diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index fad8b6f95..b72ab79af 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -62,7 +62,7 @@
         "role": "primary test (not a tradable cell)",
         "statistic": "mean over events of (mean of the 4 overnight leg log returns - mean of the 4 intraday leg log returns), gross, legs as in arms.c_decomposition",
         "alternative": "not equal to 0 at every stage; at the holdout a pass also needs the sign of the validation estimate (multiple_testing.no_direction_lock)",
-        "why_kept": "The direct test of H3's 'versus'. It uses official prints only, so it needs no fill and no cost model. The literature (LPS 2019, ABJK 2022) concerns large, liquid names and gives no sign for movers, so the test is two-sided at every stage. It is not locked to the development sign, because development is survivorship-limited (chronology.labels.development) and gates nothing. At the holdout, a confirmatory pass also needs the holdout estimate to have the sign of the governing validation estimate, so a pass replicates the screened direction."
+        "why_kept": "The direct test of H3's 'versus'. It uses official prints only, so it needs no fill and no cost model; it is therefore not an exact replication of LPS 2019, whose open is the first-half-hour VWAP. LPS 2019 excludes microcaps (price below $5 or the bottom NYSE size quintile), and ABJK 2022 keeps common stocks above $1 (excluding financials and utilities) with its effect in all but the largest size decile; neither studies the mover population or gives a sign for movers, so the test is two-sided at every stage. It is not locked to the development sign, because development is survivorship-limited (chronology.labels.development) and gates nothing. At the holdout, a confirmatory pass also needs the holdout estimate to have the sign of the governing validation estimate, so a pass replicates the screened direction."
       }
     ],
     "tradable_cells": "H1-D-b_lane-low, H3-a and H3-b are tradable cells and nothing else. H1-D and H3-c are primary tests and are never tradable cells. The robustness requirement (statistics.robustness_required_for_a_pass) applies to the three tradable cells only.",
@@ -576,25 +576,26 @@
   },
   "run_discipline": {
     "study_code": {
-      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend.",
+      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend. Review round 18, second repair (R2-2): the tree a run names is HEAD's study tree, which core.guards.running_tree returns only when git status reports no change to the study tree, no index entry of it is marked assume-unchanged or skip-worktree, and every file of that tree is a regular file in the working copy whose own bytes hash to its blob (git hash-object --no-filters, which reads neither the index nor a filter). Every git command core.guards runs ignores replace refs (git --no-replace-objects), so no replace ref stands in for a commit, tree or blob that a guard reads. running_tree checks once, when a run builds its context: a file changed later in the same run is not detected.",
       "path": "blueprints/us-equities/mover-v3/study/",
       "fetch_path": "blueprints/us-equities/mover-v3/study/fetch/",
       "tree": null,
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "0e0a53f4cd1cbb2745994acdf0d46ca1f0eb01fb",
+        "tree": "cc7ecaecfc0207b61bd20fa4178bfa6769bbc857",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
       "runtime": "uv-managed CPython 3.13.15; duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 and their dependencies (study/runtime-requirements.txt)",
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
-        "date": "2026-09-25",
-        "tree": "0e0a53f4cd1cbb2745994acdf0d46ca1f0eb01fb",
+        "date": "2026-10-01",
+        "tree": "cc7ecaecfc0207b61bd20fa4178bfa6769bbc857",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
-        "command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
-        "tests_run": 329,
+        "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
+        "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
+        "tests_run": 419,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -862,7 +863,7 @@
     "fetch": "Before any outcome of a stage (development, validation, and each holdout 'count' or 'read'), the frozen code fetches every quote window, minute bar, per-event daily bar and official print that stage needs, and for development and validation first the full 2016-2020 screen data (universe_and_identity.request_shapes), under universe_and_identity.asof. Review round 8, R8-1: the request plan (symbols, asof, sessions, stamps, entry, exit, search and backward windows, and the enumeration) is derived by core/plan.py and core/stage.py, in the evaluation tree, only from sealed inputs (the calendar, the enumeration, corporate-action records, decision-time inputs, and the timestamps and eligibility of already sealed quotes); the loop core/driver.py fetches every planned request not yet sealed until the plan adds nothing. study/fetch/ receives one planned request and returns its raw pages; it derives nothing and parses no row. Terminal-search windows of censored trades extend past the segment end (populations.terminal_exits.segment_end), and backward windows follow populations.terminal_exits.booking (R8-7). The result is sealed as a sha256-pinned private snapshot (the ledger's sha256; the ledger holds every page's sha256 and normalized-record sha256), and that sha256 and the stage's fetch-incomplete rate by kind are committed in the run log. At most one re-fetch is allowed: once, of only the fetch-incomplete requests, before any outcome of that stage, followed by fetching any window that only then became plannable, committed the same way. After it, the 1% void rule is final. No outcome is computed from unsealed data.",
     "synthetic_tests": "The evaluator refuses a results file whose run-log entry names a tree other than the pinned one, a holdout count or read from a tree other than the pinned one or a passing transport deviation of it, a transport deviation without a passing reproduction check, a runtime that differs from runtime.lock, an edited (not appended) amendment file, a second results file for a stage, a read retry that chronology.holdout.read_timing does not permit, and an outcome computed before the stage's fetch rate is committed. It accepts a run from a commit reachable from origin/main whose study tree equals the pinned tree, with run-log, access-log and amendment lines committed after the freeze. A test kills a run before its results write and asserts that nothing was written and that the retry reproduces an uninterrupted run byte for byte. The suite is study/tests/, run by study_code.test_command under study/runtime.lock. Review round 9 (F6) adds command-level tests against a temporary repository shaped like this one after the freeze (tests/fixture_repo.py), so no test depends on the real protocol's status or writes to the real run log: every command refusing on a draft, a stage fetched once and evaluated into one results file with a kill after the write, the context refusals (bytecode isolation and ignored files, logs off origin/main, a protocol edited after the freeze, amendment timing, coverage_decision, transport deviations), the count-only command, and the holdout path through collect, count with two extensions and read, with two batches of different enumerations and a rename re-fetch, and the not-read label after the deadline.",
     "pinned_copies": "The study tree imports no module outside itself except the Python standard library, numpy, pandas, exchange_calendars and duckdb (review round 7, F6; review round 8, E1 adds duckdb, which the pinned dedupe_identity needs). It holds byte-for-byte copies of the external definitions it needs, listed in study/pinned_copies.json as (source path, commit aa6fc79, git blob, sha256, definition names): the Bars class and ET, et_epoch, TIME_BUCKETS, PRICE_TIERS, DV_TIERS, time_bucket, price_tier and dv_tier from mover-early-entry rules.py (R8-12); official_price from sessions_io.py; valid_quote from quotes.py; dedupe_identity with DUPLICATE_SERIES_MIN_SESSIONS, DUPLICATE_SERIES_MIN_SPAN_COVERAGE, CONTINUITY_RATIO, _rename_terminus and _components from broad-universe coverage.py; DATA_SYMBOL from collect_daily.py. A synthetic test reads each source with git cat-file at the listed blob, checks the blob hash and sha256, extracts each named definition with ast (decorators included) and asserts that the copy is identical and holds nothing else. Because nothing outside the tree is imported, a later edit to those paths on main cannot reach a run, and no module-level code of rules.py, quotes.py or coverage.py (their fees.json, protocol.json and duckdb-connection code) ever runs.",
-    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is read, never drawn again, and an output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
+    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is never drawn again. It is adopted only through core.store.recover_seal (review round 18, R5, and its repair): its ledger is verified against its seal record, as the dry run's is (freeze_preconditions), and its binding must name the running study tree, protocol sha256 and runtime-lock sha256, the label, the seed, the source snapshot (its binding, requests and sealed attempts) and the request plan. A snapshot without its seal record is refused, and a partial, unbound, mismatched or altered one is refused when its seal.json is intact. seal.json is a write-once record inside the snapshot directory, not an external anchor: a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted (a residual recorded in review_record, round 18). An output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
   },
   "leverage_and_exits": "Research runs use 1x equal notional. Paper use of any passing rule follows the README's exit and leverage policy (at most one broker-held closing order per share, the leverage-schedule-v1-20260922 ceiling, and the leverage-ladder gate rows in catalogs/us-equities/gates-20260922.json, one rung at a time). H3-b stays at 1x in any later paper use until the 2x rung and its overnight cap are clean. The edge-shrink term stays 0 until a holdout pass.",
   "freeze_preconditions": [
@@ -874,7 +875,7 @@
     "The Alpaca market-data plan's documented historical-data rate limit recorded with its source, and a request-count fetch-time estimate for development and validation at that limit: the full 2016-2020 screen fetch (sessions x requests per session for the enumerated list) plus the per-event requests for at most 20 x (k + 3 sqrt(k) + 3) candidates per year, where k is that year's sampled candidate count (pre_freeze_access_path.outputs). This candidate bound governs the margin test. The estimate must leave a margin of at least 50% under the 40 sessions before N0 (coverage_rule.thresholds.fetch_margin_min and fetch_estimate, decided by the count-only code, review round 8, R8-9). If it does not, the protocol is not frozen as written. core/count_only.py fetch_estimate computes it (review round 9, M-2): the full 2016-2020 screen requests (sessions x 4 x ceil(enumerated symbols / 100)) plus, per year, candidate_bound(k) x 58 per-event requests (core.plan.per_event_requests_max: 5 per-event requests; per arm one entry window and at most 7 forward exit and 7 rename-sensitivity windows; and 8 backward windows), at the recorded rate limit. Review round 11, C2: the estimate counts requests, not pages; a request of more than one page (an event's minute bars, up to 3 pages) takes one rate slot per page, so the estimate is not a strict upper bound, and the minute-bar pages add little to an estimate dominated by single-page screen requests. The fetch itself is paced at the pinned rate (pre_freeze_access_path.rate_limit). Review round 15, F12: that request-count estimate is replaced by a page-based one at the slower of the pinned rate and the dry run's measured throughput, with the market-data and trading limits pinned separately and pinned retry and evaluation-and-merge allowances (pre_freeze_access_path.pipeline_allowance; coverage_rule.thresholds.fetch_estimate.rule), so the margin gate is applied to budgeted end-to-end time rather than to requests at the rate ceiling; the native dry run therefore comes before the count-only run.",
     "The identity probe (exposure_registry.pre_freeze_access_path.identity_probe) run by committed count-only code, with at least 20 rename probes, at least 95% matches for bars and for auctions and at least 90% for quotes (coverage_rule.thresholds.identity_probe; the count-only code emits the pass or fail, R8-9), no observed ticker-reuse failure (review round 15, N07), and the ticker-reuse result recorded (verified, or unverified for 2016-2020 if no case exists or none is conclusive)",
     "The study tree committed with runtime.lock and synthetic tests that pass under that runtime before any outcome, with 0 skips (run_discipline.study_code.test_command). Done in draft at the revision named by run_discipline.study_code.draft_tree_at_this_revision (test_record); it must be rerun on the tree that the freeze pins. The tests cover: every populations.formulas case, each official-print source label, the exclusion rules, a suspected unadjusted split, the fill-quote cases, the terminal-exit cases, the universe_and_identity cases (FB/META through the pinned dedupe_identity, ticker reuse, rename inside a hold, a split and a rename inside one hold, empty responses, fetch-date asof refused, corporate-action date fields), split, ex-dividend and 5% special-dividend crossings, the 2016-2020 early closes, a calendar and a fee amendment, a 2017 and a 2019 fee lookup with the TAF cap, the fetch-failure cases for every request kind, a dropped middle year, segment-end censoring and the embargo (including none at N0), the independence of validation and the holdout from every development output (H3-c two-sided with no direction lock, validation breakpoints from validation sessions only), the robustness statistics, the gate test, the count_unit keys, the holdout-read classification, the run_discipline refusals and the evaluator's holdout refusals, the access log's authorization and completion records including count and read retries, the net-return formula and the cash band, the in-hold split-record rule, a split on a session with no bar, censored exits searched past a segment end, backward windows, the pinned copies against their blobs, the atomic results write and the read retry, the plan regeneration and reparse checks, and the transport-deviation reproduction check. The code imports no module outside the study tree except the Python standard library, numpy, pandas, exchange_calendars and duckdb, so none of rules.close_hhmm, rules.fee_rates, rules.sell_fees, rules.net_return, rules.net_return_np and quotes.fetch_one can be called, and a test asserts both.",
-    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only.",
+    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only. A sealed dry-run snapshot is recovered without fetching only through core.store.recover_seal (review round 18, R5, and its repair after the round-18 reviews). The ledger is read under the sha256 that its seal record (seal.json, published once before the ledger) recorded at seal time, never under a digest of the ledger being checked, and must give that record back exactly: the binding, every completion stamp with its attempt, status and page count, every page sha256 and the counts. The binding must name the running study tree, protocol sha256 and runtime-lock sha256 (core.runner.seal_run_identity), the sessions, the symbols and the request plan, and the ledger's requests must be the ones it names. The fetch start (utc_start) is bound beside that identity and read back, never matched: a retry on a later UTC day recovers the seal, and the output names that start as fetch_utc_start (provenance metadata from the seal, not market data). A run from another study tree, protocol or runtime lock must fetch its own snapshot under a new snapshot root, so the dry run the freeze relies on was fetched by the tree it names. A snapshot without its seal record is refused, and a partial, unbound, mismatched or altered one is refused when its seal.json is intact. seal.json is a write-once record inside the snapshot directory, not an external anchor: a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted (a residual recorded in review_record, round 18).",
     "The frozen collector (core/plan.py collection plan and core/driver.py loop over the study/fetch/ transport) committed in the study tree, with its schedule committed and enabled so that the first collection batch covers the session of the freeze (holdout_gate.prospective_collection)",
     "The exposure registry updated with everything the author saw since this draft",
     "status set to frozen, frozen_before_outcomes true, run_discipline.study_code tree and fetch_tree (tree hashes only) and data_file_sha256s filled in, coverage_decision (dropped years and items_tested from the governing count-only output) recorded, and the protocol sha256 recorded in a commit that becomes reachable from origin/main (chronology.holdout.window defines the freeze commit); the study tree was merged to main before the freeze pull request, which does not change it coverage_decision is {dropped_years (integers), items_tested (a boolean), count_only_output: 'blueprints/us-equities/mover-v3/results/count-only-output.json', count_only_output_sha256}. core.runner.context refuses a coverage_decision that is mistyped or differs from that committed output's item_rule (review round 9, F7), and a development or validation run refuses an enumeration file whose sha256 differs from the output's part0.enumeration_sha256. Review round 15, F04: core.runner.check_coverage_decision also refuses unless the governing complete 'count_only' line cites the output and the output's dependency manifest equals the frozen tree, data files, parameters, coverage_rule and rate limit. Review round 15, N02: open_before_first_holdout_count is empty at the freeze. After the freeze neither the protocol nor non-transport code can change, so an entry left there could never be cleared and the first holdout count could never be authorized (core.holdout.authorize refuses while it holds one).",
@@ -1150,6 +1151,30 @@
       "round": 17,
       "input": "Cross-family (GPT-6) re-review of round 17 at 1961e23f, minor: the round-17 F2 wording said every identity use, the terminal-zero rename count included, resolves through the dated issuer resolver, but the rename diagnostic (study/core/trades.py:228 at 1961e23f) still selected renames by old_symbol == sym, so OLD -> MID on the entry day then MID -> NEW during the hold reported no rename and requested no rename sensitivity.",
       "resolution": "Implemented the issuer-aware alternative rather than narrowing the wording: core/trades.py resolves the terminal-zero rename diagnostic through Ctx.issuer_records. Four regressions in tests/test_trades.py: test_terminal_zero_chained_rename_is_counted_and_rerequested and test_terminal_zero_rename_diagnostic_rejects_other_issuers fail on 1961e23f; the single-rename and entry-day boundary cases pass on both as guards. Protocol: the rule sentence in universe_and_identity.corporate_action_dates. Study suite: 362 tests OK."
+    },
+    {
+      "date": "2026-09-26",
+      "round": 18,
+      "input": "Pre-freeze residuals from the round-17 verifiers and GPT-6 re-review at 803bc351: R1 (F1), H3-c's last overnight leg and mixed split/spin-off legs; R2 (F2), a name_change effective exactly at asof=t for every issuer-record consumer; R3 (F3), the exhausted-terminal refusal reason; R4 (F4), the no-valid-page-calibration guard; R5 (F5), safe retry of the count-only dry run and transport-check live samples after sealing.",
+      "resolution": "R1-R4 are coverage only: tests/test_trades.py adds last-leg and mixed-action H3-c cases in count and read modes and asof-day boundaries for action exclusions, terminal mergers and the terminal-zero rename diagnostic; tests/test_holdout.py asserts the exact terminal_actions acquisition refusal and the exhausted planner's enumeration-only boundary; tests/test_calibration.py directly asserts the no-valid-page-calibration refusal. All eight targeted cases pass on unchanged 803bc351 production code. R5 follows core.holdout.collect at that pin: core/count_only.py dry_run and core/transport_check.py seal_live_samples validate an existing snapshot with Store.read, require its binding and complete request/stamp set to match the new request, and reuse its sha256 without fetching or writing; partial, mismatched, unbound or altered snapshots refuse. The dry-run binding includes sessions, symbols, fetch date and request plan; each live-sample binding includes label, seed, source request/attempt digests and sample plan. Tests in tests/test_seal_recovery.py cover matching recovery, mismatched or missing binding, partial ledgers/pages and altered pages for both callers, with no further request and unchanged bytes. Before the change the dry-run matching retry raises SealError after fetching again, its refusal cases also fetch again, and the live-sample refusal cases accept invalid seals or fetch again; the live matching retry already passes. Protocol: freeze_preconditions' dry-run sentence and run_discipline.transport_deviations. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+    },
+    {
+      "date": "2026-09-26",
+      "round": 18,
