From af38dced9d2e8188768407ef569cc5d25549417e Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Sat, 26 Sep 2026 14:15:08 -0400
Subject: [PATCH 01/15] Mover v3 round 18: pre-freeze residual coverage, seal
 recovery for dry runs and live samples, literature correction

Residuals the round-17 verifiers and the GPT-6 re-review named:
- R1-R4, coverage only. Eight tests pass on unchanged 803bc351 production code:
  - the H3-c split on the last overnight leg, and a split and a spin-off on
    different legs;
  - a name_change dated exactly on asof t, for every issuer-record consumer
    and the terminal-zero rename diagnostic;
  - the exact terminal_actions refusal reason;
  - a direct test of the no-valid-page-calibration guard.
- R5: count_only.dry_run and transport_check.seal_live_samples adopt the
  recover-if-matching pattern of core.holdout.collect. An existing snapshot
  is validated with Store.read; its binding and complete request/stamp set
  must match the new request; its sha256 is reused without fetching or
  writing. Partial, mismatched, unbound or altered snapshots refuse. Eight
  tests are in tests/test_seal_recovery.py. Reverting only the two production
  files gives 30 failures and 1 error. The dry-run local variable is named
  seal_identity so it does not shadow the imported core.identity module.
- Literature: item_set.items[4].why_kept described the LPS 2019 and ABJK 2022
  samples together as 'large, liquid names'. Re-verified from the
  manuscripts: LPS excludes microcaps (below $5 or the bottom NYSE size
  quintile) and opens at the first-half-hour VWAP; ABJK keeps common stocks
  above $1 (excluding financials and utilities), with its effect in all
  but the largest decile. The test stays two-sided; no rule changes.

Two round-18 review_record entries. Study test_command: 376 tests OK. The
protocol stays draft_pending_independent_pre_outcome_review, with
frozen_before_outcomes false. R1-R5 were implemented by GPT-6 (gpt-6-astra,
effort max) test-first and verified by the coordinator; the literature
correction was found by the GPT-6 paper sweep and verified by the coordinator.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../mover-v3/protocol-core-draft.json         |  18 +-
 .../mover-v3/study/core/count_only.py         |  29 ++-
 .../mover-v3/study/core/transport_check.py    |  28 ++-
 .../mover-v3/study/tests/test_calibration.py  |   9 +
 .../mover-v3/study/tests/test_holdout.py      |  22 ++-
 .../study/tests/test_seal_recovery.py         | 175 ++++++++++++++++++
 .../mover-v3/study/tests/test_trades.py       |  68 +++++++
 manifests/evidence.json                       |   4 +-
 8 files changed, 327 insertions(+), 26 deletions(-)
 create mode 100644 blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index fad8b6f95..c59d2ab44 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -62,7 +62,7 @@
         "role": "primary test (not a tradable cell)",
         "statistic": "mean over events of (mean of the 4 overnight leg log returns - mean of the 4 intraday leg log returns), gross, legs as in arms.c_decomposition",
         "alternative": "not equal to 0 at every stage; at the holdout a pass also needs the sign of the validation estimate (multiple_testing.no_direction_lock)",
-        "why_kept": "The direct test of H3's 'versus'. It uses official prints only, so it needs no fill and no cost model. The literature (LPS 2019, ABJK 2022) concerns large, liquid names and gives no sign for movers, so the test is two-sided at every stage. It is not locked to the development sign, because development is survivorship-limited (chronology.labels.development) and gates nothing. At the holdout, a confirmatory pass also needs the holdout estimate to have the sign of the governing validation estimate, so a pass replicates the screened direction."
+        "why_kept": "The direct test of H3's 'versus'. It uses official prints only, so it needs no fill and no cost model; it is therefore not an exact replication of LPS 2019, whose open is the first-half-hour VWAP. LPS 2019 excludes microcaps (price below $5 or the bottom NYSE size quintile), and ABJK 2022 keeps common stocks above $1 (excluding financials and utilities) with its effect in all but the largest size decile; neither studies the mover population or gives a sign for movers, so the test is two-sided at every stage. It is not locked to the development sign, because development is survivorship-limited (chronology.labels.development) and gates nothing. At the holdout, a confirmatory pass also needs the holdout estimate to have the sign of the governing validation estimate, so a pass replicates the screened direction."
       }
     ],
     "tradable_cells": "H1-D-b_lane-low, H3-a and H3-b are tradable cells and nothing else. H1-D and H3-c are primary tests and are never tradable cells. The robustness requirement (statistics.robustness_required_for_a_pass) applies to the three tradable cells only.",
@@ -862,7 +862,7 @@
     "fetch": "Before any outcome of a stage (development, validation, and each holdout 'count' or 'read'), the frozen code fetches every quote window, minute bar, per-event daily bar and official print that stage needs, and for development and validation first the full 2016-2020 screen data (universe_and_identity.request_shapes), under universe_and_identity.asof. Review round 8, R8-1: the request plan (symbols, asof, sessions, stamps, entry, exit, search and backward windows, and the enumeration) is derived by core/plan.py and core/stage.py, in the evaluation tree, only from sealed inputs (the calendar, the enumeration, corporate-action records, decision-time inputs, and the timestamps and eligibility of already sealed quotes); the loop core/driver.py fetches every planned request not yet sealed until the plan adds nothing. study/fetch/ receives one planned request and returns its raw pages; it derives nothing and parses no row. Terminal-search windows of censored trades extend past the segment end (populations.terminal_exits.segment_end), and backward windows follow populations.terminal_exits.booking (R8-7). The result is sealed as a sha256-pinned private snapshot (the ledger's sha256; the ledger holds every page's sha256 and normalized-record sha256), and that sha256 and the stage's fetch-incomplete rate by kind are committed in the run log. At most one re-fetch is allowed: once, of only the fetch-incomplete requests, before any outcome of that stage, followed by fetching any window that only then became plannable, committed the same way. After it, the 1% void rule is final. No outcome is computed from unsealed data.",
     "synthetic_tests": "The evaluator refuses a results file whose run-log entry names a tree other than the pinned one, a holdout count or read from a tree other than the pinned one or a passing transport deviation of it, a transport deviation without a passing reproduction check, a runtime that differs from runtime.lock, an edited (not appended) amendment file, a second results file for a stage, a read retry that chronology.holdout.read_timing does not permit, and an outcome computed before the stage's fetch rate is committed. It accepts a run from a commit reachable from origin/main whose study tree equals the pinned tree, with run-log, access-log and amendment lines committed after the freeze. A test kills a run before its results write and asserts that nothing was written and that the retry reproduces an uninterrupted run byte for byte. The suite is study/tests/, run by study_code.test_command under study/runtime.lock. Review round 9 (F6) adds command-level tests against a temporary repository shaped like this one after the freeze (tests/fixture_repo.py), so no test depends on the real protocol's status or writes to the real run log: every command refusing on a draft, a stage fetched once and evaluated into one results file with a kill after the write, the context refusals (bytecode isolation and ignored files, logs off origin/main, a protocol edited after the freeze, amendment timing, coverage_decision, transport deviations), the count-only command, and the holdout path through collect, count with two extensions and read, with two batches of different enumerations and a rename re-fetch, and the not-read label after the deadline.",
     "pinned_copies": "The study tree imports no module outside itself except the Python standard library, numpy, pandas, exchange_calendars and duckdb (review round 7, F6; review round 8, E1 adds duckdb, which the pinned dedupe_identity needs). It holds byte-for-byte copies of the external definitions it needs, listed in study/pinned_copies.json as (source path, commit aa6fc79, git blob, sha256, definition names): the Bars class and ET, et_epoch, TIME_BUCKETS, PRICE_TIERS, DV_TIERS, time_bucket, price_tier and dv_tier from mover-early-entry rules.py (R8-12); official_price from sessions_io.py; valid_quote from quotes.py; dedupe_identity with DUPLICATE_SERIES_MIN_SESSIONS, DUPLICATE_SERIES_MIN_SPAN_COVERAGE, CONTINUITY_RATIO, _rename_terminus and _components from broad-universe coverage.py; DATA_SYMBOL from collect_daily.py. A synthetic test reads each source with git cat-file at the listed blob, checks the blob hash and sha256, extracts each named definition with ast (decorators included) and asserts that the copy is identical and holds nothing else. Because nothing outside the tree is imported, a later edit to those paths on main cannot reach a run, and no module-level code of rules.py, quotes.py or coverage.py (their fees.json, protocol.json and duckdb-connection code) ever runs.",
-    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is read, never drawn again, and an output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
+    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is adopted only after Store.read validation and a match of its binding to the label, seed, source snapshot and request plan, never drawn again; a partial, mismatched or altered snapshot refuses (review round 18, R5), and an output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
   },
   "leverage_and_exits": "Research runs use 1x equal notional. Paper use of any passing rule follows the README's exit and leverage policy (at most one broker-held closing order per share, the leverage-schedule-v1-20260922 ceiling, and the leverage-ladder gate rows in catalogs/us-equities/gates-20260922.json, one rung at a time). H3-b stays at 1x in any later paper use until the 2x rung and its overnight cap are clean. The edge-shrink term stays 0 until a holdout pass.",
   "freeze_preconditions": [
@@ -874,7 +874,7 @@
     "The Alpaca market-data plan's documented historical-data rate limit recorded with its source, and a request-count fetch-time estimate for development and validation at that limit: the full 2016-2020 screen fetch (sessions x requests per session for the enumerated list) plus the per-event requests for at most 20 x (k + 3 sqrt(k) + 3) candidates per year, where k is that year's sampled candidate count (pre_freeze_access_path.outputs). This candidate bound governs the margin test. The estimate must leave a margin of at least 50% under the 40 sessions before N0 (coverage_rule.thresholds.fetch_margin_min and fetch_estimate, decided by the count-only code, review round 8, R8-9). If it does not, the protocol is not frozen as written. core/count_only.py fetch_estimate computes it (review round 9, M-2): the full 2016-2020 screen requests (sessions x 4 x ceil(enumerated symbols / 100)) plus, per year, candidate_bound(k) x 58 per-event requests (core.plan.per_event_requests_max: 5 per-event requests; per arm one entry window and at most 7 forward exit and 7 rename-sensitivity windows; and 8 backward windows), at the recorded rate limit. Review round 11, C2: the estimate counts requests, not pages; a request of more than one page (an event's minute bars, up to 3 pages) takes one rate slot per page, so the estimate is not a strict upper bound, and the minute-bar pages add little to an estimate dominated by single-page screen requests. The fetch itself is paced at the pinned rate (pre_freeze_access_path.rate_limit). Review round 15, F12: that request-count estimate is replaced by a page-based one at the slower of the pinned rate and the dry run's measured throughput, with the market-data and trading limits pinned separately and pinned retry and evaluation-and-merge allowances (pre_freeze_access_path.pipeline_allowance; coverage_rule.thresholds.fetch_estimate.rule), so the margin gate is applied to budgeted end-to-end time rather than to requests at the rate ceiling; the native dry run therefore comes before the count-only run.",
     "The identity probe (exposure_registry.pre_freeze_access_path.identity_probe) run by committed count-only code, with at least 20 rename probes, at least 95% matches for bars and for auctions and at least 90% for quotes (coverage_rule.thresholds.identity_probe; the count-only code emits the pass or fail, R8-9), no observed ticker-reuse failure (review round 15, N07), and the ticker-reuse result recorded (verified, or unverified for 2016-2020 if no case exists or none is conclusive)",
     "The study tree committed with runtime.lock and synthetic tests that pass under that runtime before any outcome, with 0 skips (run_discipline.study_code.test_command). Done in draft at the revision named by run_discipline.study_code.draft_tree_at_this_revision (test_record); it must be rerun on the tree that the freeze pins. The tests cover: every populations.formulas case, each official-print source label, the exclusion rules, a suspected unadjusted split, the fill-quote cases, the terminal-exit cases, the universe_and_identity cases (FB/META through the pinned dedupe_identity, ticker reuse, rename inside a hold, a split and a rename inside one hold, empty responses, fetch-date asof refused, corporate-action date fields), split, ex-dividend and 5% special-dividend crossings, the 2016-2020 early closes, a calendar and a fee amendment, a 2017 and a 2019 fee lookup with the TAF cap, the fetch-failure cases for every request kind, a dropped middle year, segment-end censoring and the embargo (including none at N0), the independence of validation and the holdout from every development output (H3-c two-sided with no direction lock, validation breakpoints from validation sessions only), the robustness statistics, the gate test, the count_unit keys, the holdout-read classification, the run_discipline refusals and the evaluator's holdout refusals, the access log's authorization and completion records including count and read retries, the net-return formula and the cash band, the in-hold split-record rule, a split on a session with no bar, censored exits searched past a segment end, backward windows, the pinned copies against their blobs, the atomic results write and the read retry, the plan regeneration and reparse checks, and the transport-deviation reproduction check. The code imports no module outside the study tree except the Python standard library, numpy, pandas, exchange_calendars and duckdb, so none of rules.close_hhmm, rules.fee_rates, rules.sell_fees, rules.net_return, rules.net_return_np and quotes.fetch_one can be called, and a test asserts both.",
-    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only.",
+    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only. A sealed dry-run snapshot is recovered without fetching only after Store.read validation and a match of its binding to the sessions, symbols, fetch date and request plan; a partial, mismatched or altered snapshot refuses (review round 18, R5).",
     "The frozen collector (core/plan.py collection plan and core/driver.py loop over the study/fetch/ transport) committed in the study tree, with its schedule committed and enabled so that the first collection batch covers the session of the freeze (holdout_gate.prospective_collection)",
     "The exposure registry updated with everything the author saw since this draft",
     "status set to frozen, frozen_before_outcomes true, run_discipline.study_code tree and fetch_tree (tree hashes only) and data_file_sha256s filled in, coverage_decision (dropped years and items_tested from the governing count-only output) recorded, and the protocol sha256 recorded in a commit that becomes reachable from origin/main (chronology.holdout.window defines the freeze commit); the study tree was merged to main before the freeze pull request, which does not change it coverage_decision is {dropped_years (integers), items_tested (a boolean), count_only_output: 'blueprints/us-equities/mover-v3/results/count-only-output.json', count_only_output_sha256}. core.runner.context refuses a coverage_decision that is mistyped or differs from that committed output's item_rule (review round 9, F7), and a development or validation run refuses an enumeration file whose sha256 differs from the output's part0.enumeration_sha256. Review round 15, F04: core.runner.check_coverage_decision also refuses unless the governing complete 'count_only' line cites the output and the output's dependency manifest equals the frozen tree, data files, parameters, coverage_rule and rate limit. Review round 15, N02: open_before_first_holdout_count is empty at the freeze. After the freeze neither the protocol nor non-transport code can change, so an entry left there could never be cleared and the first holdout count could never be authorized (core.holdout.authorize refuses while it holds one).",
@@ -1150,6 +1150,18 @@
       "round": 17,
       "input": "Cross-family (GPT-6) re-review of round 17 at 1961e23f, minor: the round-17 F2 wording said every identity use, the terminal-zero rename count included, resolves through the dated issuer resolver, but the rename diagnostic (study/core/trades.py:228 at 1961e23f) still selected renames by old_symbol == sym, so OLD -> MID on the entry day then MID -> NEW during the hold reported no rename and requested no rename sensitivity.",
       "resolution": "Implemented the issuer-aware alternative rather than narrowing the wording: core/trades.py resolves the terminal-zero rename diagnostic through Ctx.issuer_records. Four regressions in tests/test_trades.py: test_terminal_zero_chained_rename_is_counted_and_rerequested and test_terminal_zero_rename_diagnostic_rejects_other_issuers fail on 1961e23f; the single-rename and entry-day boundary cases pass on both as guards. Protocol: the rule sentence in universe_and_identity.corporate_action_dates. Study suite: 362 tests OK."
+    },
+    {
+      "date": "2026-09-26",
+      "round": 18,
+      "input": "Pre-freeze residuals from the round-17 verifiers and GPT-6 re-review at 803bc351: R1 (F1), H3-c's last overnight leg and mixed split/spin-off legs; R2 (F2), a name_change effective exactly at asof=t for every issuer-record consumer; R3 (F3), the exhausted-terminal refusal reason; R4 (F4), the no-valid-page-calibration guard; R5 (F5), safe retry of the count-only dry run and transport-check live samples after sealing.",
+      "resolution": "R1-R4 are coverage only: tests/test_trades.py adds last-leg and mixed-action H3-c cases in count and read modes and asof-day boundaries for action exclusions, terminal mergers and the terminal-zero rename diagnostic; tests/test_holdout.py asserts the exact terminal_actions acquisition refusal and the exhausted planner's enumeration-only boundary; tests/test_calibration.py directly asserts the no-valid-page-calibration refusal. All eight targeted cases pass on unchanged 803bc351 production code. R5 follows core.holdout.collect at that pin: core/count_only.py dry_run and core/transport_check.py seal_live_samples validate an existing snapshot with Store.read, require its binding and complete request/stamp set to match the new request, and reuse its sha256 without fetching or writing; partial, mismatched, unbound or altered snapshots refuse. The dry-run binding includes sessions, symbols, fetch date and request plan; each live-sample binding includes label, seed, source request/attempt digests and sample plan. Tests in tests/test_seal_recovery.py cover matching recovery, mismatched or missing binding, partial ledgers/pages and altered pages for both callers, with no further request and unchanged bytes. Before the change the dry-run matching retry raises SealError after fetching again, its refusal cases also fetch again, and the live-sample refusal cases accept invalid seals or fetch again; the live matching retry already passes. Protocol: freeze_preconditions' dry-run sentence and run_discipline.transport_deviations. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+    },
+    {
+      "date": "2026-09-26",
+      "round": 18,
+      "input": "Literature correction from a live GPT-6 academic-paper sweep for strategy-research (25 verified papers; evidence/artifacts/trading-convergence-20260926/papers-strategy.md): item_set.items[4].why_kept described the LPS 2019 and ABJK 2022 samples together as 'large, liquid names'.",
+      "resolution": "Re-verified by the coordinator from the manuscripts. ABJK 2022 (JFE 145(3), September 2021 manuscript): CRSP share codes 10 and 11 on NYSE, AMEX and NASDAQ, excluding financial and utility firms and firm-months with a previous month-end price at or below one dollar, May 1993 to December 2017; the high-minus-low hedge return is significant for all but the largest size decile. LPS 2019 (LSE accepted version, eprints.lse.ac.uk/87481): microcaps, i.e. a price below $5 or the bottom NYSE size quintile, are always excluded, and the open is the first-half-hour VWAP from TAQ. The sentence now states each sample separately and that the official-print diagnostic is not an exact replication of LPS's VWAP open. Rule impact: none; the test stays two-sided at every stage and no arm, horizon, threshold or code changes."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
diff --git a/blueprints/us-equities/mover-v3/study/core/count_only.py b/blueprints/us-equities/mover-v3/study/core/count_only.py
index 868d76b5b..30d38b8c2 100644
--- a/blueprints/us-equities/mover-v3/study/core/count_only.py
+++ b/blueprints/us-equities/mover-v3/study/core/count_only.py
@@ -19,13 +19,13 @@
 from core import formulas as FM
 from core import identity, plan
 from core.calendar import year_of
-from core.canon import dumps, sha256_bytes
+from core.canon import dumps, sha256_bytes, sha256_file
 from core.coverage_rule import (checked_thresholds, fetch_margin, identity_limited, item_rule, probe_decision,
                                 rule_sha256, year_decision)
 from core.fills import fill_at
 from core.params import FETCH, SAMPLING, T
 from core.records import MERGER_TYPES
-from core.store import Store
+from core.store import SealError, Store
 from pinned.sessions_io_copy import official_price
 
 PART1_RANGE = ("2016-01-04", "2020-12-31")
@@ -470,12 +470,27 @@ def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root,
     seal and counted (counts only; run.py dry-run writes the output with its run-log line). progress, when given,
     receives the snapshot sha256 as soon as it is sealed, so a run that fails afterwards still logs it (review round
     12, F3)."""
-    dry_run_requests(cal, sessions, symbols)            # refuses before any fetch (review round 11, C1)
-    store = Store()
+    reqs = dry_run_requests(cal, sessions, symbols)     # refuses before any fetch (review round 11, C1)
+    store, sha = Store(), None
     root = Path(snapshot_root) / "dry-run"
-    driver.stage_fetch(lambda st: dry_run_requests(cal, sessions, symbols), transports, store, fetch_date,
-                       clock=clock)
-    sha = store.write(root)
+    # core.holdout.collect's recover-if-matching pattern (803bc351): validate before adopting a seal or fetching.
+    seal_identity = {"sessions": list(sessions), "symbols": list(symbols), "fetch_date": fetch_date,
+                "requests": sorted(plan.record(r) for r in reqs)}
+    if (root / "ledger.jsonl").exists():
+        sha = sha256_file(root / "ledger.jsonl")
+        try:
+            store = Store.read(root, sha)
+        except (OSError, ValueError, KeyError, EOFError) as exc:
+            raise SealError("dry-run snapshot is invalid or partially written") from exc
+        if store.binding != {"identity": seal_identity}:
+            raise SealError("dry-run snapshot binding differs from the requested dry run")
+        if store.request_records() != seal_identity["requests"] or set(store.state) != set(store.req):
+            raise SealError("dry-run snapshot is partially written: requests or completion stamps differ")
+    elif (root / "pages").exists():
+        raise SealError("dry-run snapshot is partially written: cannot overwrite or fetch it again")
+    if sha is None:
+        driver.stage_fetch(lambda st: reqs, transports, store, fetch_date, clock=clock)
+        sha = store.write(root, binding={"identity": seal_identity})
     if progress is not None:
         progress["dry-run"] = sha
     return dry_run_output(snapshot_root, sha, sessions, symbols)
diff --git a/blueprints/us-equities/mover-v3/study/core/transport_check.py b/blueprints/us-equities/mover-v3/study/core/transport_check.py
index 9a54aee25..a1d0b4875 100644
--- a/blueprints/us-equities/mover-v3/study/core/transport_check.py
+++ b/blueprints/us-equities/mover-v3/study/core/transport_check.py
@@ -133,16 +133,36 @@ def reproduction_from_sealed(planner, store, changed_paths: list, fetch_prefix:
 
 def seal_live_samples(store, transports, seed, holdout_stores, live_root, clock=None) -> dict:
     """{label: sha256} of each snapshot's sealed live sample. A label whose sample is already sealed under live_root
-    (a run killed after sealing it) is read, never fetched again, so a sample is drawn at most once."""
+    (a run killed after sealing it) is validated and recovered only for the same source and seeded requests,
+    never fetched again, so a sample is drawn at most once."""
     from pathlib import Path
-    from core.canon import sha256_bytes
+    from core.canon import sha256_bytes, sha256_file
+    from core.store import SealError, Store
     shas = {}
     for label, st in [("stage", store), *holdout_stores]:
         d = Path(live_root) / label
+        # Bind the source's requests and sealed attempts (raw-page digests, not parsed outcomes), as collect's
+        # base_snapshots bind its inputs. Follow core.holdout.collect's recovery pattern at 803bc351.
+        source = {"binding": st.binding, "requests": st.request_records(), "attempts": {
+            key: [{**attempt, "pages": [sha256_bytes(raw) for raw in attempt["pages"]]}
+                  for attempt in st.history.get(key, []) + [st.state[key]]] for key in sorted(st.req)}}
+        identity = {"label": label, "seed": seed, "source_sha256": sha256_bytes(dumps(source).encode("utf-8")),
+                    "requests": sorted(record(r) for _, reqs in live_sample(st, seed=seed) for r in reqs)}
         if (d / "ledger.jsonl").exists():
-            shas[label] = sha256_bytes((d / "ledger.jsonl").read_bytes())
+            sha = sha256_file(d / "ledger.jsonl")
+            try:
+                live = Store.read(d, sha)
+            except (OSError, ValueError, KeyError, EOFError) as exc:
+                raise SealError("live sample snapshot is invalid or partially written") from exc
+            if live.binding != {"identity": identity}:
+                raise SealError("live sample snapshot binding differs from the source or seeded requests")
+            if live.request_records() != identity["requests"] or set(live.state) != set(live.req):
+                raise SealError("live sample snapshot is partially written: requests or completion stamps differ")
+            shas[label] = sha
+        elif (d / "pages").exists():
+            raise SealError("live sample snapshot is partially written: cannot overwrite or fetch it again")
         else:
-            shas[label] = fetch_live(st, transports, seed=seed, clock=clock).write(d)
+            shas[label] = fetch_live(st, transports, seed=seed, clock=clock).write(d, binding={"identity": identity})
     return shas
 
 
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_calibration.py b/blueprints/us-equities/mover-v3/study/tests/test_calibration.py
index 597145a27..5e6710dfa 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_calibration.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_calibration.py
@@ -72,6 +72,15 @@ def test_unmeasured_kinds_use_the_largest_observed_quote_bound(self):
                 with self.assertRaisesRegex(guards.Refused, kind):
                     check_calibration(output, underbounded)
 
