
+    /// measurably folds into one plateau and drops the settle a step (see
+    /// <c>GpuTuning.FlatSpreadMhz</c>); above the maximum the probe has left the plan's shape.
+    /// The bounds also keep every write the probing can produce inside the shape the e2e suite
+    /// asserts.</summary>
+    internal const int MinRiseMhz = 8;
+
+    internal const int MaxRiseMhz = 24;
+
     /// <summary>What the refinement left on the card: the deltas the final write holds (also
     /// copied into the plan's array by <see cref="GpuTuning.Apply"/>), the settle point of the
     /// final read-back (null when it wasn't readable), how many extra writes were spent, and
@@ -37,10 +53,10 @@ internal sealed record Outcome(int[] DeltasKhz, (int Mv, int Mhz)? Realized, int
     /// point misses the plan's, probes alternative (cap, flat) pairs through
     /// <paramref name="apply"/> — which writes a delta array and returns the effective read-back.
     /// Candidates come from the read-back itself (the flat re-aimed at the value its first anchor
-    /// realized, the cap re-centered to keep the settle clock) with a small scan as fallback.
-    /// Ends on the best-scoring pair, re-applied if a later probe overwrote it; the outcome's
-    /// realization is always the final read-back's, so a thermal step between probes can't leave
-    /// a stale claim behind.
+    /// realized, the cap re-centered to keep the settle clock) with an alternating scan around
+    /// the plan's flat as fallback. Ends on the best-scoring pair, re-applied if a later probe
+    /// overwrote it; the outcome's realization is always the final read-back's, so a thermal step
+    /// between probes can't leave a stale claim behind.
     /// </summary>
     public static Outcome Refine(Func<int[], IReadOnlyList<(int Mv, int Mhz)>> apply,
         IReadOnlyList<(int Mv, int Mhz)> stock, GpuTuning.CurvePlan plan,
@@ -66,7 +82,8 @@ public static Outcome Refine(Func<int[], IReadOnlyList<(int Mv, int Mhz)>> apply
                 break;
             }
 
-            if (v <= c || !tried.Add((c, v)))
+            if (v - c < MinRiseMhz || v - c > MaxRiseMhz
+                || Math.Abs(c - plan.CapMhz) > MaxCapAdjustMhz || !tried.Add((c, v)))
             {
                 continue;
             }
@@ -118,26 +135,38 @@ private static int Score((int Mv, int Mhz)? realized, GpuTuning.CurvePlan plan)
 
     /// <summary>The probe sequence: first the pairs the read-back suggests — the flat re-aimed at
     /// the value its first anchor realized (the read-back is the local bin grid), with the cap
-    /// kept, re-centered so the settle-point clock stays on the request, and dropped a step — then
-    /// a flat-value scan around the plan's own, downward through one bin and one step up.</summary>
+    /// kept, re-centered so the settle-point clock stays on the request, and dropped a step —
+    /// then a flat-value scan alternating around the plan's own before walking deeper down: the
+    /// driver rounds both ways, and a budget spent all downward would never reach an upward
+    /// landing. The consuming loop's shape bounds filter what a distorted read-back suggests.</summary>
     private static IEnumerable<(int C, int V)> Candidates(GpuTuning.CurvePlan plan,
         IReadOnlyList<(int Mv, int Mhz)> planReadBack)
     {
         if (GpuTuning.PointAtVoltage(planReadBack, plan.FlatMv) is { } flatRead)
         {
             int vr = flatRead.Mhz;
             yield return (plan.CapMhz, vr);
-            yield return (2 * plan.SettleMhz - vr, vr);
+            yield return (RecenteredCap(plan, vr), vr);
             yield return (plan.CapMhz - 4, vr - 8);
         }
 
-        for (int d = 1; d <= 6; d++)
+        foreach (int d in new[] { -1, +1, -2, +2, -3, -4, -5, -6 })
         {
-            yield return (plan.CapMhz, plan.FlatMhz - d);
+            yield return (plan.CapMhz, plan.FlatMhz + d);
         }
+    }
 
-        yield return (plan.CapMhz, plan.FlatMhz + 1);
-        yield return (plan.CapMhz, plan.FlatMhz + 2);
+    /// <summary>The cap that keeps the settle-point clock on the plan's request when the flat is
+    /// re-aimed at <paramref name="vr"/>. The settle sits <c>t</c> of the way into the cap→flat
+    /// gap (the plan's own geometry, not a fixed fraction — anchor gaps vary within one curve),
+    /// so the segment through (settle, request) solves to <c>(S − t·vr) / (1 − t)</c>; at
+    /// <c>t = 0</c> — a gap of one boost step or same-mV anchors — the settle sits on the cap
+    /// anchor and the cap is the requested clock itself.</summary>
+    private static int RecenteredCap(GpuTuning.CurvePlan plan, int vr)
+    {
+        double t = plan.FlatMv == plan.CapMv ? 0
+            : (double)(plan.SettleMv - plan.CapMv) / (plan.FlatMv - plan.CapMv);
+        return t == 0 ? plan.SettleMhz : (int)Math.Round((plan.SettleMhz - t * vr) / (1 - t));
     }
 
     /// <summary>The delta array for a probed (cap, flat) pair — the plan's own shape