+      "input": "Literature correction from a live GPT-6 academic-paper sweep for strategy-research (25 verified papers; PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md): item_set.items[4].why_kept described the LPS 2019 and ABJK 2022 samples together as 'large, liquid names'.",
+      "resolution": "Re-verified by the coordinator from the manuscripts. ABJK 2022 (JFE 145(3), September 2021 manuscript): CRSP share codes 10 and 11 on NYSE, AMEX and NASDAQ, excluding financial and utility firms and firm-months with a previous month-end price at or below one dollar, May 1993 to December 2017; the high-minus-low hedge return is significant for all but the largest size decile. LPS 2019 (LSE accepted version, eprints.lse.ac.uk/87481): microcaps, i.e. a price below $5 or the bottom NYSE size quintile, are always excluded, and the open is the first-half-hour VWAP from TAQ. The sentence now states each sample separately and that the official-print diagnostic is not an exact replication of LPS's VWAP open. Rule impact: none; the test stays two-sided at every stage and no arm, horizon, threshold or code changes."
+    },
+    {
+      "date": "2026-10-01",
+      "round": 18,
+      "input": "Independent pre-outcome reviews of PR #360 (round 18 at af38dced). Claude Opus (2026-09-30): H1 (high), the dry-run seal binding had no study tree. A tree whose change lies outside the plan code (study/fetch/, core/driver.py) adopted, without a request, the seal that a failed run of another tree left. run.py's finally block writes a failed end line, so the next run opens a new start line. The output and run-log line then named the new tree although its transport never ran, so the F12 calibration could come from another tree's transport (freeze_preconditions[8] wants the tree the freeze pins to fetch). M1 (medium): the matched identity held the current run's fetch date, which changes neither the plan nor the fetch, so a retry on a later UTC day was refused for good, and the round-18 test asserted that rule. Lows: L1, a ledger cut after the attempt-0 stamp of a re-fetched request passed set(state) == set(req); L2, zlib.error, TypeError, AttributeError and an OSError outside the try escaped the SealError wrapping; L3, the holdout label's seed case was refused at 'stage' first; L4, the literature entry cited a path that exists only on PR #358's branch; L5, the draft tree and test record were stale. GPT-6.1 Sol (native Codex 0.159.2, effort ultra, 2026-10-01): G-H (high), recovery read each seal under a sha256 computed from the ledger being checked, so a page replaced together with its ledger digests was adopted and turned a failing transport check into a pass after one provider call. G-M (medium): removing the request-record comparisons, or the source binding from the live-sample source digest, left every recovery test passing.",
+      "resolution": "core/store.py: Store.write(seal_record=True) publishes a seal record (seal.json) once, before the ledger. It holds the ledger sha256, the binding, every completion stamp as [key, attempt, status, pages], every page sha256, and the attempt and page counts. core.store.recover_seal is the only recovery path of count_only.dry_run and transport_check.seal_live_samples. It reads the ledger under the recorded sha256 (G-H) and requires the snapshot to give the record back exactly, which compares the attempt stamps exactly (L1). It then checks, separately, the identity, the request plan, and the ledger's request records against the requests the binding names (G-M). Store.read checks every completion stamp's page count against its attempt's page events, and every refusal is a SealError naming the dry run or the live-sample label (L2). The repair also made three changes that this record first left unnamed: test_record.command records the env-prefixed -B command that was run and gains a command_note field; Store.read refuses a second completion stamp for one (key, attempt) in every snapshot it reads, of every type, not only in recoverable seals; and Store.write refuses a directory that already holds seal.json. The dry-run identity is {study_tree, protocol_sha256, runtime_lock_sha256, sessions, symbols, requests}, with the first three from core.runner.seal_run_identity (H1). Its fetch start (utc_start) is bound beside the identity, read back into the output as fetch_utc_start and never matched (M1). Each live sample adds the same three to its label, seed, source digest (binding, requests, attempts) and requests. Residuals, recorded and not fixed: (1) seal.json is a write-once record inside the snapshot directory, not an external anchor. While it is intact, recovery refuses a page replaced with its ledger digests, a cut ledger and a ledger whose durations or vintages changed, but a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted: nothing here resists a writer who rewrites seal.json. (2) core.holdout.collect still reads its seal under a digest of its own ledger, the G-H pattern on another path; it predates this round. (3) The orphan-output adoption paths (run.py dry-run and transport-check) verify the seals against the sha256 values named in the output body, not against seal.json. Tests in tests/test_seal_recovery.py: two command-level regressions written first. At af38dced the H1 case fails with 'AssertionError: SealError not raised' and the M1 case errors with 'SealError: dry-run snapshot binding differs from the requested dry run' (Ran 10 tests, FAILED (failures=1, errors=1)). Fifteen unit cases. For the dry run: a later-day retry; another study tree, protocol or runtime lock; a changed plan for the same sessions and symbols; a missing or mismatched seal record; a ledger with altered fetch times; a page replaced with its ledger digests; a resealed request change; a resealed stamp page count; a ledger cut after a re-fetched request's first stamp; unreadable snapshots. For the live samples: run-wide changes sealed into a mixed root, so that each label's own refusal is asserted (L3); a missing seal record; altered fetch times; a resealed request change; and the GPT experiment end to end through reproduction_check. Reproduced directly at af38dced (not committed): passes false, then true after the page and digest replacement, with 1 provider call in all; an edited duration accepted (measured elapsed 0.002 s to 16000.002 s); the cut ledger accepted; zlib.error, AttributeError and IsADirectoryError escaping. At the repair each refuses as a SealError. Mutants, each killed by its named test: study_tree removed from the dry-run identity (test_another_study_tree_protocol_or_runtime_lock_refuses and the command-level H1 test); the fetch date matched again (test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start and the command-level M1 test); the plan-change check removed (test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses); the request-equality check removed (test_a_resealed_request_change_refuses, dry run and live samples); recovery hashing the current ledger instead of the seal record (test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record, dry run and live samples); the source binding omitted from the live digest (test_mismatched_or_missing_binding_refuses_without_requests, change source_binding). L4: the round-18 literature entry cites PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md; the merge order is the coordinator's decision. L5: run_discipline.study_code.draft_tree_at_this_revision and test_record name the repaired tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17 and 395 tests. The GPT review also confirmed, against the primary manuscripts, the LPS 2019 (eprints.lse.ac.uk/87481, section 3, pp. 9-10) and ABJK 2022 (September 2021 manuscript, section 3, p. 10 and section 4.2.2, p. 18) sample definitions that the round-18 literature correction states. Follow-up, 2026-10-01: an independent verification of this repair passed it with five low findings, and four are repaired. The rule sentences in freeze_preconditions and run_discipline.transport_deviations said that an altered snapshot refuses; they now say that it is refused when its seal.json is intact, and state residual (1). The seal record's per-page sha256 comparison had no test (emptying page_sha256s in core.store.seal_record_of passed all 393 tests at 5a1d4b0e): test_a_resealed_page_replacement_refuses (dry run, and each live-sample label) replaces a page with its ledger digests, reseals only the ledger_sha256 of seal.json, and asserts the refusal 'the snapshot differs from its seal record', no transport call and unchanged bytes. Under that mutant the suite now fails in this test's three cases and nowhere else (Ran 395 tests, FAILED (failures=3)). This record now names the three changes above and lists its residuals, and a stray git-ignored bytecode directory (scripts/__pycache__) was deleted from the review worktree, which changes no tracked file. Protocol: the dry-run sentence of freeze_preconditions and run_discipline.transport_deviations. Study suite: 395 tests OK. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+    },
+    {
+      "date": "2026-10-01",
+      "round": 18,
+      "input": "Cross-family re-check of the round-18 repair of PR #360 at 406ad3c5 (the repair 1e3fd5a1 with origin/main at 3361b342 merged in; study tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17). GPT-6.1 Sol (cx/gpt-6.1-sol, effort max, Codex 0.159.2, read-only, through the packaged lane on OmniRoute, tools/sota-convergence/landscape-sweep/codex_call.sh), 2026-10-01 03:42-04:18Z. Verdict: changes needed; four findings, each reproduced by the reviewer's own probe. R2-1 (high): a seal record whose ledger_sha256 is JSON null turned ledger verification off. core.store._recover_seal passed the recorded value to Store.read, which compares no digest when it is given None, and seal_record_of gave the null back, so the record comparison passed too. R2-2 (high): the study tree in a seal identity could differ from the files that ran. core.guards.running_tree returned HEAD's study tree whenever git status reported no change, and git status reports none for a tracked file whose index entry is marked assume-unchanged or skip-worktree; core.runner.seal_run_identity copies that tree into every seal identity, so H1's binding could be bypassed. R2-3 (medium): a snapshot path that was a regular file held no ledger, pages or seal record, so it counted as unused; the caller fetched again and Store.write then raised NotADirectoryError, outside SealError. R2-4 (medium): two stamp controls had no test. Mutant A (st['attempt'] replaced by 0 in seal_record_of's stamp entries) passed all 27 recovery tests, and mutant B (Store.read's refusal of a second completion stamp removed) passed the 393 tests the reviewer ran. The same re-check confirmed that the seven mutants the earlier entry names are killed by their named tests, that its three residuals are stated accurately, and that the protocol status and the recorded draft tree were correct.",
+      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, a file name with a control character (git hash-object reads one path per line), a symbolic-link or submodule entry, and a git hash-object call that fails or prints too few hashes are refused. Every git command core.guards runs ignores replace refs: core.guards.git_command builds each one with --no-replace-objects. The option first came in a follow-up commit of this repair (ba106834), on the two git calls of running_tree, after a direct probe of the content check as first committed (28fafe84): with a replace ref on HEAD's study tree object (git replace), git status reported nothing for files that matched the replacement tree, no index flag was set, git ls-tree listed the replacement's blobs under the id of HEAD's tree, and running_tree returned HEAD's tree. The coordinator ruled that this belongs to R2-2 (it is the correctness of the content check that this repair adds, not a fifth finding) and asked for it in the shared helper (follow-up F2, 89f64e24), so that committed_bytes, the tree diff behind transport deviations (fetch_only_diff, and the changed paths run.py transport-check lists) and every rev-parse, log, show and verify-commit read the repository's own objects as well. With it, running_tree's own git status reports files that match a replacement tree as changed. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths; git(1) --no-replace-objects and git-replace(1). run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. Follow-up F1 (the coordinator's ruling, 89f64e24) closes the class: a snapshot path counts as unused, and is fetched into, only if it is absent and its nearest existing ancestor is a directory, or it is an empty directory. A path under a regular file or a dangling link, and a directory that holds anything without a ledger (a stray ledger.jsonl.tmp or seal.json.tmp, any other file), are refused as a SealError before any fetch; a directory with pages or a seal record keeps its 'partially written' refusal. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes, and after F1 a snapshot path of any shape listed under R2-3 is refused there, before a fetch. What can still fail after a fetch, outside SealError, is an operating-system error while Store.write writes (permissions, a full disk, a path changed between the check and the write). (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests: 24 in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py: 12 written first for the four findings, 3 with the first follow-up, 8 with the coordinator's follow-up and 1 after the independent verification below. On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. The first follow-up added three tests to tests/test_guards.py: the replace-ref state, which failed first at 28fafe84 ('Ran 13 tests in 3.251s', 'FAILED (failures=1)', 'AssertionError: Refused not raised'), and two for branches of the content check that no test reached (a line break in a tracked file name; git hash-object exiting with an error or printing one hash too few), which pass at 28fafe84 and have mutants (7) and (8) as their failing evidence. The coordinator's follow-up added eight, written first. For F1, in tests/test_seal_recovery.py, for the dry run and for the live samples: a regular file or a dangling link as the snapshot root; a directory that holds only a stray ledger.jsonl.tmp, seal.json.tmp or other file; and unused paths (absent, absent under absent directories, an existing empty directory) that are still fetched into and sealed. For F2, in tests/test_guards.py: committed_bytes and fetch_only_diff under a replace ref. On the code of 7acb6944 the three modules gave 'Ran 57 tests in 16.168s' and 'FAILED (failures=7, errors=8)'. Six tests failed: the four F1 refusal tests (NotADirectoryError under a regular-file root, FileExistsError beside a stray ledger.jsonl.tmp or seal.json.tmp, 'SealError not raised' beside any other file, and Store.write's own SealError after the fetch under a dangling-link root), committed_bytes returning the replacement blob, and fetch_only_diff returning true for trees that also differ in core/. The two unused-path tests pass there by construction: they guard against refusing a path that is unused. The replace-ref test of the first follow-up is kept: with every git command ignoring replace refs, running_tree's own git status reports the files as changed, and that is the refusal it now asserts. After the repair the three modules give 'Ran 57 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. All were run at cd36752e, except (9), run at 89f64e24, since when core/store.py and tests/test_seal_recovery.py are unchanged. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed, test_running_tree_refuses_a_committed_symbolic_link, test_running_tree_refuses_a_file_name_that_one_line_cannot_carry and test_running_tree_refuses_when_git_does_not_hash_every_file (Ran 55 tests, FAILED (failures=11), all 'Refused not raised'; at ba106834 the replace-ref test failed here too, and since F2 git status itself refuses that state). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 55 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag, which shows that the flag refusal runs first and has its own failing cases). (4) Non-directory refusal at the snapshot path removed, with F1's rule kept: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 42 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 42 tests, FAILED (failures=2), 'SealError not raised'). (7) The control-character refusal removed: its test fails on the message, because git hash-object then fails and that branch refuses the tree (Ran 15 tests, FAILED (failures=1)). (8) git hash-object's exit status ignored, and separately its count of hashes ignored: test_running_tree_refuses_when_git_does_not_hash_every_file, 'Refused not raised' in the matching case (Ran 15 tests, FAILED (failures=1), each). (9) F1's rule removed, which falls back to the R2-3 check: test_a_snapshot_root_that_is_not_a_directory_refuses_without_requests, test_a_snapshot_directory_that_holds_only_stray_files_refuses_without_requests, test_a_live_root_that_is_not_a_directory_refuses_without_requests and test_a_label_directory_that_holds_only_stray_files_refuses_without_requests (Ran 42 tests, FAILED (failures=5, errors=8)). (10) --no-replace-objects removed from core.guards.git_command: test_committed_bytes_returns_the_real_blob_under_a_replace_ref, test_the_transport_deviation_diff_compares_the_real_trees_under_a_replace_ref and test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree, the last with 'Refused not raised' (Ran 55 tests, FAILED (failures=3)). An independent Opus verification of ace56485 (stack-verifier, read-only, 2026-10-01 06:01-07:58Z) confirmed the repair (full suite 418 OK, each mutant above killed, scope and pins correct) and found two defects, both fixed in 50fd6836: no test protected --no-filters, because git applies no anchored repository-relative attribute pattern to the absolute paths running_tree gives git hash-object, so the clean filter of test_running_tree_refuses_a_change_that_a_clean_filter_hides never reached the content check (with the option removed, Ran 55 tests, OK), and that test now uses a basename pattern and fails without the option (Ran 56 tests, FAILED (failures=1), 'Refused not raised'); and the index-flag refusal's message said that the bits hide a change, which misled for a checkout made under core.ignoreStat=true, where git marks every file it checks out assume-unchanged, so the refusal stays and its message now says that the index marks the files, so the run cannot verify them, and how to clear the bits (test_running_tree_refuses_a_checkout_made_under_core_ignore_stat_and_says_how_to_clear_it, which failed first on the old wording). Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) Closed by follow-up F1. Before it (measured with core/store.py as at 28fafe84, which F1 was the next commit to change), under a snapshot root that was a regular file the dry run made 16 provider calls before Store.write raised NotADirectoryError, and in a snapshot directory that held only a stray ledger.jsonl.tmp or seal.json.tmp it made 16 calls before Store.write raised FileExistsError, leaving pages behind. On the final tree each of these, and a directory that holds any other file, is refused as a SealError with 0 provider calls, and nothing is written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit, and it does not recompute the tree's id from the files: it takes the tree and blob ids that git reads from the object store. (6) A file that is not in the tree is seen only through git status (the untracked and ignored-file checks of review round 9, F9, which this repair does not change), and git status reads the work tree that git is configured with. Probed, not committed: with core.worktree pointing at another clean copy of the files, an untracked package core/a/__init__.py in the study directory, which would shadow core/a.py on import, was not reported and running_tree returned the tree. A change to a tracked file is still refused there, because the content check reads the files under the repository path it is given. Protocol: run_discipline.study_code.rule gains the R2-2 sentences, with F2's rule that every git command of core.guards ignores replace refs; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the final tree cc7ecaecfc0207b61bd20fa4178bfa6769bbc857 and 419 tests ('Ran 419 tests in 273.947s', 'OK'; earlier in this repair, 'Ran 407 tests in 296.620s', 'OK' at 28fafe84, 'Ran 410 tests in 302.526s', 'OK' at ba106834 and 'Ran 418 tests in 282.984s', 'OK' at cd36752e). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1204,7 +1229,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 329 tests, 0 failures, 0 errors, 0 skips at draft tree 0e0a53f4cd1cbb2745994acdf0d46ca1f0eb01fb (2026-09-25); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 419 tests, 0 failures, 0 errors, 0 skips at draft tree cc7ecaecfc0207b61bd20fa4178bfa6769bbc857 (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,
diff --git a/blueprints/us-equities/mover-v3/study/core/count_only.py b/blueprints/us-equities/mover-v3/study/core/count_only.py
index 868d76b5b..cf778f0dd 100644
--- a/blueprints/us-equities/mover-v3/study/core/count_only.py
+++ b/blueprints/us-equities/mover-v3/study/core/count_only.py
@@ -25,7 +25,7 @@
 from core.fills import fill_at
 from core.params import FETCH, SAMPLING, T
 from core.records import MERGER_TYPES
-from core.store import Store
+from core.store import Store, checked_run_identity, recover_seal
 from pinned.sessions_io_copy import official_price
 