+    def test_invalid_page_maxima_refuse_with_no_valid_page_calibration(self):
+        """check_dry_run_bound requires a mapping of nonnegative integer page maxima, excluding booleans."""
+        for maxima in (None, [], 1, "pages", {"quote_entry": 1, "event_minute": -1},
+                       {"quote_entry": True}, {"quote_entry": 1.0}, {"quote_entry": "1"}):
+            with self.subTest(maxima=maxima):
+                with self.assertRaisesRegex(guards.Refused,
+                                            "^the native dry run has no valid page calibration$"):
+                    check_calibration({"measured": {**FR.MEASURED, "pages_per_request_max": maxima}})
+
     def test_missing_quote_measurements_cannot_bound_unmeasured_kinds(self):
         for maxima in ({}, {"screen_daily_raw": 1}, {"screen_daily_raw": 1, "quote_exit": 0}):
             with self.subTest(maxima=maxima):
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_holdout.py b/blueprints/us-equities/mover-v3/study/tests/test_holdout.py
index db5711085..1baee8ecf 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_holdout.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_holdout.py
@@ -852,8 +852,9 @@ def dated_actions(path, params):
         m.route = dated_actions
         m.fail = [(lambda path, p: path == "/v1/corporate-actions" and p["end"] == terminal_date,
                    "timeout", 100)]
-        reqs = plan.assets_requests() + [plan.corporate_actions_request("2016-01-01", enum_date),
-                                         plan.terminal_actions_request(terminal_date)]
+        enum_reqs = plan.assets_requests() + [plan.corporate_actions_request("2016-01-01", enum_date),
+                                              plan.terminal_actions_request(terminal_date)]
+        reqs = list(enum_reqs)
         for day in cal.range("2020-04-01", enum_date):
             reqs.extend(plan.screen_requests(cal, day, ["MOVR"]))
         live = Store()
@@ -877,14 +878,15 @@ def dated_actions(path, params):
             quotes.append(book(cal, cal.offset(t, 5), "15:55", 10.0, 10.02))
         ctx = {"cal": cal, "fees": costs.Fees(FEES, cal=cal), "cells": CELLS}
         store = holdout.HoldoutStore([], live, cal)
-        try:
-            spec = holdout._spec_factory(ctx, "2020-01-02", "2020-12-31", frozenset(), frozenset(),
-                                         ("H1-D-b_lane-low",), terminal_date)(store)
-            tr = resolve(ev, "b_lane", spec.ctx("read"), store, {"MOVR": quotes})
-        except holdout.HoldoutRefused:
-            return
-        self.assertEqual(tr["status"], "void",
-                         f"exhausted terminal_actions booked {tr.get('exit')} with cash={tr.get('cash')}")
+        spec_for = holdout._spec_factory(ctx, "2020-01-02", "2020-12-31", frozenset(), frozenset(),
+                                         ("H1-D-b_lane-low",), terminal_date)
+        # Exhaustion leaves the planner at the enumeration and terminal requests, never per-event requests.
+        planned = holdout._planner(spec_for, "plan", enum_date, terminal_date)(store)
+        self.assertEqual([r["key"] for r in planned], [r["key"] for r in enum_reqs])
+        with self.assertRaisesRegex(holdout.HoldoutRefused,
+                                    "^terminal_actions acquisition is incomplete: terminal records are unknown$"):
+            spec = spec_for(store)
+            resolve(ev, "b_lane", spec.ctx("read"), store, {"MOVR": quotes})
 
     def test_exhausted_terminal_merger_request_below_one_percent_refuses_booking(self):
         self._exhausted_terminal_trade("cash_merger")
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
new file mode 100644
index 000000000..2ea23ad2c
--- /dev/null
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -0,0 +1,175 @@
+"""Round 18 R5: extend core.holdout.collect's recovery contract at 803bc351 to
+count_only.dry_run and transport_check.seal_live_samples. Only temporary synthetic
+snapshots are read or damaged; every transport uses FakeMarket.
+"""
+import copy
+import gzip
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from core import count_only as CO
+from core import plan, transport_check
+from core.store import SealError, Store
+from tests import synth
+from tests.test_identity import fixed_clock, issuer_data, transports
+
+
+def snapshot_bytes(root):
+    return {str(p.relative_to(root)): p.read_bytes() for p in Path(root).rglob("*") if p.is_file()}
+
+
+class RecoveryChecks:
+    """Store.write's write-once rule also forbids fetching again before refusing a used directory."""
+
+    def assert_refuses_unchanged(self, root, market, call):
+        before, calls = snapshot_bytes(root), len(market.calls)
+        with self.assertRaises(SealError):
+            call()
+        self.assertEqual(market.calls[calls:], [], "a used snapshot must not draw provider data again")
+        self.assertEqual(snapshot_bytes(root), before)
+
+    def damage_partial(self, directory, kind):
+        ledger = directory / "ledger.jsonl"
+        if kind == "pages_only":
+            ledger.unlink()
+        elif kind == "partial_json":
+            ledger.write_bytes(ledger.read_bytes()[:-5])
+        elif kind == "missing_stamp":
+            # A syntactically valid prefix is still an unfinished snapshot.
+            ledger.write_bytes(b"\n".join(ledger.read_bytes().splitlines()[:-1]) + b"\n")
+        elif kind == "empty_ledger":
+            ledger.write_bytes(b"")
+        elif kind == "missing_page":
+            next((directory / "pages").iterdir()).unlink()
+
+    def remove_binding(self, directory):
+        ledger = directory / "ledger.jsonl"
+        lines = [line for line in ledger.read_bytes().splitlines() if json.loads(line)["event"] != "snapshot"]
+        ledger.write_bytes(b"\n".join(lines) + b"\n")
+
+    def alter_page(self, directory):
+        # Keep gzip valid so Store.read must check the sealed page digest/length.
+        next((directory / "pages").iterdir()).write_bytes(gzip.compress(b'{"altered":true}', mtime=0))
+
+
+class DryRunSealRecovery(RecoveryChecks, unittest.TestCase):
+    def setUp(self):
+        self.cal = synth.calendar("2022-06-01", "2023-12-29")
+        self.sessions, self.symbols, self.fetch_date = ["2023-03-01"], ["AAA"], "2026-09-26"
+        self.market = synth.FakeMarket(self.cal)
+        daily, prints = issuer_data(self.cal, "2022-06-01", "2023-12-29", lambda day: 7.25)
+        self.market.add("synthetic", [("2015-01-01", "AAA")], daily=daily, auctions=prints)
+
+    def run_dry(self, root, **overrides):
+        args = {"sessions": self.sessions, "symbols": self.symbols, "fetch_date": self.fetch_date, **overrides}
+        return CO.dry_run(self.cal, transports=transports(self.market), snapshot_root=root,
+                          clock=fixed_clock, **args)
+
+    def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            first_progress, retry_progress = {}, {}
+            first = self.run_dry(tmp, progress=first_progress)
+            self.assertTrue(self.market.calls)
+            before, calls = snapshot_bytes(tmp), len(self.market.calls)
+            self.market.issuers.clear()           # a second draw would return different pages
+            retry = self.run_dry(tmp, progress=retry_progress)
+            self.assertEqual(retry, first)
+            self.assertEqual(retry_progress, first_progress)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(tmp), before)
+
+    def test_mismatched_or_missing_binding_refuses_without_requests(self):
+        changes = ({"sessions": ["2023-03-02"]}, {"symbols": ["BBB"]},
+                   {"fetch_date": "2026-09-27"}, {})
+        for change in changes:
+            with self.subTest(change=change), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                if not change:
+                    self.remove_binding(Path(tmp) / "dry-run")
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp, **change))
+
+    def test_partial_snapshot_refuses_without_requests(self):
+        for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page"):
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                self.damage_partial(Path(tmp) / "dry-run", kind)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp))
+
+    def test_altered_page_refuses_without_requests(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.alter_page(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp))
+
+
+class LiveSampleSealRecovery(RecoveryChecks, unittest.TestCase):
+    def setUp(self):
+        self.cal = synth.calendar("2022-06-01", "2023-12-29")
+        self.market = synth.FakeMarket(self.cal)
+        self.sources = {}
+        for label, symbol in (("stage", "AAA"), ("collect-synthetic", "BBB")):
+            req = plan.quote_request("quote_exit", symbol, "2023-03-01",
+                                     self.cal.at("2023-03-01", "15:55"), self.cal.close("2023-03-01"))
+            source = Store()
+            synth.put_quotes(source, req, symbol, [synth.quote(self.cal.at("2023-03-01", "15:55"), 7.2, 7.3)])
+            self.sources[label] = source
+            self.market.add(symbol, [("2015-01-01", symbol)],
+                            quotes=[synth.quote(self.cal.at("2023-03-01", "15:55"), 7.2, 7.3)])
+
+    def seal_samples(self, root, seed="synthetic-seed", sources=None):
+        sources = self.sources if sources is None else sources
+        return transport_check.seal_live_samples(sources["stage"], transports(self.market), seed,
+                                                 [("collect-synthetic", sources["collect-synthetic"])],
+                                                 root, clock=fixed_clock)
+
+    def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            first = self.seal_samples(tmp)
+            self.assertEqual(set(first), set(self.sources))
+            self.assertEqual(len(self.market.calls), 2)
+            before, calls = snapshot_bytes(tmp), len(self.market.calls)
+            self.market.issuers.clear()
+            self.assertEqual(self.seal_samples(tmp), first)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(tmp), before)
+
+    def test_mismatched_or_missing_binding_refuses_without_requests(self):
+        for label in self.sources:
+            for change in ("seed", "source_request", "source_page", "missing_binding"):
+                with self.subTest(label=label, change=change), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    sources, seed = copy.deepcopy(self.sources), "synthetic-seed"
+                    if change == "seed":
+                        seed = "different-seed"
+                    elif change == "source_request":
+                        req = plan.quote_request("quote_exit", "OTHER", "2023-03-01",
+                                                 self.cal.at("2023-03-01", "15:55"), self.cal.close("2023-03-01"))
+                        sources[label] = Store()
+                        synth.put_quotes(sources[label], req, "OTHER", [])
+                    elif change == "source_page":
+                        state = next(iter(sources[label].state.values()))
+                        state["pages"] = [b'{"quotes":{}}']
+                    else:
+                        self.remove_binding(Path(tmp) / label)
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp, seed, sources))
+
+    def test_partial_snapshot_refuses_without_requests(self):
+        for label in self.sources:
+            for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page"):
+                with self.subTest(label=label, kind=kind), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    self.damage_partial(Path(tmp) / label, kind)
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp))
+
+    def test_altered_page_refuses_without_requests(self):
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.alter_page(Path(tmp) / label)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_trades.py b/blueprints/us-equities/mover-v3/study/tests/test_trades.py
index 478003491..692d4caea 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_trades.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_trades.py
@@ -568,6 +568,53 @@ def test_terminal_merger_identity_respects_reuse_dates_and_acquiree_role(self):
                 if no_record is not None:
                     self.assertEqual(result["no_merger_record"], no_record)
 
+    def test_asof_day_rename_does_not_join_successor_action_exclusions(self):
+        """corporate_action_dates: only a rename effective after asof=t advances the held issuer."""
+        for day in (self.cal.offset(self.t, -1), self.t):
+            for typ, field, excluded in (("spin_off", "source_symbol", "spin_off_record_excluded"),
+                                         ("forward_split", "symbol", "split_record_excluded"),
+                                         ("reverse_split", "symbol", "split_record_excluded")):
+                for symbol in ("OLD", "NEW"):
+                    with self.subTest(day=day, action=typ, symbol=symbol):
+                        actions = [self._rename("OLD", "NEW", day),
+                                   {"type": typ, field: symbol, "date": self.d[3]}]
+                        self._assert_statuses(actions, excluded if symbol == "OLD" else None)
+
+    def test_asof_day_rename_does_not_join_successor_terminal_mergers(self):
+        """The same strict asof boundary governs the terminal-merger consumer of issuer_records."""
+        cal, d = self.cal, self.d
+        qs = {"OLD": [book(cal, d[1], "09:35"), book(cal, d[3], "15:59", 11.9, 11.95)]}
+        for day in (cal.offset(self.t, -1), self.t):
+            for typ in ("cash_merger", "stock_merger", "stock_and_cash_merger"):
+                for symbol in ("OLD", "NEW"):
+                    with self.subTest(day=day, action=typ, symbol=symbol):
+                        actions = [self._rename("OLD", "NEW", day),
+                                   {"type": typ, "acquiree_symbol": symbol, "acquirer_symbol": "BIG", "date": d[3]}]
+                        count = resolve(self.ev, "b_lane", ctx_for(cal, actions=actions, mode="count"), Store(), qs)
+                        self.assertEqual(count["status"], "counted")
+                        read = resolve(self.ev, "b_lane", ctx_for(cal, actions=actions), Store(), qs)
+                        self.assertEqual(read["exit"], "terminal_merger" if symbol == "OLD" else "terminal_zero")
+                        if symbol == "OLD":
+                            self.assertEqual(read["primary_parts"][2], 11.9)
+                        else:
+                            self.assertTrue(read["no_merger_record"])
+                            self.assertEqual(read["nets"]["primary"], -1.0)
+
+    def test_terminal_zero_asof_day_rename_never_starts_a_successor_chain(self):
+        """A later successor rename in the diagnostic interval cannot revive a transition at or before t."""
+        cal, d = self.cal, self.d
+        for day in (cal.offset(self.t, -1), self.t):
+            with self.subTest(day=day):
+                actions = [self._rename("MID", "NEW", d[3]), self._rename("OLD", "MID", day)]
+                store = Store()
+                tr = resolve(self.ev, "b_lane", ctx_for(cal, actions=actions), store,
+                             {"OLD": [book(cal, d[1], "09:35")],
+                              "NEW": [book(cal, d[5], "15:55", 10.5, 10.6)]})
+                self.assertEqual((tr["exit"], tr["nets"]["primary"]), ("terminal_zero", -1.0))
+                self.assertFalse(tr["rename_record_in_window"])
+                self.assertNotIn("rename_sensitivity", tr)
+                self.assertFalse(any(r["kind"] == "quote_rename" for r in store.req.values()))
+
     def test_terminal_zero_chained_rename_is_counted_and_rerequested(self):
         """Round 17 F2 re-review: use the dated issuer chain from Ctx.issuer_records at 1961e23f,
         including an entry-day transition that is itself outside the diagnostic interval."""
@@ -745,6 +792,27 @@ def test_h3c_checks_each_split_when_another_split_is_adjusted(self):
             with self.subTest(missing=missing):
                 self._assert_split_eligibility(dict.fromkeys(days, 2.0), {missing}, -0.17328679513998632)
 
+    def test_split_on_the_last_overnight_leg_is_checked_in_both_paths(self):
+        """populations.corporate_actions includes the last interval (t+4, t+5], not just earlier legs."""
+        day = self.cal.offset(self.t, 5)
+        for ratio, value in ((2.0, -0.17328679513998632), (0.5, 0.17328679513998632)):
+            with self.subTest(ratio=ratio):
+                self._assert_split_eligibility({day: ratio}, {day}, value)
+
+    def test_split_and_spin_off_on_different_legs_exclude_the_whole_event(self):
+        """Per-leg record_exclusion returns the first excluded leg; a carried split cannot hide a spin-off."""
+        for split_k, spin_k in ((2, 5), (5, 2)):
+            split_day, spin_day = (self.cal.offset(self.t, k) for k in (split_k, spin_k))
+            for adjusted in (False, True):
+                ev, splits = self._split_event({split_day: 2.0}, {split_day: 2.0} if adjusted else {})
+                spin = {"type": "spin_off", "source_symbol": "MOVR", "new_symbol": "SPUN", "date": spin_day}
+                expected = "split_record_excluded" if split_k < spin_k and not adjusted else "spin_off_record_excluded"
+                for mode in ("read", "count"):
+                    with self.subTest(split_k=split_k, spin_k=spin_k, adjusted=adjusted, mode=mode):
+                        result = h3c_event(ev, ctx_for(self.cal, actions=[spin, *splits], mode=mode))
+                        self.assertEqual(result["status"], expected)
+                        self.assertNotIn("value", result)
+
     def test_legs_decompose_close_to_close(self):
         cal, t = self.cal, self.t
         ev = make_event(cal, t)
diff --git a/manifests/evidence.json b/manifests/evidence.json
index 807851300..ab674865e 100644
--- a/manifests/evidence.json
+++ b/manifests/evidence.json
@@ -12108,8 +12108,8 @@
     },
     {
       "path": "blueprints/us-equities/mover-v3/protocol-core-draft.json",
-      "sha256": "6d2966248d2518fd967fcae41622c64e9a6a379def758dcd449c40bfdb00badd",
-      "bytes": 328610
+      "sha256": "9faf04d0df72950719280815bbea337d906d1c2a33c4b892bad6c11b377622e2",
+      "bytes": 332696
     },
     {
       "path": "blueprints/us-equities/mover-v3/protocol-draft.json",

From 7e07e7ae1fc5a4e338768d54373d653dec287979 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Wed, 30 Sep 2026 20:28:31 -0400
Subject: [PATCH 02/15] Mover v3 round 18 repair: failing-first command tests
 for H1 and M1

Two command-level regressions for the dry-run seal recovery, through
run.py dry-run against the fixture repository. Each run's output step
fails after the seal, so run.py's finally block writes a failed end line
and the next run opens a new start line.
- H1: tree B, which changes only study/fetch/ and so keeps the same request
  plan, must not adopt tree A's seal. At af38dced it does:
  "AssertionError: SealError not raised" at test_seal_recovery.py:239.
- M1: the same tree retrying on the next UTC day must adopt its seal and
  read back the first run's start. At af38dced the fetch date is matched:
  "core.store.SealError: dry-run snapshot binding differs from the
  requested dry run" (count_only.py:486).
The binding case that asserted a fetch-date refusal (the wrong rule, the
review's M1) is dropped. Module run at af38dced: Ran 10 tests,
FAILED (failures=1, errors=1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../study/tests/test_seal_recovery.py         | 106 +++++++++++++++++-
 1 file changed, 104 insertions(+), 2 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
index 2ea23ad2c..141d5068d 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -2,12 +2,14 @@
 count_only.dry_run and transport_check.seal_live_samples. Only temporary synthetic
 snapshots are read or damaged; every transport uses FakeMarket.
 """
+import contextlib
 import copy
 import gzip
 import json
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 from core import count_only as CO
 from core import plan, transport_check
@@ -81,8 +83,7 @@ def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
             self.assertEqual(snapshot_bytes(tmp), before)
 
     def test_mismatched_or_missing_binding_refuses_without_requests(self):
-        changes = ({"sessions": ["2023-03-02"]}, {"symbols": ["BBB"]},
-                   {"fetch_date": "2026-09-27"}, {})
+        changes = ({"sessions": ["2023-03-02"]}, {"symbols": ["BBB"]}, {})
         for change in changes:
             with self.subTest(change=change), tempfile.TemporaryDirectory() as tmp:
                 self.run_dry(tmp)
@@ -171,5 +172,106 @@ def test_altered_page_refuses_without_requests(self):
                 self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp))
 
 
+class DryRunCommandRecovery(RecoveryChecks, unittest.TestCase):
+    """Repair of the round-18 reviews (H1, M1) at the command level. A dry run whose output step fails after the seal
+    writes a failed end line in run.py's finally block, so the next run opens a new start line and finds the seal.
+    It adopts that seal only for the study tree, protocol and runtime lock that fetched it (H1: freeze_preconditions[8]
+    wants the tree the freeze will pin to fetch), and on any later UTC day (M1: the fetch start is read back from the
+    seal, never matched)."""
+
+    SESSION = "2023-03-01"
+    DAY1, DAY2 = "2026-12-01T00:00:00Z", "2026-12-02T00:00:00Z"
+
+    def setUp(self):
+        self.cal = synth.calendar("2022-06-01", "2023-12-29")
+        self.market = synth.FakeMarket(self.cal)
+        s = self.SESSION
+        daily, prints = issuer_data(self.cal, self.cal.offset(s, -60), self.cal.offset(s, 12), lambda day: 7.25)
+        self.market.add("synthetic", [("2015-01-01", "AAA")], daily=daily, auctions=prints)
+        self.now = [self.DAY1]
+
+    @contextlib.contextmanager
+    def command(self):
+        import run
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.build(tmp, frozen=False)["repo"]
+            with FR.isolated_bytecode(), mock.patch.object(run, "REPO", repo), \
+                    mock.patch.object(run, "transports", lambda *_: transports(self.market)), \
+                    mock.patch.object(run, "clock", lambda: self.now[0]):
+                yield run, repo, Path(tmp)
+
+    def argv(self, root):
+        return ["dry-run", "--sessions", self.SESSION, "--symbols", "AAA", "--snapshot-root", str(root)]
+
+    def fail_after_the_seal(self, run, repo, root) -> str:
+        """The pushed start line, then a run whose output step fails after the seal; returns the sha256 that its
+        failed end line logged (review round 12, F3). Both lines are pushed."""
+        from core import logs
+        from core.params import RUN_LOG
+        from tests import fixture_repo as FR
+        self.assertEqual(run.main(self.argv(root)), 0)
+        FR.commit_push(repo, "2026-10-01T01:00:00+00:00")
+        with mock.patch.object(CO, "dry_run_output", side_effect=RuntimeError("synthetic failure after the seal")), \
+                self.assertRaisesRegex(RuntimeError, "after the seal"):
+            run.main(self.argv(root))
+        line = logs.read_lines(repo / RUN_LOG)[-1]
+        self.assertEqual((line["purpose"], line["status"], len(line["input_snapshot_sha256s"])),
+                         ("dry_run", "failed", 1))
+        FR.commit_push(repo, "2026-10-01T01:05:00+00:00")
+        return line["input_snapshot_sha256s"][0]
+
+    def test_a_seal_left_by_a_failed_run_is_refused_to_another_study_tree(self):
+        """H1: tree A seals and fails after the seal; tree B changes only study/fetch/ (the request plan is the same).
+        At af38dced B adopted A's seal without a request and wrote an output stamped with B's tree, so the F12
+        calibration came from a transport B never ran. Now B is refused, nothing is fetched or written, and B fetches
+        its own snapshot under a new root."""
+        from core.params import DRY_RUN_OUTPUT, STUDY_PATH
+        from tests import fixture_repo as FR
+        with self.command() as (run, repo, tmp):
+            root = tmp / "snap"
+            sealed = self.fail_after_the_seal(run, repo, root)
+            FR.write(repo / STUDY_PATH / "fetch" / "transport.py", "HOST = 'fixture-fixed'\n")
+            FR.commit_push(repo, "2026-10-01T02:00:00+00:00")
+            tree_b = FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
+            self.assertEqual(run.main(self.argv(root)), 0)               # B's start line
+            FR.commit_push(repo, "2026-10-01T02:05:00+00:00")
+            self.assert_refuses_unchanged(root, self.market, lambda: run.main(self.argv(root)))
+            self.assertFalse((repo / DRY_RUN_OUTPUT).exists())
+            FR.commit_push(repo, "2026-10-01T02:10:00+00:00")             # the refused run's failed end line
+            fresh = tmp / "snap-tree-b"
+            self.assertEqual(run.main(self.argv(fresh)), 0)              # a new start line
+            FR.commit_push(repo, "2026-10-01T02:15:00+00:00")
+            calls = len(self.market.calls)
+            self.assertEqual(run.main(self.argv(fresh)), 0)
+            self.assertGreater(len(self.market.calls), calls)            # B's own transport fetched
+            out = json.loads((repo / DRY_RUN_OUTPUT).read_text())
+            self.assertEqual(out["study_tree"], tree_b)
+            self.assertNotEqual(out["snapshot_sha256"], sealed)
+
+    def test_a_seal_left_by_a_failed_run_is_adopted_on_a_later_utc_day(self):
+        """M1: the same tree, protocol and runtime lock retry on the next UTC day and adopt the seal without a request.
+        The output's fetch_utc_start is the first run's start, read back from the seal binding; the end line keeps its
+        own start. At af38dced the fetch date was matched, so this retry was refused for good."""
+        from core import logs
+        from core.params import DRY_RUN_OUTPUT, RUN_LOG
+        from tests import fixture_repo as FR
+        with self.command() as (run, repo, tmp):
+            root = tmp / "snap"
+            sealed = self.fail_after_the_seal(run, repo, root)
+            self.now[0] = self.DAY2
+            self.assertEqual(run.main(self.argv(root)), 0)               # a new start line on the next UTC day
+            FR.commit_push(repo, "2026-10-02T01:00:00+00:00")
+            before, calls = snapshot_bytes(root), len(self.market.calls)
+            self.assertEqual(run.main(self.argv(root)), 0)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(root), before)
+            out = json.loads((repo / DRY_RUN_OUTPUT).read_text())
+            self.assertEqual((out["snapshot_sha256"], out["fetch_utc_start"]), (sealed, self.DAY1))
+            line = logs.read_lines(repo / RUN_LOG)[-1]
+            self.assertEqual((line["purpose"], line["status"], line["input_snapshot_sha256s"], line["utc_start"]),
+                             ("dry_run", "complete", [sealed], self.DAY2))
+
+
 if __name__ == "__main__":
     unittest.main()

From f693df2408c305c2ed79dd9803f5e91a8b2f6028 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Wed, 30 Sep 2026 20:47:51 -0400
Subject: [PATCH 03/15] Mover v3 round 18 repair: seal records and run-identity
 binding for seal recovery

Resolves the round-18 pre-outcome reviews of the two recoverable seals
(count_only.dry_run, transport_check.seal_live_samples), following
core.holdout.collect's identity shape.

- G-H: Store.write(seal_record=True) publishes seal.json once, before the
  ledger. It holds the ledger sha256, the binding, every completion stamp
  [key, attempt, status, pages], every page sha256, and the attempt and
  page counts. core.store.recover_seal reads the ledger under the recorded
  digest, never a digest of the ledger being checked, and the snapshot
  must give the record back exactly. Store.read checks each stamp's page
  count against its page events.
- H1: each seal binds the running study tree, protocol sha256 and
  runtime-lock sha256 (runner.seal_run_identity, validated by
  store.checked_run_identity). The dry-run identity is {study_tree,
  protocol_sha256, runtime_lock_sha256, sessions, symbols, requests}; live
  samples add the same three fields to label, seed, source and requests.
- M1: the dry run's fetch start (utc_start) is bound beside the identity,
  read back into the output as fetch_utc_start, and never matched.
- G-M: separate checks for the identity, the request plan, and the ledger's
  request records against the requests the binding names.
- L1: attempt stamps are compared exactly through the seal record.
- L2: every recovery refusal is a SealError (zlib.error, TypeError,
  AttributeError and OSError included), naming the dry run or the label.
- L3: run-wide changes are sealed into a mixed live root, so each label's
  own refusal is asserted.

