diff --git a/theme/scripts/audit.mjs b/theme/scripts/audit.mjs
index 7b2999e..823e46b 100644
--- a/theme/scripts/audit.mjs
+++ b/theme/scripts/audit.mjs
@@ -170,7 +170,10 @@ function parseTokens(path) {
   }
 
   let radiusCount = 0;
-  for (const m of text.matchAll(/--radius-[A-Za-z0-9-]*\s*:\s*([^;}]+?)\s*;/g)) {
+  /* (?:-[A-Za-z0-9-]*)? — also matches the deprecated bare --radius key
+   * that drives the bare `rounded` utility, so a future non-zero bare
+   * key override cannot escape the drift guard. */
+  for (const m of text.matchAll(/--radius(?:-[A-Za-z0-9-]*)?\s*:\s*([^;}]+?)\s*;/g)) {
     radiusCount++;
     if (!/^0*\.?0*(px|rem|em)?$/.test(m[1].trim())) {
       fail(2, `radius token --radius-…: ${m[1].trim()} is not zero — Rams requires absolute zero roundedness (design doc, Shapes)`);
diff --git a/theme/scripts/audit.test.mjs b/theme/scripts/audit.test.mjs
index 23e840d..1fac233 100644
--- a/theme/scripts/audit.test.mjs
+++ b/theme/scripts/audit.test.mjs
@@ -27,9 +27,13 @@
  *   T8  inline style="…" attributes on implementation
  *       pages are audited too (no evasion path around
  *       the <style>-block scan)                       → flagged (exit 1)
+ *   T9  CR-01: the deprecated bare --radius key drives
+ *       bare `rounded` → var(--radius) = 0px (controlled
+ *       build); non-zero bare key → exit 2; the inert
+ *       v3-style DEFAULT sub-key must not reappear
  */
 import { spawnSync } from 'node:child_process';
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -119,6 +123,16 @@ if (!realTokens.includes('--radius-md: 0px;')) {
 }
 writeFileSync(badRadiusTokens, realTokens.replace('--radius-md: 0px;', '--radius-md: 4px;'));
 
+/* T9 — CR-01: the deprecated bare --radius key (the key that actually
+ * drives the bare `rounded` utility in v4) must be present and zero;
+ * a non-zero mutation must trip the drift guard (exit 2). */
+if (!realTokens.includes('--radius: 0px;')) {
+  console.error('fixture setup: bare --radius: 0px; (drives bare `rounded`) not found in src/tokens.css');
+  process.exit(1);
+}
+const bareRadiusTokens = join(FIX, 'tokens-bare-radius.css');
+writeFileSync(bareRadiusTokens, realTokens.replace('--radius: 0px;', '--radius: 4px;'));
+
 /* T6 — off-token value inside @layer components (implementation-
  * owned layer) must never be skipped. */
 writeFileSync(compLayerCss, `@layer components {
@@ -226,6 +240,43 @@ writeFileSync(styleAttrPage, `<!DOCTYPE html>
     `out=${r.out.slice(0, 300)}`);
 }
 
+// T9 — CR-01: bare `rounded` is driven by the deprecated bare --radius key
+{
+  check('T9 tokens.css carries the bare --radius: 0px key (drives bare rounded)',
+    realTokens.includes('--radius: 0px;'),
+    'src/tokens.css lost the deprecated bare --radius key — bare rounded would fall back to the v3 .25rem default');
+  check('T9 inert v3-style --radius-DEFAULT sub-key absent',
+    !/--radius-DEFAULT/.test(realTokens),
+    'src/tokens.css re-added a v3-style DEFAULT sub-key — v4 ignores it; the bare --radius key is the one that drives bare rounded');
+  const r = runAudit(['--tokens', bareRadiusTokens, clean]);
+  check('T9 non-zero bare --radius token → exit 2 (drift guard)', r.status === 2,
+    `status=${r.status} error=${r.error} out=${r.out.slice(0, 200)}`);
+
+  /* controlled build (reviewer's evasion proof, locked in as a
+   * regression): the real token sheet must compile bare `rounded`
+   * to var(--radius) — never the v3 .25rem default. */
+  const entry = join(FIX, 'cr01-entry.css');
+  const out = join(FIX, 'cr01-out.css');
+  writeFileSync(entry, `@import "tailwindcss";\n${realTokens}\n@source inline("rounded");\n`);
+  const nm = join(FIX, 'node_modules');
+  if (!existsSync(nm)) {
+    symlinkSync(resolve(THEME, '..', 'node_modules'), nm); // fixture-side resolution for @import "tailwindcss"
+  }
+  const bin = resolve(THEME, '..', 'node_modules', '.bin', 'tailwindcss');
+  const b = spawnSync(bin, ['-i', entry, '-o', out, '--minify'], { encoding: 'utf8' });
+  check('T9 controlled build (bare rounded candidate) succeeds', b.status === 0,
+    `status=${b.status} ${(b.stderr || '').slice(0, 300)}`);
+  const built = existsSync(out) ? readFileSync(out, 'utf8') : '';
+  check('T9 bare rounded compiles to var(--radius)',
+    /\.rounded\{[^}]*border-radius:var\(--radius\)[^}]*\}/.test(built),
+    `rounded rule: ${(built.match(/\.rounded\{[^}]*\}/) || ['(none)'])[0]}`);
+  check('T9 --radius: 0px emitted by @theme static',
+    /--radius:\s*0px/.test(built), 'no --radius:0px custom property in the controlled build output');
+  check('T9 v3 .25rem default no longer drives bare rounded',
+    !/\.rounded\{[^}]*border-radius:\.25rem/.test(built),
+    'bare rounded still compiles to the v3 .25rem default');
+}
+
 /* ————— report ————— */
 console.log(`audit.test: ${passes.length} passed, ${failures.length} failed`);
 passes.forEach((p) => console.log(`  PASS ${p}`));
diff --git a/theme/src/tokens.css b/theme/src/tokens.css
index 6b1200f..a6bed24 100644
--- a/theme/src/tokens.css
+++ b/theme/src/tokens.css
@@ -96,9 +96,13 @@
   --font-mono: "Space Grotesk", "Geist", ui-monospace, monospace;
 
   /* — Radius: absolute zero roundedness (design doc, Shapes). Every
-     token-driven rounded-* utility compiles to 0. NOTE: v4's
-     rounded-none/rounded-full are literal built-ins, not var-driven. — */
-  --radius-DEFAULT: 0px;
+     token-driven rounded-* utility compiles to 0 — including bare
+     `rounded`, which v4 drives from the deprecated bare --radius key
+     (v3-compat default, node_modules/tailwindcss/theme.css "Deprecated"
+     block); the v3-style DEFAULT sub-key form is inert in v4 and must
+     not reappear. rounded-none/rounded-full are literal built-ins,
+     not var-driven. — */
+  --radius: 0px; /* deprecated bare key — THE key that drives bare `rounded` */
   --radius-xs: 0px;
   --radius-sm: 0px;
   --radius-md: 0px;