 PART1_RANGE = ("2016-01-04", "2020-12-31")
@@ -464,18 +464,32 @@ def dry_run_requests(cal, sessions: list, symbols: list) -> list:
     return out
 
 
-def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root, fetch_date: str,
+def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root, utc_start: str, run_identity: dict,
             clock=driver.utc_now, progress: dict | None = None) -> dict:
     """freeze_preconditions: the native dry run through core/driver.py and the transport, sealed, re-read from the
     seal and counted (counts only; run.py dry-run writes the output with its run-log line). progress, when given,
     receives the snapshot sha256 as soon as it is sealed, so a run that fails afterwards still logs it (review round
-    12, F3)."""
-    dry_run_requests(cal, sessions, symbols)            # refuses before any fetch (review round 11, C1)
-    store = Store()
+    12, F3).
+
+    A snapshot already sealed under <snapshot_root>/dry-run (a run that failed or was killed after its seal) is
+    adopted without fetching only through core.store.recover_seal (review round 18, R5, and its repair): its seal
+    record verifies the ledger and pages (G-H), and its binding names the running study tree, protocol and runtime
+    lock (run_identity; H1, so a tree whose fetch plumbing never ran cannot take another tree's seal), the sessions,
+    the symbols and the request plan. utc_start, the fetch start, is bound beside that identity and read back from
+    the seal into the output (fetch_utc_start), never matched (M1): a retry on a later UTC day adopts the seal."""
+    reqs = dry_run_requests(cal, sessions, symbols)     # refuses before any fetch (review round 11, C1)
+    if not isinstance(utc_start, str) or not utc_start:
+        raise ValueError("the dry run needs its fetch start (utc_start)")
     root = Path(snapshot_root) / "dry-run"
-    driver.stage_fetch(lambda st: dry_run_requests(cal, sessions, symbols), transports, store, fetch_date,
-                       clock=clock)
-    sha = store.write(root)
+    seal_identity = {**checked_run_identity(run_identity), "sessions": list(sessions), "symbols": list(symbols),
+                     "requests": sorted(plan.record(r) for r in reqs)}
+    recovered = recover_seal(root, seal_identity, "dry-run", extra=("utc_start",))
+    if recovered is None:
+        store = Store()
+        driver.stage_fetch(lambda st: reqs, transports, store, utc_start[:10], clock=clock)
+        sha = store.write(root, binding={"identity": seal_identity, "utc_start": utc_start}, seal_record=True)
+    else:
+        sha = recovered[1]
     if progress is not None:
         progress["dry-run"] = sha
     return dry_run_output(snapshot_root, sha, sessions, symbols)
@@ -483,9 +497,12 @@ def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root,
 
 def dry_run_output(snapshot_root, sha: str, sessions: list, symbols: list) -> dict:
     """The dry-run output from its sealed snapshot alone (review round 15, N02 / R14-open-2: run.py dry-run
-    recomputes it to adopt an output that a hard kill left with no run-log line)."""
+    recomputes it to adopt an output that a hard kill left with no run-log line). fetch_utc_start is the fetch start
+    the seal's binding holds (review round 18 repair, M1), provenance metadata rather than market data; None for a
+    seal without one."""
     sealed = Store.read(Path(snapshot_root) / "dry-run", sha)
-    return {"kind": "mover_v3_dry_run_output", "snapshot_sha256": sha, "sessions": list(sessions),
+    return {"kind": "mover_v3_dry_run_output", "snapshot_sha256": sha,
+            "fetch_utc_start": (sealed.binding or {}).get("utc_start"), "sessions": list(sessions),
             "symbols_count": len(symbols), "counts": dry_run_counts(sealed),
             "incomplete_by_kind": sealed.incomplete_by_kind(), "measured": dry_run_measured(sealed)}
 
diff --git a/blueprints/us-equities/mover-v3/study/core/guards.py b/blueprints/us-equities/mover-v3/study/core/guards.py
index f51ec0e95..412f6fa19 100644
--- a/blueprints/us-equities/mover-v3/study/core/guards.py
+++ b/blueprints/us-equities/mover-v3/study/core/guards.py
@@ -17,10 +17,16 @@
 time comes only from a commit signed by the pinned GitHub web-flow key (verified_merge, M3); a transport deviation
 governs only with the hashed output of a logged run.py transport-check run (check_study_tree, H1); void deviations
 are typed (voids, F4); and every locked package's version and dist-info RECORD digest is checked (check_runtime, L3).
+
+Review round 18, second repair: the running tree is HEAD's only when no index flag hides a tracked file and every
+tracked file's own bytes are its blob (running_tree, R2-2), and every git command this module runs ignores replace
+refs (git_command, follow-up F2), so each guard reads the repository's own commits, trees and blobs.
 """
 from __future__ import annotations
 
 import json
+import os
+import stat
 import subprocess
 import sys
 from pathlib import Path
@@ -43,12 +49,21 @@ class Refused(Exception):
     pass
 
 
+def git_command(repo, *args) -> list:
+    """The argument list of every git command this module runs (git, git_ok, committed_bytes, verified_merge and the
+    running-tree checks). Review round 18, second repair, follow-up F2: --no-replace-objects (git(1)) makes git ignore
+    replace refs (git-replace(1)), with which a local refs/replace entry puts another commit, tree or blob in place of
+    the one a guard names. So a guard reads the repository's own objects: the tree a run names, the protocol and logs
+    at a commit, the tree diff behind a transport deviation, the commits whose times and signatures it uses."""
+    return ["git", "--no-replace-objects", "-C", str(repo), *args]
+
+
 def git(repo, *args) -> str:
-    return subprocess.check_output(["git", "-C", str(repo), *args], text=True).strip()
+    return subprocess.check_output(git_command(repo, *args), text=True).strip()
 
 
 def git_ok(repo, *args) -> bool:
-    return subprocess.run(["git", "-C", str(repo), *args], stdout=subprocess.DEVNULL,
+    return subprocess.run(git_command(repo, *args), stdout=subprocess.DEVNULL,
                           stderr=subprocess.DEVNULL).returncode == 0
 
 
@@ -56,7 +71,7 @@ def committed_bytes(repo, ref: str, path: str):
     """The bytes of path at ref, or None if the path does not exist there."""
     if not git_ok(repo, "cat-file", "-e", f"{ref}:{path}"):
         return None
-    return subprocess.check_output(["git", "-C", str(repo), "show", f"{ref}:{path}"])
+    return subprocess.check_output(git_command(repo, "show", f"{ref}:{path}"))
 
 
 # ---------------------------------------------------------------- the running tree
@@ -64,7 +79,15 @@ def committed_bytes(repo, ref: str, path: str):
 def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     """The git tree hash of the study directory at HEAD; refuses if the working copy of it differs from HEAD, or
     if it holds an ignored file other than a __pycache__ entry (review round 9, F9: an ignored file is invisible to
-    the tree hash but could still be imported)."""
+    the tree hash but could still be imported).
+
+    Review round 18, second repair (R2-2): git status alone does not show that the working copy is HEAD's. It reports
+    no change to a tracked file whose index entry is marked assume-unchanged or skip-worktree (git-update-index(1)),
+    nor one that a clean filter maps back to the committed bytes, nor files that match a tree which a replace ref puts
+    in place of HEAD's (git-replace(1)). So an index entry with either flag is refused, and every file of the tree
+    returned must be a regular file whose own bytes hash to its blob: the tree is read without replace refs
+    (git_command), and the files without the index and without filters. Both checks run here, once, when a run builds
+    its context: a file changed later in the same run is not seen."""
     dirty = git(repo, "status", "--porcelain", "--untracked-files=all", "--", study_path)
     if dirty:
         raise Refused("the study tree has uncommitted changes; a run executes a committed tree only")
@@ -73,7 +96,81 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     planted = [p for p in ignored if "__pycache__" not in Path(p).parts]
     if planted:
         raise Refused(f"the study tree holds ignored files that are not bytecode caches: {planted[:5]}")
-    return git(repo, "rev-parse", f"HEAD:{study_path}")
+    masked = _masked_index_entries(repo, study_path)
+    if masked:
+        # the independent verification of ace56485 (C7): with core.ignoreStat=true every file git checks out is marked
+        # assume-unchanged, so a bit need not hide a change; the refusal stays, and the message says how to clear it
+        raise Refused(f"the index marks study files assume-unchanged or skip-worktree, so git status does not check "
+                      f"them and the run cannot verify them: {masked[:5]}; clear the bits (git update-index "
+                      "--no-assume-unchanged or --no-skip-worktree on those files) and, if core.ignoreStat is true, "
+                      "unset it, or git marks every file it checks out assume-unchanged again")
+    tree = git(repo, "rev-parse", f"HEAD:{study_path}")
+    unverified = _unverified_files(repo, tree, study_path)
+    if unverified:
+        raise Refused(f"the study tree's files are not all regular files that hold the committed bytes, although git "
+                      f"status reports no change: {unverified[:5]}; a run executes a committed tree only")
+    return tree
+
+
+def _masked_index_entries(repo, study_path: str) -> list:
+    """Every index entry under study_path that is marked assume-unchanged or skip-worktree, as '<path> (<flags>)'.
+    git-ls-files(1) -v prints the tag of an assume-unchanged entry in lowercase and that of a skip-worktree entry as S
+    (s with both flags)."""
+    out = subprocess.check_output(git_command(repo, "ls-files", "-v", "-z", "--", study_path))
+    masked = []
+    for row in out.split(b"\0"):
+        if row:
+            tag = row[:1].decode("ascii", "replace")
+            flags = [name for name, marked in (("assume-unchanged", tag.islower()), ("skip-worktree", tag in "Ss"))
+                     if marked]
+            if flags:
+                masked.append(f"{os.fsdecode(row[2:])} ({' and '.join(flags)})")
+    return masked
+
+
+def _unverified_files(repo, tree: str, study_path: str) -> list:
+    """The files of `tree` (the study tree at HEAD) that the working copy does not hold as committed, each with its
+    problem. An entry must be a regular-file blob: a symbolic link or submodule entry is refused, because the tree hash
+    covers a link's text and not the file it names. Its working file must be a regular file, and its bytes must hash to
+    the entry's blob. One git hash-object --no-filters --stdin-paths call hashes the files themselves, so the result
+    depends on no index entry (its flags or its cached stat data) and on no clean filter. The tree is listed without
+    replace refs (git_command), so the blobs are its own and not those of a tree that a replace ref puts in its
+    place."""
+    out = subprocess.check_output(git_command(repo, "ls-tree", "-r", "-z", tree))
+    problems, paths, blobs = [], [], []
+    for row in out.split(b"\0"):
+        if not row:
+            continue
+        meta, name = row.split(b"\t", 1)
+        mode, kind, blob = meta.decode("ascii").split()
+        path = f"{study_path.rstrip('/')}/{os.fsdecode(name)}"
+        if kind != "blob" or mode not in ("100644", "100755"):
+            problems.append(f"{path} is a symbolic link or submodule entry (mode {mode})")
+        elif any(ord(c) < 32 for c in path):
+            problems.append(f"{path!r} has a control character in its name")    # --stdin-paths reads a path per line
+        else:
+            try:
+                file_mode = os.lstat(Path(repo) / path).st_mode      # the entry itself: a link is not followed
+            except OSError:
+                problems.append(f"{path} is missing")
+            else:
+                if stat.S_ISREG(file_mode):
+                    paths.append(path)
+                    blobs.append(blob)
+                else:
+                    problems.append(f"{path} is not a regular file")
+    if paths:
+        base = Path(repo).resolve()
+        hashed = subprocess.run(git_command(repo, "hash-object", "--no-filters", "--stdin-paths"),
+                                input=b"".join(os.fsencode(str(base / p)) + b"\n" for p in paths),
+                                capture_output=True)
+        got = hashed.stdout.decode("ascii", "replace").split()
+        if hashed.returncode != 0 or len(got) != len(paths):
+            problems.append("git hash-object could not read every tracked file: "
+                            + hashed.stderr.decode("utf-8", "replace").strip()[:200])
+        else:
+            problems.extend(f"{p} differs from HEAD's blob" for p, want, have in zip(paths, blobs, got) if have != want)
+    return problems
 
 
 def check_bytecode_isolated() -> None:
@@ -117,7 +214,7 @@ def verified_merge(repo, commit: str, key: dict | None = None) -> bool:
     email = git(repo, "show", "-s", "--format=%ce", commit)
     if email == key["committer_email"]:
         env = {"GNUPGHOME": _gnupg_home(key), "PATH": __import__("os").environ.get("PATH", "/usr/bin:/bin")}
-        res = subprocess.run(["git", "-C", str(repo), "-c", "gpg.program=gpg", "verify-commit", "--raw", commit],
+        res = subprocess.run(git_command(repo, "-c", "gpg.program=gpg", "verify-commit", "--raw", commit),
                              capture_output=True, text=True, env=env)
         for line in res.stderr.splitlines():
             parts = line.split()
diff --git a/blueprints/us-equities/mover-v3/study/core/runner.py b/blueprints/us-equities/mover-v3/study/core/runner.py
index 74e6cd408..6b9a521a4 100644
--- a/blueprints/us-equities/mover-v3/study/core/runner.py
+++ b/blueprints/us-equities/mover-v3/study/core/runner.py
@@ -53,6 +53,14 @@ def count_only_dependencies(ctx: dict, protocol: dict, rate: dict, allowance: di
             "rate_limit": dict(rate), "pipeline_allowance": dict(allowance) if allowance is not None else None}
 
 
+def seal_run_identity(ctx: dict) -> dict:
+    """The running study tree, protocol sha256 and runtime-lock sha256 that a recoverable seal binds, as
+    core.holdout.collect's identity does (review round 18 repair, H1): the native dry run's snapshot and each
+    transport-check live sample (core.store.recover_seal)."""
+    return {"study_tree": ctx["tree"], "protocol_sha256": ctx["protocol_sha256"],
+            "runtime_lock_sha256": ctx["runtime_lock_sha256"]}
+
+
 def adopt_uncited_output(out_path, expected: dict, ignore=("code_revision",)) -> str:
     """Review round 15, N02 (R14-open-2): a pre-freeze output that a hard kill left with no run-log line (the process
     died between the output's rename and its line) is adopted, never fetched again: its content must equal the
diff --git a/blueprints/us-equities/mover-v3/study/core/store.py b/blueprints/us-equities/mover-v3/study/core/store.py
index 0520edf47..759e1b955 100644
--- a/blueprints/us-equities/mover-v3/study/core/store.py
+++ b/blueprints/us-equities/mover-v3/study/core/store.py
@@ -8,18 +8,34 @@
 latest attempt governs. Legacy records without a duration remain readable but cannot calibrate throughput.
 An optional leading {"event": "snapshot", "binding": {...}} binds a collection seal to its authorization and
 batch inputs, including its original start time, for recovery before the completion logs are written.
+Every completion stamp's page count equals its attempt's page events. Review round 18 repair (G-H): a recoverable
+seal (the native dry run, a transport-check live sample) also publishes its seal record, seal.json, once and before
+the ledger, and recover_seal adopts such a seal only against that record, never against a digest of the ledger it is
+checking. Second repair (R2-1, R2-3 and its follow-up F1): the record must hold a sha256 of the ledger (a null there
+turned the verification off), and a snapshot path is fetched into only when it is unused: absent under a directory, or
+an empty directory. Anything else without a ledger is refused before any fetch.
 """
 from __future__ import annotations
 
 import gzip
 import json
 import os
+import zlib
 from pathlib import Path
 
 from core import records
 from core.canon import dumps, sha256_bytes
 from core.plan import record
 
+SEAL_RECORD = "seal.json"
+SEAL_RECORD_KIND = "mover_v3_seal_record"
+RUN_IDENTITY_KEYS = ("study_tree", "protocol_sha256", "runtime_lock_sha256")
+# review round 18 repair (L2): every way a damaged or partially written snapshot can fail to read: an unreadable path
+# (a directory, a bad gzip header), a truncated or corrupt gzip page, text that is not UTF-8 JSON, a line that is not
+# an object or lacks a field, an unhashable value, or nesting too deep to parse
+READ_ERRORS = (OSError, EOFError, ValueError, KeyError, IndexError, TypeError, AttributeError, RecursionError,
+               zlib.error)
+
 
 class SealError(Exception):
     pass
@@ -30,6 +46,132 @@ def normalized_sha256(parser: str, raw: bytes) -> str:
     return sha256_bytes(dumps(records.normalize_page(parser, raw)).encode("utf-8"))
 