Tests: tests/test_seal_recovery.py, 15 new unit cases. The commit-1
command tests now pass. Callers in test_count_only.py and test_fetch.py
pass the run identity. Study suite: Ran 393 tests, OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mover-v3/study/core/count_only.py         |  52 +--
 .../us-equities/mover-v3/study/core/runner.py |   8 +
 .../us-equities/mover-v3/study/core/store.py  | 143 +++++++-
 .../mover-v3/study/core/transport_check.py    |  48 ++-
 blueprints/us-equities/mover-v3/study/run.py  |   9 +-
 .../mover-v3/study/tests/test_count_only.py   |   4 +-
 .../mover-v3/study/tests/test_fetch.py        |  10 +-
 .../study/tests/test_seal_recovery.py         | 342 +++++++++++++++++-
 8 files changed, 528 insertions(+), 88 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/core/count_only.py b/blueprints/us-equities/mover-v3/study/core/count_only.py
index 30d38b8c2..cf778f0dd 100644
--- a/blueprints/us-equities/mover-v3/study/core/count_only.py
+++ b/blueprints/us-equities/mover-v3/study/core/count_only.py
@@ -19,13 +19,13 @@
 from core import formulas as FM
 from core import identity, plan
 from core.calendar import year_of
-from core.canon import dumps, sha256_bytes, sha256_file
+from core.canon import dumps, sha256_bytes
 from core.coverage_rule import (checked_thresholds, fetch_margin, identity_limited, item_rule, probe_decision,
                                 rule_sha256, year_decision)
 from core.fills import fill_at
 from core.params import FETCH, SAMPLING, T
 from core.records import MERGER_TYPES
-from core.store import SealError, Store
+from core.store import Store, checked_run_identity, recover_seal
 from pinned.sessions_io_copy import official_price
 
 PART1_RANGE = ("2016-01-04", "2020-12-31")
@@ -464,33 +464,32 @@ def dry_run_requests(cal, sessions: list, symbols: list) -> list:
     return out
 
 
-def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root, fetch_date: str,
+def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root, utc_start: str, run_identity: dict,
             clock=driver.utc_now, progress: dict | None = None) -> dict:
     """freeze_preconditions: the native dry run through core/driver.py and the transport, sealed, re-read from the
     seal and counted (counts only; run.py dry-run writes the output with its run-log line). progress, when given,
     receives the snapshot sha256 as soon as it is sealed, so a run that fails afterwards still logs it (review round
-    12, F3)."""
+    12, F3).
+
+    A snapshot already sealed under <snapshot_root>/dry-run (a run that failed or was killed after its seal) is
+    adopted without fetching only through core.store.recover_seal (review round 18, R5, and its repair): its seal
+    record verifies the ledger and pages (G-H), and its binding names the running study tree, protocol and runtime
+    lock (run_identity; H1, so a tree whose fetch plumbing never ran cannot take another tree's seal), the sessions,
+    the symbols and the request plan. utc_start, the fetch start, is bound beside that identity and read back from
+    the seal into the output (fetch_utc_start), never matched (M1): a retry on a later UTC day adopts the seal."""
     reqs = dry_run_requests(cal, sessions, symbols)     # refuses before any fetch (review round 11, C1)
-    store, sha = Store(), None
+    if not isinstance(utc_start, str) or not utc_start:
+        raise ValueError("the dry run needs its fetch start (utc_start)")
     root = Path(snapshot_root) / "dry-run"
-    # core.holdout.collect's recover-if-matching pattern (803bc351): validate before adopting a seal or fetching.
-    seal_identity = {"sessions": list(sessions), "symbols": list(symbols), "fetch_date": fetch_date,
-                "requests": sorted(plan.record(r) for r in reqs)}
-    if (root / "ledger.jsonl").exists():
-        sha = sha256_file(root / "ledger.jsonl")
-        try:
-            store = Store.read(root, sha)
-        except (OSError, ValueError, KeyError, EOFError) as exc:
-            raise SealError("dry-run snapshot is invalid or partially written") from exc
-        if store.binding != {"identity": seal_identity}:
-            raise SealError("dry-run snapshot binding differs from the requested dry run")
-        if store.request_records() != seal_identity["requests"] or set(store.state) != set(store.req):
-            raise SealError("dry-run snapshot is partially written: requests or completion stamps differ")
-    elif (root / "pages").exists():
-        raise SealError("dry-run snapshot is partially written: cannot overwrite or fetch it again")
-    if sha is None:
-        driver.stage_fetch(lambda st: reqs, transports, store, fetch_date, clock=clock)
-        sha = store.write(root, binding={"identity": seal_identity})
+    seal_identity = {**checked_run_identity(run_identity), "sessions": list(sessions), "symbols": list(symbols),
+                     "requests": sorted(plan.record(r) for r in reqs)}
+    recovered = recover_seal(root, seal_identity, "dry-run", extra=("utc_start",))
+    if recovered is None:
+        store = Store()
+        driver.stage_fetch(lambda st: reqs, transports, store, utc_start[:10], clock=clock)
+        sha = store.write(root, binding={"identity": seal_identity, "utc_start": utc_start}, seal_record=True)
+    else:
+        sha = recovered[1]
     if progress is not None:
         progress["dry-run"] = sha
     return dry_run_output(snapshot_root, sha, sessions, symbols)
@@ -498,9 +497,12 @@ def dry_run(cal, sessions: list, symbols: list, transports: dict, snapshot_root,
 
 def dry_run_output(snapshot_root, sha: str, sessions: list, symbols: list) -> dict:
     """The dry-run output from its sealed snapshot alone (review round 15, N02 / R14-open-2: run.py dry-run
-    recomputes it to adopt an output that a hard kill left with no run-log line)."""
+    recomputes it to adopt an output that a hard kill left with no run-log line). fetch_utc_start is the fetch start
+    the seal's binding holds (review round 18 repair, M1), provenance metadata rather than market data; None for a
+    seal without one."""
     sealed = Store.read(Path(snapshot_root) / "dry-run", sha)
-    return {"kind": "mover_v3_dry_run_output", "snapshot_sha256": sha, "sessions": list(sessions),
+    return {"kind": "mover_v3_dry_run_output", "snapshot_sha256": sha,
+            "fetch_utc_start": (sealed.binding or {}).get("utc_start"), "sessions": list(sessions),
             "symbols_count": len(symbols), "counts": dry_run_counts(sealed),
             "incomplete_by_kind": sealed.incomplete_by_kind(), "measured": dry_run_measured(sealed)}
 
diff --git a/blueprints/us-equities/mover-v3/study/core/runner.py b/blueprints/us-equities/mover-v3/study/core/runner.py
index 74e6cd408..6b9a521a4 100644
--- a/blueprints/us-equities/mover-v3/study/core/runner.py
+++ b/blueprints/us-equities/mover-v3/study/core/runner.py
@@ -53,6 +53,14 @@ def count_only_dependencies(ctx: dict, protocol: dict, rate: dict, allowance: di
             "rate_limit": dict(rate), "pipeline_allowance": dict(allowance) if allowance is not None else None}
 
 
+def seal_run_identity(ctx: dict) -> dict:
+    """The running study tree, protocol sha256 and runtime-lock sha256 that a recoverable seal binds, as
+    core.holdout.collect's identity does (review round 18 repair, H1): the native dry run's snapshot and each
+    transport-check live sample (core.store.recover_seal)."""
+    return {"study_tree": ctx["tree"], "protocol_sha256": ctx["protocol_sha256"],
+            "runtime_lock_sha256": ctx["runtime_lock_sha256"]}
+
+
 def adopt_uncited_output(out_path, expected: dict, ignore=("code_revision",)) -> str:
     """Review round 15, N02 (R14-open-2): a pre-freeze output that a hard kill left with no run-log line (the process
     died between the output's rename and its line) is adopted, never fetched again: its content must equal the
diff --git a/blueprints/us-equities/mover-v3/study/core/store.py b/blueprints/us-equities/mover-v3/study/core/store.py
index 0520edf47..27f4a17d4 100644
--- a/blueprints/us-equities/mover-v3/study/core/store.py
+++ b/blueprints/us-equities/mover-v3/study/core/store.py
@@ -8,18 +8,32 @@
 latest attempt governs. Legacy records without a duration remain readable but cannot calibrate throughput.
 An optional leading {"event": "snapshot", "binding": {...}} binds a collection seal to its authorization and
 batch inputs, including its original start time, for recovery before the completion logs are written.
+Every completion stamp's page count equals its attempt's page events. Review round 18 repair (G-H): a recoverable
+seal (the native dry run, a transport-check live sample) also publishes its seal record, seal.json, once and before
+the ledger, and recover_seal adopts such a seal only against that record, never against a digest of the ledger it is
+checking.
 """
 from __future__ import annotations
 
 import gzip
 import json
 import os
+import zlib
 from pathlib import Path
 
 from core import records
 from core.canon import dumps, sha256_bytes
 from core.plan import record
 
+SEAL_RECORD = "seal.json"
+SEAL_RECORD_KIND = "mover_v3_seal_record"
+RUN_IDENTITY_KEYS = ("study_tree", "protocol_sha256", "runtime_lock_sha256")
+# review round 18 repair (L2): every way a damaged or partially written snapshot can fail to read: an unreadable path
+# (a directory, a bad gzip header), a truncated or corrupt gzip page, text that is not UTF-8 JSON, a line that is not
+# an object or lacks a field, an unhashable value, or nesting too deep to parse
+READ_ERRORS = (OSError, EOFError, ValueError, KeyError, IndexError, TypeError, AttributeError, RecursionError,
+               zlib.error)
+
 
 class SealError(Exception):
     pass
@@ -30,6 +44,98 @@ def normalized_sha256(parser: str, raw: bytes) -> str:
     return sha256_bytes(dumps(records.normalize_page(parser, raw)).encode("utf-8"))
 
 
+def checked_run_identity(run_identity: dict) -> dict:
+    """The running command's study tree, protocol sha256 and runtime-lock sha256, which a recoverable seal binds like
+    core.holdout.collect's identity (review round 18 repair, H1; core.runner.seal_run_identity builds it from the
+    context). Exactly those three keys, each a non-empty string, so no seal is written or adopted without them."""
+    if not isinstance(run_identity, dict) or sorted(run_identity) != sorted(RUN_IDENTITY_KEYS) or \
+            any(not isinstance(run_identity[k], str) or not run_identity[k] for k in RUN_IDENTITY_KEYS):
+        raise ValueError(f"a recoverable seal binds {', '.join(RUN_IDENTITY_KEYS)}, each a non-empty string")
+    return {k: run_identity[k] for k in RUN_IDENTITY_KEYS}
+
+
+def seal_record_of(store, ledger_sha256: str) -> dict:
+    """The seal record (review round 18 repair, G-H and L1): the ledger's sha256, the binding, every completion stamp
+    in ledger order as [key, attempt, status, page count], every page's sha256, and the attempt and page counts.
+    Store.write(seal_record=True) publishes it once; recover_seal reads the ledger under its ledger_sha256 and
+    requires the snapshot it reads to give this record back exactly."""
+    stamps, pages = [], []
+    for key in sorted(set(store.req) | set(store.state)):
+        for st in store.history.get(key, []) + ([store.state[key]] if key in store.state else []):
+            stamps.append([key, st["attempt"], st["status"], len(st["pages"])])
+            pages.extend(sha256_bytes(raw) for raw in st["pages"])
+    return {"kind": SEAL_RECORD_KIND, "ledger_sha256": ledger_sha256, "binding": store.binding, "stamps": stamps,
+            "attempts": len(stamps), "page_sha256s": pages, "pages": len(pages)}
+
+
+def _publish(directory: Path, name: str, data: bytes) -> None:
+    """canon.atomic_write_results's pattern: an exclusive temporary file, fsync, rename, then the directory's fsync,
+    so a file published first is durable before the next one is renamed into place."""
+    with (directory / f"{name}.tmp").open("xb") as f:
+        f.write(data)
+        f.flush()
+        os.fsync(f.fileno())
+    os.replace(directory / f"{name}.tmp", directory / name)
+    fd = os.open(directory, os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
+    """core.holdout.collect's recover-if-matching pattern for a recoverable seal (count_only.dry_run and
+    transport_check.seal_live_samples; review round 18, R5, and its repair). None when nothing was written under
+    directory: the caller fetches and seals. Otherwise the sealed (store, sha256, binding), only when:
+      - the seal record exists and the ledger reads under the sha256 it recorded at seal time, never under a digest
+        of the ledger being checked (G-H), and the snapshot read gives that record back exactly: its binding, every
+        completion stamp with its attempt, status and page count (L1), every page sha256 and the counts;
+      - the binding holds exactly the identity and `extra` (each a non-empty string the caller reads back and never
+        matches, the dry run's utc_start; M1), and the identity equals `identity` apart from its request plan: the
+        running study tree, protocol and runtime lock (H1) and the caller's inputs;
+      - the bound request plan equals identity["requests"] (the plan-change check), and the ledger's request records
+        are exactly the requests the binding names (G-M), each with its completion stamps.
+    A directory with pages or a seal record but no ledger is partially written. Every refusal is a SealError naming
+    `what` (L2); none fetches or writes."""
+    try:
+        return _recover_seal(Path(directory), identity, tuple(extra))
+    except SealError as exc:
+        raise SealError(f"{what}: {exc}") from exc
+    except READ_ERRORS as exc:
+        raise SealError(f"{what}: the snapshot is invalid or partially written ({type(exc).__name__}: {exc})") \
+            from exc
+
+
+def _recover_seal(d: Path, identity: dict, extra: tuple):
+    if not (d / "ledger.jsonl").exists():
+        if (d / "pages").exists() or (d / SEAL_RECORD).exists():
+            raise SealError("the snapshot is partially written: it cannot be overwritten or fetched again")
+        return None
+    if not (d / SEAL_RECORD).is_file():
+        raise SealError("the snapshot has no seal record, so it cannot be verified and is not adopted")
+    sealed = json.loads((d / SEAL_RECORD).read_bytes())
+    if not isinstance(sealed, dict) or sealed.get("kind") != SEAL_RECORD_KIND:
+        raise SealError("the seal record is invalid")
+    sha = sealed["ledger_sha256"]          # the digest recorded at seal time, never one of the ledger being checked
+    store = Store.read(d, sha)
+    # Store.read checked the ledger against that digest; the snapshot must also give back the rest of the record
+    if seal_record_of(store, sealed["ledger_sha256"]) != sealed:
+        raise SealError("the snapshot differs from its seal record (binding, completion stamps, pages or counts)")
+    binding = store.binding if isinstance(store.binding, dict) else {}
+    bound = binding.get("identity")
+    if sorted(binding) != sorted(("identity",) + extra) or not isinstance(bound, dict) or \
+            any(not isinstance(binding[k], str) or not binding[k] for k in extra):
+        raise SealError("the snapshot binding is missing or malformed")
+    changed = sorted(k for k in set(bound) | set(identity) if k != "requests" and bound.get(k) != identity.get(k))
+    if changed:
+        raise SealError(f"the snapshot was sealed for another {', '.join(changed)}")
+    if bound.get("requests") != identity["requests"]:
+        raise SealError("the snapshot was sealed for another request plan")
+    if store.request_records() != bound["requests"] or set(store.state) != set(store.req):
+        raise SealError("the snapshot's requests or completion stamps differ from the requests its binding names")
+    return store, sha, binding
+
+
 class Store:
     def __init__(self):
         self.req = {}       # key -> request
@@ -111,12 +217,14 @@ def request_records(self) -> list:
         return sorted(record(r) for r in self.req.values())
 
     # ------------------------------------------------------------ disk
-    def write(self, directory, *, binding: dict | None = None) -> str:
+    def write(self, directory, *, binding: dict | None = None, seal_record: bool = False) -> str:
         """Write once; publish the ledger only after all pages. Returns its sha256, which binds every page and
         any supplied authorization identity. Existing sealed or partially written snapshots are never overwritten.
-        Publication follows canon.atomic_write_results's temporary-file, fsync, rename pattern."""
+        Publication follows canon.atomic_write_results's temporary-file, fsync, rename pattern. With seal_record
+        (a recoverable seal; review round 18 repair, G-H), the seal record (seal_record_of) is published once, before
+        the ledger, so every published recoverable ledger has the record that recover_seal verifies it against."""
         d = Path(directory)
-        if (d / "ledger.jsonl").exists():
+        if (d / "ledger.jsonl").exists() or (d / SEAL_RECORD).exists():
             raise SealError("snapshot ledger already exists: cannot overwrite a sealed snapshot")
         try:
             (d / "pages").mkdir(parents=True, exist_ok=False)
@@ -131,17 +239,11 @@ def write(self, directory, *, binding: dict | None = None) -> str:
             for st in self.history.get(key, []) + [self.state[key]]:
                 lines.extend(self._attempt_lines(d, key, req, name, st))
         data = ("\n".join(lines) + "\n").encode("utf-8")
-        with (d / "ledger.jsonl.tmp").open("xb") as f:
-            f.write(data)
-            f.flush()
-            os.fsync(f.fileno())
-        os.replace(d / "ledger.jsonl.tmp", d / "ledger.jsonl")
-        fd = os.open(d, os.O_RDONLY)
-        try:
-            os.fsync(fd)
-        finally:
-            os.close(fd)
-        return sha256_bytes(data)
+        sha = sha256_bytes(data)
+        if seal_record:
+            _publish(d, SEAL_RECORD, (dumps(seal_record_of(self, sha)) + "\n").encode("utf-8"))
+        _publish(d, "ledger.jsonl", data)
+        return sha
 
     @staticmethod
     def _attempt_lines(d, key, req, name, st) -> list:
@@ -165,7 +267,7 @@ def read(cls, directory, expected_sha256: str | None = None) -> "Store":
         data = (d / "ledger.jsonl").read_bytes()
         if expected_sha256 is not None and sha256_bytes(data) != expected_sha256:
             raise SealError("snapshot ledger sha256 differs from the sealed value")
-        store, pages = cls(), {}
+        store, pages, stamped = cls(), {}, {}
         for line in data.decode("utf-8").splitlines():
             if not line.strip():
                 continue   # the ledger of a snapshot that sealed no new request (a later holdout count)
@@ -184,10 +286,21 @@ def read(cls, directory, expected_sha256: str | None = None) -> "Store":
                 pages.setdefault((rec["key"], rec["attempt"]), []).append(raw)
                 store.page_norm.setdefault((rec["key"], rec["attempt"]), []).append(rec.get("normalized_sha256"))
             else:
+                attempt = (rec["key"], rec["attempt"])
+                if attempt in stamped:
+                    raise SealError(f"{rec['key']} attempt {rec['attempt']}: a second completion stamp")
+                stamped[attempt] = rec["pages"]
                 if rec["key"] in store.state:
                     store.history.setdefault(rec["key"], []).append(store.state[rec["key"]])
                 store.state[rec["key"]] = {"status": "complete" if ev == "stamp_complete" else "incomplete",
                                            "pages": pages.get((rec["key"], rec["attempt"]), []),
                                            "vintage": rec["vintage"], "attempt": rec["attempt"], "error": rec["error"],
                                            "elapsed_seconds": rec.get("elapsed_seconds")}
+        # review round 18 repair (G-H): every completion stamp's page count equals its attempt's page events, and every
+        # page event belongs to a stamped attempt (Store.write writes an attempt's pages, then its stamp)
+        for attempt in set(stamped) | set(pages):
+            count = stamped.get(attempt)
+            if type(count) is not int or count != len(pages.get(attempt, [])):
+                raise SealError(f"{attempt[0]} attempt {attempt[1]}: the completion stamp's page count differs from "
+                                "its page events")
         return store
diff --git a/blueprints/us-equities/mover-v3/study/core/transport_check.py b/blueprints/us-equities/mover-v3/study/core/transport_check.py
index a1d0b4875..1f028cf6d 100644
--- a/blueprints/us-equities/mover-v3/study/core/transport_check.py
+++ b/blueprints/us-equities/mover-v3/study/core/transport_check.py
@@ -131,53 +131,51 @@ def reproduction_from_sealed(planner, store, changed_paths: list, fetch_prefix:
     return _combine(out)
 
 
-def seal_live_samples(store, transports, seed, holdout_stores, live_root, clock=None) -> dict:
+def seal_live_samples(store, transports, seed, holdout_stores, live_root, run_identity: dict, clock=None) -> dict:
     """{label: sha256} of each snapshot's sealed live sample. A label whose sample is already sealed under live_root
-    (a run killed after sealing it) is validated and recovered only for the same source and seeded requests,
-    never fetched again, so a sample is drawn at most once."""
+    (a run killed after sealing it) is adopted, never fetched again, so a sample is drawn at most once, and only
+    through core.store.recover_seal (review round 18, R5, and its repair): its seal record verifies the ledger and
+    pages (G-H), and its binding names the running study tree, protocol and runtime lock (run_identity, H1), the
+    label, the seed, the source snapshot and the sample's requests."""
     from pathlib import Path
-    from core.canon import sha256_bytes, sha256_file
-    from core.store import SealError, Store
+    from core.canon import sha256_bytes
+    from core.store import checked_run_identity, recover_seal
+    run = checked_run_identity(run_identity)
     shas = {}
     for label, st in [("stage", store), *holdout_stores]:
         d = Path(live_root) / label
-        # Bind the source's requests and sealed attempts (raw-page digests, not parsed outcomes), as collect's
-        # base_snapshots bind its inputs. Follow core.holdout.collect's recovery pattern at 803bc351.
+        # Bind the source's binding, requests and sealed attempts (raw-page digests, not parsed outcomes), as
+        # collect's base_snapshots bind its inputs. Follow core.holdout.collect's recovery pattern at 803bc351.
         source = {"binding": st.binding, "requests": st.request_records(), "attempts": {
             key: [{**attempt, "pages": [sha256_bytes(raw) for raw in attempt["pages"]]}
                   for attempt in st.history.get(key, []) + [st.state[key]]] for key in sorted(st.req)}}
-        identity = {"label": label, "seed": seed, "source_sha256": sha256_bytes(dumps(source).encode("utf-8")),
+        identity = {**run, "label": label, "seed": seed,
+                    "source_sha256": sha256_bytes(dumps(source).encode("utf-8")),
                     "requests": sorted(record(r) for _, reqs in live_sample(st, seed=seed) for r in reqs)}
-        if (d / "ledger.jsonl").exists():
-            sha = sha256_file(d / "ledger.jsonl")
-            try:
-                live = Store.read(d, sha)
-            except (OSError, ValueError, KeyError, EOFError) as exc:
-                raise SealError("live sample snapshot is invalid or partially written") from exc
-            if live.binding != {"identity": identity}:
-                raise SealError("live sample snapshot binding differs from the source or seeded requests")
-            if live.request_records() != identity["requests"] or set(live.state) != set(live.req):
-                raise SealError("live sample snapshot is partially written: requests or completion stamps differ")
-            shas[label] = sha
-        elif (d / "pages").exists():
-            raise SealError("live sample snapshot is partially written: cannot overwrite or fetch it again")
+        recovered = recover_seal(d, identity, f"live sample {label!r}")
+        if recovered is not None:
+            shas[label] = recovered[1]
         else:
-            shas[label] = fetch_live(st, transports, seed=seed, clock=clock).write(d, binding={"identity": identity})
+            shas[label] = fetch_live(st, transports, seed=seed, clock=clock).write(
+                d, binding={"identity": identity}, seal_record=True)
     return shas
 
 
 def reproduction_check(planner, store, transports, changed_paths: list, fetch_prefix: str, seed: str | None = None,
-                       holdout_stores: tuple = (), live_root=None, clock=None) -> dict:
+                       holdout_stores: tuple = (), live_root=None, clock=None,
+                       run_identity: dict | None = None) -> dict:
     """holdout_stores: [(label, sealed store)] of every sealed holdout snapshot (review round 11, F3), each checked
     by (b) and (c); (a) needs the holdout planners and is a deterministic function of unchanged code. With live_root
-    (run.py transport-check), each live sample is sealed first and the check is computed from the seals."""
+    (run.py transport-check), each live sample is sealed first, bound to run_identity (the running study tree,
+    protocol and runtime lock; required there, review round 18 repair, H1), and the check is computed from the
+    seals."""
     only_fetch = tree_diff_only_under_fetch(changed_paths, fetch_prefix)
     out = {"only_fetch_changed": only_fetch}
     if not only_fetch:
         out["passes"] = False
         return out
     if live_root is not None:
-        shas = seal_live_samples(store, transports, seed, holdout_stores, live_root, clock)
+        shas = seal_live_samples(store, transports, seed, holdout_stores, live_root, run_identity, clock)
         return reproduction_from_sealed(planner, store, changed_paths, fetch_prefix, seed, holdout_stores, live_root,
                                         shas)
     out["plan"] = check_plan(planner, store)
diff --git a/blueprints/us-equities/mover-v3/study/run.py b/blueprints/us-equities/mover-v3/study/run.py
index 6e73ae608..8bf63a34d 100644
--- a/blueprints/us-equities/mover-v3/study/run.py
+++ b/blueprints/us-equities/mover-v3/study/run.py
@@ -203,8 +203,10 @@ def cmd_dry_run(a) -> int:
     tr = transports(ctx["protocol"])                     # the pinned rate limit, before any fetch (C2)
     start, status, digest, out, progress = clock(), "failed", None, None, {}
     try:
-        out = count_only.dry_run(cal, sessions, symbols, tr, a.snapshot_root, start[:10], clock=clock,
-                                 progress=progress)
+        # review round 18 repair (H1, M1): the seal binds this tree, protocol and runtime lock, and keeps the fetch
+        # start beside them, read back (never matched) when a later run adopts the seal
+        out = count_only.dry_run(cal, sessions, symbols, tr, a.snapshot_root, start, runner.seal_run_identity(ctx),
+                                 clock=clock, progress=progress)
         out.update({"study_tree": ctx["tree"], "code_revision": ctx["commit"]})
         digest = atomic_write_results(out_path, out)
         status = "complete"
@@ -274,7 +276,8 @@ def cmd_transport_check(a) -> int:
         # review round 15, N02 (R14-open-2): each live sample is sealed under live_root before the check is computed
         # from the seals, and a sample sealed by a killed run is read, never drawn again
         res = transport_check.reproduction_check(ST.planner(spec), store, tr, changed, "fetch", seed=seed,
-                                                 holdout_stores=hstores, live_root=live_root, clock=clock)
+                                                 holdout_stores=hstores, live_root=live_root, clock=clock,
+                                                 run_identity=runner.seal_run_identity(ctx))
         res.update(meta)
         digest = atomic_write_results(out_path, res)
         status = "complete"
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_count_only.py b/blueprints/us-equities/mover-v3/study/tests/test_count_only.py
index fe31c471c..7e4576090 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_count_only.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_count_only.py
@@ -667,8 +667,10 @@ def test_dry_run_bounds_every_request_reach_not_only_sessions(self):
         self.assertEqual(min(r["params"]["start"][:10] for r in reqs), "2021-01-04")
         with self.assertRaises(ValueError):                          # a mixed list is refused as a whole
             CO.dry_run_requests(cal, [first, "2021-02-01"], ["AAA"])
+        run_identity = {"study_tree": "t", "protocol_sha256": "p", "runtime_lock_sha256": "r"}
         with self.assertRaises(ValueError):                          # dry_run refuses before any fetch
-            CO.dry_run(cal, ["2021-01-04"], ["AAA"], None, "/nonexistent", "2026-09-25", clock=fixed_clock)
+            CO.dry_run(cal, ["2021-01-04"], ["AAA"], None, "/nonexistent", "2026-09-25T00:00:00Z", run_identity,
+                       clock=fixed_clock)
 
     def test_dry_run_command_writes_counts_once_from_an_exposed_window(self):
         import run
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_fetch.py b/blueprints/us-equities/mover-v3/study/tests/test_fetch.py
index 7b1629c7f..f29cda15d 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_fetch.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_fetch.py
@@ -315,9 +315,11 @@ def test_the_live_sample_is_sealed_and_the_check_recomputes_from_the_seals(self)
         a sample already sealed under the live root is read, never drawn again."""
         changed = ["blueprints/us-equities/mover-v3/study/fetch/transport.py"]
         prefix = "blueprints/us-equities/mover-v3/study/fetch"
+        run_identity = {"study_tree": "t", "protocol_sha256": "p", "runtime_lock_sha256": "r"}
         with tempfile.TemporaryDirectory() as live_root:
             res = transport_check.reproduction_check(self.planner, self.sealed, transports(self.m), changed, prefix,
-                                                     seed="s", live_root=live_root, clock=fixed_clock)
+                                                     seed="s", live_root=live_root, clock=fixed_clock,
+                                                     run_identity=run_identity)
             self.assertTrue(res["passes"], res)
             self.assertEqual(sorted(res["live_snapshots"]), ["stage"])
             again = transport_check.reproduction_from_sealed(self.planner, self.sealed, changed, prefix, "s", (),
@@ -325,8 +327,12 @@ def test_the_live_sample_is_sealed_and_the_check_recomputes_from_the_seals(self)
             self.assertEqual(again, res)
             dead = {"data": None, "trading": None}           # no transport: a second draw would fail
             reused = transport_check.reproduction_check(self.planner, self.sealed, dead, changed, prefix, seed="s",
-                                                        live_root=live_root, clock=fixed_clock)
+                                                        live_root=live_root, clock=fixed_clock,
+                                                        run_identity=run_identity)
             self.assertEqual(reused, res)
+            with self.assertRaises(ValueError):              # review round 18 repair (H1): no seal without its tree
+                transport_check.reproduction_check(self.planner, self.sealed, dead, changed, prefix, seed="s",
+                                                   live_root=live_root, clock=fixed_clock)
 
     def test_live_sample_detects_different_rows(self):
         other = synth.FakeMarket(self.cal)
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
index 141d5068d..ac139aa30 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -1,11 +1,16 @@
 """Round 18 R5: extend core.holdout.collect's recovery contract at 803bc351 to
-count_only.dry_run and transport_check.seal_live_samples. Only temporary synthetic
+count_only.dry_run and transport_check.seal_live_samples, and its repair after the
+round-18 pre-outcome reviews (Claude H1, M1, L1-L3; GPT G-H, G-M): both adopt a seal
+only through core.store.recover_seal, against its seal record and a binding that
+names the running study tree, protocol and runtime lock. Only temporary synthetic
 snapshots are read or damaged; every transport uses FakeMarket.
 """
 import contextlib
 import copy
 import gzip
 import json
+import re
+import shutil
 import tempfile
 import unittest
 from pathlib import Path
@@ -13,21 +18,46 @@
 
 from core import count_only as CO
 from core import plan, transport_check
-from core.store import SealError, Store
+from core.canon import dumps, sha256_bytes, sha256_file
+from core.store import SEAL_RECORD, SealError, Store, normalized_sha256
 from tests import synth
 from tests.test_identity import fixed_clock, issuer_data, transports
 
+# the running study tree, protocol and runtime lock (core.runner.seal_run_identity builds it from the context)
+RUN = {"study_tree": "synthetic-tree", "protocol_sha256": "synthetic-protocol", "runtime_lock_sha256": "synthetic-lock"}
+FETCH_CHANGE = "blueprints/us-equities/mover-v3/study/fetch/transport.py"
+FETCH_PREFIX = "blueprints/us-equities/mover-v3/study/fetch"
+
 
 def snapshot_bytes(root):
     return {str(p.relative_to(root)): p.read_bytes() for p in Path(root).rglob("*") if p.is_file()}
 
 
+def ledger_lines(directory) -> list:
+    return [json.loads(line) for line in (Path(directory) / "ledger.jsonl").read_bytes().splitlines() if line.strip()]
+
+
+def write_ledger(directory, lines) -> None:
+    """Rewrite the ledger in Store.write's line format; a str line is written as it is."""
+    text = "\n".join(x if isinstance(x, str) else dumps(x) for x in lines) + "\n"
+    (Path(directory) / "ledger.jsonl").write_bytes(text.encode("utf-8"))
+
+
+def reseal(directory) -> None:
+    """A forger who also rewrites the seal record: its ledger_sha256 becomes the edited ledger's, every other field
+    stays as sealed, so only the checks after the digest can refuse the edit."""
+    path = Path(directory) / SEAL_RECORD
+    record = json.loads(path.read_bytes())
+    record["ledger_sha256"] = sha256_file(Path(directory) / "ledger.jsonl")
+    path.write_bytes((dumps(record) + "\n").encode("utf-8"))
+
+
 class RecoveryChecks:
     """Store.write's write-once rule also forbids fetching again before refusing a used directory."""
 