 
+def checked_run_identity(run_identity: dict) -> dict:
+    """The running command's study tree, protocol sha256 and runtime-lock sha256, which a recoverable seal binds like
+    core.holdout.collect's identity (review round 18 repair, H1; core.runner.seal_run_identity builds it from the
+    context). Exactly those three keys, each a non-empty string, so no seal is written or adopted without them."""
+    if not isinstance(run_identity, dict) or sorted(run_identity) != sorted(RUN_IDENTITY_KEYS) or \
+            any(not isinstance(run_identity[k], str) or not run_identity[k] for k in RUN_IDENTITY_KEYS):
+        raise ValueError(f"a recoverable seal binds {', '.join(RUN_IDENTITY_KEYS)}, each a non-empty string")
+    return {k: run_identity[k] for k in RUN_IDENTITY_KEYS}
+
+
+def seal_record_of(store, ledger_sha256: str) -> dict:
+    """The seal record (review round 18 repair, G-H and L1): the ledger's sha256, the binding, every completion stamp
+    in ledger order as [key, attempt, status, page count], every page's sha256, and the attempt and page counts.
+    Store.write(seal_record=True) publishes it once; recover_seal reads the ledger under its ledger_sha256 and
+    requires the snapshot it reads to give this record back exactly."""
+    stamps, pages = [], []
+    for key in sorted(set(store.req) | set(store.state)):
+        for st in store.history.get(key, []) + ([store.state[key]] if key in store.state else []):
+            stamps.append([key, st["attempt"], st["status"], len(st["pages"])])
+            pages.extend(sha256_bytes(raw) for raw in st["pages"])
+    return {"kind": SEAL_RECORD_KIND, "ledger_sha256": ledger_sha256, "binding": store.binding, "stamps": stamps,
+            "attempts": len(stamps), "page_sha256s": pages, "pages": len(pages)}
+
+
+def _publish(directory: Path, name: str, data: bytes) -> None:
+    """canon.atomic_write_results's pattern: an exclusive temporary file, fsync, rename, then the directory's fsync,
+    so a file published first is durable before the next one is renamed into place."""
+    with (directory / f"{name}.tmp").open("xb") as f:
+        f.write(data)
+        f.flush()
+        os.fsync(f.fileno())
+    os.replace(directory / f"{name}.tmp", directory / name)
+    fd = os.open(directory, os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
+    """core.holdout.collect's recover-if-matching pattern for a recoverable seal (count_only.dry_run and
+    transport_check.seal_live_samples; review round 18, R5, and its repairs). None when directory is unused: it does
+    not exist and its nearest existing ancestor is a directory, or it is an empty directory. The caller then fetches
+    and seals. Otherwise the sealed (store, sha256, binding), only when:
+      - the seal record exists and holds a sha256 of the ledger (64 lowercase hexadecimal characters; R2-1: a null
+        there would turn Store.read's comparison off), the ledger reads under that sha256, recorded at seal time,
+        never under a digest of the ledger being checked (G-H), and the snapshot read gives that record back exactly:
+        its binding, every completion stamp with its attempt, status and page count (L1), every page sha256 and the
+        counts;
+      - the binding holds exactly the identity and `extra` (each a non-empty string the caller reads back and never
+        matches, the dry run's utc_start; M1), and the identity equals `identity` apart from its request plan: the
+        running study tree, protocol and runtime lock (H1) and the caller's inputs;
+      - the bound request plan equals identity["requests"] (the plan-change check), and the ledger's request records
+        are exactly the requests the binding names (G-M), each with its completion stamps.
+    A directory with pages or a seal record but no ledger is partially written. Nor is any of these unused: a path
+    that exists and is not a directory (a regular file, a dangling symbolic link; R2-3), a path whose nearest existing
+    ancestor is not a directory, and a directory that holds anything else without a ledger (a stray ledger.jsonl.tmp
+    or seal.json.tmp, any other file; F1, the follow-up on R2-3). Every refusal made here is a SealError naming `what`
+    (L2), made before the caller can fetch; this function neither fetches nor writes."""
+    try:
+        return _recover_seal(Path(directory), identity, tuple(extra))
+    except SealError as exc:
+        raise SealError(f"{what}: {exc}") from exc
+    except READ_ERRORS as exc:
+        raise SealError(f"{what}: the snapshot is invalid or partially written ({type(exc).__name__}: {exc})") \
+            from exc
+
+
+def _nearest_existing(path: Path) -> Path:
+    """path, or its nearest ancestor that exists; a dangling symbolic link exists."""
+    while not os.path.lexists(path) and path != path.parent:
+        path = path.parent
+    return path
+
+
+def _recover_seal(d: Path, identity: dict, extra: tuple):
+    # review round 18, second repair (R2-3): a regular file or a dangling symbolic link at the snapshot path holds no
+    # ledger, pages or seal record, but it is not an unused directory; returning None for it made the caller fetch
+    # again before Store.write failed
+    if os.path.lexists(d) and not d.is_dir():
+        raise SealError("the snapshot path exists and is not a directory: it cannot be overwritten or fetched again")
+    if not (d / "ledger.jsonl").exists():
+        if (d / "pages").exists() or (d / SEAL_RECORD).exists():
+            raise SealError("the snapshot is partially written: it cannot be overwritten or fetched again")
+        # follow-up F1: without a ledger, pages or seal record the path is unused only if it is an empty directory, or
+        # is absent under a directory. Under a regular file or a dangling link, or beside a stray file (a
+        # ledger.jsonl.tmp, a seal.json.tmp, anything else), Store.write would fail after the fetch, or seal beside a
+        # file it did not write
+        if d.is_dir():
+            held = sorted(entry.name for entry in d.iterdir())
+            if held:
+                raise SealError(f"the snapshot directory is not empty and holds no ledger ({held[:5]}): it cannot be "
+                                "overwritten or fetched again")
+        elif not _nearest_existing(d.parent).is_dir():
+            raise SealError("the snapshot path lies under a path that is not a directory: nothing can be sealed there")
+        return None
+    if not (d / SEAL_RECORD).is_file():
+        raise SealError("the snapshot has no seal record, so it cannot be verified and is not adopted")
+    sealed = json.loads((d / SEAL_RECORD).read_bytes())
+    if not isinstance(sealed, dict) or sealed.get("kind") != SEAL_RECORD_KIND:
+        raise SealError("the seal record is invalid")
+    sha = sealed.get("ledger_sha256")      # the digest recorded at seal time, never one of the ledger being checked
+    # review round 18, second repair (R2-1): Store.read compares no digest when it is given None, and seal_record_of
+    # gives a null back, so a record without a sha256 would be adopted with its ledger unverified
+    if not isinstance(sha, str) or len(sha) != 64 or set(sha) - set("0123456789abcdef"):
+        raise SealError("the seal record holds no sha256 of its ledger (64 lowercase hexadecimal characters), so the "
+                        "ledger cannot be verified and is not adopted")
+    store = Store.read(d, sha)
+    # Store.read checked the ledger against that digest; the snapshot must also give back the rest of the record
+    if seal_record_of(store, sha) != sealed:
+        raise SealError("the snapshot differs from its seal record (binding, completion stamps, pages or counts)")
+    binding = store.binding if isinstance(store.binding, dict) else {}
+    bound = binding.get("identity")
+    if sorted(binding) != sorted(("identity",) + extra) or not isinstance(bound, dict) or \
+            any(not isinstance(binding[k], str) or not binding[k] for k in extra):
+        raise SealError("the snapshot binding is missing or malformed")
+    changed = sorted(k for k in set(bound) | set(identity) if k != "requests" and bound.get(k) != identity.get(k))
+    if changed:
+        raise SealError(f"the snapshot was sealed for another {', '.join(changed)}")
+    if bound.get("requests") != identity["requests"]:
+        raise SealError("the snapshot was sealed for another request plan")
+    if store.request_records() != bound["requests"] or set(store.state) != set(store.req):
+        raise SealError("the snapshot's requests or completion stamps differ from the requests its binding names")
+    return store, sha, binding
+
+
 class Store:
     def __init__(self):
         self.req = {}       # key -> request
@@ -111,12 +253,14 @@ def request_records(self) -> list:
         return sorted(record(r) for r in self.req.values())
 
     # ------------------------------------------------------------ disk
-    def write(self, directory, *, binding: dict | None = None) -> str:
+    def write(self, directory, *, binding: dict | None = None, seal_record: bool = False) -> str:
         """Write once; publish the ledger only after all pages. Returns its sha256, which binds every page and
         any supplied authorization identity. Existing sealed or partially written snapshots are never overwritten.
-        Publication follows canon.atomic_write_results's temporary-file, fsync, rename pattern."""
+        Publication follows canon.atomic_write_results's temporary-file, fsync, rename pattern. With seal_record
+        (a recoverable seal; review round 18 repair, G-H), the seal record (seal_record_of) is published once, before
+        the ledger, so every published recoverable ledger has the record that recover_seal verifies it against."""
         d = Path(directory)
-        if (d / "ledger.jsonl").exists():
+        if (d / "ledger.jsonl").exists() or (d / SEAL_RECORD).exists():
             raise SealError("snapshot ledger already exists: cannot overwrite a sealed snapshot")
         try:
             (d / "pages").mkdir(parents=True, exist_ok=False)
@@ -131,17 +275,11 @@ def write(self, directory, *, binding: dict | None = None) -> str:
             for st in self.history.get(key, []) + [self.state[key]]:
                 lines.extend(self._attempt_lines(d, key, req, name, st))
         data = ("\n".join(lines) + "\n").encode("utf-8")
-        with (d / "ledger.jsonl.tmp").open("xb") as f:
-            f.write(data)
-            f.flush()
-            os.fsync(f.fileno())
-        os.replace(d / "ledger.jsonl.tmp", d / "ledger.jsonl")
-        fd = os.open(d, os.O_RDONLY)
-        try:
-            os.fsync(fd)
-        finally:
-            os.close(fd)
-        return sha256_bytes(data)
+        sha = sha256_bytes(data)
+        if seal_record:
+            _publish(d, SEAL_RECORD, (dumps(seal_record_of(self, sha)) + "\n").encode("utf-8"))
+        _publish(d, "ledger.jsonl", data)
+        return sha
 
     @staticmethod
     def _attempt_lines(d, key, req, name, st) -> list:
@@ -165,7 +303,7 @@ def read(cls, directory, expected_sha256: str | None = None) -> "Store":
         data = (d / "ledger.jsonl").read_bytes()
         if expected_sha256 is not None and sha256_bytes(data) != expected_sha256:
             raise SealError("snapshot ledger sha256 differs from the sealed value")
-        store, pages = cls(), {}
+        store, pages, stamped = cls(), {}, {}
         for line in data.decode("utf-8").splitlines():
             if not line.strip():
                 continue   # the ledger of a snapshot that sealed no new request (a later holdout count)
@@ -184,10 +322,21 @@ def read(cls, directory, expected_sha256: str | None = None) -> "Store":
                 pages.setdefault((rec["key"], rec["attempt"]), []).append(raw)
                 store.page_norm.setdefault((rec["key"], rec["attempt"]), []).append(rec.get("normalized_sha256"))
             else:
+                attempt = (rec["key"], rec["attempt"])
+                if attempt in stamped:
+                    raise SealError(f"{rec['key']} attempt {rec['attempt']}: a second completion stamp")
+                stamped[attempt] = rec["pages"]
                 if rec["key"] in store.state:
                     store.history.setdefault(rec["key"], []).append(store.state[rec["key"]])
                 store.state[rec["key"]] = {"status": "complete" if ev == "stamp_complete" else "incomplete",
                                            "pages": pages.get((rec["key"], rec["attempt"]), []),
                                            "vintage": rec["vintage"], "attempt": rec["attempt"], "error": rec["error"],
                                            "elapsed_seconds": rec.get("elapsed_seconds")}
+        # review round 18 repair (G-H): every completion stamp's page count equals its attempt's page events, and every
+        # page event belongs to a stamped attempt (Store.write writes an attempt's pages, then its stamp)
+        for attempt in set(stamped) | set(pages):
+            count = stamped.get(attempt)
+            if type(count) is not int or count != len(pages.get(attempt, [])):
+                raise SealError(f"{attempt[0]} attempt {attempt[1]}: the completion stamp's page count differs from "
+                                "its page events")
         return store
diff --git a/blueprints/us-equities/mover-v3/study/core/transport_check.py b/blueprints/us-equities/mover-v3/study/core/transport_check.py
index 9a54aee25..1f028cf6d 100644
--- a/blueprints/us-equities/mover-v3/study/core/transport_check.py
+++ b/blueprints/us-equities/mover-v3/study/core/transport_check.py
@@ -131,33 +131,51 @@ def reproduction_from_sealed(planner, store, changed_paths: list, fetch_prefix:
     return _combine(out)
 
 
-def seal_live_samples(store, transports, seed, holdout_stores, live_root, clock=None) -> dict:
+def seal_live_samples(store, transports, seed, holdout_stores, live_root, run_identity: dict, clock=None) -> dict:
     """{label: sha256} of each snapshot's sealed live sample. A label whose sample is already sealed under live_root
-    (a run killed after sealing it) is read, never fetched again, so a sample is drawn at most once."""
+    (a run killed after sealing it) is adopted, never fetched again, so a sample is drawn at most once, and only
+    through core.store.recover_seal (review round 18, R5, and its repair): its seal record verifies the ledger and
+    pages (G-H), and its binding names the running study tree, protocol and runtime lock (run_identity, H1), the
+    label, the seed, the source snapshot and the sample's requests."""
     from pathlib import Path
     from core.canon import sha256_bytes
+    from core.store import checked_run_identity, recover_seal
+    run = checked_run_identity(run_identity)
     shas = {}
     for label, st in [("stage", store), *holdout_stores]:
         d = Path(live_root) / label
-        if (d / "ledger.jsonl").exists():
-            shas[label] = sha256_bytes((d / "ledger.jsonl").read_bytes())
+        # Bind the source's binding, requests and sealed attempts (raw-page digests, not parsed outcomes), as
+        # collect's base_snapshots bind its inputs. Follow core.holdout.collect's recovery pattern at 803bc351.
+        source = {"binding": st.binding, "requests": st.request_records(), "attempts": {
+            key: [{**attempt, "pages": [sha256_bytes(raw) for raw in attempt["pages"]]}
+                  for attempt in st.history.get(key, []) + [st.state[key]]] for key in sorted(st.req)}}
+        identity = {**run, "label": label, "seed": seed,
+                    "source_sha256": sha256_bytes(dumps(source).encode("utf-8")),
+                    "requests": sorted(record(r) for _, reqs in live_sample(st, seed=seed) for r in reqs)}
+        recovered = recover_seal(d, identity, f"live sample {label!r}")
+        if recovered is not None:
+            shas[label] = recovered[1]
         else:
-            shas[label] = fetch_live(st, transports, seed=seed, clock=clock).write(d)
+            shas[label] = fetch_live(st, transports, seed=seed, clock=clock).write(
+                d, binding={"identity": identity}, seal_record=True)
     return shas
 
 
 def reproduction_check(planner, store, transports, changed_paths: list, fetch_prefix: str, seed: str | None = None,
-                       holdout_stores: tuple = (), live_root=None, clock=None) -> dict:
+                       holdout_stores: tuple = (), live_root=None, clock=None,
+                       run_identity: dict | None = None) -> dict:
     """holdout_stores: [(label, sealed store)] of every sealed holdout snapshot (review round 11, F3), each checked
     by (b) and (c); (a) needs the holdout planners and is a deterministic function of unchanged code. With live_root
-    (run.py transport-check), each live sample is sealed first and the check is computed from the seals."""
+    (run.py transport-check), each live sample is sealed first, bound to run_identity (the running study tree,
+    protocol and runtime lock; required there, review round 18 repair, H1), and the check is computed from the
+    seals."""
     only_fetch = tree_diff_only_under_fetch(changed_paths, fetch_prefix)
     out = {"only_fetch_changed": only_fetch}
     if not only_fetch:
         out["passes"] = False
         return out
     if live_root is not None:
-        shas = seal_live_samples(store, transports, seed, holdout_stores, live_root, clock)
+        shas = seal_live_samples(store, transports, seed, holdout_stores, live_root, run_identity, clock)
         return reproduction_from_sealed(planner, store, changed_paths, fetch_prefix, seed, holdout_stores, live_root,
                                         shas)
     out["plan"] = check_plan(planner, store)
diff --git a/blueprints/us-equities/mover-v3/study/run.py b/blueprints/us-equities/mover-v3/study/run.py
index 6e73ae608..8bf63a34d 100644
--- a/blueprints/us-equities/mover-v3/study/run.py
+++ b/blueprints/us-equities/mover-v3/study/run.py
@@ -203,8 +203,10 @@ def cmd_dry_run(a) -> int:
     tr = transports(ctx["protocol"])                     # the pinned rate limit, before any fetch (C2)
     start, status, digest, out, progress = clock(), "failed", None, None, {}
     try:
-        out = count_only.dry_run(cal, sessions, symbols, tr, a.snapshot_root, start[:10], clock=clock,
-                                 progress=progress)
+        # review round 18 repair (H1, M1): the seal binds this tree, protocol and runtime lock, and keeps the fetch
+        # start beside them, read back (never matched) when a later run adopts the seal
+        out = count_only.dry_run(cal, sessions, symbols, tr, a.snapshot_root, start, runner.seal_run_identity(ctx),
+                                 clock=clock, progress=progress)
         out.update({"study_tree": ctx["tree"], "code_revision": ctx["commit"]})
         digest = atomic_write_results(out_path, out)
         status = "complete"
@@ -274,7 +276,8 @@ def cmd_transport_check(a) -> int:
         # review round 15, N02 (R14-open-2): each live sample is sealed under live_root before the check is computed
         # from the seals, and a sample sealed by a killed run is read, never drawn again
         res = transport_check.reproduction_check(ST.planner(spec), store, tr, changed, "fetch", seed=seed,
-                                                 holdout_stores=hstores, live_root=live_root, clock=clock)
+                                                 holdout_stores=hstores, live_root=live_root, clock=clock,
+                                                 run_identity=runner.seal_run_identity(ctx))
         res.update(meta)
         digest = atomic_write_results(out_path, res)
         status = "complete"
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_calibration.py b/blueprints/us-equities/mover-v3/study/tests/test_calibration.py
index 597145a27..5e6710dfa 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_calibration.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_calibration.py
@@ -72,6 +72,15 @@ def test_unmeasured_kinds_use_the_largest_observed_quote_bound(self):
                 with self.assertRaisesRegex(guards.Refused, kind):
                     check_calibration(output, underbounded)
 
+    def test_invalid_page_maxima_refuse_with_no_valid_page_calibration(self):
+        """check_dry_run_bound requires a mapping of nonnegative integer page maxima, excluding booleans."""
+        for maxima in (None, [], 1, "pages", {"quote_entry": 1, "event_minute": -1},
+                       {"quote_entry": True}, {"quote_entry": 1.0}, {"quote_entry": "1"}):
+            with self.subTest(maxima=maxima):
+                with self.assertRaisesRegex(guards.Refused,
+                                            "^the native dry run has no valid page calibration$"):
+                    check_calibration({"measured": {**FR.MEASURED, "pages_per_request_max": maxima}})
+
     def test_missing_quote_measurements_cannot_bound_unmeasured_kinds(self):
         for maxima in ({}, {"screen_daily_raw": 1}, {"screen_daily_raw": 1, "quote_exit": 0}):
             with self.subTest(maxima=maxima):
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_count_only.py b/blueprints/us-equities/mover-v3/study/tests/test_count_only.py
index fe31c471c..7e4576090 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_count_only.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_count_only.py
@@ -667,8 +667,10 @@ def test_dry_run_bounds_every_request_reach_not_only_sessions(self):
         self.assertEqual(min(r["params"]["start"][:10] for r in reqs), "2021-01-04")
         with self.assertRaises(ValueError):                          # a mixed list is refused as a whole
             CO.dry_run_requests(cal, [first, "2021-02-01"], ["AAA"])
+        run_identity = {"study_tree": "t", "protocol_sha256": "p", "runtime_lock_sha256": "r"}
         with self.assertRaises(ValueError):                          # dry_run refuses before any fetch
-            CO.dry_run(cal, ["2021-01-04"], ["AAA"], None, "/nonexistent", "2026-09-25", clock=fixed_clock)
+            CO.dry_run(cal, ["2021-01-04"], ["AAA"], None, "/nonexistent", "2026-09-25T00:00:00Z", run_identity,
+                       clock=fixed_clock)
 
     def test_dry_run_command_writes_counts_once_from_an_exposed_window(self):
         import run
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_fetch.py b/blueprints/us-equities/mover-v3/study/tests/test_fetch.py
index 7b1629c7f..f29cda15d 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_fetch.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_fetch.py
@@ -315,9 +315,11 @@ def test_the_live_sample_is_sealed_and_the_check_recomputes_from_the_seals(self)
         a sample already sealed under the live root is read, never drawn again."""
         changed = ["blueprints/us-equities/mover-v3/study/fetch/transport.py"]
         prefix = "blueprints/us-equities/mover-v3/study/fetch"
+        run_identity = {"study_tree": "t", "protocol_sha256": "p", "runtime_lock_sha256": "r"}
         with tempfile.TemporaryDirectory() as live_root:
             res = transport_check.reproduction_check(self.planner, self.sealed, transports(self.m), changed, prefix,
-                                                     seed="s", live_root=live_root, clock=fixed_clock)
+                                                     seed="s", live_root=live_root, clock=fixed_clock,
+                                                     run_identity=run_identity)
             self.assertTrue(res["passes"], res)
             self.assertEqual(sorted(res["live_snapshots"]), ["stage"])
             again = transport_check.reproduction_from_sealed(self.planner, self.sealed, changed, prefix, "s", (),
@@ -325,8 +327,12 @@ def test_the_live_sample_is_sealed_and_the_check_recomputes_from_the_seals(self)
             self.assertEqual(again, res)
             dead = {"data": None, "trading": None}           # no transport: a second draw would fail
             reused = transport_check.reproduction_check(self.planner, self.sealed, dead, changed, prefix, seed="s",
-                                                        live_root=live_root, clock=fixed_clock)
+                                                        live_root=live_root, clock=fixed_clock,
+                                                        run_identity=run_identity)
             self.assertEqual(reused, res)
+            with self.assertRaises(ValueError):              # review round 18 repair (H1): no seal without its tree
+                transport_check.reproduction_check(self.planner, self.sealed, dead, changed, prefix, seed="s",
+                                                   live_root=live_root, clock=fixed_clock)
 
     def test_live_sample_detects_different_rows(self):
         other = synth.FakeMarket(self.cal)
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_guards.py b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
index 233aec137..da95f8dcb 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_guards.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
@@ -1,14 +1,27 @@
 """run_discipline refusals: frozen protocol and running tree (R8-4), protocol sha256 (R8-2), vintages before the
-freeze (R8-4), the committed-tree requirement and the freeze commit time."""
+freeze (R8-4), the committed-tree requirement and the freeze commit time. Review round 18, second repair (R2-2): the
+running tree is HEAD's only when no index flag hides a tracked file from git status and every tracked file's bytes are
+HEAD's blob."""
+import contextlib
 import json
+import re
+import shlex
 import subprocess
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 from core import guards
 from core.params import PROTOCOL_PATH, STUDY_PATH
 
+TRANSPORT = f"{STUDY_PATH}/fetch/transport.py"
+# git-ls-files(1) -v: the tag of an index entry marked assume-unchanged is lowercase, that of one marked skip-worktree
+# is S, and s with both; git-update-index(1) sets each flag. (flag names in the refusal, tag, update-index options)
+INDEX_FLAGS = (("assume-unchanged", "h", ("--assume-unchanged",)),
+               ("skip-worktree", "S", ("--skip-worktree",)),
+               ("assume-unchanged and skip-worktree", "s", ("--assume-unchanged", "--skip-worktree")))
+
 
 def sh(repo, *args):
     return subprocess.check_output(["git", "-C", str(repo), *args], text=True,
@@ -17,6 +30,241 @@ def sh(repo, *args):
                                         "GIT_COMMITTER_DATE": "2026-10-02T21:30:00+00:00", "PATH": "/usr/bin:/bin"}).strip()
 
 
+def status(repo) -> str:
+    """What core.guards.running_tree asks git first: the study tree's changes, untracked files included."""
+    return sh(repo, "status", "--porcelain", "--untracked-files=all", "--", STUDY_PATH)
+
+
+class RunningTreeContent(unittest.TestCase):
+    """Review round 18, second repair (R2-2). At 406ad3c5 running_tree returned HEAD's study tree whenever git status
+    reported no change, so the tree a run named (and every seal identity bound, H1) could differ from the files that
+    ran. Each case builds a state in which git status reports nothing."""
+
+    @contextlib.contextmanager
+    def study_repo(self):
+        """A temporary repository (tests/fixture_repo.py) whose committed, clean study tree holds two files."""
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.init_repo(Path(tmp) / "repo")
+            FR.write(repo / STUDY_PATH / "core" / "a.py", "x = 1\n")
+            FR.write(repo / TRANSPORT, "HOST = 'fixture'\n")
+            FR.commit_push(repo, "2026-10-01T21:30:00+00:00", "study tree")
+            self.assertEqual(guards.running_tree(repo), sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"))
+            yield repo, Path(tmp)
+
+    def change(self, repo, tmp, how):
+        from tests import fixture_repo as FR
+        path = repo / TRANSPORT
+        if how == "changed":
+            path.write_text("HOST = 'changed'\n")
+        elif how == "deleted":
+            path.unlink()
+        elif how == "replaced_by_a_link":       # a link to a file outside the repository that holds the same bytes
+            target = FR.write(tmp / "transport-outside.py", path.read_bytes())
+            path.unlink()
+            path.symlink_to(target)
+
+    def test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree(self):
+        """The index-flag refusal: an entry with either flag is refused, with a message that names the file and the
+        flag, whether or not the file changed (git status reports nothing in each case, a deleted file included)."""
+        for flag, tag, options in INDEX_FLAGS:
+            for how in ("unchanged", "changed", "deleted"):
+                with self.subTest(flag=flag, file=how), self.study_repo() as (repo, tmp):
+                    for option in options:
+                        sh(repo, "update-index", option, TRANSPORT)
+                    self.change(repo, tmp, how)
+                    self.assertEqual(status(repo), "")
+                    self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"{tag} {TRANSPORT}")
+                    with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} ({flag})")):
+                        guards.running_tree(repo)
+
+    def test_running_tree_refuses_a_checkout_made_under_core_ignore_stat_and_says_how_to_clear_it(self):
+        """With core.ignoreStat=true git marks every file it checks out assume-unchanged (git-config(1)), so in a fresh
+        clone made with it every study file is masked although each holds HEAD's bytes. The refusal stays, by design:
+        git status does not check those files, and the run cannot verify them through it. The message says that the
+        index marks them and how to clear the bits; at ace56485 it said that they hide a change, which misled for this
+        case (the independent verification of ace56485, C7). Unsetting core.ignoreStat alone leaves the bits; clearing
+        them lets the same files run."""
+        with self.study_repo() as (repo, tmp):
+            sh(tmp, "clone", "-q", "-c", "core.ignoreStat=true", str(repo), "clone")
+            clone = tmp / "clone"
+            tree, files = sh(clone, "rev-parse", f"HEAD:{STUDY_PATH}"), sh(clone, "ls-files", "--", STUDY_PATH).split()
+            self.assertEqual(sh(clone, "ls-files", "-v", "--", STUDY_PATH).splitlines(), [f"h {f}" for f in files])
+            self.assertEqual((status(clone), guards._unverified_files(clone, tree, STUDY_PATH)), ("", []))
+            with self.assertRaises(guards.Refused) as refused:
+                guards.running_tree(clone)
+            for part in ("the index marks study files assume-unchanged or skip-worktree",
+                         "so git status does not check them and the run cannot verify them", f"{TRANSPORT} (assume",
+                         "clear the bits (git update-index --no-assume-unchanged or --no-skip-worktree",
+                         "if core.ignoreStat is true, unset it"):
+                self.assertIn(part, str(refused.exception))
+            sh(clone, "config", "--unset", "core.ignoreStat")
+            with self.assertRaisesRegex(guards.Refused, "^the index marks study files"):
+                guards.running_tree(clone)
+            sh(clone, "update-index", "--no-assume-unchanged", "--", *files)
+            self.assertEqual(guards.running_tree(clone), tree)
+
+    def test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed(self):
+        """The content check alone: with the index-flag refusal bypassed, a flagged file that changed, was deleted or
+        was replaced by a link to the same bytes is still refused, because the working file's own bytes are hashed."""
+        cases = {"changed": "differs from HEAD's blob", "deleted": "is missing",
+                 "replaced_by_a_link": "is not a regular file"}
+        for flag, _, options in INDEX_FLAGS[:2]:
+            for how, problem in cases.items():
+                with self.subTest(flag=flag, file=how), self.study_repo() as (repo, tmp):
+                    for option in options:
+                        sh(repo, "update-index", option, TRANSPORT)
+                    self.change(repo, tmp, how)
+                    self.assertEqual(status(repo), "")
+                    with mock.patch.object(guards, "_masked_index_entries", lambda *args: []), \
+                            self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} {problem}")):
+                        guards.running_tree(repo)
+
+    def test_running_tree_refuses_a_change_that_a_clean_filter_hides(self):
+        """Only the content check can refuse this one, and only because it hashes with --no-filters: no index flag is
+        set, and git status reports nothing because a clean filter (set in the repository's own configuration and
+        .git/info/attributes, neither of them tracked) gives the committed bytes back for the edited file. The
+        attribute is a basename pattern, which git applies both to the repository-relative path git status checks and
+        to the absolute path running_tree gives git hash-object --stdin-paths, so without --no-filters that call would
+        hash the committed bytes as well. At ace56485 the pattern was the anchored repository-relative path, which git
+        does not apply to an absolute path: the filter never reached the content check, and removing --no-filters
+        passed this test (the independent verification of ace56485, C7)."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, tmp):
+            committed = FR.write(tmp / "transport-committed.py", (repo / TRANSPORT).read_bytes())
+            sh(repo, "config", "filter.committed.clean", f"cat {shlex.quote(str(committed))}")
+            FR.write(repo / ".git" / "info" / "attributes", f"{Path(TRANSPORT).name} filter=committed\n")
+            (repo / TRANSPORT).write_text("HOST = 'changed'\n")      # the committed length: git compares content
+            self.assertEqual(len("HOST = 'changed'\n"), len(committed.read_bytes()))
+            self.assertEqual(status(repo), "")
+            self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
+            blob = sh(repo, "rev-parse", f"HEAD:{TRANSPORT}")
+            self.assertEqual(sh(repo, "hash-object", TRANSPORT), blob)
+
+            def hashed(*options):
+                """git hash-object given the file as running_tree gives it: an absolute path, one per line."""
+                return subprocess.run(["git", "-C", str(repo), "hash-object", *options, "--stdin-paths"],
+                                      input=f"{Path(repo).resolve() / TRANSPORT}\n", capture_output=True, text=True,
+                                      check=True).stdout.strip()
+            self.assertEqual((hashed() == blob, hashed("--no-filters") == blob), (True, False))
+            with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} differs from HEAD's blob")):
+                guards.running_tree(repo)
+
+    def test_running_tree_refuses_a_committed_symbolic_link(self):
+        """A symbolic-link entry is refused: the tree hash covers the link's text, not the file it names."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, tmp):
+            link = f"{STUDY_PATH}/core/b.py"
+            (repo / link).symlink_to("a.py")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "a symbolic link")
+            self.assertEqual(status(repo), "")
+            self.assertEqual(sh(repo, "ls-tree", "HEAD", "--", link).split()[0], "120000")
+            with self.assertRaisesRegex(guards.Refused, re.escape(f"{link} is a symbolic link or submodule entry")):
+                guards.running_tree(repo)
+
+    def test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree(self):
+        """running_tree reads HEAD's own tree, without replace refs (git-replace(1); git --no-replace-objects). With a
+        replace ref on HEAD's study tree object, git reads another tree in its place: plain git status reports nothing
+        for files that match that other tree, no index flag is set, and git ls-tree lists its blobs under the id of
+        HEAD's tree. At 28fafe84 the content check compared the files with those blobs and running_tree returned
+        HEAD's tree. At ba106834 the content check listed the tree without replace refs and refused the file. Since
+        follow-up F2 every git command of core.guards ignores replace refs (git_command), so its git status already
+        reports the files as changed."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, _):
+            head, tree = sh(repo, "rev-parse", "HEAD"), sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
+            (repo / TRANSPORT).write_text("HOST = 'changed'\n")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "another tree")
+            sh(repo, "replace", tree, sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"))
+            sh(repo, "reset", "-q", "--soft", head)         # HEAD names the first tree; the files are the second's
+            self.assertEqual(sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+            self.assertEqual((status(repo), (repo / TRANSPORT).read_text()), ("", "HOST = 'changed'\n"))
+            self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
+            with self.assertRaisesRegex(guards.Refused, "^the study tree has uncommitted changes"):
+                guards.running_tree(repo)
+            # the module's own git names the same tree and, unlike plain git status above, reports the file
+            self.assertEqual(guards.git(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+            self.assertIn(TRANSPORT, guards.git(repo, "status", "--porcelain", "--", STUDY_PATH))
+
+    def test_running_tree_refuses_a_file_name_that_one_line_cannot_carry(self):
+        """git hash-object --stdin-paths reads one path per line, so a tracked file whose name holds a control
+        character (here a line break) is refused by name, before any path is handed to it."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, _):
+            FR.write(repo / STUDY_PATH / "core" / "two\nlines.py", "y = 1\n")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "a line break in a file name")
+            self.assertEqual(status(repo), "")
+            with self.assertRaisesRegex(guards.Refused, "lines.py' has a control character in its name"):
+                guards.running_tree(repo)
+
+    def test_running_tree_refuses_when_git_does_not_hash_every_file(self):
+        """The content check fails closed: if git hash-object exits with an error, or prints fewer hashes than the
+        files it was given, the tree is refused, whatever the hashes it did print."""
+        real = subprocess.run
+
+        def altered(change):
+            def run(command, *args, **kwargs):
+                done = real(command, *args, **kwargs)
+                return change(done) if "hash-object" in command else done
+            return run
+        cases = {"an_error_exit": lambda done: subprocess.CompletedProcess(done.args, 128, done.stdout, b"fatal: x"),
+                 "one_hash_short": lambda done: subprocess.CompletedProcess(
+                     done.args, 0, done.stdout.split(b"\n", 1)[0] + b"\n", done.stderr)}
+        for case, change in cases.items():
+            with self.subTest(case=case), self.study_repo() as (repo, _):
+                with mock.patch.object(guards.subprocess, "run", altered(change)), \
+                        self.assertRaisesRegex(guards.Refused, "git hash-object could not read every tracked file"):
+                    guards.running_tree(repo)
+
+
+class RealObjects(unittest.TestCase):
+    """Review round 18, second repair, follow-up F2: every git command core.guards runs is built by
+    core.guards.git_command with --no-replace-objects (git(1); git-replace(1)), so a guard reads the repository's own
+    commit, tree or blob and not an object that a local replace ref puts in its place. The running-tree case is
+    RunningTreeContent.test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree; these are two other
+    guards. In each, git without the option gives the replacement, which the test shows first."""
+
+    def test_committed_bytes_returns_the_real_blob_under_a_replace_ref(self):
+        """committed_bytes reads the protocol, the logs and the deviations at a commit (frozen_protocol, void_records,
+        first_reach). With a replace ref on the committed blob, git show prints the replacement."""
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.init_repo(Path(tmp) / "repo")
+            committed = FR.write(repo / PROTOCOL_PATH, json.dumps({"status": "frozen"})).read_bytes()
+            first = FR.commit_push(repo, "2026-10-01T21:30:00+00:00", "the protocol")
+            FR.write(repo / PROTOCOL_PATH, json.dumps({"status": "edited"}))
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "another protocol")
+            sh(repo, "replace", sh(repo, "rev-parse", f"{first}:{PROTOCOL_PATH}"),
+               sh(repo, "rev-parse", f"HEAD:{PROTOCOL_PATH}"))
+            self.assertEqual(json.loads(sh(repo, "show", f"{first}:{PROTOCOL_PATH}")), {"status": "edited"})
+            self.assertEqual(guards.committed_bytes(repo, first, PROTOCOL_PATH), committed)
+
+    def test_the_transport_deviation_diff_compares_the_real_trees_under_a_replace_ref(self):
+        """fetch_only_diff decides whether a running tree differs from the pinned tree only under fetch/ (the
+        transport-deviation rule, check_study_tree; run.py transport-check lists the changed paths the same way).
+        Here the trees also differ in core/a.py. With a replace ref that puts the pinned tree's core/ in place of the
+        other tree's, git diff-tree lists the transport alone."""
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.init_repo(Path(tmp) / "repo")
+            FR.write(repo / STUDY_PATH / "core" / "a.py", "x = 1\n")
+            FR.write(repo / TRANSPORT, "HOST = 'fixture'\n")
+            first = FR.commit_push(repo, "2026-10-01T21:30:00+00:00", "the pinned tree")
+            FR.write(repo / STUDY_PATH / "core" / "a.py", "x = 2\n")
+            FR.write(repo / TRANSPORT, "HOST = 'changed'\n")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "a tree that also changes core/")
+            pinned, tree = (sh(repo, "rev-parse", f"{commit}:{STUDY_PATH}") for commit in (first, "HEAD"))
+            self.assertEqual(sh(repo, "diff-tree", "-r", "--name-only", pinned, tree).splitlines(),
+                             ["core/a.py", "fetch/transport.py"])
+            sh(repo, "replace", sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}/core"),
+               sh(repo, "rev-parse", f"{first}:{STUDY_PATH}/core"))
+            self.assertEqual(sh(repo, "diff-tree", "-r", "--name-only", pinned, tree).splitlines(),
+                             ["fetch/transport.py"])
+            self.assertFalse(guards.fetch_only_diff(repo, pinned, tree))
+            self.assertEqual(guards.git(repo, "diff-tree", "-r", "--name-only", pinned, tree).splitlines(),
+                             ["core/a.py", "fetch/transport.py"])
+
+
 class Guards(unittest.TestCase):
     def test_require_frozen_and_matching_tree(self):
         tree = "a" * 40
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_holdout.py b/blueprints/us-equities/mover-v3/study/tests/test_holdout.py
index db5711085..1baee8ecf 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_holdout.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_holdout.py
@@ -852,8 +852,9 @@ def dated_actions(path, params):
         m.route = dated_actions
         m.fail = [(lambda path, p: path == "/v1/corporate-actions" and p["end"] == terminal_date,
                    "timeout", 100)]
-        reqs = plan.assets_requests() + [plan.corporate_actions_request("2016-01-01", enum_date),
-                                         plan.terminal_actions_request(terminal_date)]
+        enum_reqs = plan.assets_requests() + [plan.corporate_actions_request("2016-01-01", enum_date),
+                                              plan.terminal_actions_request(terminal_date)]
+        reqs = list(enum_reqs)
         for day in cal.range("2020-04-01", enum_date):
             reqs.extend(plan.screen_requests(cal, day, ["MOVR"]))
         live = Store()
@@ -877,14 +878,15 @@ def dated_actions(path, params):
             quotes.append(book(cal, cal.offset(t, 5), "15:55", 10.0, 10.02))
         ctx = {"cal": cal, "fees": costs.Fees(FEES, cal=cal), "cells": CELLS}
         store = holdout.HoldoutStore([], live, cal)
-        try:
-            spec = holdout._spec_factory(ctx, "2020-01-02", "2020-12-31", frozenset(), frozenset(),
-                                         ("H1-D-b_lane-low",), terminal_date)(store)
-            tr = resolve(ev, "b_lane", spec.ctx("read"), store, {"MOVR": quotes})
-        except holdout.HoldoutRefused:
-            return
-        self.assertEqual(tr["status"], "void",
-                         f"exhausted terminal_actions booked {tr.get('exit')} with cash={tr.get('cash')}")
+        spec_for = holdout._spec_factory(ctx, "2020-01-02", "2020-12-31", frozenset(), frozenset(),
+                                         ("H1-D-b_lane-low",), terminal_date)
+        # Exhaustion leaves the planner at the enumeration and terminal requests, never per-event requests.
+        planned = holdout._planner(spec_for, "plan", enum_date, terminal_date)(store)
+        self.assertEqual([r["key"] for r in planned], [r["key"] for r in enum_reqs])
+        with self.assertRaisesRegex(holdout.HoldoutRefused,
+                                    "^terminal_actions acquisition is incomplete: terminal records are unknown$"):
+            spec = spec_for(store)
+            resolve(ev, "b_lane", spec.ctx("read"), store, {"MOVR": quotes})
 