-    def assert_refuses_unchanged(self, root, market, call):
+    def assert_refuses_unchanged(self, root, market, call, pattern=""):
         before, calls = snapshot_bytes(root), len(market.calls)
-        with self.assertRaises(SealError):
+        with self.assertRaisesRegex(SealError, pattern):
             call()
         self.assertEqual(market.calls[calls:], [], "a used snapshot must not draw provider data again")
         self.assertEqual(snapshot_bytes(root), before)
@@ -45,6 +75,10 @@ def damage_partial(self, directory, kind):
             ledger.write_bytes(b"")
         elif kind == "missing_page":
             next((directory / "pages").iterdir()).unlink()
+        elif kind == "record_only":
+            # the ledger and the pages are gone; the seal record that precedes the ledger is left
+            ledger.unlink()
+            shutil.rmtree(directory / "pages")
 
     def remove_binding(self, directory):
         ledger = directory / "ledger.jsonl"
@@ -55,17 +89,49 @@ def alter_page(self, directory):
         # Keep gzip valid so Store.read must check the sealed page digest/length.
         next((directory / "pages").iterdir()).write_bytes(gzip.compress(b'{"altered":true}', mtime=0))
 
+    def edit_fetch_times(self, directory):
+        """G-H: only the recorded vintages and durations change (dry_run_measured's F12 inputs). The stamps, pages,
+        requests and binding the seal record summarizes stay, so only the ledger digest it holds can refuse this."""
+        lines = ledger_lines(directory)
+        for x in lines:
+            if x["event"].startswith("stamp"):
+                x["vintage"] = "2000-01-01T00:00:00Z"
+                if isinstance(x.get("elapsed_seconds"), (int, float)):
+                    x["elapsed_seconds"] += 1000.0
+        write_ledger(directory, lines)
+
+    def replace_page_and_digests(self, directory, raw=b'{"altered":true}'):
+        """G-H, the GPT review's experiment: the first page is replaced together with its ledger digests (sha256,
+        length, normalized sha256); the binding, requests and stamps are kept, and the seal record is not touched."""
+        directory = Path(directory)
+        lines = ledger_lines(directory)
+        page = next(x for x in lines if x["event"] == "page")
+        parser = next(x["parser"] for x in lines if x["event"] == "request" and x["key"] == page["key"])
+        (directory / page["file"]).write_bytes(gzip.compress(raw, compresslevel=6, mtime=0))
+        page.update(sha256=sha256_bytes(raw), bytes=len(raw), normalized_sha256=normalized_sha256(parser, raw))
+        write_ledger(directory, lines)
+
+    def alter_request(self, directory):
+        """G-M: a persisted request whose parameters change while its key, stamps and pages stay, under the expected
+        binding, with the seal record resealed: only the request-equality check can refuse it."""
+        lines = ledger_lines(directory)
+        req = next(x for x in lines if x["event"] == "request")
+        req["params"] = {**req["params"], "feed": "altered"}
+        write_ledger(directory, lines)
+        reseal(directory)
+
 
 class DryRunSealRecovery(RecoveryChecks, unittest.TestCase):
     def setUp(self):
         self.cal = synth.calendar("2022-06-01", "2023-12-29")
-        self.sessions, self.symbols, self.fetch_date = ["2023-03-01"], ["AAA"], "2026-09-26"
+        self.sessions, self.symbols, self.utc_start = ["2023-03-01"], ["AAA"], "2026-09-26T10:00:00Z"
         self.market = synth.FakeMarket(self.cal)
         daily, prints = issuer_data(self.cal, "2022-06-01", "2023-12-29", lambda day: 7.25)
         self.market.add("synthetic", [("2015-01-01", "AAA")], daily=daily, auctions=prints)
 
     def run_dry(self, root, **overrides):
-        args = {"sessions": self.sessions, "symbols": self.symbols, "fetch_date": self.fetch_date, **overrides}
+        args = {"sessions": self.sessions, "symbols": self.symbols, "utc_start": self.utc_start, "run_identity": RUN,
+                **overrides}
         return CO.dry_run(self.cal, transports=transports(self.market), snapshot_root=root,
                           clock=fixed_clock, **args)
 
@@ -74,6 +140,10 @@ def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
             first_progress, retry_progress = {}, {}
             first = self.run_dry(tmp, progress=first_progress)
             self.assertTrue(self.market.calls)
+            record = json.loads((Path(tmp) / "dry-run" / SEAL_RECORD).read_bytes())
+            self.assertEqual(record["ledger_sha256"], first["snapshot_sha256"])
+            self.assertEqual(record["binding"]["utc_start"], self.utc_start)
+            self.assertEqual(record["binding"]["identity"]["study_tree"], RUN["study_tree"])
             before, calls = snapshot_bytes(tmp), len(self.market.calls)
             self.market.issuers.clear()           # a second draw would return different pages
             retry = self.run_dry(tmp, progress=retry_progress)
@@ -82,6 +152,48 @@ def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
             self.assertEqual(self.market.calls[calls:], [])
             self.assertEqual(snapshot_bytes(tmp), before)
 
+    def test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start(self):
+        """M1: the fetch start changes neither the plan nor the fetch (core/driver.py), so it is bound beside the
+        identity and read back from the seal, never matched. At af38dced the matched fetch date refused this retry
+        for good (and test_mismatched_or_missing_binding_refuses_without_requests asserted that rule)."""
+        with tempfile.TemporaryDirectory() as tmp:
+            first = self.run_dry(tmp)
+            self.assertEqual(first["fetch_utc_start"], self.utc_start)
+            before, calls = snapshot_bytes(tmp), len(self.market.calls)
+            self.market.issuers.clear()
+            retry = self.run_dry(tmp, utc_start="2026-09-28T09:00:00Z")
+            self.assertEqual(retry, first)
+            self.assertEqual(retry["fetch_utc_start"], self.utc_start)
+            self.assertEqual(self.market.calls[calls:], [])
+            self.assertEqual(snapshot_bytes(tmp), before)
+
+    def test_another_study_tree_protocol_or_runtime_lock_refuses(self):
+        """H1: the seal binds the running study tree, protocol sha256 and runtime-lock sha256, so a run from any other
+        one refuses it and must fetch its own (freeze_preconditions[8]); at af38dced the binding held none of them.
+        A dry run without all three refuses before any fetch."""
+        for key in sorted(RUN):
+            with self.subTest(changed=key), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                other = {**RUN, key: "another-" + RUN[key]}
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp, run_identity=other),
+                                              f"^dry-run: the snapshot was sealed for another {key}$")
+        with tempfile.TemporaryDirectory() as tmp:
+            calls = len(self.market.calls)
+            for bad in ({}, {**RUN, "study_tree": ""}, {**RUN, "extra": "x"}, None):
+                with self.subTest(run_identity=bad), self.assertRaises(ValueError):
+                    self.run_dry(tmp, run_identity=bad)
+            self.assertEqual((self.market.calls[calls:], snapshot_bytes(tmp)), ([], {}))
+
+    def test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses(self):
+        """The plan-change check: a plan that differs for the same sessions, symbols and run identity (here one
+        request fewer) refuses the seal."""
+        planned = CO.dry_run_requests
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            with mock.patch.object(CO, "dry_run_requests", lambda *args: planned(*args)[:-1]):
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                              "^dry-run: the snapshot was sealed for another request plan$")
+
     def test_mismatched_or_missing_binding_refuses_without_requests(self):
         changes = ({"sessions": ["2023-03-02"]}, {"symbols": ["BBB"]}, {})
         for change in changes:
@@ -92,7 +204,7 @@ def test_mismatched_or_missing_binding_refuses_without_requests(self):
                 self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp, **change))
 
     def test_partial_snapshot_refuses_without_requests(self):
-        for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page"):
+        for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page", "record_only"):
             with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
                 self.run_dry(tmp)
                 self.damage_partial(Path(tmp) / "dry-run", kind)
@@ -104,6 +216,122 @@ def test_altered_page_refuses_without_requests(self):
             self.alter_page(Path(tmp) / "dry-run")
             self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp))
 
+    def test_a_missing_or_mismatched_seal_record_refuses(self):
+        """G-H: a seal is adopted only against the seal record written once at seal time, so a ledger without one, or
+        with a record that is unreadable or does not match it, refuses."""
+        cases = {"missing": "no seal record", "not_json": "JSONDecodeError", "not_an_object": "seal record is invalid",
+                 "other_digest": "ledger sha256 differs", "other_stamps": "differs from its seal record"}
+        for kind, pattern in cases.items():
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                path = Path(tmp) / "dry-run" / SEAL_RECORD
+                record = json.loads(path.read_bytes())
+                if kind == "missing":
+                    path.unlink()
+                elif kind == "not_json":
+                    path.write_bytes(b"{")
+                elif kind == "not_an_object":
+                    path.write_bytes(b"[]\n")
+                else:
+                    if kind == "other_digest":
+                        record["ledger_sha256"] = "0" * 64
+                    else:
+                        record["stamps"][0][3] += 1
+                    path.write_bytes((dumps(record) + "\n").encode("utf-8"))
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
+
+    def test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record(self):
+        """G-H: an edit that keeps every stamp, page, request and the binding (here the vintages and the durations the
+        F12 calibration reads) is refused only because the ledger must have the digest its seal record holds. At
+        af38dced recovery hashed the edited ledger itself and adopted it."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.edit_fetch_times(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: snapshot ledger sha256 differs from the sealed value$")
+
+    def test_a_page_replaced_with_its_ledger_digests_refuses(self):
+        """G-H, the GPT review's experiment on the dry run: a page replaced together with its ledger digests, with
+        the binding, requests and stamps kept, was adopted at af38dced."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.replace_page_and_digests(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), "ledger sha256 differs")
+
+    def test_a_resealed_request_change_refuses(self):
+        """G-M: a persisted request altered under the expected binding, with the seal record resealed, is refused by
+        the comparison of the ledger's request records with the requests its binding names."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            self.alter_request(Path(tmp) / "dry-run")
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: the snapshot's requests or completion stamps differ")
+
+    def test_a_resealed_stamp_page_count_change_refuses(self):
+        """G-H: Store.read checks every completion stamp's page count against its attempt's page events."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            directory = Path(tmp) / "dry-run"
+            lines = ledger_lines(directory)
+            stamp = next(x for x in lines if x["event"] == "stamp_complete" and x["pages"])
+            stamp["pages"] += 1
+            write_ledger(directory, lines)
+            reseal(directory)
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), "page count differs")
+
+    def test_a_ledger_cut_after_a_refetched_requests_first_stamp_refuses(self):
+        """L1: at af38dced, set(state) == set(req) accepted a ledger cut right after the attempt-0 stamp of a request
+        that was re-fetched (here the last request in key order, complete at attempt 1). The seal record's ledger
+        digest refuses it, and, when the digest is resealed, so does the exact comparison of the attempt stamps."""
+        last = max(CO.dry_run_requests(self.cal, self.sessions, self.symbols), key=lambda r: r["key"])
+
+        def first_attempt(path, p):
+            return path == last["endpoint"] and all(p.get(k) == str(v) for k, v in last["params"].items())
+        for resealed, pattern in ((False, "ledger sha256 differs"), (True, "differs from its seal record")):
+            with self.subTest(resealed=resealed), tempfile.TemporaryDirectory() as tmp:
+                self.market.fail = [(first_attempt, "urlerror", 4)]      # the first call and its 3 retries
+                self.run_dry(tmp)
+                directory = Path(tmp) / "dry-run"
+                lines = ledger_lines(directory)
+                self.assertEqual([(x["attempt"], x["event"]) for x in lines
+                                  if x.get("key") == last["key"] and x["event"].startswith("stamp")],
+                                 [(0, "stamp_incomplete"), (1, "stamp_complete")])
+                cut = next(i for i, x in enumerate(lines)
+                           if x["event"] == "stamp_incomplete" and x["key"] == last["key"])
+                write_ledger(directory, lines[: cut + 1])
+                if resealed:
+                    reseal(directory)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
+
+    def test_unreadable_snapshots_refuse_with_a_seal_error(self):
+        """L2: at af38dced a corrupt gzip page (zlib.error), a ledger line that is not a JSON object (TypeError,
+        AttributeError) and an unreadable ledger (OSError, from sha256_file outside the try) escaped as other
+        exceptions. Each is now a SealError naming the error, with no request and no byte change; the two edited
+        ledgers are resealed so their lines reach the parser."""
+        cases = {"corrupt_page": "decompressing", "list_line": "TypeError", "number_line": "AttributeError",
+                 "ledger_is_a_directory": "IsADirectoryError"}
+        for kind, pattern in cases.items():
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                directory = Path(tmp) / "dry-run"
+                if kind == "corrupt_page":
+                    page = sorted((directory / "pages").iterdir())[0]
+                    good = page.read_bytes()
+                    page.write_bytes(good[:10] + b"\xff" * (len(good) - 18) + good[-8:])
+                elif kind == "ledger_is_a_directory":
+                    (directory / "ledger.jsonl").unlink()
+                    (directory / "ledger.jsonl").mkdir()
+                else:
+                    lines = (directory / "ledger.jsonl").read_text(encoding="utf-8").splitlines()
+                    write_ledger(directory, lines[:-1] + ["[1, 2]" if kind == "list_line" else "7"])
+                    reseal(directory)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
+
+
+# every change that applies to the whole transport-check run rather than to one label's source
+RUN_WIDE = {"seed": {"seed": "another-seed"},
+            **{key: {"run_identity": {**RUN, key: "another-" + value}} for key, value in RUN.items()}}
+
 
 class LiveSampleSealRecovery(RecoveryChecks, unittest.TestCase):
     def setUp(self):
@@ -119,11 +347,21 @@ def setUp(self):
             self.market.add(symbol, [("2015-01-01", symbol)],
                             quotes=[synth.quote(self.cal.at("2023-03-01", "15:55"), 7.2, 7.3)])
 
-    def seal_samples(self, root, seed="synthetic-seed", sources=None):
+    def seal_samples(self, root, seed="synthetic-seed", sources=None, run_identity=RUN):
         sources = self.sources if sources is None else sources
         return transport_check.seal_live_samples(sources["stage"], transports(self.market), seed,
                                                  [("collect-synthetic", sources["collect-synthetic"])],
-                                                 root, clock=fixed_clock)
+                                                 root, run_identity, clock=fixed_clock)
+
+    def seal_mixed(self, root, label, **change):
+        """L3: a live root whose `label` sample is sealed as the test sealed it and every other label under `change`,
+        so a run with `change` adopts the other labels and is refused at `label` itself. At af38dced the holdout
+        label's seed case was refused at 'stage' first and never reached the holdout label."""
+        with tempfile.TemporaryDirectory() as original, tempfile.TemporaryDirectory() as changed:
+            self.seal_samples(original)
+            self.seal_samples(changed, **change)
+            for name in self.sources:
+                shutil.copytree(Path(original if name == label else changed) / name, Path(root) / name)
 
     def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
         with tempfile.TemporaryDirectory() as tmp:
@@ -136,15 +374,26 @@ def test_matching_seal_is_recovered_without_requests_or_byte_changes(self):
             self.assertEqual(self.market.calls[calls:], [])
             self.assertEqual(snapshot_bytes(tmp), before)
 
+    def test_another_seed_study_tree_protocol_or_runtime_lock_refuses_at_each_label(self):
+        """H1 for live samples (each binds the running study tree, protocol and runtime lock) and L3 (a run-wide
+        change is refused at the label under test, which the message names)."""
+        for label in self.sources:
+            for key, change in RUN_WIDE.items():
+                with self.subTest(label=label, changed=key), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_mixed(tmp, label, **change)
+                    self.assert_refuses_unchanged(
+                        tmp, self.market, lambda: self.seal_samples(tmp, **change),
+                        f"^live sample {re.escape(repr(label))}: the snapshot was sealed for another {key}$")
+
     def test_mismatched_or_missing_binding_refuses_without_requests(self):
+        """A change to one label's source (its requests, a page, or only its Store.binding; G-M) or a ledger without
+        its binding refuses at that label."""
         for label in self.sources:
-            for change in ("seed", "source_request", "source_page", "missing_binding"):
+            for change in ("source_request", "source_page", "source_binding", "missing_binding"):
                 with self.subTest(label=label, change=change), tempfile.TemporaryDirectory() as tmp:
                     self.seal_samples(tmp)
-                    sources, seed = copy.deepcopy(self.sources), "synthetic-seed"
-                    if change == "seed":
-                        seed = "different-seed"
-                    elif change == "source_request":
+                    sources = copy.deepcopy(self.sources)
+                    if change == "source_request":
                         req = plan.quote_request("quote_exit", "OTHER", "2023-03-01",
                                                  self.cal.at("2023-03-01", "15:55"), self.cal.close("2023-03-01"))
                         sources[label] = Store()
@@ -152,13 +401,17 @@ def test_mismatched_or_missing_binding_refuses_without_requests(self):
                     elif change == "source_page":
                         state = next(iter(sources[label].state.values()))
                         state["pages"] = [b'{"quotes":{}}']
+                    elif change == "source_binding":
+                        # G-M: only the source's Store.binding changes; its requests and sealed attempts stay
+                        sources[label].binding = {"identity": {"synthetic": "another source binding"}}
                     else:
                         self.remove_binding(Path(tmp) / label)
-                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp, seed, sources))
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp, sources=sources),
+                                                  f"^live sample {re.escape(repr(label))}: ")
 
     def test_partial_snapshot_refuses_without_requests(self):
         for label in self.sources:
-            for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page"):
+            for kind in ("pages_only", "partial_json", "missing_stamp", "empty_ledger", "missing_page", "record_only"):
                 with self.subTest(label=label, kind=kind), tempfile.TemporaryDirectory() as tmp:
                     self.seal_samples(tmp)
                     self.damage_partial(Path(tmp) / label, kind)
@@ -171,6 +424,60 @@ def test_altered_page_refuses_without_requests(self):
                 self.alter_page(Path(tmp) / label)
                 self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp))
 
+    def test_a_missing_seal_record_refuses(self):
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                (Path(tmp) / label / SEAL_RECORD).unlink()
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.seal_samples(tmp), "no seal record")
+
+    def test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record(self):
+        """G-H: the same ledger-only edit as the dry run's, for each label."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.edit_fetch_times(Path(tmp) / label)
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: snapshot ledger sha256 differs from the sealed value$")
+
+    def test_a_resealed_request_change_refuses(self):
+        """G-M: a persisted request altered under the expected binding, with the seal record resealed."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.alter_request(Path(tmp) / label)
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: the snapshot's requests or completion stamps differ")
+
+    def test_a_resealed_live_page_cannot_turn_a_failing_check_into_a_pass(self):
+        """G-H, the GPT review's experiment end to end: the sealed live sample differs from its source, so the check
+        fails; then the live page and its ledger digests are replaced by the source's page, with the binding, requests
+        and stamps kept. At af38dced recovery adopted the edited ledger and the check passed, after one provider call
+        in all. Now the rerun refuses, with no call and no byte change."""
+        s = "2023-03-01"
+        req = plan.quote_request("quote_exit", "AAA", s, self.cal.at(s, "15:55"), self.cal.close(s))
+        market = synth.FakeMarket(self.cal)
+        market.add("AAA", [("2015-01-01", "AAA")], quotes=[synth.quote(self.cal.at(s, "15:55"), 7.1, 7.4)])
+        with tempfile.TemporaryDirectory() as tmp:
+            sealed = Store()
+            synth.put_quotes(sealed, req, "AAA", [synth.quote(self.cal.at(s, "15:55"), 7.2, 7.3)])
+            source = Store.read(Path(tmp) / "source", sealed.write(Path(tmp) / "source"))
+            live_root = Path(tmp) / "live"
+
+            def check():
+                return transport_check.reproduction_check(lambda st: [req], source, transports(market), [FETCH_CHANGE],
+                                                          FETCH_PREFIX, seed="synthetic-seed", live_root=live_root,
+                                                          clock=fixed_clock, run_identity=RUN)
+            first = check()
+            self.assertEqual((first["passes"], first["plan"]["passes"], first["reparse"]["passes"],
+                              first["live"]["passes"], len(market.calls)), (False, True, True, False, 1))
+            self.replace_page_and_digests(live_root / "stage", source.state[req["key"]]["pages"][0])
+            self.assert_refuses_unchanged(live_root, market, check,
+                                          "^live sample 'stage': snapshot ledger sha256 differs from the sealed value$")
+            self.assertEqual(len(market.calls), 1)
+
 
 class DryRunCommandRecovery(RecoveryChecks, unittest.TestCase):
     """Repair of the round-18 reviews (H1, M1) at the command level. A dry run whose output step fails after the seal
@@ -236,7 +543,8 @@ def test_a_seal_left_by_a_failed_run_is_refused_to_another_study_tree(self):
             tree_b = FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
             self.assertEqual(run.main(self.argv(root)), 0)               # B's start line
             FR.commit_push(repo, "2026-10-01T02:05:00+00:00")
-            self.assert_refuses_unchanged(root, self.market, lambda: run.main(self.argv(root)))
+            self.assert_refuses_unchanged(root, self.market, lambda: run.main(self.argv(root)),
+                                          "^dry-run: the snapshot was sealed for another study_tree$")
             self.assertFalse((repo / DRY_RUN_OUTPUT).exists())
             FR.commit_push(repo, "2026-10-01T02:10:00+00:00")             # the refused run's failed end line
             fresh = tmp / "snap-tree-b"

From 5a1d4b0e39d2636fe70f56fd4c376f90c0ec23cd Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Wed, 30 Sep 2026 20:51:17 -0400
Subject: [PATCH 04/15] Mover v3 round 18 repair: protocol text, review record,
 citation and test record

- freeze_preconditions (native dry run) and run_discipline.transport_deviations
  now describe recovery through core.store.recover_seal:
  - verification against the seal record;
  - a binding to the running study tree, protocol sha256 and runtime-lock
    sha256 plus the caller's inputs and request plan;
  - the dry run's fetch start read back as fetch_utc_start, never matched;
  - a new snapshot root for any other tree, protocol or runtime lock.
- review_record: one round-18 entry dated 2026-10-01 for the Claude
  (H1, M1, L1-L5) and GPT (G-H, G-M) reviews. It records the failing-first
  output, the reproduction at af38dced, the mutants with their killing
  tests, the record's limit (a write-once file, not an external anchor),
  what is not changed (holdout.collect; orphan adoption), and the GPT
  review's confirmation of the LPS 2019 and ABJK 2022 sample definitions.
- L4: the round-18 literature entry cites PR #358 (not yet on main),
  7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md.
- L5: draft_tree_at_this_revision, test_record and freeze_acceptance[7]
  name tree 20a3dab800eed4c08e53e259ff061a37b9e3d93e (fetch tree
  unchanged) with 393 tests. test_record.command is the command actually
  run; command_note explains the environment prefix.