     def test_exhausted_terminal_merger_request_below_one_percent_refuses_booking(self):
         self._exhausted_terminal_trade("cash_merger")
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
new file mode 100644
index 000000000..782bf2835
--- /dev/null
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -0,0 +1,891 @@
+"""Round 18 R5: extend core.holdout.collect's recovery contract at 803bc351 to
+count_only.dry_run and transport_check.seal_live_samples, and its repair after the
+round-18 pre-outcome reviews (Claude H1, M1, L1-L3; GPT G-H, G-M): both adopt a seal
+only through core.store.recover_seal, against its seal record and a binding that
+names the running study tree, protocol and runtime lock. Only temporary synthetic
+snapshots are read or damaged; every transport uses FakeMarket.
+
+Second repair, after the cross-family re-check of that repair (GPT-6.1 Sol, 2026-10-01; R2-1 to R2-4): a seal record
+without a sha256 of its ledger, a snapshot path that is not a directory, a change of attempt ids alone, and, at the
+command level, a study file whose change an index flag hides from git status.
+"""
+import contextlib
+import copy
+import gzip
+import json
+import os
+import re
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from core import count_only as CO
+from core import plan, transport_check
+from core.canon import dumps, sha256_bytes, sha256_file
+from core.store import SEAL_RECORD, SealError, Store, normalized_sha256
+from tests import synth
+from tests.test_identity import fixed_clock, issuer_data, transports
+
+# the running study tree, protocol and runtime lock (core.runner.seal_run_identity builds it from the context)
+RUN = {"study_tree": "synthetic-tree", "protocol_sha256": "synthetic-protocol", "runtime_lock_sha256": "synthetic-lock"}
+FETCH_CHANGE = "blueprints/us-equities/mover-v3/study/fetch/transport.py"
+FETCH_PREFIX = "blueprints/us-equities/mover-v3/study/fetch"
+# R2-1: what a seal record can hold in place of its ledger's sha256 (64 lowercase hexadecimal characters). At 406ad3c5
+# only null was adopted (Store.read compares no digest when it is given None); the others were refused by that
+# comparison or as a missing field, none as a malformed record.
+NOT_A_SHA256 = ("null", "missing", "number", "list", "short", "trailing_newline", "uppercase", "not_hexadecimal")
+# R2-3: what can stand at a snapshot path in place of a directory
+NOT_A_DIRECTORY = ("regular_file", "dangling_link")
+# F1 (the coordinator's follow-up on R2-3): what a snapshot directory can hold without a ledger, pages or seal record
+STRAY_FILES = ("ledger.jsonl.tmp", "seal.json.tmp", "unrelated.txt")
+# F1: snapshot paths that are unused, and so are still fetched into and sealed
+FRESH_PATHS = ("absent", "absent_under_absent_directories", "empty_directory")
+
+
+def snapshot_bytes(root):
+    """Every file's bytes under root, and every symbolic link's target (a dangling link is not a file)."""
+    return {str(p.relative_to(root)): os.readlink(p) if p.is_symlink() else p.read_bytes()
+            for p in Path(root).rglob("*") if p.is_symlink() or p.is_file()}
+
+
+def ledger_lines(directory) -> list:
+    return [json.loads(line) for line in (Path(directory) / "ledger.jsonl").read_bytes().splitlines() if line.strip()]
+
+
+def write_ledger(directory, lines) -> None:
+    """Rewrite the ledger in Store.write's line format; a str line is written as it is."""
+    text = "\n".join(x if isinstance(x, str) else dumps(x) for x in lines) + "\n"
+    (Path(directory) / "ledger.jsonl").write_bytes(text.encode("utf-8"))
+
+
+def reseal(directory) -> None:
+    """A forger who also rewrites the seal record: its ledger_sha256 becomes the edited ledger's, every other field
+    stays as sealed, so only the checks after the digest can refuse the edit."""
+    path = Path(directory) / SEAL_RECORD
+    record = json.loads(path.read_bytes())
+    record["ledger_sha256"] = sha256_file(Path(directory) / "ledger.jsonl")
+    path.write_bytes((dumps(record) + "\n").encode("utf-8"))
+
+
+class RecoveryChecks:
+    """Store.write's write-once rule also forbids fetching again before refusing a used directory."""
+
+    def assert_refuses_unchanged(self, root, market, call, pattern=""):
+        before, calls = snapshot_bytes(root), len(market.calls)
+        with self.assertRaisesRegex(SealError, pattern):
+            call()
+        self.assertEqual(market.calls[calls:], [], "a used snapshot must not draw provider data again")
+        self.assertEqual(snapshot_bytes(root), before)
+
+    def damage_partial(self, directory, kind):
+        ledger = directory / "ledger.jsonl"
+        if kind == "pages_only":
+            ledger.unlink()
+        elif kind == "partial_json":
+            ledger.write_bytes(ledger.read_bytes()[:-5])
+        elif kind == "missing_stamp":
+            # A syntactically valid prefix is still an unfinished snapshot.
+            ledger.write_bytes(b"\n".join(ledger.read_bytes().splitlines()[:-1]) + b"\n")
+        elif kind == "empty_ledger":
+            ledger.write_bytes(b"")
+        elif kind == "missing_page":
+            next((directory / "pages").iterdir()).unlink()
+        elif kind == "record_only":
+            # the ledger and the pages are gone; the seal record that precedes the ledger is left
+            ledger.unlink()
+            shutil.rmtree(directory / "pages")
+
+    def remove_binding(self, directory):
+        ledger = directory / "ledger.jsonl"
+        lines = [line for line in ledger.read_bytes().splitlines() if json.loads(line)["event"] != "snapshot"]
+        ledger.write_bytes(b"\n".join(lines) + b"\n")
+
+    def alter_page(self, directory):
+        # Keep gzip valid so Store.read must check the sealed page digest/length.
+        next((directory / "pages").iterdir()).write_bytes(gzip.compress(b'{"altered":true}', mtime=0))
+
+    def edit_fetch_times(self, directory):
+        """G-H: only the recorded vintages and durations change (dry_run_measured's F12 inputs). The stamps, pages,
+        requests and binding the seal record summarizes stay, so only the ledger digest it holds can refuse this."""
+        lines = ledger_lines(directory)
+        for x in lines:
+            if x["event"].startswith("stamp"):
+                x["vintage"] = "2000-01-01T00:00:00Z"
+                if isinstance(x.get("elapsed_seconds"), (int, float)):
+                    x["elapsed_seconds"] += 1000.0
+        write_ledger(directory, lines)
+
+    def replace_page_and_digests(self, directory, raw=b'{"altered":true}'):
+        """G-H, the GPT review's experiment: the first page is replaced together with its ledger digests (sha256,
+        length, normalized sha256); the binding, requests and stamps are kept, and the seal record is not touched."""
+        directory = Path(directory)
+        lines = ledger_lines(directory)
+        page = next(x for x in lines if x["event"] == "page")
+        parser = next(x["parser"] for x in lines if x["event"] == "request" and x["key"] == page["key"])
+        (directory / page["file"]).write_bytes(gzip.compress(raw, compresslevel=6, mtime=0))
+        page.update(sha256=sha256_bytes(raw), bytes=len(raw), normalized_sha256=normalized_sha256(parser, raw))
+        write_ledger(directory, lines)
+
+    def alter_request(self, directory):
+        """G-M: a persisted request whose parameters change while its key, stamps and pages stay, under the expected
+        binding, with the seal record resealed: only the request-equality check can refuse it."""
+        lines = ledger_lines(directory)
+        req = next(x for x in lines if x["event"] == "request")
+        req["params"] = {**req["params"], "feed": "altered"}
+        write_ledger(directory, lines)
+        reseal(directory)
+
+    def break_record_digest(self, directory, kind):
+        """R2-1: only the seal record's ledger_sha256 changes, to something that is not a sha256 (NOT_A_SHA256)."""
+        path = Path(directory) / SEAL_RECORD
+        record = json.loads(path.read_bytes())
+        sha = record.pop("ledger_sha256")
+        values = {"null": None, "number": 0, "list": [sha], "short": sha[:63], "trailing_newline": sha + "\n",
+                  "uppercase": "A" + sha[1:], "not_hexadecimal": "g" + sha[1:]}
+        if kind != "missing":
+            record["ledger_sha256"] = values[kind]
+        path.write_bytes((dumps(record) + "\n").encode("utf-8"))
+
+    def replace_with_a_non_directory(self, directory, kind):
+        """R2-3: the snapshot path itself stops being a directory (NOT_A_DIRECTORY)."""
+        shutil.rmtree(directory)
+        self.put_a_non_directory(directory, kind)
+
+    def put_a_non_directory(self, path, kind):
+        """A regular file or a dangling symbolic link at `path` (NOT_A_DIRECTORY)."""
+        if kind == "regular_file":
+            path.write_bytes(b"not a snapshot directory\n")
+        else:
+            path.symlink_to(path.parent / "absent-target")
+
+    def leave_only_a_stray_file(self, directory, name):
+        """F1: the snapshot directory holds one file that is no ledger, pages directory or seal record
+        (STRAY_FILES)."""
+        if directory.exists():
+            shutil.rmtree(directory)
+        directory.mkdir()
+        (directory / name).write_bytes(b"stray\n")
+
+    def renumber_attempt(self, directory, key, old, new) -> list:
+        """R2-4: one attempt of `key` gets another id, in its page events and in its completion stamp; the seal record
+        is resealed. Returns the events changed, after checking that nothing else changed: the ledger keeps every
+        other field of every line (stamp counts, statuses, page counts, page digests), the pages keep their bytes and
+        the seal record keeps every field but ledger_sha256. So only the attempt ids the seal record holds for its
+        stamps can refuse the edit."""
+        directory = Path(directory)
+        before, record = snapshot_bytes(directory), json.loads((directory / SEAL_RECORD).read_bytes())
+        sealed, lines = ledger_lines(directory), ledger_lines(directory)
+        changed = [x for x in lines if x["event"] in ("page", "stamp_complete", "stamp_incomplete")
+                   and x["key"] == key and x["attempt"] == old]
+        for x in changed:
+            x["attempt"] = new
+        write_ledger(directory, lines)
+        reseal(directory)
+
+        def without(field, items):
+            return [{k: v for k, v in x.items() if k != field} for x in items]
+        self.assertEqual(without("attempt", ledger_lines(directory)), without("attempt", sealed))
+        self.assertNotEqual(ledger_lines(directory), sealed)
+        after = snapshot_bytes(directory)
+        self.assertEqual({k: v for k, v in after.items() if k.startswith("pages/")},
+                         {k: v for k, v in before.items() if k.startswith("pages/")})
+        self.assertEqual(without("ledger_sha256", [json.loads(after[SEAL_RECORD])]), without("ledger_sha256", [record]))
+        return changed
+
+
+class DryRunSealRecovery(RecoveryChecks, unittest.TestCase):
+    def setUp(self):
+        self.cal = synth.calendar("2022-06-01", "2023-12-29")
+        self.sessions, self.symbols, self.utc_start = ["2023-03-01"], ["AAA"], "2026-09-26T10:00:00Z"
+        self.market = synth.FakeMarket(self.cal)
+        daily, prints = issuer_data(self.cal, "2022-06-01", "2023-12-29", lambda day: 7.25)
+        self.market.add("synthetic", [("2015-01-01", "AAA")], daily=daily, auctions=prints)
+
+    def run_dry(self, root, **overrides):
+        args = {"sessions": self.sessions, "symbols": self.symbols, "utc_start": self.utc_start, "run_identity": RUN,
+                **overrides}
+        return CO.dry_run(self.cal, transports=transports(self.market), snapshot_root=root,
+                          clock=fixed_clock, **args)
+
+    def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            first_progress, retry_progress = {}, {}
+            first = self.run_dry(tmp, progress=first_progress)
+            self.assertTrue(self.market.calls)
+            record = json.loads((Path(tmp) / "dry-run" / SEAL_RECORD).read_bytes())
+            self.assertEqual(record["ledger_sha256"], first["snapshot_sha256"])
+            self.assertEqual(record["binding"]["utc_start"], self.utc_start)
+            self.assertEqual(record["binding"]["identity"]["study_tree"], RUN["study_tree"])
+            before, calls = snapshot_bytes(tmp), len(self.market.calls)
+            self.market.issuers.clear()           # a second draw would return different pages
+            retry = self.run_dry(tmp, progress=retry_progress)
+            self.assertEqual(retry, first)
+            self.assertEqual(retry_progress, first_progress)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(tmp), before)
+
+    def test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start(self):
+        """M1: the fetch start changes neither the plan nor the fetch (core/driver.py), so it is bound beside the
+        identity and read back from the seal, never matched. At af38dced the matched fetch date refused this retry
+        for good (and test_mismatched_or_missing_binding_refuses_without_requests asserted that rule)."""
+        with tempfile.TemporaryDirectory() as tmp:
+            first = self.run_dry(tmp)
+            self.assertEqual(first["fetch_utc_start"], self.utc_start)
+            before, calls = snapshot_bytes(tmp), len(self.market.calls)
+            self.market.issuers.clear()
+            retry = self.run_dry(tmp, utc_start="2026-09-28T09:00:00Z")
+            self.assertEqual(retry, first)
+            self.assertEqual(retry["fetch_utc_start"], self.utc_start)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(tmp), before)
+
+    def test_another_study_tree_protocol_or_runtime_lock_refuses(self):
+        """H1: the seal binds the running study tree, protocol sha256 and runtime-lock sha256, so a run from any other
+        one refuses it and must fetch its own (freeze_preconditions[8]); at af38dced the binding held none of them.
+        A dry run without all three refuses before any fetch."""
+        for key in sorted(RUN):
+            with self.subTest(changed=key), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                other = {**RUN, key: "another-" + RUN[key]}
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp, run_identity=other),
+                                              f"^dry-run: the snapshot was sealed for another {key}$")
+        with tempfile.TemporaryDirectory() as tmp:
+            calls = len(self.market.calls)
+            for bad in ({}, {**RUN, "study_tree": ""}, {**RUN, "extra": "x"}, None):
+                with self.subTest(run_identity=bad), self.assertRaises(ValueError):
+                    self.run_dry(tmp, run_identity=bad)
+            self.assertEqual((self.market.calls[calls:], snapshot_bytes(tmp)), ([], {}))
+
+    def test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses(self):
+        """The plan-change check: a plan that differs for the same sessions, symbols and run identity (here one
+        request fewer) refuses the seal."""
+        planned = CO.dry_run_requests
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            with mock.patch.object(CO, "dry_run_requests", lambda *args: planned(*args)[:-1]):
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                              "^dry-run: the snapshot was sealed for another request plan$")
+
+    def test_mismatched_or_missing_binding_refuses_without_requests(self):
+        changes = ({"sessions": ["2023-03-02"]}, {"symbols": ["BBB"]}, {})
+        for change in changes:
+            with self.subTest(change=change), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                if not change:
+                    self.remove_binding(Path(tmp) / "dry-run")
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp, **change))
+
+    def test_partial_snapshot_refuses_without_requests(self):
+        for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page", "record_only"):
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                self.damage_partial(Path(tmp) / "dry-run", kind)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp))
+
+    def test_altered_page_refuses_without_requests(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.alter_page(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp))
+
+    def test_a_missing_or_mismatched_seal_record_refuses(self):
+        """G-H: a seal is adopted only against the seal record written once at seal time, so a ledger without one, or
+        with a record that is unreadable or does not match it, refuses."""
+        cases = {"missing": "no seal record", "not_json": "JSONDecodeError", "not_an_object": "seal record is invalid",
+                 "other_digest": "ledger sha256 differs", "other_stamps": "differs from its seal record"}
+        for kind, pattern in cases.items():
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                path = Path(tmp) / "dry-run" / SEAL_RECORD
+                record = json.loads(path.read_bytes())
+                if kind == "missing":
+                    path.unlink()
+                elif kind == "not_json":
+                    path.write_bytes(b"{")
+                elif kind == "not_an_object":
+                    path.write_bytes(b"[]\n")
+                else:
+                    if kind == "other_digest":
+                        record["ledger_sha256"] = "0" * 64
+                    else:
+                        record["stamps"][0][3] += 1
+                    path.write_bytes((dumps(record) + "\n").encode("utf-8"))
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
+
+    def test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record(self):
+        """G-H: an edit that keeps every stamp, page, request and the binding (here the vintages and the durations the
+        F12 calibration reads) is refused only because the ledger must have the digest its seal record holds. At
+        af38dced recovery hashed the edited ledger itself and adopted it."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.edit_fetch_times(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: snapshot ledger sha256 differs from the sealed value$")
+
+    def test_a_page_replaced_with_its_ledger_digests_refuses(self):
+        """G-H, the GPT review's experiment on the dry run: a page replaced together with its ledger digests, with
+        the binding, requests and stamps kept, was adopted at af38dced."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.replace_page_and_digests(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), "ledger sha256 differs")
+
+    def test_a_resealed_page_replacement_refuses(self):
+        """G-H, the per-page comparison: the GPT review's experiment with the seal record's ledger_sha256 also rewritten
+        to the edited ledger's (reseal). The ledger then reads under the record and the page matches its edited ledger
+        digests, so only the page sha256s the seal record holds refuse it. At 5a1d4b0e no test covered that comparison:
+        emptying page_sha256s in core.store.seal_record_of passed the whole suite."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            directory = Path(tmp) / "dry-run"
+            self.replace_page_and_digests(directory)
+            reseal(directory)
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: the snapshot differs from its seal record")
+
+    def test_a_resealed_request_change_refuses(self):
+        """G-M: a persisted request altered under the expected binding, with the seal record resealed, is refused by
+        the comparison of the ledger's request records with the requests its binding names."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.alter_request(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: the snapshot's requests or completion stamps differ")
+
+    def test_a_resealed_stamp_page_count_change_refuses(self):
+        """G-H: Store.read checks every completion stamp's page count against its attempt's page events."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            directory = Path(tmp) / "dry-run"
+            lines = ledger_lines(directory)
+            stamp = next(x for x in lines if x["event"] == "stamp_complete" and x["pages"])
+            stamp["pages"] += 1
+            write_ledger(directory, lines)
+            reseal(directory)
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), "page count differs")
+
+    def test_a_ledger_cut_after_a_refetched_requests_first_stamp_refuses(self):
+        """L1: at af38dced, set(state) == set(req) accepted a ledger cut right after the attempt-0 stamp of a request
+        that was re-fetched (here the last request in key order, complete at attempt 1). The seal record's ledger
+        digest refuses it, and, when the digest is resealed, so does the exact comparison of the attempt stamps."""
+        last = max(CO.dry_run_requests(self.cal, self.sessions, self.symbols), key=lambda r: r["key"])
+
+        def first_attempt(path, p):
+            return path == last["endpoint"] and all(p.get(k) == str(v) for k, v in last["params"].items())
+        for resealed, pattern in ((False, "ledger sha256 differs"), (True, "differs from its seal record")):
+            with self.subTest(resealed=resealed), tempfile.TemporaryDirectory() as tmp:
+                self.market.fail = [(first_attempt, "urlerror", 4)]      # the first call and its 3 retries
+                self.run_dry(tmp)
+                directory = Path(tmp) / "dry-run"
+                lines = ledger_lines(directory)
+                self.assertEqual([(x["attempt"], x["event"]) for x in lines
+                                  if x.get("key") == last["key"] and x["event"].startswith("stamp")],
+                                 [(0, "stamp_incomplete"), (1, "stamp_complete")])
+                cut = next(i for i, x in enumerate(lines)
+                           if x["event"] == "stamp_incomplete" and x["key"] == last["key"])
+                write_ledger(directory, lines[: cut + 1])
+                if resealed:
+                    reseal(directory)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
+
+    def test_unreadable_snapshots_refuse_with_a_seal_error(self):
+        """L2: at af38dced a corrupt gzip page (zlib.error), a ledger line that is not a JSON object (TypeError,
+        AttributeError) and an unreadable ledger (OSError, from sha256_file outside the try) escaped as other
+        exceptions. Each is now a SealError naming the error, with no request and no byte change; the two edited
+        ledgers are resealed so their lines reach the parser."""
+        cases = {"corrupt_page": "decompressing", "list_line": "TypeError", "number_line": "AttributeError",
+                 "ledger_is_a_directory": "IsADirectoryError"}
+        for kind, pattern in cases.items():
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                directory = Path(tmp) / "dry-run"
+                if kind == "corrupt_page":
+                    page = sorted((directory / "pages").iterdir())[0]
+                    good = page.read_bytes()
+                    page.write_bytes(good[:10] + b"\xff" * (len(good) - 18) + good[-8:])
+                elif kind == "ledger_is_a_directory":
+                    (directory / "ledger.jsonl").unlink()
+                    (directory / "ledger.jsonl").mkdir()
+                else:
+                    lines = (directory / "ledger.jsonl").read_text(encoding="utf-8").splitlines()
+                    write_ledger(directory, lines[:-1] + ["[1, 2]" if kind == "list_line" else "7"])
+                    reseal(directory)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
+
+    def test_a_seal_record_without_a_ledger_sha256_refuses(self):
+        """R2-1: recovery reads the ledger under the sha256 its seal record holds, so a record that holds none cannot
+        verify it. At 406ad3c5 a record whose ledger_sha256 was JSON null was adopted: Store.read compares no digest
+        when it is given None, and the record comparison used the same null. With the ledger's vintages and durations
+        edited as well (the F12 calibration's inputs), that seal was adopted too, without a request. Every value that
+        is not 64 lowercase hexadecimal characters is now refused as a malformed record, before the ledger is read."""
+        for ledger_edited in (False, True):
+            for kind in NOT_A_SHA256:
+                with self.subTest(kind=kind, ledger_edited=ledger_edited), tempfile.TemporaryDirectory() as tmp:
+                    self.run_dry(tmp)
+                    directory = Path(tmp) / "dry-run"
+                    if ledger_edited:
+                        self.edit_fetch_times(directory)
+                    self.break_record_digest(directory, kind)
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                                  "^dry-run: the seal record holds no sha256 of its ledger")
+
+    def test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests(self):
+        """R2-3: a regular file or a dangling symbolic link at the snapshot path holds no ledger, pages or seal record,
+        so at 406ad3c5 it counted as unused: the dry run fetched again (16 calls here) and Store.write then failed,
+        with NotADirectoryError for the file and with its own 'pages already exist' SealError for the link. It is a
+        used path: a SealError that names the dry run, no request, no byte change."""
+        for kind in NOT_A_DIRECTORY:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                self.replace_with_a_non_directory(Path(tmp) / "dry-run", kind)
+                self.assertIn("dry-run", snapshot_bytes(tmp))
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                              "^dry-run: the snapshot path exists and is not a directory")
+
+    def test_a_snapshot_root_that_is_not_a_directory_refuses_without_requests(self):
+        """F1, the first shape R2-3's repair left: the snapshot root, one level above the snapshot path, is a regular
+        file or a dangling symbolic link. The path itself does not exist, so at 7acb6944 it counted as unused: the
+        dry run made its 16 calls and Store.write then failed (NotADirectoryError for the file). A path is unused
+        only under a directory."""
+        for kind in NOT_A_DIRECTORY:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "snapshot-root"
+                self.put_a_non_directory(root, kind)
+                self.assertIn("snapshot-root", snapshot_bytes(tmp))
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(root),
+                                              "^dry-run: the snapshot path lies under a path that is not a directory")
+
+    def test_a_snapshot_directory_that_holds_only_stray_files_refuses_without_requests(self):
+        """F1, the second shape: a snapshot directory with no ledger, pages or seal record that is not empty. At