The study tree is unchanged by this commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mover-v3/protocol-core-draft.json         | 25 ++++++++++++-------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index c59d2ab44..cd67a22d6 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -583,18 +583,19 @@
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "0e0a53f4cd1cbb2745994acdf0d46ca1f0eb01fb",
+        "tree": "20a3dab800eed4c08e53e259ff061a37b9e3d93e",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
       "runtime": "uv-managed CPython 3.13.15; duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 and their dependencies (study/runtime-requirements.txt)",
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
-        "date": "2026-09-25",
-        "tree": "0e0a53f4cd1cbb2745994acdf0d46ca1f0eb01fb",
+        "date": "2026-10-01",
+        "tree": "20a3dab800eed4c08e53e259ff061a37b9e3d93e",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
-        "command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
-        "tests_run": 329,
+        "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
+        "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
+        "tests_run": 393,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -862,7 +863,7 @@
     "fetch": "Before any outcome of a stage (development, validation, and each holdout 'count' or 'read'), the frozen code fetches every quote window, minute bar, per-event daily bar and official print that stage needs, and for development and validation first the full 2016-2020 screen data (universe_and_identity.request_shapes), under universe_and_identity.asof. Review round 8, R8-1: the request plan (symbols, asof, sessions, stamps, entry, exit, search and backward windows, and the enumeration) is derived by core/plan.py and core/stage.py, in the evaluation tree, only from sealed inputs (the calendar, the enumeration, corporate-action records, decision-time inputs, and the timestamps and eligibility of already sealed quotes); the loop core/driver.py fetches every planned request not yet sealed until the plan adds nothing. study/fetch/ receives one planned request and returns its raw pages; it derives nothing and parses no row. Terminal-search windows of censored trades extend past the segment end (populations.terminal_exits.segment_end), and backward windows follow populations.terminal_exits.booking (R8-7). The result is sealed as a sha256-pinned private snapshot (the ledger's sha256; the ledger holds every page's sha256 and normalized-record sha256), and that sha256 and the stage's fetch-incomplete rate by kind are committed in the run log. At most one re-fetch is allowed: once, of only the fetch-incomplete requests, before any outcome of that stage, followed by fetching any window that only then became plannable, committed the same way. After it, the 1% void rule is final. No outcome is computed from unsealed data.",
     "synthetic_tests": "The evaluator refuses a results file whose run-log entry names a tree other than the pinned one, a holdout count or read from a tree other than the pinned one or a passing transport deviation of it, a transport deviation without a passing reproduction check, a runtime that differs from runtime.lock, an edited (not appended) amendment file, a second results file for a stage, a read retry that chronology.holdout.read_timing does not permit, and an outcome computed before the stage's fetch rate is committed. It accepts a run from a commit reachable from origin/main whose study tree equals the pinned tree, with run-log, access-log and amendment lines committed after the freeze. A test kills a run before its results write and asserts that nothing was written and that the retry reproduces an uninterrupted run byte for byte. The suite is study/tests/, run by study_code.test_command under study/runtime.lock. Review round 9 (F6) adds command-level tests against a temporary repository shaped like this one after the freeze (tests/fixture_repo.py), so no test depends on the real protocol's status or writes to the real run log: every command refusing on a draft, a stage fetched once and evaluated into one results file with a kill after the write, the context refusals (bytecode isolation and ignored files, logs off origin/main, a protocol edited after the freeze, amendment timing, coverage_decision, transport deviations), the count-only command, and the holdout path through collect, count with two extensions and read, with two batches of different enumerations and a rename re-fetch, and the not-read label after the deadline.",
     "pinned_copies": "The study tree imports no module outside itself except the Python standard library, numpy, pandas, exchange_calendars and duckdb (review round 7, F6; review round 8, E1 adds duckdb, which the pinned dedupe_identity needs). It holds byte-for-byte copies of the external definitions it needs, listed in study/pinned_copies.json as (source path, commit aa6fc79, git blob, sha256, definition names): the Bars class and ET, et_epoch, TIME_BUCKETS, PRICE_TIERS, DV_TIERS, time_bucket, price_tier and dv_tier from mover-early-entry rules.py (R8-12); official_price from sessions_io.py; valid_quote from quotes.py; dedupe_identity with DUPLICATE_SERIES_MIN_SESSIONS, DUPLICATE_SERIES_MIN_SPAN_COVERAGE, CONTINUITY_RATIO, _rename_terminus and _components from broad-universe coverage.py; DATA_SYMBOL from collect_daily.py. A synthetic test reads each source with git cat-file at the listed blob, checks the blob hash and sha256, extracts each named definition with ast (decorators included) and asserts that the copy is identical and holds nothing else. Because nothing outside the tree is imported, a later edit to those paths on main cannot reach a run, and no module-level code of rules.py, quotes.py or coverage.py (their fees.json, protocol.json and duckdb-connection code) ever runs.",
-    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is adopted only after Store.read validation and a match of its binding to the label, seed, source snapshot and request plan, never drawn again; a partial, mismatched or altered snapshot refuses (review round 18, R5), and an output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
+    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is never drawn again. It is adopted only through core.store.recover_seal (review round 18, R5, and its repair): its ledger is verified against its seal record, as the dry run's is (freeze_preconditions), and its binding must name the running study tree, protocol sha256 and runtime-lock sha256, the label, the seed, the source snapshot (its binding, requests and sealed attempts) and the request plan. A partial, unrecorded, mismatched or altered snapshot refuses, and an output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
   },
   "leverage_and_exits": "Research runs use 1x equal notional. Paper use of any passing rule follows the README's exit and leverage policy (at most one broker-held closing order per share, the leverage-schedule-v1-20260922 ceiling, and the leverage-ladder gate rows in catalogs/us-equities/gates-20260922.json, one rung at a time). H3-b stays at 1x in any later paper use until the 2x rung and its overnight cap are clean. The edge-shrink term stays 0 until a holdout pass.",
   "freeze_preconditions": [
@@ -874,7 +875,7 @@
     "The Alpaca market-data plan's documented historical-data rate limit recorded with its source, and a request-count fetch-time estimate for development and validation at that limit: the full 2016-2020 screen fetch (sessions x requests per session for the enumerated list) plus the per-event requests for at most 20 x (k + 3 sqrt(k) + 3) candidates per year, where k is that year's sampled candidate count (pre_freeze_access_path.outputs). This candidate bound governs the margin test. The estimate must leave a margin of at least 50% under the 40 sessions before N0 (coverage_rule.thresholds.fetch_margin_min and fetch_estimate, decided by the count-only code, review round 8, R8-9). If it does not, the protocol is not frozen as written. core/count_only.py fetch_estimate computes it (review round 9, M-2): the full 2016-2020 screen requests (sessions x 4 x ceil(enumerated symbols / 100)) plus, per year, candidate_bound(k) x 58 per-event requests (core.plan.per_event_requests_max: 5 per-event requests; per arm one entry window and at most 7 forward exit and 7 rename-sensitivity windows; and 8 backward windows), at the recorded rate limit. Review round 11, C2: the estimate counts requests, not pages; a request of more than one page (an event's minute bars, up to 3 pages) takes one rate slot per page, so the estimate is not a strict upper bound, and the minute-bar pages add little to an estimate dominated by single-page screen requests. The fetch itself is paced at the pinned rate (pre_freeze_access_path.rate_limit). Review round 15, F12: that request-count estimate is replaced by a page-based one at the slower of the pinned rate and the dry run's measured throughput, with the market-data and trading limits pinned separately and pinned retry and evaluation-and-merge allowances (pre_freeze_access_path.pipeline_allowance; coverage_rule.thresholds.fetch_estimate.rule), so the margin gate is applied to budgeted end-to-end time rather than to requests at the rate ceiling; the native dry run therefore comes before the count-only run.",
     "The identity probe (exposure_registry.pre_freeze_access_path.identity_probe) run by committed count-only code, with at least 20 rename probes, at least 95% matches for bars and for auctions and at least 90% for quotes (coverage_rule.thresholds.identity_probe; the count-only code emits the pass or fail, R8-9), no observed ticker-reuse failure (review round 15, N07), and the ticker-reuse result recorded (verified, or unverified for 2016-2020 if no case exists or none is conclusive)",
     "The study tree committed with runtime.lock and synthetic tests that pass under that runtime before any outcome, with 0 skips (run_discipline.study_code.test_command). Done in draft at the revision named by run_discipline.study_code.draft_tree_at_this_revision (test_record); it must be rerun on the tree that the freeze pins. The tests cover: every populations.formulas case, each official-print source label, the exclusion rules, a suspected unadjusted split, the fill-quote cases, the terminal-exit cases, the universe_and_identity cases (FB/META through the pinned dedupe_identity, ticker reuse, rename inside a hold, a split and a rename inside one hold, empty responses, fetch-date asof refused, corporate-action date fields), split, ex-dividend and 5% special-dividend crossings, the 2016-2020 early closes, a calendar and a fee amendment, a 2017 and a 2019 fee lookup with the TAF cap, the fetch-failure cases for every request kind, a dropped middle year, segment-end censoring and the embargo (including none at N0), the independence of validation and the holdout from every development output (H3-c two-sided with no direction lock, validation breakpoints from validation sessions only), the robustness statistics, the gate test, the count_unit keys, the holdout-read classification, the run_discipline refusals and the evaluator's holdout refusals, the access log's authorization and completion records including count and read retries, the net-return formula and the cash band, the in-hold split-record rule, a split on a session with no bar, censored exits searched past a segment end, backward windows, the pinned copies against their blobs, the atomic results write and the read retry, the plan regeneration and reparse checks, and the transport-deviation reproduction check. The code imports no module outside the study tree except the Python standard library, numpy, pandas, exchange_calendars and duckdb, so none of rules.close_hhmm, rules.fee_rates, rules.sell_fees, rules.net_return, rules.net_return_np and quotes.fetch_one can be called, and a test asserts both.",
-    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only. A sealed dry-run snapshot is recovered without fetching only after Store.read validation and a match of its binding to the sessions, symbols, fetch date and request plan; a partial, mismatched or altered snapshot refuses (review round 18, R5).",
+    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only. A sealed dry-run snapshot is recovered without fetching only through core.store.recover_seal (review round 18, R5, and its repair after the round-18 reviews). The ledger is read under the sha256 that its seal record (seal.json, published once before the ledger) recorded at seal time, never under a digest of the ledger being checked, and must give that record back exactly: the binding, every completion stamp with its attempt, status and page count, every page sha256 and the counts. The binding must name the running study tree, protocol sha256 and runtime-lock sha256 (core.runner.seal_run_identity), the sessions, the symbols and the request plan, and the ledger's requests must be the ones it names. The fetch start (utc_start) is bound beside that identity and read back, never matched: a retry on a later UTC day recovers the seal, and the output names that start as fetch_utc_start (provenance metadata from the seal, not market data). A run from another study tree, protocol or runtime lock must fetch its own snapshot under a new snapshot root, so the dry run the freeze relies on was fetched by the tree it names. A partial, unrecorded, mismatched or altered snapshot refuses.",
     "The frozen collector (core/plan.py collection plan and core/driver.py loop over the study/fetch/ transport) committed in the study tree, with its schedule committed and enabled so that the first collection batch covers the session of the freeze (holdout_gate.prospective_collection)",
     "The exposure registry updated with everything the author saw since this draft",
     "status set to frozen, frozen_before_outcomes true, run_discipline.study_code tree and fetch_tree (tree hashes only) and data_file_sha256s filled in, coverage_decision (dropped years and items_tested from the governing count-only output) recorded, and the protocol sha256 recorded in a commit that becomes reachable from origin/main (chronology.holdout.window defines the freeze commit); the study tree was merged to main before the freeze pull request, which does not change it coverage_decision is {dropped_years (integers), items_tested (a boolean), count_only_output: 'blueprints/us-equities/mover-v3/results/count-only-output.json', count_only_output_sha256}. core.runner.context refuses a coverage_decision that is mistyped or differs from that committed output's item_rule (review round 9, F7), and a development or validation run refuses an enumeration file whose sha256 differs from the output's part0.enumeration_sha256. Review round 15, F04: core.runner.check_coverage_decision also refuses unless the governing complete 'count_only' line cites the output and the output's dependency manifest equals the frozen tree, data files, parameters, coverage_rule and rate limit. Review round 15, N02: open_before_first_holdout_count is empty at the freeze. After the freeze neither the protocol nor non-transport code can change, so an entry left there could never be cleared and the first holdout count could never be authorized (core.holdout.authorize refuses while it holds one).",
@@ -1160,8 +1161,14 @@
     {
       "date": "2026-09-26",
       "round": 18,
-      "input": "Literature correction from a live GPT-6 academic-paper sweep for strategy-research (25 verified papers; evidence/artifacts/trading-convergence-20260926/papers-strategy.md): item_set.items[4].why_kept described the LPS 2019 and ABJK 2022 samples together as 'large, liquid names'.",
+      "input": "Literature correction from a live GPT-6 academic-paper sweep for strategy-research (25 verified papers; PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md): item_set.items[4].why_kept described the LPS 2019 and ABJK 2022 samples together as 'large, liquid names'.",
       "resolution": "Re-verified by the coordinator from the manuscripts. ABJK 2022 (JFE 145(3), September 2021 manuscript): CRSP share codes 10 and 11 on NYSE, AMEX and NASDAQ, excluding financial and utility firms and firm-months with a previous month-end price at or below one dollar, May 1993 to December 2017; the high-minus-low hedge return is significant for all but the largest size decile. LPS 2019 (LSE accepted version, eprints.lse.ac.uk/87481): microcaps, i.e. a price below $5 or the bottom NYSE size quintile, are always excluded, and the open is the first-half-hour VWAP from TAQ. The sentence now states each sample separately and that the official-print diagnostic is not an exact replication of LPS's VWAP open. Rule impact: none; the test stays two-sided at every stage and no arm, horizon, threshold or code changes."
+    },
+    {
+      "date": "2026-10-01",
+      "round": 18,
+      "input": "Independent pre-outcome reviews of PR #360 (round 18 at af38dced). Claude Opus (2026-09-30): H1 (high), the dry-run seal binding had no study tree. A tree whose change lies outside the plan code (study/fetch/, core/driver.py) adopted, without a request, the seal that a failed run of another tree left. run.py's finally block writes a failed end line, so the next run opens a new start line. The output and run-log line then named the new tree although its transport never ran, so the F12 calibration could come from another tree's transport (freeze_preconditions[8] wants the tree the freeze pins to fetch). M1 (medium): the matched identity held the current run's fetch date, which changes neither the plan nor the fetch, so a retry on a later UTC day was refused for good, and the round-18 test asserted that rule. Lows: L1, a ledger cut after the attempt-0 stamp of a re-fetched request passed set(state) == set(req); L2, zlib.error, TypeError, AttributeError and an OSError outside the try escaped the SealError wrapping; L3, the holdout label's seed case was refused at 'stage' first; L4, the literature entry cited a path that exists only on PR #358's branch; L5, the draft tree and test record were stale. GPT-6.1 Sol (native Codex 0.159.2, effort ultra, 2026-10-01): G-H (high), recovery read each seal under a sha256 computed from the ledger being checked, so a page replaced together with its ledger digests was adopted and turned a failing transport check into a pass after one provider call. G-M (medium): removing the request-record comparisons, or the source binding from the live-sample source digest, left every recovery test passing.",
+      "resolution": "core/store.py: Store.write(seal_record=True) publishes a seal record (seal.json) once, before the ledger. It holds the ledger sha256, the binding, every completion stamp as [key, attempt, status, pages], every page sha256, and the attempt and page counts. core.store.recover_seal is the only recovery path of count_only.dry_run and transport_check.seal_live_samples. It reads the ledger under the recorded sha256 (G-H) and requires the snapshot to give the record back exactly, which compares the attempt stamps exactly (L1). It then checks, separately, the identity, the request plan, and the ledger's request records against the requests the binding names (G-M). Store.read checks every completion stamp's page count against its attempt's page events, and every refusal is a SealError naming the dry run or the live-sample label (L2). The dry-run identity is {study_tree, protocol_sha256, runtime_lock_sha256, sessions, symbols, requests}, with the first three from core.runner.seal_run_identity (H1). Its fetch start (utc_start) is bound beside the identity, read back into the output as fetch_utc_start and never matched (M1). Each live sample adds the same three to its label, seed, source digest (binding, requests, attempts) and requests. Limit: the seal record is a write-once file in the snapshot directory, not an external anchor. While the record is untouched, it refuses a page replaced with its ledger digests, a cut ledger and a ledger whose durations or vintages changed. A rewrite of both the ledger and the record is refused only by the binding, plan and request checks. Not changed: core.holdout.collect still reads its seal under a digest of its own ledger, and orphan-output adoption reads seals under the sha256 the uncited output names. Tests in tests/test_seal_recovery.py: two command-level regressions written first. At af38dced the H1 case fails with 'AssertionError: SealError not raised' and the M1 case errors with 'SealError: dry-run snapshot binding differs from the requested dry run' (Ran 10 tests, FAILED (failures=1, errors=1)). Fifteen unit cases. For the dry run: a later-day retry; another study tree, protocol or runtime lock; a changed plan for the same sessions and symbols; a missing or mismatched seal record; a ledger with altered fetch times; a page replaced with its ledger digests; a resealed request change; a resealed stamp page count; a ledger cut after a re-fetched request's first stamp; unreadable snapshots. For the live samples: run-wide changes sealed into a mixed root, so that each label's own refusal is asserted (L3); a missing seal record; altered fetch times; a resealed request change; and the GPT experiment end to end through reproduction_check. Reproduced directly at af38dced (not committed): passes false, then true after the page and digest replacement, with 1 provider call in all; an edited duration accepted (measured elapsed 0.002 s to 16000.002 s); the cut ledger accepted; zlib.error, AttributeError and IsADirectoryError escaping. At the repair each refuses as a SealError. Mutants, each killed by its named test: study_tree removed from the dry-run identity (test_another_study_tree_protocol_or_runtime_lock_refuses and the command-level H1 test); the fetch date matched again (test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start and the command-level M1 test); the plan-change check removed (test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses); the request-equality check removed (test_a_resealed_request_change_refuses, dry run and live samples); recovery hashing the current ledger instead of the seal record (test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record, dry run and live samples); the source binding omitted from the live digest (test_mismatched_or_missing_binding_refuses_without_requests, change source_binding). L4: the round-18 literature entry cites PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md; the merge order is the coordinator's decision. L5: run_discipline.study_code.draft_tree_at_this_revision and test_record name the repaired tree 20a3dab800eed4c08e53e259ff061a37b9e3d93e and 393 tests. The GPT review also confirmed, against the primary manuscripts, the LPS 2019 (eprints.lse.ac.uk/87481, section 3, pp. 9-10) and ABJK 2022 (September 2021 manuscript, section 3, p. 10 and section 4.2.2, p. 18) sample definitions that the round-18 literature correction states. Protocol: the dry-run sentence of freeze_preconditions and run_discipline.transport_deviations. Study suite: 393 tests OK. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1216,7 +1223,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 329 tests, 0 failures, 0 errors, 0 skips at draft tree 0e0a53f4cd1cbb2745994acdf0d46ca1f0eb01fb (2026-09-25); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 393 tests, 0 failures, 0 errors, 0 skips at draft tree 20a3dab800eed4c08e53e259ff061a37b9e3d93e (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,

From 1e3fd5a1877dc724059e9b2480461d1a83293164 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Wed, 30 Sep 2026 22:03:19 -0400
Subject: [PATCH 05/15] Mover v3 round 18 repair follow-up: per-page
 seal-record regression, qualified recovery rules, review record

An independent verification of the round-18 repair passed it with five low
findings; four are repaired. The fourth, a stray git-ignored scripts/__pycache__
in the review worktree, was deleted and changes no tracked file.

- Protocol: the dry-run sentence of freeze_preconditions and
  run_discipline.transport_deviations no longer say that an altered snapshot
  refuses outright. A snapshot without its seal record is refused, and a
  partial, unbound, mismatched or altered one is refused when its seal.json is
  intact. seal.json is a write-once record inside the snapshot directory, not
  an external anchor: a consistent rewrite of both the ledger and seal.json
  that keeps the binding, the request plan and the requests is adopted.
- tests/test_seal_recovery.py: test_a_resealed_page_replacement_refuses (dry
  run, and each live-sample label) replaces a page with its ledger digests and
  reseals only ledger_sha256 in seal.json. It asserts 'the snapshot differs
  from its seal record', no transport call and unchanged bytes. The probe
  mutant that empties page_sha256s in core.store.seal_record_of passed all 393
  tests at 5a1d4b0e; it now fails this test's three cases and nothing else
  (Ran 395 tests, FAILED (failures=3)).
- review_record, round-18 repair entry: one sentence names the three diff
  items it omitted (test_record.command with its command_note, Store.read's
  second-stamp refusal for every snapshot type, Store.write's refusal of a
  directory holding seal.json). Three residuals are recorded: the seal.json
  limit; core.holdout.collect reading its seal under a digest of its own ledger
  (predates this round); orphan-output adoption verifying seals against the
  sha256 values the output body names, not seal.json.
- run_discipline.study_code.draft_tree_at_this_revision, test_record and the
  freeze_acceptance evidence name the new study tree
  6cb88f03b45fad24f0fb95568b21e2834b9cdc17 and 395 tests (fetch tree
  f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb unchanged).

Study suite: Ran 395 tests, OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mover-v3/protocol-core-draft.json         | 14 +++++------
 .../study/tests/test_seal_recovery.py         | 25 +++++++++++++++++++
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index cd67a22d6..ab4b634a0 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -583,7 +583,7 @@
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "20a3dab800eed4c08e53e259ff061a37b9e3d93e",
+        "tree": "6cb88f03b45fad24f0fb95568b21e2834b9cdc17",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
@@ -591,11 +591,11 @@
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
         "date": "2026-10-01",
-        "tree": "20a3dab800eed4c08e53e259ff061a37b9e3d93e",
+        "tree": "6cb88f03b45fad24f0fb95568b21e2834b9cdc17",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
         "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
         "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
-        "tests_run": 393,
+        "tests_run": 395,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -863,7 +863,7 @@
     "fetch": "Before any outcome of a stage (development, validation, and each holdout 'count' or 'read'), the frozen code fetches every quote window, minute bar, per-event daily bar and official print that stage needs, and for development and validation first the full 2016-2020 screen data (universe_and_identity.request_shapes), under universe_and_identity.asof. Review round 8, R8-1: the request plan (symbols, asof, sessions, stamps, entry, exit, search and backward windows, and the enumeration) is derived by core/plan.py and core/stage.py, in the evaluation tree, only from sealed inputs (the calendar, the enumeration, corporate-action records, decision-time inputs, and the timestamps and eligibility of already sealed quotes); the loop core/driver.py fetches every planned request not yet sealed until the plan adds nothing. study/fetch/ receives one planned request and returns its raw pages; it derives nothing and parses no row. Terminal-search windows of censored trades extend past the segment end (populations.terminal_exits.segment_end), and backward windows follow populations.terminal_exits.booking (R8-7). The result is sealed as a sha256-pinned private snapshot (the ledger's sha256; the ledger holds every page's sha256 and normalized-record sha256), and that sha256 and the stage's fetch-incomplete rate by kind are committed in the run log. At most one re-fetch is allowed: once, of only the fetch-incomplete requests, before any outcome of that stage, followed by fetching any window that only then became plannable, committed the same way. After it, the 1% void rule is final. No outcome is computed from unsealed data.",
     "synthetic_tests": "The evaluator refuses a results file whose run-log entry names a tree other than the pinned one, a holdout count or read from a tree other than the pinned one or a passing transport deviation of it, a transport deviation without a passing reproduction check, a runtime that differs from runtime.lock, an edited (not appended) amendment file, a second results file for a stage, a read retry that chronology.holdout.read_timing does not permit, and an outcome computed before the stage's fetch rate is committed. It accepts a run from a commit reachable from origin/main whose study tree equals the pinned tree, with run-log, access-log and amendment lines committed after the freeze. A test kills a run before its results write and asserts that nothing was written and that the retry reproduces an uninterrupted run byte for byte. The suite is study/tests/, run by study_code.test_command under study/runtime.lock. Review round 9 (F6) adds command-level tests against a temporary repository shaped like this one after the freeze (tests/fixture_repo.py), so no test depends on the real protocol's status or writes to the real run log: every command refusing on a draft, a stage fetched once and evaluated into one results file with a kill after the write, the context refusals (bytecode isolation and ignored files, logs off origin/main, a protocol edited after the freeze, amendment timing, coverage_decision, transport deviations), the count-only command, and the holdout path through collect, count with two extensions and read, with two batches of different enumerations and a rename re-fetch, and the not-read label after the deadline.",
     "pinned_copies": "The study tree imports no module outside itself except the Python standard library, numpy, pandas, exchange_calendars and duckdb (review round 7, F6; review round 8, E1 adds duckdb, which the pinned dedupe_identity needs). It holds byte-for-byte copies of the external definitions it needs, listed in study/pinned_copies.json as (source path, commit aa6fc79, git blob, sha256, definition names): the Bars class and ET, et_epoch, TIME_BUCKETS, PRICE_TIERS, DV_TIERS, time_bucket, price_tier and dv_tier from mover-early-entry rules.py (R8-12); official_price from sessions_io.py; valid_quote from quotes.py; dedupe_identity with DUPLICATE_SERIES_MIN_SESSIONS, DUPLICATE_SERIES_MIN_SPAN_COVERAGE, CONTINUITY_RATIO, _rename_terminus and _components from broad-universe coverage.py; DATA_SYMBOL from collect_daily.py. A synthetic test reads each source with git cat-file at the listed blob, checks the blob hash and sha256, extracts each named definition with ast (decorators included) and asserts that the copy is identical and holds nothing else. Because nothing outside the tree is imported, a later edit to those paths on main cannot reach a run, and no module-level code of rules.py, quotes.py or coverage.py (their fees.json, protocol.json and duckdb-connection code) ever runs.",
-    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is never drawn again. It is adopted only through core.store.recover_seal (review round 18, R5, and its repair): its ledger is verified against its seal record, as the dry run's is (freeze_preconditions), and its binding must name the running study tree, protocol sha256 and runtime-lock sha256, the label, the seed, the source snapshot (its binding, requests and sealed attempts) and the request plan. A partial, unrecorded, mismatched or altered snapshot refuses, and an output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
+    "transport_deviations": "The fetch transport must work against a live API for 12-18 months (review round 7, C2). Review round 8, R8-1: study/fetch/ holds only the transport (HTTP client, host, endpoint path, authentication header, pagination and retry); the request plan, the stamps and windows, the enumeration, response parsing and row filtering are evaluation code outside it, so no change under study/fetch/ can change a request, a stamp, a window, the parsing or the evaluation. It can change which bytes arrive (review round 11, F3: the child process returns raw pages that the parent parses), which the reproduction check below bounds by sampling and does not exclude. A deviation that changes only files under study/fetch/ is a transport deviation. Before any run from the new tree, it passes a committed reproduction check against the most recently sealed snapshot of each request kind that exists (or the snapshot of the pre-freeze native dry run, freeze_preconditions): (a) the new tree regenerates the request plan from the sealed inputs and its canonical request records equal the sealed request records byte for byte; (b) every sealed raw page, re-parsed offline, gives byte-identical normalized records (its sealed normalized_sha256), for every page, not a sample; (c) the new transport re-requests the first 200 requests of each kind, in sha256 order of their request records, and their merged normalized records equal the sealed ones (core/transport_check.py). The result is committed in deviations.json with the deviation. A passing transport deviation may govern every later fetch, collection batch, count and read, whose results carry the qualifier 'transport-deviation'. A deviation that touches any file outside study/fetch/, or fails the check, is an ordinary deviation (deviations). Limitation: a change of the provider's response format needs a parser change outside study/fetch/, which is an ordinary deviation. If no passing transport deviation restores collection or fetching in time, the affected sessions are late-collected (holdout_gate.prospective_collection) or the read misses its deadline, and chronology.holdout.read_timing applies. Record format (review round 9, H-2): deviations.json is {\"deviations\": [...]}, and a transport deviation carries number, kind 'transport', cause, diff_reference, new_tree, new_fetch_tree, affected_stages and transport_check (the reproduction check's result, with passes). core.guards.check_study_tree accepts a running tree other than the pinned one only when a committed entry names it as new_tree and the running study/fetch/ tree as new_fetch_tree, its transport_check passed, and the pinned tree and it differ only in paths under fetch/. Every result from it carries 'transport-deviation'. Review round 10, H1 and F6: the reproduction check runs only as run.py transport-check from the new tree (which may differ from the pinned tree only under fetch/), against a development or validation snapshot sealed by that stage's logged fetch (it holds every screen and per-event request kind). It writes results/transport-check-<first 12 characters of the new tree>.json with a 'transport_check' run-log line. transport_check in the deviation must carry passes, output_path and output_sha256, and core.guards.check_study_tree accepts the deviation only when that committed output says passes for the new tree and a complete run-log line from the new tree wrote it; a self-declared passes: true is refused. Because the transport runs in a child process that returns raw bytes only, a change under fetch/ cannot alter planning, parsing, seeds, statistics or labels, and (a) and (b) need no rerun at run time: they are deterministic functions of unchanged code and sealed bytes, bound by the output's hash. Limitation: (c) keeps the fixed sample of the first 200 requests per kind in sha256 order of their request records. Any committed rule is known in advance, and an unpredictable sample could not be reproduced, so a transport written to alter only unsampled responses is not caught by (c). A stage snapshot holds no enumeration request (assets and corporate actions come from the count-only part 0 and the collection batches), so transport-check does not re-request those kinds, and a change that alters only them is not caught by (c). Review round 11, F3: (c) samples 200 requests per kind in sha256 order of the seed followed by the request record, where the seed is the id of the first origin/main commit holding the new tree, a signed merge made after the transport was written, so the sample cannot be known when the transport is written. transport-check also runs (b) and (c) against every sealed holdout snapshot (collection batches and count and read snapshots) and refuses without --holdout-root once one exists; (a) is not rerun for them, since it is a deterministic function of the unchanged plan code. Development is evaluated only after validation's fetch line is on origin/main, which closes the window between development results and the validation fetch. A holdout read under a passing transport deviation may support a claim, with the qualifier 'transport-deviation'. Limitation: a transport that alters responses of unsampled requests only is still not caught, now with a probability set by the unpredictable sample. Review round 15, N02 (R14-open-2): run.py transport-check seals each live sample (c) under <snapshot root>/transport-check-<tree>-live/<label> before it computes the check from the seals (core.transport_check.seal_live_samples and reproduction_from_sealed), and the output names each sample's sha256 (live_snapshots). A sample already sealed there by a killed run is never drawn again. It is adopted only through core.store.recover_seal (review round 18, R5, and its repair): its ledger is verified against its seal record, as the dry run's is (freeze_preconditions), and its binding must name the running study tree, protocol sha256 and runtime-lock sha256, the label, the seed, the source snapshot (its binding, requests and sealed attempts) and the request plan. A snapshot without its seal record is refused, and a partial, unbound, mismatched or altered one is refused when its seal.json is intact. seal.json is a write-once record inside the snapshot directory, not an external anchor: a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted (a residual recorded in review_record, round 18). An output that a hard kill left with no run-log line is adopted only if it equals the check recomputed from the seals."
   },
   "leverage_and_exits": "Research runs use 1x equal notional. Paper use of any passing rule follows the README's exit and leverage policy (at most one broker-held closing order per share, the leverage-schedule-v1-20260922 ceiling, and the leverage-ladder gate rows in catalogs/us-equities/gates-20260922.json, one rung at a time). H3-b stays at 1x in any later paper use until the 2x rung and its overnight cap are clean. The edge-shrink term stays 0 until a holdout pass.",
   "freeze_preconditions": [
@@ -875,7 +875,7 @@
     "The Alpaca market-data plan's documented historical-data rate limit recorded with its source, and a request-count fetch-time estimate for development and validation at that limit: the full 2016-2020 screen fetch (sessions x requests per session for the enumerated list) plus the per-event requests for at most 20 x (k + 3 sqrt(k) + 3) candidates per year, where k is that year's sampled candidate count (pre_freeze_access_path.outputs). This candidate bound governs the margin test. The estimate must leave a margin of at least 50% under the 40 sessions before N0 (coverage_rule.thresholds.fetch_margin_min and fetch_estimate, decided by the count-only code, review round 8, R8-9). If it does not, the protocol is not frozen as written. core/count_only.py fetch_estimate computes it (review round 9, M-2): the full 2016-2020 screen requests (sessions x 4 x ceil(enumerated symbols / 100)) plus, per year, candidate_bound(k) x 58 per-event requests (core.plan.per_event_requests_max: 5 per-event requests; per arm one entry window and at most 7 forward exit and 7 rename-sensitivity windows; and 8 backward windows), at the recorded rate limit. Review round 11, C2: the estimate counts requests, not pages; a request of more than one page (an event's minute bars, up to 3 pages) takes one rate slot per page, so the estimate is not a strict upper bound, and the minute-bar pages add little to an estimate dominated by single-page screen requests. The fetch itself is paced at the pinned rate (pre_freeze_access_path.rate_limit). Review round 15, F12: that request-count estimate is replaced by a page-based one at the slower of the pinned rate and the dry run's measured throughput, with the market-data and trading limits pinned separately and pinned retry and evaluation-and-merge allowances (pre_freeze_access_path.pipeline_allowance; coverage_rule.thresholds.fetch_estimate.rule), so the margin gate is applied to budgeted end-to-end time rather than to requests at the rate ceiling; the native dry run therefore comes before the count-only run.",
     "The identity probe (exposure_registry.pre_freeze_access_path.identity_probe) run by committed count-only code, with at least 20 rename probes, at least 95% matches for bars and for auctions and at least 90% for quotes (coverage_rule.thresholds.identity_probe; the count-only code emits the pass or fail, R8-9), no observed ticker-reuse failure (review round 15, N07), and the ticker-reuse result recorded (verified, or unverified for 2016-2020 if no case exists or none is conclusive)",
     "The study tree committed with runtime.lock and synthetic tests that pass under that runtime before any outcome, with 0 skips (run_discipline.study_code.test_command). Done in draft at the revision named by run_discipline.study_code.draft_tree_at_this_revision (test_record); it must be rerun on the tree that the freeze pins. The tests cover: every populations.formulas case, each official-print source label, the exclusion rules, a suspected unadjusted split, the fill-quote cases, the terminal-exit cases, the universe_and_identity cases (FB/META through the pinned dedupe_identity, ticker reuse, rename inside a hold, a split and a rename inside one hold, empty responses, fetch-date asof refused, corporate-action date fields), split, ex-dividend and 5% special-dividend crossings, the 2016-2020 early closes, a calendar and a fee amendment, a 2017 and a 2019 fee lookup with the TAF cap, the fetch-failure cases for every request kind, a dropped middle year, segment-end censoring and the embargo (including none at N0), the independence of validation and the holdout from every development output (H3-c two-sided with no direction lock, validation breakpoints from validation sessions only), the robustness statistics, the gate test, the count_unit keys, the holdout-read classification, the run_discipline refusals and the evaluator's holdout refusals, the access log's authorization and completion records including count and read retries, the net-return formula and the cash band, the in-hold split-record rule, a split on a session with no bar, censored exits searched past a segment end, backward windows, the pinned copies against their blobs, the atomic results write and the read retry, the plan regeneration and reparse checks, and the transport-deviation reproduction check. The code imports no module outside the study tree except the Python standard library, numpy, pandas, exchange_calendars and duckdb, so none of rules.close_hhmm, rules.fee_rates, rules.sell_fees, rules.net_return, rules.net_return_np and quotes.fetch_one can be called, and a test asserts both.",
-    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only. A sealed dry-run snapshot is recovered without fetching only through core.store.recover_seal (review round 18, R5, and its repair after the round-18 reviews). The ledger is read under the sha256 that its seal record (seal.json, published once before the ledger) recorded at seal time, never under a digest of the ledger being checked, and must give that record back exactly: the binding, every completion stamp with its attempt, status and page count, every page sha256 and the counts. The binding must name the running study tree, protocol sha256 and runtime-lock sha256 (core.runner.seal_run_identity), the sessions, the symbols and the request plan, and the ledger's requests must be the ones it names. The fetch start (utc_start) is bound beside that identity and read back, never matched: a retry on a later UTC day recovers the seal, and the output names that start as fetch_utc_start (provenance metadata from the seal, not market data). A run from another study tree, protocol or runtime lock must fetch its own snapshot under a new snapshot root, so the dry run the freeze relies on was fetched by the tree it names. A partial, unrecorded, mismatched or altered snapshot refuses.",
+    "A native dry run of the frozen study tree's fetch and evaluation plumbing (review round 8, E4): the tree that the freeze will pin fetches, through core/driver.py and study/fetch/, the screen, per-event daily and minute bars with pagination, auctions and quote windows (entry, exit and search, with prevailing-quote lookback) for a few sessions of an already exposed window outside every v3 stage (for example 2023 sessions of v1/v2 development), with asof = the session. It emits only request, page, empty-response, fetch-incomplete and record-format counts (core/count_only.py dry_run_requests and dry_run_counts), never a price, spread, return or event list, and is logged in exposure_registry. Its sealed snapshot may serve the transport reproduction check until a stage snapshot exists. In code (review round 10, F6): run.py dry-run --sessions --symbols --snapshot-root, pre-freeze, from committed files on origin/main; its sessions lie in 2021-01-04 .. 2024-10-17, so every window, the E+1 .. E+5 search windows included, ends before the holdout breakpoint screen starts on 2024-11-01. Review round 11, C1: that session bound is necessary, not sufficient, because a session's lookbacks reach back (per-event daily bars from t-60, auctions from t-22, minute bars from 04:00 ET of t-19, the screen from s-1). core.count_only.check_dry_run_reach therefore refuses the whole plan unless every planned request starts on or after 2021-01-04 and ends on or before 2024-10-31, so the earliest allowed session is the 60th session after 2021-01-04 (about 2021-03-31); a session such as 2021-01-04 would read v3 validation data before the freeze, which exposure_registry.update_rule forbids. run.py dry-run checks this before any fetch or run-log line. It plans the screen, the per-event requests, the b_lane entry window and every forward exit window (W0 with the prevailing-quote lookback, W1 and E+1 .. E+5), writes results/dry-run-output.json once with its run-log line, and emits counts only. A sealed dry-run snapshot is recovered without fetching only through core.store.recover_seal (review round 18, R5, and its repair after the round-18 reviews). The ledger is read under the sha256 that its seal record (seal.json, published once before the ledger) recorded at seal time, never under a digest of the ledger being checked, and must give that record back exactly: the binding, every completion stamp with its attempt, status and page count, every page sha256 and the counts. The binding must name the running study tree, protocol sha256 and runtime-lock sha256 (core.runner.seal_run_identity), the sessions, the symbols and the request plan, and the ledger's requests must be the ones it names. The fetch start (utc_start) is bound beside that identity and read back, never matched: a retry on a later UTC day recovers the seal, and the output names that start as fetch_utc_start (provenance metadata from the seal, not market data). A run from another study tree, protocol or runtime lock must fetch its own snapshot under a new snapshot root, so the dry run the freeze relies on was fetched by the tree it names. A snapshot without its seal record is refused, and a partial, unbound, mismatched or altered one is refused when its seal.json is intact. seal.json is a write-once record inside the snapshot directory, not an external anchor: a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted (a residual recorded in review_record, round 18).",
     "The frozen collector (core/plan.py collection plan and core/driver.py loop over the study/fetch/ transport) committed in the study tree, with its schedule committed and enabled so that the first collection batch covers the session of the freeze (holdout_gate.prospective_collection)",
     "The exposure registry updated with everything the author saw since this draft",
     "status set to frozen, frozen_before_outcomes true, run_discipline.study_code tree and fetch_tree (tree hashes only) and data_file_sha256s filled in, coverage_decision (dropped years and items_tested from the governing count-only output) recorded, and the protocol sha256 recorded in a commit that becomes reachable from origin/main (chronology.holdout.window defines the freeze commit); the study tree was merged to main before the freeze pull request, which does not change it coverage_decision is {dropped_years (integers), items_tested (a boolean), count_only_output: 'blueprints/us-equities/mover-v3/results/count-only-output.json', count_only_output_sha256}. core.runner.context refuses a coverage_decision that is mistyped or differs from that committed output's item_rule (review round 9, F7), and a development or validation run refuses an enumeration file whose sha256 differs from the output's part0.enumeration_sha256. Review round 15, F04: core.runner.check_coverage_decision also refuses unless the governing complete 'count_only' line cites the output and the output's dependency manifest equals the frozen tree, data files, parameters, coverage_rule and rate limit. Review round 15, N02: open_before_first_holdout_count is empty at the freeze. After the freeze neither the protocol nor non-transport code can change, so an entry left there could never be cleared and the first holdout count could never be authorized (core.holdout.authorize refuses while it holds one).",
@@ -1168,7 +1168,7 @@
       "date": "2026-10-01",
       "round": 18,
       "input": "Independent pre-outcome reviews of PR #360 (round 18 at af38dced). Claude Opus (2026-09-30): H1 (high), the dry-run seal binding had no study tree. A tree whose change lies outside the plan code (study/fetch/, core/driver.py) adopted, without a request, the seal that a failed run of another tree left. run.py's finally block writes a failed end line, so the next run opens a new start line. The output and run-log line then named the new tree although its transport never ran, so the F12 calibration could come from another tree's transport (freeze_preconditions[8] wants the tree the freeze pins to fetch). M1 (medium): the matched identity held the current run's fetch date, which changes neither the plan nor the fetch, so a retry on a later UTC day was refused for good, and the round-18 test asserted that rule. Lows: L1, a ledger cut after the attempt-0 stamp of a re-fetched request passed set(state) == set(req); L2, zlib.error, TypeError, AttributeError and an OSError outside the try escaped the SealError wrapping; L3, the holdout label's seed case was refused at 'stage' first; L4, the literature entry cited a path that exists only on PR #358's branch; L5, the draft tree and test record were stale. GPT-6.1 Sol (native Codex 0.159.2, effort ultra, 2026-10-01): G-H (high), recovery read each seal under a sha256 computed from the ledger being checked, so a page replaced together with its ledger digests was adopted and turned a failing transport check into a pass after one provider call. G-M (medium): removing the request-record comparisons, or the source binding from the live-sample source digest, left every recovery test passing.",
-      "resolution": "core/store.py: Store.write(seal_record=True) publishes a seal record (seal.json) once, before the ledger. It holds the ledger sha256, the binding, every completion stamp as [key, attempt, status, pages], every page sha256, and the attempt and page counts. core.store.recover_seal is the only recovery path of count_only.dry_run and transport_check.seal_live_samples. It reads the ledger under the recorded sha256 (G-H) and requires the snapshot to give the record back exactly, which compares the attempt stamps exactly (L1). It then checks, separately, the identity, the request plan, and the ledger's request records against the requests the binding names (G-M). Store.read checks every completion stamp's page count against its attempt's page events, and every refusal is a SealError naming the dry run or the live-sample label (L2). The dry-run identity is {study_tree, protocol_sha256, runtime_lock_sha256, sessions, symbols, requests}, with the first three from core.runner.seal_run_identity (H1). Its fetch start (utc_start) is bound beside the identity, read back into the output as fetch_utc_start and never matched (M1). Each live sample adds the same three to its label, seed, source digest (binding, requests, attempts) and requests. Limit: the seal record is a write-once file in the snapshot directory, not an external anchor. While the record is untouched, it refuses a page replaced with its ledger digests, a cut ledger and a ledger whose durations or vintages changed. A rewrite of both the ledger and the record is refused only by the binding, plan and request checks. Not changed: core.holdout.collect still reads its seal under a digest of its own ledger, and orphan-output adoption reads seals under the sha256 the uncited output names. Tests in tests/test_seal_recovery.py: two command-level regressions written first. At af38dced the H1 case fails with 'AssertionError: SealError not raised' and the M1 case errors with 'SealError: dry-run snapshot binding differs from the requested dry run' (Ran 10 tests, FAILED (failures=1, errors=1)). Fifteen unit cases. For the dry run: a later-day retry; another study tree, protocol or runtime lock; a changed plan for the same sessions and symbols; a missing or mismatched seal record; a ledger with altered fetch times; a page replaced with its ledger digests; a resealed request change; a resealed stamp page count; a ledger cut after a re-fetched request's first stamp; unreadable snapshots. For the live samples: run-wide changes sealed into a mixed root, so that each label's own refusal is asserted (L3); a missing seal record; altered fetch times; a resealed request change; and the GPT experiment end to end through reproduction_check. Reproduced directly at af38dced (not committed): passes false, then true after the page and digest replacement, with 1 provider call in all; an edited duration accepted (measured elapsed 0.002 s to 16000.002 s); the cut ledger accepted; zlib.error, AttributeError and IsADirectoryError escaping. At the repair each refuses as a SealError. Mutants, each killed by its named test: study_tree removed from the dry-run identity (test_another_study_tree_protocol_or_runtime_lock_refuses and the command-level H1 test); the fetch date matched again (test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start and the command-level M1 test); the plan-change check removed (test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses); the request-equality check removed (test_a_resealed_request_change_refuses, dry run and live samples); recovery hashing the current ledger instead of the seal record (test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record, dry run and live samples); the source binding omitted from the live digest (test_mismatched_or_missing_binding_refuses_without_requests, change source_binding). L4: the round-18 literature entry cites PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md; the merge order is the coordinator's decision. L5: run_discipline.study_code.draft_tree_at_this_revision and test_record name the repaired tree 20a3dab800eed4c08e53e259ff061a37b9e3d93e and 393 tests. The GPT review also confirmed, against the primary manuscripts, the LPS 2019 (eprints.lse.ac.uk/87481, section 3, pp. 9-10) and ABJK 2022 (September 2021 manuscript, section 3, p. 10 and section 4.2.2, p. 18) sample definitions that the round-18 literature correction states. Protocol: the dry-run sentence of freeze_preconditions and run_discipline.transport_deviations. Study suite: 393 tests OK. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+      "resolution": "core/store.py: Store.write(seal_record=True) publishes a seal record (seal.json) once, before the ledger. It holds the ledger sha256, the binding, every completion stamp as [key, attempt, status, pages], every page sha256, and the attempt and page counts. core.store.recover_seal is the only recovery path of count_only.dry_run and transport_check.seal_live_samples. It reads the ledger under the recorded sha256 (G-H) and requires the snapshot to give the record back exactly, which compares the attempt stamps exactly (L1). It then checks, separately, the identity, the request plan, and the ledger's request records against the requests the binding names (G-M). Store.read checks every completion stamp's page count against its attempt's page events, and every refusal is a SealError naming the dry run or the live-sample label (L2). The repair also made three changes that this record first left unnamed: test_record.command records the env-prefixed -B command that was run and gains a command_note field; Store.read refuses a second completion stamp for one (key, attempt) in every snapshot it reads, of every type, not only in recoverable seals; and Store.write refuses a directory that already holds seal.json. The dry-run identity is {study_tree, protocol_sha256, runtime_lock_sha256, sessions, symbols, requests}, with the first three from core.runner.seal_run_identity (H1). Its fetch start (utc_start) is bound beside the identity, read back into the output as fetch_utc_start and never matched (M1). Each live sample adds the same three to its label, seed, source digest (binding, requests, attempts) and requests. Residuals, recorded and not fixed: (1) seal.json is a write-once record inside the snapshot directory, not an external anchor. While it is intact, recovery refuses a page replaced with its ledger digests, a cut ledger and a ledger whose durations or vintages changed, but a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted: nothing here resists a writer who rewrites seal.json. (2) core.holdout.collect still reads its seal under a digest of its own ledger, the G-H pattern on another path; it predates this round. (3) The orphan-output adoption paths (run.py dry-run and transport-check) verify the seals against the sha256 values named in the output body, not against seal.json. Tests in tests/test_seal_recovery.py: two command-level regressions written first. At af38dced the H1 case fails with 'AssertionError: SealError not raised' and the M1 case errors with 'SealError: dry-run snapshot binding differs from the requested dry run' (Ran 10 tests, FAILED (failures=1, errors=1)). Fifteen unit cases. For the dry run: a later-day retry; another study tree, protocol or runtime lock; a changed plan for the same sessions and symbols; a missing or mismatched seal record; a ledger with altered fetch times; a page replaced with its ledger digests; a resealed request change; a resealed stamp page count; a ledger cut after a re-fetched request's first stamp; unreadable snapshots. For the live samples: run-wide changes sealed into a mixed root, so that each label's own refusal is asserted (L3); a missing seal record; altered fetch times; a resealed request change; and the GPT experiment end to end through reproduction_check. Reproduced directly at af38dced (not committed): passes false, then true after the page and digest replacement, with 1 provider call in all; an edited duration accepted (measured elapsed 0.002 s to 16000.002 s); the cut ledger accepted; zlib.error, AttributeError and IsADirectoryError escaping. At the repair each refuses as a SealError. Mutants, each killed by its named test: study_tree removed from the dry-run identity (test_another_study_tree_protocol_or_runtime_lock_refuses and the command-level H1 test); the fetch date matched again (test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start and the command-level M1 test); the plan-change check removed (test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses); the request-equality check removed (test_a_resealed_request_change_refuses, dry run and live samples); recovery hashing the current ledger instead of the seal record (test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record, dry run and live samples); the source binding omitted from the live digest (test_mismatched_or_missing_binding_refuses_without_requests, change source_binding). L4: the round-18 literature entry cites PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md; the merge order is the coordinator's decision. L5: run_discipline.study_code.draft_tree_at_this_revision and test_record name the repaired tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17 and 395 tests. The GPT review also confirmed, against the primary manuscripts, the LPS 2019 (eprints.lse.ac.uk/87481, section 3, pp. 9-10) and ABJK 2022 (September 2021 manuscript, section 3, p. 10 and section 4.2.2, p. 18) sample definitions that the round-18 literature correction states. Follow-up, 2026-10-01: an independent verification of this repair passed it with five low findings, and four are repaired. The rule sentences in freeze_preconditions and run_discipline.transport_deviations said that an altered snapshot refuses; they now say that it is refused when its seal.json is intact, and state residual (1). The seal record's per-page sha256 comparison had no test (emptying page_sha256s in core.store.seal_record_of passed all 393 tests at 5a1d4b0e): test_a_resealed_page_replacement_refuses (dry run, and each live-sample label) replaces a page with its ledger digests, reseals only the ledger_sha256 of seal.json, and asserts the refusal 'the snapshot differs from its seal record', no transport call and unchanged bytes. Under that mutant the suite now fails in this test's three cases and nowhere else (Ran 395 tests, FAILED (failures=3)). This record now names the three changes above and lists its residuals, and a stray git-ignored bytecode directory (scripts/__pycache__) was deleted from the review worktree, which changes no tracked file. Protocol: the dry-run sentence of freeze_preconditions and run_discipline.transport_deviations. Study suite: 395 tests OK. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1223,7 +1223,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 393 tests, 0 failures, 0 errors, 0 skips at draft tree 20a3dab800eed4c08e53e259ff061a37b9e3d93e (2026-10-01); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 395 tests, 0 failures, 0 errors, 0 skips at draft tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17 (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
index ac139aa30..8ab783aca 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -258,6 +258,19 @@ def test_a_page_replaced_with_its_ledger_digests_refuses(self):
             self.replace_page_and_digests(Path(tmp) / "dry-run")
             self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), "ledger sha256 differs")
 
+    def test_a_resealed_page_replacement_refuses(self):
+        """G-H, the per-page comparison: the GPT review's experiment with the seal record's ledger_sha256 also rewritten
+        to the edited ledger's (reseal). The ledger then reads under the record and the page matches its edited ledger
+        digests, so only the page sha256s the seal record holds refuse it. At 5a1d4b0e no test covered that comparison:
+        emptying page_sha256s in core.store.seal_record_of passed the whole suite."""
+        with tempfile.TemporaryDirectory() as tmp:
+            self.run_dry(tmp)
+            directory = Path(tmp) / "dry-run"
+            self.replace_page_and_digests(directory)
+            reseal(directory)
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: the snapshot differs from its seal record")
+
     def test_a_resealed_request_change_refuses(self):
         """G-M: a persisted request altered under the expected binding, with the seal record resealed, is refused by
         the comparison of the ledger's request records with the requests its binding names."""
@@ -451,6 +464,18 @@ def test_a_resealed_request_change_refuses(self):
                     tmp, self.market, lambda: self.seal_samples(tmp),
                     f"^live sample {re.escape(repr(label))}: the snapshot's requests or completion stamps differ")
 
+    def test_a_resealed_page_replacement_refuses(self):
+        """G-H, the per-page comparison for each label, as the dry run's: a page replaced with its ledger digests and
+        the seal record's ledger_sha256 resealed is refused only by the page sha256s the seal record holds."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                self.replace_page_and_digests(Path(tmp) / label)
+                reseal(Path(tmp) / label)
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: the snapshot differs from its seal record")
+
     def test_a_resealed_live_page_cannot_turn_a_failing_check_into_a_pass(self):
         """G-H, the GPT review's experiment end to end: the sealed live sample differs from its source, so the check
         fails; then the live page and its ledger digests are replaced by the source's page, with the binding, requests

From 28fafe840d1098c6cee97d89ce1936384c5544bf Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 00:49:45 -0400
Subject: [PATCH 06/15] Mover v3 round 18, second repair: seal-record digest,
 non-directory snapshot path, tree content check, stamp tests

Repairs the four findings of the cross-family re-check of the round-18 repair
(GPT-6.1 Sol, effort max, Codex 0.159.2, 2026-10-01; changes-needed).

R2-1 (high). core.store._recover_seal passed the seal record's ledger_sha256
to Store.read, which compares no digest when it is given None, and
seal_record_of gave the null back. A record whose ledger_sha256 was JSON null
was adopted with its ledger unverified. The record must now hold 64 lowercase
hexadecimal characters; anything else is a SealError before the ledger is read.

R2-2 (high). core.guards.running_tree returned HEAD's study tree whenever git
status reported no change. git status reports none for a tracked file whose
index entry is marked assume-unchanged or skip-worktree (git-update-index(1);
git-ls-files(1) -t and -v), nor for one that a clean filter maps back to the
committed bytes, so the tree in every seal identity (H1) could differ from the
files that ran. running_tree now refuses an index entry with either flag, and
requires every file of the tree it returns to be a regular file whose own bytes
hash to its blob (one git hash-object --no-filters --stdin-paths call). A
symbolic-link or submodule entry is refused. The signature is unchanged.

R2-3 (medium). A regular file or a dangling symbolic link at the snapshot path
counted as unused: the caller fetched again and Store.write then failed. It is
now a SealError before any fetch.

R2-4 (medium). Two stamp controls had no test: the attempt ids in the seal
record's stamps, and Store.read's refusal of a second completion stamp for one
key and attempt. Both have one now; no code changes for this finding.

Not changed: recover_seal still returns None for a path under a regular file
and for a directory that holds only a stray ledger.jsonl.tmp or seal.json.tmp,
so the caller fetches before Store.write fails with an OSError.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/study/core/guards.py |  81 +++++++-
 .../us-equities/mover-v3/study/core/store.py  |  38 +++-
 .../mover-v3/study/tests/test_guards.py       | 109 ++++++++++-
 .../study/tests/test_seal_recovery.py         | 184 +++++++++++++++++-
 .../mover-v3/study/tests/test_store.py        |  27 ++-
 5 files changed, 424 insertions(+), 15 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/core/guards.py b/blueprints/us-equities/mover-v3/study/core/guards.py
index f51ec0e95..47e22375b 100644
--- a/blueprints/us-equities/mover-v3/study/core/guards.py
+++ b/blueprints/us-equities/mover-v3/study/core/guards.py
@@ -21,6 +21,8 @@
 from __future__ import annotations
 
 import json
+import os
+import stat
 import subprocess
 import sys
 from pathlib import Path
@@ -64,7 +66,14 @@ def committed_bytes(repo, ref: str, path: str):
 def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     """The git tree hash of the study directory at HEAD; refuses if the working copy of it differs from HEAD, or
     if it holds an ignored file other than a __pycache__ entry (review round 9, F9: an ignored file is invisible to
-    the tree hash but could still be imported)."""
+    the tree hash but could still be imported).
+
+    Review round 18, second repair (R2-2): git status alone does not show that the working copy is HEAD's. It reports
+    no change to a tracked file whose index entry is marked assume-unchanged or skip-worktree (git-update-index(1)),
+    nor one that a clean filter maps back to the committed bytes. So an index entry with either flag is refused, and
+    every file of the tree returned must be a regular file whose own bytes hash to its blob, read without the index
+    and without filters. Both checks run here, once, when a run builds its context: a file changed later in the same
+    run is not seen."""
     dirty = git(repo, "status", "--porcelain", "--untracked-files=all", "--", study_path)
     if dirty:
         raise Refused("the study tree has uncommitted changes; a run executes a committed tree only")
@@ -73,7 +82,75 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     planted = [p for p in ignored if "__pycache__" not in Path(p).parts]
     if planted:
         raise Refused(f"the study tree holds ignored files that are not bytecode caches: {planted[:5]}")
-    return git(repo, "rev-parse", f"HEAD:{study_path}")
+    masked = _masked_index_entries(repo, study_path)
+    if masked:
+        raise Refused(f"the study tree holds index entries that hide a file's changes from git status: {masked[:5]}; "
+                      "a run executes a committed tree only")
+    tree = git(repo, "rev-parse", f"HEAD:{study_path}")
+    unverified = _unverified_files(repo, tree, study_path)
+    if unverified:
+        raise Refused(f"the study tree's files are not all regular files that hold the committed bytes, although git "
+                      f"status reports no change: {unverified[:5]}; a run executes a committed tree only")
+    return tree
+
+
+def _masked_index_entries(repo, study_path: str) -> list:
+    """Every index entry under study_path that is marked assume-unchanged or skip-worktree, as '<path> (<flags>)'.
+    git-ls-files(1) -v prints the tag of an assume-unchanged entry in lowercase and that of a skip-worktree entry as S
+    (s with both flags)."""
+    out = subprocess.check_output(["git", "-C", str(repo), "ls-files", "-v", "-z", "--", study_path])
+    masked = []
+    for row in out.split(b"\0"):
+        if row:
+            tag = row[:1].decode("ascii", "replace")
+            flags = [name for name, marked in (("assume-unchanged", tag.islower()), ("skip-worktree", tag in "Ss"))
+                     if marked]
+            if flags:
+                masked.append(f"{os.fsdecode(row[2:])} ({' and '.join(flags)})")
+    return masked
+
+
+def _unverified_files(repo, tree: str, study_path: str) -> list:
+    """The files of `tree` (the study tree at HEAD) that the working copy does not hold as committed, each with its
+    problem. An entry must be a regular-file blob: a symbolic link or submodule entry is refused, because the tree hash
+    covers a link's text and not the file it names. Its working file must be a regular file, and its bytes must hash to
+    the entry's blob. One git hash-object --no-filters --stdin-paths call hashes the files themselves, so the result
+    depends on no index entry (its flags or its cached stat data) and on no clean filter."""
+    out = subprocess.check_output(["git", "-C", str(repo), "ls-tree", "-r", "-z", tree])
+    problems, paths, blobs = [], [], []
+    for row in out.split(b"\0"):
+        if not row:
+            continue
+        meta, name = row.split(b"\t", 1)
+        mode, kind, blob = meta.decode("ascii").split()
+        path = f"{study_path.rstrip('/')}/{os.fsdecode(name)}"
+        if kind != "blob" or mode not in ("100644", "100755"):
+            problems.append(f"{path} is a symbolic link or submodule entry (mode {mode})")
+        elif any(ord(c) < 32 for c in path):
+            problems.append(f"{path!r} has a control character in its name")    # --stdin-paths reads a path per line
+        else:
+            try:
+                file_mode = os.lstat(Path(repo) / path).st_mode      # the entry itself: a link is not followed
+            except OSError:
+                problems.append(f"{path} is missing")
+            else:
+                if stat.S_ISREG(file_mode):
+                    paths.append(path)
+                    blobs.append(blob)
+                else:
+                    problems.append(f"{path} is not a regular file")
+    if paths:
+        base = Path(repo).resolve()
+        hashed = subprocess.run(["git", "-C", str(repo), "hash-object", "--no-filters", "--stdin-paths"],
+                                input=b"".join(os.fsencode(str(base / p)) + b"\n" for p in paths),
+                                capture_output=True)
+        got = hashed.stdout.decode("ascii", "replace").split()
+        if hashed.returncode != 0 or len(got) != len(paths):
+            problems.append("git hash-object could not read every tracked file: "
+                            + hashed.stderr.decode("utf-8", "replace").strip()[:200])
+        else:
+            problems.extend(f"{p} differs from HEAD's blob" for p, want, have in zip(paths, blobs, got) if have != want)
+    return problems
 
 
 def check_bytecode_isolated() -> None:
diff --git a/blueprints/us-equities/mover-v3/study/core/store.py b/blueprints/us-equities/mover-v3/study/core/store.py
index 27f4a17d4..273509716 100644
--- a/blueprints/us-equities/mover-v3/study/core/store.py
+++ b/blueprints/us-equities/mover-v3/study/core/store.py
@@ -11,7 +11,8 @@
 Every completion stamp's page count equals its attempt's page events. Review round 18 repair (G-H): a recoverable
 seal (the native dry run, a transport-check live sample) also publishes its seal record, seal.json, once and before
 the ledger, and recover_seal adopts such a seal only against that record, never against a digest of the ledger it is
-checking.
+checking. Second repair (R2-1, R2-3): the record must hold a sha256 of the ledger (a null there turned the
+verification off), and a snapshot path that exists and is not a directory is refused before any fetch.
 """
 from __future__ import annotations
 