+        7acb6944 it counted as unused: with a stray ledger.jsonl.tmp or seal.json.tmp the dry run made its 16 calls
+        and Store.write then failed with FileExistsError, leaving pages behind; with any other file it fetched and
+        sealed beside it. A directory is unused only when it is empty."""
+        for stray in STRAY_FILES:
+            with self.subTest(stray=stray), tempfile.TemporaryDirectory() as tmp:
+                self.leave_only_a_stray_file(Path(tmp) / "dry-run", stray)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                              "^dry-run: the snapshot directory is not empty and holds no ledger")
+
+    def test_an_unused_snapshot_path_is_fetched_and_sealed(self):
+        """F1's other side: an unused path is still fetched into and sealed, and the seal is then recovered. Unused
+        means absent under an existing directory (also when several directories above it are absent) or an existing
+        empty directory."""
+        for kind in FRESH_PATHS:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "not" / "yet" / "made" if kind == "absent_under_absent_directories" else Path(tmp)
+                if kind == "empty_directory":
+                    (root / "dry-run").mkdir()
+                calls = len(self.market.calls)
+                first = self.run_dry(root)
+                self.assertGreater(len(self.market.calls), calls)
+                record = json.loads((root / "dry-run" / SEAL_RECORD).read_bytes())
+                self.assertEqual(record["ledger_sha256"], first["snapshot_sha256"])
+                before, calls = snapshot_bytes(tmp), len(self.market.calls)
+                self.assertEqual(self.run_dry(root), first)
+                self.assertEqual((self.market.calls[calls:], snapshot_bytes(tmp)), ([], before))
+
+    def fail_the_last_requests_first_attempt(self) -> dict:
+        """The L1 test's setup: the last request in key order fails its first call and its 3 retries, so it is sealed
+        incomplete at attempt 0 and complete at attempt 1. Returns that request."""
+        last = max(CO.dry_run_requests(self.cal, self.sessions, self.symbols), key=lambda r: r["key"])
+        self.market.fail = [(lambda path, p: path == last["endpoint"] and
+                             all(p.get(k) == str(v) for k, v in last["params"].items()), "urlerror", 4)]
+        return last
+
+    def test_a_resealed_attempt_id_change_refuses(self):
+        """R2-4, mutant A (st['attempt'] replaced by 0 in core.store.seal_record_of's stamp entries): at 406ad3c5 no
+        test compared attempt ids alone, so that mutant passed all 27 recovery tests (the L1 test removes a whole
+        stamp, which also changes the stamp count). Here a re-fetched request's second attempt becomes attempt 7 in
+        its page events and its completion stamp, with every count, status, page and digest kept and the seal record's
+        ledger_sha256 resealed: only the attempt ids the seal record holds refuse it."""
+        with tempfile.TemporaryDirectory() as tmp:
+            last = self.fail_the_last_requests_first_attempt()
+            self.run_dry(tmp)
+            changed = self.renumber_attempt(Path(tmp) / "dry-run", last["key"], 1, 7)
+            self.assertEqual(sorted({x["event"] for x in changed}), ["page", "stamp_complete"])
+            self.assertEqual([(x["event"], x["attempt"]) for x in ledger_lines(Path(tmp) / "dry-run")
+                              if x.get("key") == last["key"] and x["event"].startswith("stamp")],
+                             [("stamp_incomplete", 0), ("stamp_complete", 7)])
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: the snapshot differs from its seal record")
+
+
+# every change that applies to the whole transport-check run rather than to one label's source
+RUN_WIDE = {"seed": {"seed": "another-seed"},
+            **{key: {"run_identity": {**RUN, key: "another-" + value}} for key, value in RUN.items()}}
+
+
+class LiveSampleSealRecovery(RecoveryChecks, unittest.TestCase):
+    def setUp(self):
+        self.cal = synth.calendar("2022-06-01", "2023-12-29")
+        self.market = synth.FakeMarket(self.cal)
+        self.sources = {}
+        for label, symbol in (("stage", "AAA"), ("collect-synthetic", "BBB")):
+            req = plan.quote_request("quote_exit", symbol, "2023-03-01",
+                                     self.cal.at("2023-03-01", "15:55"), self.cal.close("2023-03-01"))
+            source = Store()
+            synth.put_quotes(source, req, symbol, [synth.quote(self.cal.at("2023-03-01", "15:55"), 7.2, 7.3)])
+            self.sources[label] = source
+            self.market.add(symbol, [("2015-01-01", symbol)],
+                            quotes=[synth.quote(self.cal.at("2023-03-01", "15:55"), 7.2, 7.3)])
+
+    def seal_samples(self, root, seed="synthetic-seed", sources=None, run_identity=RUN):
+        sources = self.sources if sources is None else sources
+        return transport_check.seal_live_samples(sources["stage"], transports(self.market), seed,
+                                                 [("collect-synthetic", sources["collect-synthetic"])],
+                                                 root, run_identity, clock=fixed_clock)
+
+    def seal_mixed(self, root, label, **change):
+        """L3: a live root whose `label` sample is sealed as the test sealed it and every other label under `change`,
+        so a run with `change` adopts the other labels and is refused at `label` itself. At af38dced the holdout
+        label's seed case was refused at 'stage' first and never reached the holdout label."""
+        with tempfile.TemporaryDirectory() as original, tempfile.TemporaryDirectory() as changed:
+            self.seal_samples(original)
+            self.seal_samples(changed, **change)
+            for name in self.sources:
+                shutil.copytree(Path(original if name == label else changed) / name, Path(root) / name)
+
+    def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            first = self.seal_samples(tmp)
+            self.assertEqual(set(first), set(self.sources))
+            self.assertEqual(len(self.market.calls), 2)
+            before, calls = snapshot_bytes(tmp), len(self.market.calls)
+            self.market.issuers.clear()
+            self.assertEqual(self.seal_samples(tmp), first)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(tmp), before)
+
+    def test_another_seed_study_tree_protocol_or_runtime_lock_refuses_at_each_label(self):
+        """H1 for live samples (each binds the running study tree, protocol and runtime lock) and L3 (a run-wide
+        change is refused at the label under test, which the message names)."""
+        for label in self.sources:
+            for key, change in RUN_WIDE.items():
+                with self.subTest(label=label, changed=key), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_mixed(tmp, label, **change)
+                    self.assert_refuses_unchanged(
+                        tmp, self.market, lambda: self.seal_samples(tmp, **change),
+                        f"^live sample {re.escape(repr(label))}: the snapshot was sealed for another {key}$")
+
+    def test_mismatched_or_missing_binding_refuses_without_requests(self):
+        """A change to one label's source (its requests, a page, or only its Store.binding; G-M) or a ledger without
+        its binding refuses at that label."""
+        for label in self.sources:
+            for change in ("source_request", "source_page", "source_binding", "missing_binding"):
+                with self.subTest(label=label, change=change), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    sources = copy.deepcopy(self.sources)
+                    if change == "source_request":
+                        req = plan.quote_request("quote_exit", "OTHER", "2023-03-01",
+                                                 self.cal.at("2023-03-01", "15:55"), self.cal.close("2023-03-01"))
+                        sources[label] = Store()
+                        synth.put_quotes(sources[label], req, "OTHER", [])
+                    elif change == "source_page":
+                        state = next(iter(sources[label].state.values()))
+                        state["pages"] = [b'{"quotes":{}}']
+                    elif change == "source_binding":
+                        # G-M: only the source's Store.binding changes; its requests and sealed attempts stay
+                        sources[label].binding = {"identity": {"synthetic": "another source binding"}}
+                    else:
+                        self.remove_binding(Path(tmp) / label)
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp, sources=sources),
+                                                  f"^live sample {re.escape(repr(label))}: ")
+
+    def test_partial_snapshot_refuses_without_requests(self):
+        for label in self.sources:
+            for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page", "record_only"):
+                with self.subTest(label=label, kind=kind), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    self.damage_partial(Path(tmp) / label, kind)
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp))
+
+    def test_altered_page_refuses_without_requests(self):
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.alter_page(Path(tmp) / label)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp))
+
+    def test_a_missing_seal_record_refuses(self):
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                (Path(tmp) / label / SEAL_RECORD).unlink()
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp), "no seal record")
+
+    def test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record(self):
+        """G-H: the same ledger-only edit as the dry run's, for each label."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.edit_fetch_times(Path(tmp) / label)
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: snapshot ledger sha256 differs from the sealed value$")
+
+    def test_a_resealed_request_change_refuses(self):
+        """G-M: a persisted request altered under the expected binding, with the seal record resealed."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.alter_request(Path(tmp) / label)
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: the snapshot's requests or completion stamps differ")
+
+    def test_a_resealed_page_replacement_refuses(self):
+        """G-H, the per-page comparison for each label, as the dry run's: a page replaced with its ledger digests and
+        the seal record's ledger_sha256 resealed is refused only by the page sha256s the seal record holds."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.replace_page_and_digests(Path(tmp) / label)
+                reseal(Path(tmp) / label)
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: the snapshot differs from its seal record")
+
+    def test_a_resealed_live_page_cannot_turn_a_failing_check_into_a_pass(self):
+        """G-H, the GPT review's experiment end to end: the sealed live sample differs from its source, so the check
+        fails; then the live page and its ledger digests are replaced by the source's page, with the binding, requests
+        and stamps kept. At af38dced recovery adopted the edited ledger and the check passed, after one provider call
+        in all. Now the rerun refuses, with no call and no byte change."""
+        s = "2023-03-01"
+        req = plan.quote_request("quote_exit", "AAA", s, self.cal.at(s, "15:55"), self.cal.close(s))
+        market = synth.FakeMarket(self.cal)
+        market.add("AAA", [("2015-01-01", "AAA")], quotes=[synth.quote(self.cal.at(s, "15:55"), 7.1, 7.4)])
+        with tempfile.TemporaryDirectory() as tmp:
+            sealed = Store()
+            synth.put_quotes(sealed, req, "AAA", [synth.quote(self.cal.at(s, "15:55"), 7.2, 7.3)])
+            source = Store.read(Path(tmp) / "source", sealed.write(Path(tmp) / "source"))
+            live_root = Path(tmp) / "live"
+
+            def check():
+                return transport_check.reproduction_check(lambda st: [req], source, transports(market), [FETCH_CHANGE],
+                                                          FETCH_PREFIX, seed="synthetic-seed", live_root=live_root,
+                                                          clock=fixed_clock, run_identity=RUN)
+            first = check()
+            self.assertEqual((first["passes"], first["plan"]["passes"], first["reparse"]["passes"],
+                              first["live"]["passes"], len(market.calls)), (False, True, True, False, 1))
+            self.replace_page_and_digests(live_root / "stage", source.state[req["key"]]["pages"][0])
+            self.assert_refuses_unchanged(live_root, market, check,
+                                          "^live sample 'stage': snapshot ledger sha256 differs from the sealed value$")
+            self.assertEqual(len(market.calls), 1)
+
+    def test_a_seal_record_without_a_ledger_sha256_refuses(self):
+        """R2-1 for each label, as the dry run's: a seal record whose ledger_sha256 is null (adopted at 406ad3c5, also
+        with the ledger's vintages and durations edited) or anything else that is not a sha256."""
+        for label in self.sources:
+            for ledger_edited in (False, True):
+                for kind in NOT_A_SHA256:
+                    with self.subTest(label=label, kind=kind, ledger_edited=ledger_edited), \
+                            tempfile.TemporaryDirectory() as tmp:
+                        self.seal_samples(tmp)
+                        if ledger_edited:
+                            self.edit_fetch_times(Path(tmp) / label)
+                        self.break_record_digest(Path(tmp) / label, kind)
+                        self.assert_refuses_unchanged(
+                            tmp, self.market, lambda: self.seal_samples(tmp),
+                            f"^live sample {re.escape(repr(label))}: the seal record holds no sha256 of its ledger")
+
+    def test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests(self):
+        """R2-3 for each label, as the dry run's: a regular file or a dangling symbolic link at the label's path."""
+        for label in self.sources:
+            for kind in NOT_A_DIRECTORY:
+                with self.subTest(label=label, kind=kind), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    self.replace_with_a_non_directory(Path(tmp) / label, kind)
+                    self.assertIn(label, snapshot_bytes(tmp))
+                    self.assert_refuses_unchanged(
+                        tmp, self.market, lambda: self.seal_samples(tmp),
+                        f"^live sample {re.escape(repr(label))}: the snapshot path exists and is not a directory")
+
+    def test_a_live_root_that_is_not_a_directory_refuses_without_requests(self):
+        """F1 for the live samples: the live root, one level above every label's path, is a regular file or a dangling
+        symbolic link. Every label lies under that one root, so the refusal names the first label."""
+        for kind in NOT_A_DIRECTORY:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "live-root"
+                self.put_a_non_directory(root, kind)
+                self.assertIn("live-root", snapshot_bytes(tmp))
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(root),
+                    "^live sample 'stage': the snapshot path lies under a path that is not a directory")
+
+    def test_a_label_directory_that_holds_only_stray_files_refuses_without_requests(self):
+        """F1 for each label, as the dry run's: the label's directory holds one stray file and no ledger, pages or
+        seal record. The other label's seal is adopted, and this one is refused without a request."""
+        for label in self.sources:
+            for stray in STRAY_FILES:
+                with self.subTest(label=label, stray=stray), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    self.leave_only_a_stray_file(Path(tmp) / label, stray)
+                    self.assert_refuses_unchanged(
+                        tmp, self.market, lambda: self.seal_samples(tmp),
+                        f"^live sample {re.escape(repr(label))}: the snapshot directory is not empty and holds no "
+                        "ledger")
+
+    def test_an_unused_label_path_is_fetched_and_sealed(self):
+        """F1's other side for the live samples: each label's unused path (absent, absent under absent directories, or
+        an existing empty directory) is fetched into once and sealed, and the seals are then recovered."""
+        for kind in FRESH_PATHS:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "not" / "yet" / "made" if kind == "absent_under_absent_directories" else Path(tmp)
+                if kind == "empty_directory":
+                    for label in self.sources:
+                        (root / label).mkdir()
+                calls = len(self.market.calls)
+                first = self.seal_samples(root)
+                self.assertEqual((len(self.market.calls) - calls, set(first)), (len(self.sources), set(self.sources)))
+                before, calls = snapshot_bytes(tmp), len(self.market.calls)
+                self.assertEqual(self.seal_samples(root), first)
+                self.assertEqual((self.market.calls[calls:], snapshot_bytes(tmp)), ([], before))
+
+    def test_a_resealed_attempt_id_change_refuses(self):
+        """R2-4, mutant A, for each label: the sample's one attempt becomes attempt 7 in its page event and its
+        completion stamp, with everything else kept and the seal record's ledger_sha256 resealed."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                key = next(x["key"] for x in ledger_lines(Path(tmp) / label) if x["event"] == "request")
+                changed = self.renumber_attempt(Path(tmp) / label, key, 0, 7)
+                self.assertEqual(sorted(x["event"] for x in changed), ["page", "stamp_complete"])
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: the snapshot differs from its seal record")
+
+
+class DryRunCommandRecovery(RecoveryChecks, unittest.TestCase):
+    """Repair of the round-18 reviews (H1, M1) at the command level. A dry run whose output step fails after the seal
+    writes a failed end line in run.py's finally block, so the next run opens a new start line and finds the seal.
+    It adopts that seal only for the study tree, protocol and runtime lock that fetched it (H1: freeze_preconditions[8]
+    wants the tree the freeze will pin to fetch), and on any later UTC day (M1: the fetch start is read back from the
+    seal, never matched)."""
+
+    SESSION = "2023-03-01"
+    DAY1, DAY2 = "2026-12-01T00:00:00Z", "2026-12-02T00:00:00Z"
+
+    def setUp(self):
+        self.cal = synth.calendar("2022-06-01", "2023-12-29")
+        self.market = synth.FakeMarket(self.cal)
+        s = self.SESSION
+        daily, prints = issuer_data(self.cal, self.cal.offset(s, -60), self.cal.offset(s, 12), lambda day: 7.25)
+        self.market.add("synthetic", [("2015-01-01", "AAA")], daily=daily, auctions=prints)
+        self.now = [self.DAY1]
+
+    @contextlib.contextmanager
+    def command(self):
+        import run
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.build(tmp, frozen=False)["repo"]
+            with FR.isolated_bytecode(), mock.patch.object(run, "REPO", repo), \
+                    mock.patch.object(run, "transports", lambda *_: transports(self.market)), \
+                    mock.patch.object(run, "clock", lambda: self.now[0]):
+                yield run, repo, Path(tmp)
+
+    def argv(self, root):
+        return ["dry-run", "--sessions", self.SESSION, "--symbols", "AAA", "--snapshot-root", str(root)]
+
+    def fail_after_the_seal(self, run, repo, root) -> str:
+        """The pushed start line, then a run whose output step fails after the seal; returns the sha256 that its
+        failed end line logged (review round 12, F3). Both lines are pushed."""
+        from core import logs
+        from core.params import RUN_LOG
+        from tests import fixture_repo as FR
+        self.assertEqual(run.main(self.argv(root)), 0)
+        FR.commit_push(repo, "2026-10-01T01:00:00+00:00")
+        with mock.patch.object(CO, "dry_run_output", side_effect=RuntimeError("synthetic failure after the seal")), \
+                self.assertRaisesRegex(RuntimeError, "after the seal"):
+            run.main(self.argv(root))
+        line = logs.read_lines(repo / RUN_LOG)[-1]
+        self.assertEqual((line["purpose"], line["status"], len(line["input_snapshot_sha256s"])),
+                         ("dry_run", "failed", 1))
+        FR.commit_push(repo, "2026-10-01T01:05:00+00:00")
+        return line["input_snapshot_sha256s"][0]
+
+    def test_a_seal_left_by_a_failed_run_is_refused_to_another_study_tree(self):
+        """H1: tree A seals and fails after the seal; tree B changes only study/fetch/ (the request plan is the same).
+        At af38dced B adopted A's seal without a request and wrote an output stamped with B's tree, so the F12
+        calibration came from a transport B never ran. Now B is refused, nothing is fetched or written, and B fetches
+        its own snapshot under a new root."""
+        from core.params import DRY_RUN_OUTPUT, STUDY_PATH
+        from tests import fixture_repo as FR
+        with self.command() as (run, repo, tmp):
+            root = tmp / "snap"
+            sealed = self.fail_after_the_seal(run, repo, root)
+            FR.write(repo / STUDY_PATH / "fetch" / "transport.py", "HOST = 'fixture-fixed'\n")
+            FR.commit_push(repo, "2026-10-01T02:00:00+00:00")
+            tree_b = FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
+            self.assertEqual(run.main(self.argv(root)), 0)               # B's start line
+            FR.commit_push(repo, "2026-10-01T02:05:00+00:00")
+            self.assert_refuses_unchanged(root, self.market, lambda: run.main(self.argv(root)),
+                                          "^dry-run: the snapshot was sealed for another study_tree$")
+            self.assertFalse((repo / DRY_RUN_OUTPUT).exists())
+            FR.commit_push(repo, "2026-10-01T02:10:00+00:00")             # the refused run's failed end line
+            fresh = tmp / "snap-tree-b"
+            self.assertEqual(run.main(self.argv(fresh)), 0)              # a new start line
+            FR.commit_push(repo, "2026-10-01T02:15:00+00:00")
+            calls = len(self.market.calls)
+            self.assertEqual(run.main(self.argv(fresh)), 0)
+            self.assertGreater(len(self.market.calls), calls)            # B's own transport fetched
+            out = json.loads((repo / DRY_RUN_OUTPUT).read_text())
+            self.assertEqual(out["study_tree"], tree_b)
+            self.assertNotEqual(out["snapshot_sha256"], sealed)
+
+    def test_a_seal_left_by_a_failed_run_is_adopted_on_a_later_utc_day(self):
+        """M1: the same tree, protocol and runtime lock retry on the next UTC day and adopt the seal without a request.
+        The output's fetch_utc_start is the first run's start, read back from the seal binding; the end line keeps its
+        own start. At af38dced the fetch date was matched, so this retry was refused for good."""
+        from core import logs
+        from core.params import DRY_RUN_OUTPUT, RUN_LOG
+        from tests import fixture_repo as FR
+        with self.command() as (run, repo, tmp):
+            root = tmp / "snap"
+            sealed = self.fail_after_the_seal(run, repo, root)
+            self.now[0] = self.DAY2
+            self.assertEqual(run.main(self.argv(root)), 0)               # a new start line on the next UTC day
+            FR.commit_push(repo, "2026-10-02T01:00:00+00:00")
+            before, calls = snapshot_bytes(root), len(self.market.calls)
+            self.assertEqual(run.main(self.argv(root)), 0)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(root), before)
+            out = json.loads((repo / DRY_RUN_OUTPUT).read_text())
+            self.assertEqual((out["snapshot_sha256"], out["fetch_utc_start"]), (sealed, self.DAY1))
+            line = logs.read_lines(repo / RUN_LOG)[-1]
+            self.assertEqual((line["purpose"], line["status"], line["input_snapshot_sha256s"], line["utc_start"]),
+                             ("dry_run", "complete", [sealed], self.DAY2))
+
+    def test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted(self):
+        """R2-2: H1 binds a seal to the tree core.guards.running_tree names, and at 406ad3c5 that was HEAD's tree
+        whenever git status reported no change. git status does not report a tracked file whose index entry is marked
+        assume-unchanged or skip-worktree (git-update-index(1)), so a transport edited under either flag ran as the
+        committed tree: the run opened a start line, and the next one adopted the seal that the failed run of the
+        committed tree left and named that tree in its output. Now the run is refused when it builds its context:
+        no start line, no request, no byte change, no output."""
+        from core import guards
+        from core.params import DRY_RUN_OUTPUT, RUN_LOG, STUDY_PATH
+        from tests import fixture_repo as FR
+        transport = f"{STUDY_PATH}/fetch/transport.py"
+        for flag in ("assume-unchanged", "skip-worktree"):
+            with self.subTest(flag=flag), self.command() as (run, repo, tmp):
+                root = tmp / "snap"
+                self.fail_after_the_seal(run, repo, root)
+                tree = FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
+                FR.sh(repo, "update-index", f"--{flag}", transport)
+                FR.write(repo / transport, "HOST = 'fixture-changed'\n")    # outside the plan code, as H1's tree B
+                self.assertEqual(FR.sh(repo, "status", "--porcelain", "--untracked-files=all", "--", STUDY_PATH), "")
+                self.assertEqual(FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+                log, before, calls = (repo / RUN_LOG).read_bytes(), snapshot_bytes(root), len(self.market.calls)
+                with self.assertRaisesRegex(guards.Refused, re.escape(f"{transport} ({flag})")):
+                    run.main(self.argv(root))
+                self.assertEqual(self.market.calls[calls:], [])
+                self.assertEqual(snapshot_bytes(root), before)
+                self.assertEqual((repo / RUN_LOG).read_bytes(), log)
+                self.assertFalse((repo / DRY_RUN_OUTPUT).exists())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_store.py b/blueprints/us-equities/mover-v3/study/tests/test_store.py
index 06e6e1681..efacc28eb 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_store.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_store.py
@@ -1,9 +1,13 @@
-"""Snapshot persistence must not replace the first sealed provider vintage."""
+"""Snapshot persistence must not replace the first sealed provider vintage, and a ledger gives each attempt one
+completion stamp."""
+import json
+import re
 import tempfile
 import unittest
 from pathlib import Path
 