@@ -85,18 +86,25 @@ def _publish(directory: Path, name: str, data: bytes) -> None:
 
 def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
     """core.holdout.collect's recover-if-matching pattern for a recoverable seal (count_only.dry_run and
-    transport_check.seal_live_samples; review round 18, R5, and its repair). None when nothing was written under
-    directory: the caller fetches and seals. Otherwise the sealed (store, sha256, binding), only when:
-      - the seal record exists and the ledger reads under the sha256 it recorded at seal time, never under a digest
-        of the ledger being checked (G-H), and the snapshot read gives that record back exactly: its binding, every
-        completion stamp with its attempt, status and page count (L1), every page sha256 and the counts;
+    transport_check.seal_live_samples; review round 18, R5, and its repairs). None when directory does not exist, or
+    is a directory that holds no ledger, pages directory or seal record: the caller fetches and seals. Otherwise the
+    sealed (store, sha256, binding), only when:
+      - the seal record exists and holds a sha256 of the ledger (64 lowercase hexadecimal characters; R2-1: a null
+        there would turn Store.read's comparison off), the ledger reads under that sha256, recorded at seal time,
+        never under a digest of the ledger being checked (G-H), and the snapshot read gives that record back exactly:
+        its binding, every completion stamp with its attempt, status and page count (L1), every page sha256 and the
+        counts;
       - the binding holds exactly the identity and `extra` (each a non-empty string the caller reads back and never
         matches, the dry run's utc_start; M1), and the identity equals `identity` apart from its request plan: the
         running study tree, protocol and runtime lock (H1) and the caller's inputs;
       - the bound request plan equals identity["requests"] (the plan-change check), and the ledger's request records
         are exactly the requests the binding names (G-M), each with its completion stamps.
-    A directory with pages or a seal record but no ledger is partially written. Every refusal is a SealError naming
-    `what` (L2); none fetches or writes."""
+    A directory with pages or a seal record but no ledger is partially written, and a path that exists and is not a
+    directory (a regular file, a dangling symbolic link) is not unused (R2-3). Every refusal made here is a SealError
+    naming `what` (L2), and this function neither fetches nor writes. It looks neither above directory nor at any
+    other entry in it: for a path under a regular file, or a directory that holds a stray ledger.jsonl.tmp or
+    seal.json.tmp and none of the three, it returns None, and the caller's Store.write fails after the fetch with an
+    OSError (residuals recorded in the protocol's review_record, round 18)."""
     try:
         return _recover_seal(Path(directory), identity, tuple(extra))
     except SealError as exc:
@@ -107,6 +115,11 @@ def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
 
 
 def _recover_seal(d: Path, identity: dict, extra: tuple):
+    # review round 18, second repair (R2-3): a regular file or a dangling symbolic link at the snapshot path holds no
+    # ledger, pages or seal record, but it is not an unused directory; returning None for it made the caller fetch
+    # again before Store.write failed
+    if os.path.lexists(d) and not d.is_dir():
+        raise SealError("the snapshot path exists and is not a directory: it cannot be overwritten or fetched again")
     if not (d / "ledger.jsonl").exists():
         if (d / "pages").exists() or (d / SEAL_RECORD).exists():
             raise SealError("the snapshot is partially written: it cannot be overwritten or fetched again")
@@ -116,10 +129,15 @@ def _recover_seal(d: Path, identity: dict, extra: tuple):
     sealed = json.loads((d / SEAL_RECORD).read_bytes())
     if not isinstance(sealed, dict) or sealed.get("kind") != SEAL_RECORD_KIND:
         raise SealError("the seal record is invalid")
-    sha = sealed["ledger_sha256"]          # the digest recorded at seal time, never one of the ledger being checked
+    sha = sealed.get("ledger_sha256")      # the digest recorded at seal time, never one of the ledger being checked
+    # review round 18, second repair (R2-1): Store.read compares no digest when it is given None, and seal_record_of
+    # gives a null back, so a record without a sha256 would be adopted with its ledger unverified
+    if not isinstance(sha, str) or len(sha) != 64 or set(sha) - set("0123456789abcdef"):
+        raise SealError("the seal record holds no sha256 of its ledger (64 lowercase hexadecimal characters), so the "
+                        "ledger cannot be verified and is not adopted")
     store = Store.read(d, sha)
     # Store.read checked the ledger against that digest; the snapshot must also give back the rest of the record
-    if seal_record_of(store, sealed["ledger_sha256"]) != sealed:
+    if seal_record_of(store, sha) != sealed:
         raise SealError("the snapshot differs from its seal record (binding, completion stamps, pages or counts)")
     binding = store.binding if isinstance(store.binding, dict) else {}
     bound = binding.get("identity")
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_guards.py b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
index 233aec137..a1cb4bf29 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_guards.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
@@ -1,14 +1,27 @@
 """run_discipline refusals: frozen protocol and running tree (R8-4), protocol sha256 (R8-2), vintages before the
-freeze (R8-4), the committed-tree requirement and the freeze commit time."""
+freeze (R8-4), the committed-tree requirement and the freeze commit time. Review round 18, second repair (R2-2): the
+running tree is HEAD's only when no index flag hides a tracked file from git status and every tracked file's bytes are
+HEAD's blob."""
+import contextlib
 import json
+import re
+import shlex
 import subprocess
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 from core import guards
 from core.params import PROTOCOL_PATH, STUDY_PATH
 
+TRANSPORT = f"{STUDY_PATH}/fetch/transport.py"
+# git-ls-files(1) -v: the tag of an index entry marked assume-unchanged is lowercase, that of one marked skip-worktree
+# is S, and s with both; git-update-index(1) sets each flag. (flag names in the refusal, tag, update-index options)
+INDEX_FLAGS = (("assume-unchanged", "h", ("--assume-unchanged",)),
+               ("skip-worktree", "S", ("--skip-worktree",)),
+               ("assume-unchanged and skip-worktree", "s", ("--assume-unchanged", "--skip-worktree")))
+
 
 def sh(repo, *args):
     return subprocess.check_output(["git", "-C", str(repo), *args], text=True,
@@ -17,6 +30,100 @@ def sh(repo, *args):
                                         "GIT_COMMITTER_DATE": "2026-10-02T21:30:00+00:00", "PATH": "/usr/bin:/bin"}).strip()
 
 
+def status(repo) -> str:
+    """What core.guards.running_tree asks git first: the study tree's changes, untracked files included."""
+    return sh(repo, "status", "--porcelain", "--untracked-files=all", "--", STUDY_PATH)
+
+
+class RunningTreeContent(unittest.TestCase):
+    """Review round 18, second repair (R2-2). At 406ad3c5 running_tree returned HEAD's study tree whenever git status
+    reported no change, so the tree a run named (and every seal identity bound, H1) could differ from the files that
+    ran. Each case builds a state in which git status reports nothing."""
+
+    @contextlib.contextmanager
+    def study_repo(self):
+        """A temporary repository (tests/fixture_repo.py) whose committed, clean study tree holds two files."""
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.init_repo(Path(tmp) / "repo")
+            FR.write(repo / STUDY_PATH / "core" / "a.py", "x = 1\n")
+            FR.write(repo / TRANSPORT, "HOST = 'fixture'\n")
+            FR.commit_push(repo, "2026-10-01T21:30:00+00:00", "study tree")
+            self.assertEqual(guards.running_tree(repo), sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"))
+            yield repo, Path(tmp)
+
+    def change(self, repo, tmp, how):
+        from tests import fixture_repo as FR
+        path = repo / TRANSPORT
+        if how == "changed":
+            path.write_text("HOST = 'changed'\n")
+        elif how == "deleted":
+            path.unlink()
+        elif how == "replaced_by_a_link":       # a link to a file outside the repository that holds the same bytes
+            target = FR.write(tmp / "transport-outside.py", path.read_bytes())
+            path.unlink()
+            path.symlink_to(target)
+
+    def test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree(self):
+        """The index-flag refusal: an entry with either flag is refused, with a message that names the file and the
+        flag, whether or not the file changed (git status reports nothing in each case, a deleted file included)."""
+        for flag, tag, options in INDEX_FLAGS:
+            for how in ("unchanged", "changed", "deleted"):
+                with self.subTest(flag=flag, file=how), self.study_repo() as (repo, tmp):
+                    for option in options:
+                        sh(repo, "update-index", option, TRANSPORT)
+                    self.change(repo, tmp, how)
+                    self.assertEqual(status(repo), "")
+                    self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"{tag} {TRANSPORT}")
+                    with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} ({flag})")):
+                        guards.running_tree(repo)
+
+    def test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed(self):
+        """The content check alone: with the index-flag refusal bypassed, a flagged file that changed, was deleted or
+        was replaced by a link to the same bytes is still refused, because the working file's own bytes are hashed."""
+        cases = {"changed": "differs from HEAD's blob", "deleted": "is missing",
+                 "replaced_by_a_link": "is not a regular file"}
+        for flag, _, options in INDEX_FLAGS[:2]:
+            for how, problem in cases.items():
+                with self.subTest(flag=flag, file=how), self.study_repo() as (repo, tmp):
+                    for option in options:
+                        sh(repo, "update-index", option, TRANSPORT)
+                    self.change(repo, tmp, how)
+                    self.assertEqual(status(repo), "")
+                    with mock.patch.object(guards, "_masked_index_entries", lambda *args: []), \
+                            self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} {problem}")):
+                        guards.running_tree(repo)
+
+    def test_running_tree_refuses_a_change_that_a_clean_filter_hides(self):
+        """Only the content check can refuse this one: no index flag is set, and git status reports nothing because a
+        clean filter (set in the repository's own configuration and .git/info/attributes, neither of them tracked)
+        gives the committed bytes back for the edited file. git hash-object --no-filters hashes the file itself."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, tmp):
+            committed = FR.write(tmp / "transport-committed.py", (repo / TRANSPORT).read_bytes())
+            sh(repo, "config", "filter.committed.clean", f"cat {shlex.quote(str(committed))}")
+            FR.write(repo / ".git" / "info" / "attributes", f"{TRANSPORT} filter=committed\n")
+            (repo / TRANSPORT).write_text("HOST = 'changed'\n")      # the committed length: git compares content
+            self.assertEqual(len("HOST = 'changed'\n"), len(committed.read_bytes()))
+            self.assertEqual(status(repo), "")
+            self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
+            self.assertEqual(sh(repo, "hash-object", TRANSPORT), sh(repo, "rev-parse", f"HEAD:{TRANSPORT}"))
+            with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} differs from HEAD's blob")):
+                guards.running_tree(repo)
+
+    def test_running_tree_refuses_a_committed_symbolic_link(self):
+        """A symbolic-link entry is refused: the tree hash covers the link's text, not the file it names."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, tmp):
+            link = f"{STUDY_PATH}/core/b.py"
+            (repo / link).symlink_to("a.py")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "a symbolic link")
+            self.assertEqual(status(repo), "")
+            self.assertEqual(sh(repo, "ls-tree", "HEAD", "--", link).split()[0], "120000")
+            with self.assertRaisesRegex(guards.Refused, re.escape(f"{link} is a symbolic link or submodule entry")):
+                guards.running_tree(repo)
+
+
 class Guards(unittest.TestCase):
     def test_require_frozen_and_matching_tree(self):
         tree = "a" * 40
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
index 8ab783aca..a2bc8bf28 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -4,11 +4,16 @@
 only through core.store.recover_seal, against its seal record and a binding that
 names the running study tree, protocol and runtime lock. Only temporary synthetic
 snapshots are read or damaged; every transport uses FakeMarket.
+
+Second repair, after the cross-family re-check of that repair (GPT-6.1 Sol, 2026-10-01; R2-1 to R2-4): a seal record
+without a sha256 of its ledger, a snapshot path that is not a directory, a change of attempt ids alone, and, at the
+command level, a study file whose change an index flag hides from git status.
 """
 import contextlib
 import copy
 import gzip
 import json
+import os
 import re
 import shutil
 import tempfile
@@ -27,10 +32,18 @@
 RUN = {"study_tree": "synthetic-tree", "protocol_sha256": "synthetic-protocol", "runtime_lock_sha256": "synthetic-lock"}
 FETCH_CHANGE = "blueprints/us-equities/mover-v3/study/fetch/transport.py"
 FETCH_PREFIX = "blueprints/us-equities/mover-v3/study/fetch"
+# R2-1: what a seal record can hold in place of its ledger's sha256 (64 lowercase hexadecimal characters). At 406ad3c5
+# only null was adopted (Store.read compares no digest when it is given None); the others were refused by that
+# comparison or as a missing field, none as a malformed record.
+NOT_A_SHA256 = ("null", "missing", "number", "list", "short", "trailing_newline", "uppercase", "not_hexadecimal")
+# R2-3: what can stand at a snapshot path in place of a directory
+NOT_A_DIRECTORY = ("regular_file", "dangling_link")
 
 
 def snapshot_bytes(root):
-    return {str(p.relative_to(root)): p.read_bytes() for p in Path(root).rglob("*") if p.is_file()}
+    """Every file's bytes under root, and every symbolic link's target (a dangling link is not a file)."""
+    return {str(p.relative_to(root)): os.readlink(p) if p.is_symlink() else p.read_bytes()
+            for p in Path(root).rglob("*") if p.is_symlink() or p.is_file()}
 
 
 def ledger_lines(directory) -> list:
@@ -120,6 +133,51 @@ def alter_request(self, directory):
         write_ledger(directory, lines)
         reseal(directory)
 
+    def break_record_digest(self, directory, kind):
+        """R2-1: only the seal record's ledger_sha256 changes, to something that is not a sha256 (NOT_A_SHA256)."""
+        path = Path(directory) / SEAL_RECORD
+        record = json.loads(path.read_bytes())
+        sha = record.pop("ledger_sha256")
+        values = {"null": None, "number": 0, "list": [sha], "short": sha[:63], "trailing_newline": sha + "\n",
+                  "uppercase": "A" + sha[1:], "not_hexadecimal": "g" + sha[1:]}
+        if kind != "missing":
+            record["ledger_sha256"] = values[kind]
+        path.write_bytes((dumps(record) + "\n").encode("utf-8"))
+
+    def replace_with_a_non_directory(self, directory, kind):
+        """R2-3: the snapshot path itself stops being a directory (NOT_A_DIRECTORY)."""
+        shutil.rmtree(directory)
+        if kind == "regular_file":
+            directory.write_bytes(b"not a snapshot directory\n")
+        else:
+            directory.symlink_to(directory.parent / "absent-target")
+
+    def renumber_attempt(self, directory, key, old, new) -> list:
+        """R2-4: one attempt of `key` gets another id, in its page events and in its completion stamp; the seal record
+        is resealed. Returns the events changed, after checking that nothing else changed: the ledger keeps every
+        other field of every line (stamp counts, statuses, page counts, page digests), the pages keep their bytes and
+        the seal record keeps every field but ledger_sha256. So only the attempt ids the seal record holds for its
+        stamps can refuse the edit."""
+        directory = Path(directory)
+        before, record = snapshot_bytes(directory), json.loads((directory / SEAL_RECORD).read_bytes())
+        sealed, lines = ledger_lines(directory), ledger_lines(directory)
+        changed = [x for x in lines if x["event"] in ("page", "stamp_complete", "stamp_incomplete")
+                   and x["key"] == key and x["attempt"] == old]
+        for x in changed:
+            x["attempt"] = new
+        write_ledger(directory, lines)
+        reseal(directory)
+
+        def without(field, items):
+            return [{k: v for k, v in x.items() if k != field} for x in items]
+        self.assertEqual(without("attempt", ledger_lines(directory)), without("attempt", sealed))
+        self.assertNotEqual(ledger_lines(directory), sealed)
+        after = snapshot_bytes(directory)
+        self.assertEqual({k: v for k, v in after.items() if k.startswith("pages/")},
+                         {k: v for k, v in before.items() if k.startswith("pages/")})
+        self.assertEqual(without("ledger_sha256", [json.loads(after[SEAL_RECORD])]), without("ledger_sha256", [record]))
+        return changed
+
 
 class DryRunSealRecovery(RecoveryChecks, unittest.TestCase):
     def setUp(self):
@@ -340,6 +398,61 @@ def test_unreadable_snapshots_refuse_with_a_seal_error(self):
                     reseal(directory)
                 self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp), pattern)
 
+    def test_a_seal_record_without_a_ledger_sha256_refuses(self):
+        """R2-1: recovery reads the ledger under the sha256 its seal record holds, so a record that holds none cannot
+        verify it. At 406ad3c5 a record whose ledger_sha256 was JSON null was adopted: Store.read compares no digest
+        when it is given None, and the record comparison used the same null. With the ledger's vintages and durations
+        edited as well (the F12 calibration's inputs), that seal was adopted too, without a request. Every value that
+        is not 64 lowercase hexadecimal characters is now refused as a malformed record, before the ledger is read."""
+        for ledger_edited in (False, True):
+            for kind in NOT_A_SHA256:
+                with self.subTest(kind=kind, ledger_edited=ledger_edited), tempfile.TemporaryDirectory() as tmp:
+                    self.run_dry(tmp)
+                    directory = Path(tmp) / "dry-run"
+                    if ledger_edited:
+                        self.edit_fetch_times(directory)
+                    self.break_record_digest(directory, kind)
+                    self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                                  "^dry-run: the seal record holds no sha256 of its ledger")
+
+    def test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests(self):
+        """R2-3: a regular file or a dangling symbolic link at the snapshot path holds no ledger, pages or seal record,
+        so at 406ad3c5 it counted as unused: the dry run fetched again (16 calls here) and Store.write then failed,
+        with NotADirectoryError for the file and with its own 'pages already exist' SealError for the link. It is a
+        used path: a SealError that names the dry run, no request, no byte change."""
+        for kind in NOT_A_DIRECTORY:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                self.run_dry(tmp)
+                self.replace_with_a_non_directory(Path(tmp) / "dry-run", kind)
+                self.assertIn("dry-run", snapshot_bytes(tmp))
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                              "^dry-run: the snapshot path exists and is not a directory")
+
+    def fail_the_last_requests_first_attempt(self) -> dict:
+        """The L1 test's setup: the last request in key order fails its first call and its 3 retries, so it is sealed
+        incomplete at attempt 0 and complete at attempt 1. Returns that request."""
+        last = max(CO.dry_run_requests(self.cal, self.sessions, self.symbols), key=lambda r: r["key"])
+        self.market.fail = [(lambda path, p: path == last["endpoint"] and
+                             all(p.get(k) == str(v) for k, v in last["params"].items()), "urlerror", 4)]
+        return last
+
+    def test_a_resealed_attempt_id_change_refuses(self):
+        """R2-4, mutant A (st['attempt'] replaced by 0 in core.store.seal_record_of's stamp entries): at 406ad3c5 no
+        test compared attempt ids alone, so that mutant passed all 27 recovery tests (the L1 test removes a whole
+        stamp, which also changes the stamp count). Here a re-fetched request's second attempt becomes attempt 7 in
+        its page events and its completion stamp, with every count, status, page and digest kept and the seal record's
+        ledger_sha256 resealed: only the attempt ids the seal record holds refuse it."""
+        with tempfile.TemporaryDirectory() as tmp:
+            last = self.fail_the_last_requests_first_attempt()
+            self.run_dry(tmp)
+            changed = self.renumber_attempt(Path(tmp) / "dry-run", last["key"], 1, 7)
+            self.assertEqual(sorted({x["event"] for x in changed}), ["page", "stamp_complete"])
+            self.assertEqual([(x["event"], x["attempt"]) for x in ledger_lines(Path(tmp) / "dry-run")
+                              if x.get("key") == last["key"] and x["event"].startswith("stamp")],
+                             [("stamp_incomplete", 0), ("stamp_complete", 7)])
+            self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                          "^dry-run: the snapshot differs from its seal record")
+
 
 # every change that applies to the whole transport-check run rather than to one label's source
 RUN_WIDE = {"seed": {"seed": "another-seed"},
@@ -503,6 +616,47 @@ def check():
                                           "^live sample 'stage': snapshot ledger sha256 differs from the sealed value$")
             self.assertEqual(len(market.calls), 1)
 
+    def test_a_seal_record_without_a_ledger_sha256_refuses(self):
+        """R2-1 for each label, as the dry run's: a seal record whose ledger_sha256 is null (adopted at 406ad3c5, also
+        with the ledger's vintages and durations edited) or anything else that is not a sha256."""
+        for label in self.sources:
+            for ledger_edited in (False, True):
+                for kind in NOT_A_SHA256:
+                    with self.subTest(label=label, kind=kind, ledger_edited=ledger_edited), \
+                            tempfile.TemporaryDirectory() as tmp:
+                        self.seal_samples(tmp)
+                        if ledger_edited:
+                            self.edit_fetch_times(Path(tmp) / label)
+                        self.break_record_digest(Path(tmp) / label, kind)
+                        self.assert_refuses_unchanged(
+                            tmp, self.market, lambda: self.seal_samples(tmp),
+                            f"^live sample {re.escape(repr(label))}: the seal record holds no sha256 of its ledger")
+
+    def test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests(self):
+        """R2-3 for each label, as the dry run's: a regular file or a dangling symbolic link at the label's path."""
+        for label in self.sources:
+            for kind in NOT_A_DIRECTORY:
+                with self.subTest(label=label, kind=kind), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    self.replace_with_a_non_directory(Path(tmp) / label, kind)
+                    self.assertIn(label, snapshot_bytes(tmp))
+                    self.assert_refuses_unchanged(
+                        tmp, self.market, lambda: self.seal_samples(tmp),
+                        f"^live sample {re.escape(repr(label))}: the snapshot path exists and is not a directory")
+
+    def test_a_resealed_attempt_id_change_refuses(self):
+        """R2-4, mutant A, for each label: the sample's one attempt becomes attempt 7 in its page event and its
+        completion stamp, with everything else kept and the seal record's ledger_sha256 resealed."""
+        for label in self.sources:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as tmp:
+                self.seal_samples(tmp)
+                key = next(x["key"] for x in ledger_lines(Path(tmp) / label) if x["event"] == "request")
+                changed = self.renumber_attempt(Path(tmp) / label, key, 0, 7)
+                self.assertEqual(sorted(x["event"] for x in changed), ["page", "stamp_complete"])
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(tmp),
+                    f"^live sample {re.escape(repr(label))}: the snapshot differs from its seal record")
+
 
 class DryRunCommandRecovery(RecoveryChecks, unittest.TestCase):
     """Repair of the round-18 reviews (H1, M1) at the command level. A dry run whose output step fails after the seal
@@ -605,6 +759,34 @@ def test_a_seal_left_by_a_failed_run_is_adopted_on_a_later_utc_day(self):
             self.assertEqual((line["purpose"], line["status"], line["input_snapshot_sha256s"], line["utc_start"]),
                              ("dry_run", "complete", [sealed], self.DAY2))
 
+    def test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted(self):
+        """R2-2: H1 binds a seal to the tree core.guards.running_tree names, and at 406ad3c5 that was HEAD's tree
+        whenever git status reported no change. git status does not report a tracked file whose index entry is marked
+        assume-unchanged or skip-worktree (git-update-index(1)), so a transport edited under either flag ran as the
+        committed tree: the run opened a start line, and the next one adopted the seal that the failed run of the
+        committed tree left and named that tree in its output. Now the run is refused when it builds its context:
+        no start line, no request, no byte change, no output."""
+        from core import guards
+        from core.params import DRY_RUN_OUTPUT, RUN_LOG, STUDY_PATH
+        from tests import fixture_repo as FR
+        transport = f"{STUDY_PATH}/fetch/transport.py"
+        for flag in ("assume-unchanged", "skip-worktree"):
+            with self.subTest(flag=flag), self.command() as (run, repo, tmp):
+                root = tmp / "snap"
+                self.fail_after_the_seal(run, repo, root)
+                tree = FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
+                FR.sh(repo, "update-index", f"--{flag}", transport)
+                FR.write(repo / transport, "HOST = 'fixture-changed'\n")    # outside the plan code, as H1's tree B
+                self.assertEqual(FR.sh(repo, "status", "--porcelain", "--untracked-files=all", "--", STUDY_PATH), "")
+                self.assertEqual(FR.sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+                log, before, calls = (repo / RUN_LOG).read_bytes(), snapshot_bytes(root), len(self.market.calls)
+                with self.assertRaisesRegex(guards.Refused, re.escape(f"{transport} ({flag})")):
+                    run.main(self.argv(root))
+                self.assertEqual(self.market.calls[calls:], [])
+                self.assertEqual(snapshot_bytes(root), before)
+                self.assertEqual((repo / RUN_LOG).read_bytes(), log)
+                self.assertFalse((repo / DRY_RUN_OUTPUT).exists())
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_store.py b/blueprints/us-equities/mover-v3/study/tests/test_store.py
index 06e6e1681..efacc28eb 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_store.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_store.py
@@ -1,9 +1,13 @@
-"""Snapshot persistence must not replace the first sealed provider vintage."""
+"""Snapshot persistence must not replace the first sealed provider vintage, and a ledger gives each attempt one
+completion stamp."""
+import json
+import re
 import tempfile
 import unittest
 from pathlib import Path
 
 from core import plan
+from core.canon import dumps, sha256_file
 from core.store import SealError, Store
 from tests import synth
 
@@ -25,3 +29,24 @@ def test_a_second_write_cannot_replace_a_sealed_snapshot(self):
             self.assertEqual({str(p.relative_to(directory)): p.read_bytes()
                               for p in directory.rglob("*") if p.is_file()}, before)
             self.assertEqual(Store.read(directory, sha).parsed(req["key"])[0]["symbol"], "AAA")
+
+    def test_a_second_completion_stamp_for_one_attempt_is_refused(self):
+        """Review round 18, second repair (R2-4, mutant B): Store.read refuses a second completion stamp for one key
+        and attempt in every snapshot it reads, whatever the stamp says. At 406ad3c5 no test read such a ledger: the
+        cross-family re-check removed that refusal and the 393 tests it ran still passed. The ledger is read under
+        its own sha256, so only that refusal can stop it; without it the later stamp would govern the attempt."""
+        for second in ("stamp_complete", "stamp_incomplete"):
+            with self.subTest(second=second), tempfile.TemporaryDirectory() as tmp:
+                directory = Path(tmp)
+                req = plan.assets_requests()[0]
+                store = Store()
+                synth.put_json(store, req, [{"symbol": "AAA", "status": "active"}])
+                self.assertEqual(Store.read(directory, store.write(directory)).status(req["key"]), "complete")
+                ledger = directory / "ledger.jsonl"
+                lines = ledger.read_bytes().splitlines()
+                stamp = json.loads(lines[-1])
+                self.assertEqual((stamp["event"], stamp["key"], stamp["attempt"]), ("stamp_complete", req["key"], 0))
+                ledger.write_bytes(b"\n".join(lines + [dumps({**stamp, "event": second}).encode("utf-8")]) + b"\n")
+                refusal = f"^{re.escape(req['key'])} attempt 0: a second completion stamp$"
+                with self.assertRaisesRegex(SealError, refusal):
+                    Store.read(directory, sha256_file(ledger))

From f1fcffe157db1bfa480186fd855779b9c1b67295 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 01:04:06 -0400
Subject: [PATCH 07/15] Mover v3 round 18, second repair: review record,
 running-tree rule sentence, re-pinned draft tree and test record

protocol-core-draft.json, after the study repair 28fafe84:

- review_record: one new round-18 entry (2026-10-01) for the cross-family
  re-check of the first repair (GPT-6.1 Sol, effort max, Codex 0.159.2,
  changes-needed) and its four findings R2-1 to R2-4. It states the repair,
  the failing-first output (Ran 46 tests, FAILED (failures=64, errors=9)),
  the direct reproductions at 406ad3c5, the six mutants with the tests that
  kill them, and what is not changed. It corrects three sentences of the
  earlier round-18 entry, which is left as written.
- run_discipline.study_code.rule: one sentence on how core.guards.running_tree
  establishes the tree a run names, and that it checks once per run.
- run_discipline.study_code.draft_tree_at_this_revision, test_record and
  freeze_acceptance entry 7: draft tree b1cd175496c258e9c899737996981304b331ae5c,
  407 tests (Ran 407 tests in 296.620s, OK).