 from core import plan
+from core.canon import dumps, sha256_file
 from core.store import SealError, Store
 from tests import synth
 
@@ -25,3 +29,24 @@ def test_a_second_write_cannot_replace_a_sealed_snapshot(self):
             self.assertEqual({str(p.relative_to(directory)): p.read_bytes()
                               for p in directory.rglob("*") if p.is_file()}, before)
             self.assertEqual(Store.read(directory, sha).parsed(req["key"])[0]["symbol"], "AAA")
+
+    def test_a_second_completion_stamp_for_one_attempt_is_refused(self):
+        """Review round 18, second repair (R2-4, mutant B): Store.read refuses a second completion stamp for one key
+        and attempt in every snapshot it reads, whatever the stamp says. At 406ad3c5 no test read such a ledger: the
+        cross-family re-check removed that refusal and the 393 tests it ran still passed. The ledger is read under
+        its own sha256, so only that refusal can stop it; without it the later stamp would govern the attempt."""
+        for second in ("stamp_complete", "stamp_incomplete"):
+            with self.subTest(second=second), tempfile.TemporaryDirectory() as tmp:
+                directory = Path(tmp)
+                req = plan.assets_requests()[0]
+                store = Store()
+                synth.put_json(store, req, [{"symbol": "AAA", "status": "active"}])
+                self.assertEqual(Store.read(directory, store.write(directory)).status(req["key"]), "complete")
+                ledger = directory / "ledger.jsonl"
+                lines = ledger.read_bytes().splitlines()
+                stamp = json.loads(lines[-1])
+                self.assertEqual((stamp["event"], stamp["key"], stamp["attempt"]), ("stamp_complete", req["key"], 0))
+                ledger.write_bytes(b"\n".join(lines + [dumps({**stamp, "event": second}).encode("utf-8")]) + b"\n")
+                refusal = f"^{re.escape(req['key'])} attempt 0: a second completion stamp$"
+                with self.assertRaisesRegex(SealError, refusal):
+                    Store.read(directory, sha256_file(ledger))
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_trades.py b/blueprints/us-equities/mover-v3/study/tests/test_trades.py
index 478003491..692d4caea 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_trades.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_trades.py
@@ -568,6 +568,53 @@ def test_terminal_merger_identity_respects_reuse_dates_and_acquiree_role(self):
                 if no_record is not None:
                     self.assertEqual(result["no_merger_record"], no_record)
 
+    def test_asof_day_rename_does_not_join_successor_action_exclusions(self):
+        """corporate_action_dates: only a rename effective after asof=t advances the held issuer."""
+        for day in (self.cal.offset(self.t, -1), self.t):
+            for typ, field, excluded in (("spin_off", "source_symbol", "spin_off_record_excluded"),
+                                         ("forward_split", "symbol", "split_record_excluded"),
+                                         ("reverse_split", "symbol", "split_record_excluded")):
+                for symbol in ("OLD", "NEW"):
+                    with self.subTest(day=day, action=typ, symbol=symbol):
+                        actions = [self._rename("OLD", "NEW", day),
+                                   {"type": typ, field: symbol, "date": self.d[3]}]
+                        self._assert_statuses(actions, excluded if symbol == "OLD" else None)
+
+    def test_asof_day_rename_does_not_join_successor_terminal_mergers(self):
+        """The same strict asof boundary governs the terminal-merger consumer of issuer_records."""
+        cal, d = self.cal, self.d
+        qs = {"OLD": [book(cal, d[1], "09:35"), book(cal, d[3], "15:59", 11.9, 11.95)]}
+        for day in (cal.offset(self.t, -1), self.t):
+            for typ in ("cash_merger", "stock_merger", "stock_and_cash_merger"):
+                for symbol in ("OLD", "NEW"):
+                    with self.subTest(day=day, action=typ, symbol=symbol):
+                        actions = [self._rename("OLD", "NEW", day),
+                                   {"type": typ, "acquiree_symbol": symbol, "acquirer_symbol": "BIG", "date": d[3]}]
+                        count = resolve(self.ev, "b_lane", ctx_for(cal, actions=actions, mode="count"), Store(), qs)
+                        self.assertEqual(count["status"], "counted")
+                        read = resolve(self.ev, "b_lane", ctx_for(cal, actions=actions), Store(), qs)
+                        self.assertEqual(read["exit"], "terminal_merger" if symbol == "OLD" else "terminal_zero")
+                        if symbol == "OLD":
+                            self.assertEqual(read["primary_parts"][2], 11.9)
+                        else:
+                            self.assertTrue(read["no_merger_record"])
+                            self.assertEqual(read["nets"]["primary"], -1.0)
+
+    def test_terminal_zero_asof_day_rename_never_starts_a_successor_chain(self):
+        """A later successor rename in the diagnostic interval cannot revive a transition at or before t."""
+        cal, d = self.cal, self.d
+        for day in (cal.offset(self.t, -1), self.t):
+            with self.subTest(day=day):
+                actions = [self._rename("MID", "NEW", d[3]), self._rename("OLD", "MID", day)]
+                store = Store()
+                tr = resolve(self.ev, "b_lane", ctx_for(cal, actions=actions), store,
+                             {"OLD": [book(cal, d[1], "09:35")],
+                              "NEW": [book(cal, d[5], "15:55", 10.5, 10.6)]})
+                self.assertEqual((tr["exit"], tr["nets"]["primary"]), ("terminal_zero", -1.0))
+                self.assertFalse(tr["rename_record_in_window"])
+                self.assertNotIn("rename_sensitivity", tr)
+                self.assertFalse(any(r["kind"] == "quote_rename" for r in store.req.values()))
+
     def test_terminal_zero_chained_rename_is_counted_and_rerequested(self):
         """Round 17 F2 re-review: use the dated issuer chain from Ctx.issuer_records at 1961e23f,
         including an entry-day transition that is itself outside the diagnostic interval."""
@@ -745,6 +792,27 @@ def test_h3c_checks_each_split_when_another_split_is_adjusted(self):
             with self.subTest(missing=missing):
                 self._assert_split_eligibility(dict.fromkeys(days, 2.0), {missing}, -0.17328679513998632)
 
+    def test_split_on_the_last_overnight_leg_is_checked_in_both_paths(self):
+        """populations.corporate_actions includes the last interval (t+4, t+5], not just earlier legs."""
+        day = self.cal.offset(self.t, 5)
+        for ratio, value in ((2.0, -0.17328679513998632), (0.5, 0.17328679513998632)):
+            with self.subTest(ratio=ratio):
+                self._assert_split_eligibility({day: ratio}, {day}, value)
+
+    def test_split_and_spin_off_on_different_legs_exclude_the_whole_event(self):
+        """Per-leg record_exclusion returns the first excluded leg; a carried split cannot hide a spin-off."""
+        for split_k, spin_k in ((2, 5), (5, 2)):
+            split_day, spin_day = (self.cal.offset(self.t, k) for k in (split_k, spin_k))
+            for adjusted in (False, True):
+                ev, splits = self._split_event({split_day: 2.0}, {split_day: 2.0} if adjusted else {})
+                spin = {"type": "spin_off", "source_symbol": "MOVR", "new_symbol": "SPUN", "date": spin_day}
+                expected = "split_record_excluded" if split_k < spin_k and not adjusted else "spin_off_record_excluded"
+                for mode in ("read", "count"):
+                    with self.subTest(split_k=split_k, spin_k=spin_k, adjusted=adjusted, mode=mode):
+                        result = h3c_event(ev, ctx_for(self.cal, actions=[spin, *splits], mode=mode))
+                        self.assertEqual(result["status"], expected)
+                        self.assertNotIn("value", result)
+
     def test_legs_decompose_close_to_close(self):
         cal, t = self.cal, self.t
         ev = make_event(cal, t)
diff --git a/manifests/evidence.json b/manifests/evidence.json
index fd8126a92..037f7b3ae 100644
--- a/manifests/evidence.json
+++ b/manifests/evidence.json
@@ -13560,8 +13560,8 @@
     },
     {
       "path": "blueprints/us-equities/mover-v3/protocol-core-draft.json",
-      "sha256": "6d2966248d2518fd967fcae41622c64e9a6a379def758dcd449c40bfdb00badd",
-      "bytes": 328610
+      "sha256": "87a955fe3d6b6f171609afd3fd7b544de9cd292adc82b2a55a2c66d0b89307ac",
+      "bytes": 361469
     },
     {
       "path": "blueprints/us-equities/mover-v3/protocol-draft.json",