Status stays draft_pending_independent_pre_outcome_review; nothing read an
outcome. manifests/evidence.json is not touched: its registration of this
file needs the coordinator's re-registration.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mover-v3/protocol-core-draft.json            | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index ab4b634a0..16341c516 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -576,14 +576,14 @@
   },
   "run_discipline": {
     "study_code": {
-      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend.",
+      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend. Review round 18, second repair (R2-2): the tree a run names is HEAD's study tree, which core.guards.running_tree returns only when git status reports no change to the study tree, no index entry of it is marked assume-unchanged or skip-worktree, and every file of that tree is a regular file in the working copy whose own bytes hash to its blob (git hash-object --no-filters, which reads neither the index nor a filter). The check runs once, when a run builds its context: a file changed later in the same run is not detected.",
       "path": "blueprints/us-equities/mover-v3/study/",
       "fetch_path": "blueprints/us-equities/mover-v3/study/fetch/",
       "tree": null,
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "6cb88f03b45fad24f0fb95568b21e2834b9cdc17",
+        "tree": "b1cd175496c258e9c899737996981304b331ae5c",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
@@ -591,11 +591,11 @@
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
         "date": "2026-10-01",
-        "tree": "6cb88f03b45fad24f0fb95568b21e2834b9cdc17",
+        "tree": "b1cd175496c258e9c899737996981304b331ae5c",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
         "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
         "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
-        "tests_run": 395,
+        "tests_run": 407,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -1169,6 +1169,12 @@
       "round": 18,
       "input": "Independent pre-outcome reviews of PR #360 (round 18 at af38dced). Claude Opus (2026-09-30): H1 (high), the dry-run seal binding had no study tree. A tree whose change lies outside the plan code (study/fetch/, core/driver.py) adopted, without a request, the seal that a failed run of another tree left. run.py's finally block writes a failed end line, so the next run opens a new start line. The output and run-log line then named the new tree although its transport never ran, so the F12 calibration could come from another tree's transport (freeze_preconditions[8] wants the tree the freeze pins to fetch). M1 (medium): the matched identity held the current run's fetch date, which changes neither the plan nor the fetch, so a retry on a later UTC day was refused for good, and the round-18 test asserted that rule. Lows: L1, a ledger cut after the attempt-0 stamp of a re-fetched request passed set(state) == set(req); L2, zlib.error, TypeError, AttributeError and an OSError outside the try escaped the SealError wrapping; L3, the holdout label's seed case was refused at 'stage' first; L4, the literature entry cited a path that exists only on PR #358's branch; L5, the draft tree and test record were stale. GPT-6.1 Sol (native Codex 0.159.2, effort ultra, 2026-10-01): G-H (high), recovery read each seal under a sha256 computed from the ledger being checked, so a page replaced together with its ledger digests was adopted and turned a failing transport check into a pass after one provider call. G-M (medium): removing the request-record comparisons, or the source binding from the live-sample source digest, left every recovery test passing.",
       "resolution": "core/store.py: Store.write(seal_record=True) publishes a seal record (seal.json) once, before the ledger. It holds the ledger sha256, the binding, every completion stamp as [key, attempt, status, pages], every page sha256, and the attempt and page counts. core.store.recover_seal is the only recovery path of count_only.dry_run and transport_check.seal_live_samples. It reads the ledger under the recorded sha256 (G-H) and requires the snapshot to give the record back exactly, which compares the attempt stamps exactly (L1). It then checks, separately, the identity, the request plan, and the ledger's request records against the requests the binding names (G-M). Store.read checks every completion stamp's page count against its attempt's page events, and every refusal is a SealError naming the dry run or the live-sample label (L2). The repair also made three changes that this record first left unnamed: test_record.command records the env-prefixed -B command that was run and gains a command_note field; Store.read refuses a second completion stamp for one (key, attempt) in every snapshot it reads, of every type, not only in recoverable seals; and Store.write refuses a directory that already holds seal.json. The dry-run identity is {study_tree, protocol_sha256, runtime_lock_sha256, sessions, symbols, requests}, with the first three from core.runner.seal_run_identity (H1). Its fetch start (utc_start) is bound beside the identity, read back into the output as fetch_utc_start and never matched (M1). Each live sample adds the same three to its label, seed, source digest (binding, requests, attempts) and requests. Residuals, recorded and not fixed: (1) seal.json is a write-once record inside the snapshot directory, not an external anchor. While it is intact, recovery refuses a page replaced with its ledger digests, a cut ledger and a ledger whose durations or vintages changed, but a consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted: nothing here resists a writer who rewrites seal.json. (2) core.holdout.collect still reads its seal under a digest of its own ledger, the G-H pattern on another path; it predates this round. (3) The orphan-output adoption paths (run.py dry-run and transport-check) verify the seals against the sha256 values named in the output body, not against seal.json. Tests in tests/test_seal_recovery.py: two command-level regressions written first. At af38dced the H1 case fails with 'AssertionError: SealError not raised' and the M1 case errors with 'SealError: dry-run snapshot binding differs from the requested dry run' (Ran 10 tests, FAILED (failures=1, errors=1)). Fifteen unit cases. For the dry run: a later-day retry; another study tree, protocol or runtime lock; a changed plan for the same sessions and symbols; a missing or mismatched seal record; a ledger with altered fetch times; a page replaced with its ledger digests; a resealed request change; a resealed stamp page count; a ledger cut after a re-fetched request's first stamp; unreadable snapshots. For the live samples: run-wide changes sealed into a mixed root, so that each label's own refusal is asserted (L3); a missing seal record; altered fetch times; a resealed request change; and the GPT experiment end to end through reproduction_check. Reproduced directly at af38dced (not committed): passes false, then true after the page and digest replacement, with 1 provider call in all; an edited duration accepted (measured elapsed 0.002 s to 16000.002 s); the cut ledger accepted; zlib.error, AttributeError and IsADirectoryError escaping. At the repair each refuses as a SealError. Mutants, each killed by its named test: study_tree removed from the dry-run identity (test_another_study_tree_protocol_or_runtime_lock_refuses and the command-level H1 test); the fetch date matched again (test_a_retry_on_a_later_utc_day_adopts_the_seal_and_reads_back_its_fetch_start and the command-level M1 test); the plan-change check removed (test_a_changed_request_plan_with_the_same_sessions_and_symbols_refuses); the request-equality check removed (test_a_resealed_request_change_refuses, dry run and live samples); recovery hashing the current ledger instead of the seal record (test_a_ledger_with_altered_fetch_times_refuses_against_its_seal_record, dry run and live samples); the source binding omitted from the live digest (test_mismatched_or_missing_binding_refuses_without_requests, change source_binding). L4: the round-18 literature entry cites PR #358 (not yet on main), 7e29448d:evidence/artifacts/trading-convergence-20260926/papers-strategy.md; the merge order is the coordinator's decision. L5: run_discipline.study_code.draft_tree_at_this_revision and test_record name the repaired tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17 and 395 tests. The GPT review also confirmed, against the primary manuscripts, the LPS 2019 (eprints.lse.ac.uk/87481, section 3, pp. 9-10) and ABJK 2022 (September 2021 manuscript, section 3, p. 10 and section 4.2.2, p. 18) sample definitions that the round-18 literature correction states. Follow-up, 2026-10-01: an independent verification of this repair passed it with five low findings, and four are repaired. The rule sentences in freeze_preconditions and run_discipline.transport_deviations said that an altered snapshot refuses; they now say that it is refused when its seal.json is intact, and state residual (1). The seal record's per-page sha256 comparison had no test (emptying page_sha256s in core.store.seal_record_of passed all 393 tests at 5a1d4b0e): test_a_resealed_page_replacement_refuses (dry run, and each live-sample label) replaces a page with its ledger digests, reseals only the ledger_sha256 of seal.json, and asserts the refusal 'the snapshot differs from its seal record', no transport call and unchanged bytes. Under that mutant the suite now fails in this test's three cases and nowhere else (Ran 395 tests, FAILED (failures=3)). This record now names the three changes above and lists its residuals, and a stray git-ignored bytecode directory (scripts/__pycache__) was deleted from the review worktree, which changes no tracked file. Protocol: the dry-run sentence of freeze_preconditions and run_discipline.transport_deviations. Study suite: 395 tests OK. Synthetic tests only; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+    },
+    {
+      "date": "2026-10-01",
+      "round": 18,
+      "input": "Cross-family re-check of the round-18 repair of PR #360 at 406ad3c5 (the repair 1e3fd5a1 with origin/main at 3361b342 merged in; study tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17). GPT-6.1 Sol (cx/gpt-6.1-sol, effort max, Codex 0.159.2, read-only, through the packaged lane on OmniRoute, tools/sota-convergence/landscape-sweep/codex_call.sh), 2026-10-01 03:42-04:18Z. Verdict: changes needed; four findings, each reproduced by the reviewer's own probe. R2-1 (high): a seal record whose ledger_sha256 is JSON null turned ledger verification off. core.store._recover_seal passed the recorded value to Store.read, which compares no digest when it is given None, and seal_record_of gave the null back, so the record comparison passed too. R2-2 (high): the study tree in a seal identity could differ from the files that ran. core.guards.running_tree returned HEAD's study tree whenever git status reported no change, and git status reports none for a tracked file whose index entry is marked assume-unchanged or skip-worktree; core.runner.seal_run_identity copies that tree into every seal identity, so H1's binding could be bypassed. R2-3 (medium): a snapshot path that was a regular file held no ledger, pages or seal record, so it counted as unused; the caller fetched again and Store.write then raised NotADirectoryError, outside SealError. R2-4 (medium): two stamp controls had no test. Mutant A (st['attempt'] replaced by 0 in seal_record_of's stamp entries) passed all 27 recovery tests, and mutant B (Store.read's refusal of a second completion stamp removed) passed the 393 tests the reviewer ran. The same re-check confirmed that the seven mutants the earlier entry names are killed by their named tests, that its three residuals are stated accurately, and that the protocol status and the recorded draft tree were correct.",
+      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, and a symbolic-link or submodule entry are refused. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths. run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes; residual (4) lists what still fails after a fetch. (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests, written first, in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py (12 tests). On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. After the repair the three modules give 'Ran 46 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed and test_running_tree_refuses_a_committed_symbolic_link (Ran 44 tests, FAILED (failures=8), all 'Refused not raised'). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 44 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag). (4) Non-directory refusal removed: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 36 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 36 tests, FAILED (failures=2), 'SealError not raised'). Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) recover_seal looks neither above the snapshot path nor at other entries in it. Measured after the repair: under a snapshot root that is a regular file the dry run still makes 16 provider calls before Store.write raises NotADirectoryError; in a snapshot directory that holds only a stray ledger.jsonl.tmp or seal.json.tmp it makes 16 calls before Store.write raises FileExistsError, and the pages it wrote make the next run refuse the directory as partially written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit. Protocol: run_discipline.study_code.rule gains the R2-2 sentence; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the repaired tree b1cd175496c258e9c899737996981304b331ae5c and 407 tests ('Ran 407 tests in 296.620s', 'OK'). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1223,7 +1229,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 395 tests, 0 failures, 0 errors, 0 skips at draft tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17 (2026-10-01); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 407 tests, 0 failures, 0 errors, 0 skips at draft tree b1cd175496c258e9c899737996981304b331ae5c (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,

From ba1068345a595b862a9439659a6a83230639a411 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 01:11:26 -0400
Subject: [PATCH 08/15] Mover v3 round 18, second repair follow-up: the tree's
 blobs are read without replace refs; three content-check tests

Found by a direct probe of the repair's own content check (28fafe84), before
any re-review. With a replace ref on HEAD's study tree object (git-replace(1)),
git reads another tree in its place: git status reports nothing for files that
match that other tree, no index flag is set, and git ls-tree lists its blobs
under the id of HEAD's tree. running_tree compared the files with those blobs
and returned HEAD's tree. It now reads the tree id and lists the tree with
git --no-replace-objects, so the blobs compared are the tree's own.

Tests (tests/test_guards.py): the replace-ref state, which failed first with
'AssertionError: Refused not raised' (Ran 13 tests, FAILED (failures=1)); a
tracked file name with a line break, refused before git hash-object
--stdin-paths is given any path; and git hash-object exiting with an error or
printing one hash too few, which refuses the tree. The last two cover branches
of the content check that no test reached.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/study/core/guards.py | 16 +++---
 .../mover-v3/study/tests/test_guards.py       | 49 +++++++++++++++++++
 2 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/core/guards.py b/blueprints/us-equities/mover-v3/study/core/guards.py
index 47e22375b..6017515c7 100644
--- a/blueprints/us-equities/mover-v3/study/core/guards.py
+++ b/blueprints/us-equities/mover-v3/study/core/guards.py
@@ -70,10 +70,11 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
 
     Review round 18, second repair (R2-2): git status alone does not show that the working copy is HEAD's. It reports
     no change to a tracked file whose index entry is marked assume-unchanged or skip-worktree (git-update-index(1)),
-    nor one that a clean filter maps back to the committed bytes. So an index entry with either flag is refused, and
-    every file of the tree returned must be a regular file whose own bytes hash to its blob, read without the index
-    and without filters. Both checks run here, once, when a run builds its context: a file changed later in the same
-    run is not seen."""
+    nor one that a clean filter maps back to the committed bytes, nor files that match a tree which a replace ref puts
+    in place of HEAD's (git-replace(1)). So an index entry with either flag is refused, and every file of the tree
+    returned must be a regular file whose own bytes hash to its blob: the tree is read without replace refs, and the
+    files without the index and without filters. Both checks run here, once, when a run builds its context: a file
+    changed later in the same run is not seen."""
     dirty = git(repo, "status", "--porcelain", "--untracked-files=all", "--", study_path)
     if dirty:
         raise Refused("the study tree has uncommitted changes; a run executes a committed tree only")
@@ -86,7 +87,7 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     if masked:
         raise Refused(f"the study tree holds index entries that hide a file's changes from git status: {masked[:5]}; "
                       "a run executes a committed tree only")
-    tree = git(repo, "rev-parse", f"HEAD:{study_path}")
+    tree = git(repo, "--no-replace-objects", "rev-parse", f"HEAD:{study_path}")
     unverified = _unverified_files(repo, tree, study_path)
     if unverified:
         raise Refused(f"the study tree's files are not all regular files that hold the committed bytes, although git "
@@ -115,8 +116,9 @@ def _unverified_files(repo, tree: str, study_path: str) -> list:
     problem. An entry must be a regular-file blob: a symbolic link or submodule entry is refused, because the tree hash
     covers a link's text and not the file it names. Its working file must be a regular file, and its bytes must hash to
     the entry's blob. One git hash-object --no-filters --stdin-paths call hashes the files themselves, so the result
-    depends on no index entry (its flags or its cached stat data) and on no clean filter."""
-    out = subprocess.check_output(["git", "-C", str(repo), "ls-tree", "-r", "-z", tree])
+    depends on no index entry (its flags or its cached stat data) and on no clean filter. The tree is listed with git
+    --no-replace-objects, so the blobs are its own and not those of a tree that a replace ref puts in its place."""
+    out = subprocess.check_output(["git", "-C", str(repo), "--no-replace-objects", "ls-tree", "-r", "-z", tree])
     problems, paths, blobs = [], [], []
     for row in out.split(b"\0"):
         if not row:
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_guards.py b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
index a1cb4bf29..392eff4bb 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_guards.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
@@ -123,6 +123,55 @@ def test_running_tree_refuses_a_committed_symbolic_link(self):
             with self.assertRaisesRegex(guards.Refused, re.escape(f"{link} is a symbolic link or submodule entry")):
                 guards.running_tree(repo)
 
+    def test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree(self):
+        """The blobs compared are those of the tree returned, read without replace refs (git-replace(1); git
+        --no-replace-objects). With a replace ref on HEAD's study tree object, git reads another tree in its place:
+        git status reports nothing for files that match that other tree, no index flag is set, and git ls-tree lists
+        its blobs under the id of HEAD's tree. At 28fafe84 the content check compared the files with those blobs and
+        running_tree returned HEAD's tree."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, _):
+            head, tree = sh(repo, "rev-parse", "HEAD"), sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
+            (repo / TRANSPORT).write_text("HOST = 'changed'\n")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "another tree")
+            sh(repo, "replace", tree, sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"))
+            sh(repo, "reset", "-q", "--soft", head)         # HEAD names the first tree; the files are the second's
+            self.assertEqual(sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+            self.assertEqual((status(repo), (repo / TRANSPORT).read_text()), ("", "HOST = 'changed'\n"))
+            self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
+            with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} differs from HEAD's blob")):
+                guards.running_tree(repo)
+
+    def test_running_tree_refuses_a_file_name_that_one_line_cannot_carry(self):
+        """git hash-object --stdin-paths reads one path per line, so a tracked file whose name holds a control
+        character (here a line break) is refused by name, before any path is handed to it."""
+        from tests import fixture_repo as FR
+        with self.study_repo() as (repo, _):
+            FR.write(repo / STUDY_PATH / "core" / "two\nlines.py", "y = 1\n")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "a line break in a file name")
+            self.assertEqual(status(repo), "")
+            with self.assertRaisesRegex(guards.Refused, "lines.py' has a control character in its name"):
+                guards.running_tree(repo)
+
+    def test_running_tree_refuses_when_git_does_not_hash_every_file(self):
+        """The content check fails closed: if git hash-object exits with an error, or prints fewer hashes than the
+        files it was given, the tree is refused, whatever the hashes it did print."""
+        real = subprocess.run
+
+        def altered(change):
+            def run(command, *args, **kwargs):
+                done = real(command, *args, **kwargs)
+                return change(done) if "hash-object" in command else done
+            return run
+        cases = {"an_error_exit": lambda done: subprocess.CompletedProcess(done.args, 128, done.stdout, b"fatal: x"),
+                 "one_hash_short": lambda done: subprocess.CompletedProcess(
+                     done.args, 0, done.stdout.split(b"\n", 1)[0] + b"\n", done.stderr)}
+        for case, change in cases.items():
+            with self.subTest(case=case), self.study_repo() as (repo, _):
+                with mock.patch.object(guards.subprocess, "run", altered(change)), \
+                        self.assertRaisesRegex(guards.Refused, "git hash-object could not read every tracked file"):
+                    guards.running_tree(repo)
+
 
 class Guards(unittest.TestCase):
     def test_require_frozen_and_matching_tree(self):

From 7acb6944c152db6339a10336fd7ff39cc5427928 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 01:22:53 -0400
Subject: [PATCH 09/15] Mover v3 round 18, second repair follow-up: review
 record and pins for the final study tree

protocol-core-draft.json, after the study follow-up ba106834:

- review_record: the second-repair entry of 2026-10-01 (added in f1fcffe1,
  not yet reviewed) now also records the replace-ref state found by a direct
  probe of the content check at 28fafe84, its fix (git --no-replace-objects),
  the three follow-up tests, the mutant runs repeated on the final tree
  (content check removed: Ran 47 tests, FAILED (failures=12); index-flag
  refusal removed: Ran 47 tests, FAILED (failures=11)) and three more mutants,
  and two more residuals: what running_tree does not check, and an untracked
  file that git status does not report when core.worktree points elsewhere.
- run_discipline.study_code.rule: the R2-2 sentence names the read without
  replace refs.
- draft_tree_at_this_revision, test_record and freeze_acceptance entry 7:
  draft tree 61f939b1c98844875f79feb3512f0119b9e65fc1, 410 tests
  (Ran 410 tests in 302.526s, OK).

Relative to 406ad3c5 the protocol gains one review_record entry. Status stays
draft_pending_independent_pre_outcome_review; nothing read an outcome.
manifests/evidence.json is not touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/protocol-core-draft.json    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index 16341c516..e88d0ca44 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -576,14 +576,14 @@
   },
   "run_discipline": {
     "study_code": {
-      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend. Review round 18, second repair (R2-2): the tree a run names is HEAD's study tree, which core.guards.running_tree returns only when git status reports no change to the study tree, no index entry of it is marked assume-unchanged or skip-worktree, and every file of that tree is a regular file in the working copy whose own bytes hash to its blob (git hash-object --no-filters, which reads neither the index nor a filter). The check runs once, when a run builds its context: a file changed later in the same run is not detected.",
+      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend. Review round 18, second repair (R2-2): the tree a run names is HEAD's study tree, which core.guards.running_tree returns only when git status reports no change to the study tree, no index entry of it is marked assume-unchanged or skip-worktree, and every file of that tree is a regular file in the working copy whose own bytes hash to its blob (git hash-object --no-filters, which reads neither the index nor a filter; the tree is read with git --no-replace-objects, so no replace ref stands in for it). The check runs once, when a run builds its context: a file changed later in the same run is not detected.",
       "path": "blueprints/us-equities/mover-v3/study/",
       "fetch_path": "blueprints/us-equities/mover-v3/study/fetch/",
       "tree": null,
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "b1cd175496c258e9c899737996981304b331ae5c",
+        "tree": "61f939b1c98844875f79feb3512f0119b9e65fc1",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
@@ -591,11 +591,11 @@
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
         "date": "2026-10-01",
-        "tree": "b1cd175496c258e9c899737996981304b331ae5c",
+        "tree": "61f939b1c98844875f79feb3512f0119b9e65fc1",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
         "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
         "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
-        "tests_run": 407,
+        "tests_run": 410,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -1174,7 +1174,7 @@
       "date": "2026-10-01",
       "round": 18,
       "input": "Cross-family re-check of the round-18 repair of PR #360 at 406ad3c5 (the repair 1e3fd5a1 with origin/main at 3361b342 merged in; study tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17). GPT-6.1 Sol (cx/gpt-6.1-sol, effort max, Codex 0.159.2, read-only, through the packaged lane on OmniRoute, tools/sota-convergence/landscape-sweep/codex_call.sh), 2026-10-01 03:42-04:18Z. Verdict: changes needed; four findings, each reproduced by the reviewer's own probe. R2-1 (high): a seal record whose ledger_sha256 is JSON null turned ledger verification off. core.store._recover_seal passed the recorded value to Store.read, which compares no digest when it is given None, and seal_record_of gave the null back, so the record comparison passed too. R2-2 (high): the study tree in a seal identity could differ from the files that ran. core.guards.running_tree returned HEAD's study tree whenever git status reported no change, and git status reports none for a tracked file whose index entry is marked assume-unchanged or skip-worktree; core.runner.seal_run_identity copies that tree into every seal identity, so H1's binding could be bypassed. R2-3 (medium): a snapshot path that was a regular file held no ledger, pages or seal record, so it counted as unused; the caller fetched again and Store.write then raised NotADirectoryError, outside SealError. R2-4 (medium): two stamp controls had no test. Mutant A (st['attempt'] replaced by 0 in seal_record_of's stamp entries) passed all 27 recovery tests, and mutant B (Store.read's refusal of a second completion stamp removed) passed the 393 tests the reviewer ran. The same re-check confirmed that the seven mutants the earlier entry names are killed by their named tests, that its three residuals are stated accurately, and that the protocol status and the recorded draft tree were correct.",
-      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, and a symbolic-link or submodule entry are refused. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths. run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes; residual (4) lists what still fails after a fetch. (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests, written first, in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py (12 tests). On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. After the repair the three modules give 'Ran 46 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed and test_running_tree_refuses_a_committed_symbolic_link (Ran 44 tests, FAILED (failures=8), all 'Refused not raised'). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 44 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag). (4) Non-directory refusal removed: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 36 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 36 tests, FAILED (failures=2), 'SealError not raised'). Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) recover_seal looks neither above the snapshot path nor at other entries in it. Measured after the repair: under a snapshot root that is a regular file the dry run still makes 16 provider calls before Store.write raises NotADirectoryError; in a snapshot directory that holds only a stray ledger.jsonl.tmp or seal.json.tmp it makes 16 calls before Store.write raises FileExistsError, and the pages it wrote make the next run refuse the directory as partially written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit. Protocol: run_discipline.study_code.rule gains the R2-2 sentence; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the repaired tree b1cd175496c258e9c899737996981304b331ae5c and 407 tests ('Ran 407 tests in 296.620s', 'OK'). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, a file name with a control character (git hash-object reads one path per line), a symbolic-link or submodule entry, and a git hash-object call that fails or prints too few hashes are refused. It reads the tree id and lists the tree with git --no-replace-objects, so the blobs compared are the tree's own. That option came in a follow-up commit of this repair (ba106834), after a direct probe of the content check as first committed (28fafe84): with a replace ref on HEAD's study tree object (git replace), git status reported nothing for files that matched the replacement tree, no index flag was set, git ls-tree listed the replacement's blobs under the id of HEAD's tree, and running_tree returned HEAD's tree. It belongs to R2-2: it is the correctness of the content check that this repair adds for R2-2, not a fifth finding. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths; git(1) --no-replace-objects and git-replace(1). run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes; residual (4) lists what still fails after a fetch. (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests: 15 in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py, 12 of them written first. On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. The follow-up added three tests to tests/test_guards.py: the replace-ref state, which failed first at 28fafe84 ('Ran 13 tests in 3.251s', 'FAILED (failures=1)', 'AssertionError: Refused not raised'), and two for branches of the content check that no test reached (a line break in a tracked file name; git hash-object exiting with an error or printing one hash too few), which pass at 28fafe84 and have mutants (8) and (9) as their failing evidence. After the repair the three modules give 'Ran 49 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. (1), (4), (5) and (6) ran at 28fafe84, and core/store.py and their tests are unchanged since; the others ran at ba106834. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed, test_running_tree_refuses_a_committed_symbolic_link, test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree, test_running_tree_refuses_a_file_name_that_one_line_cannot_carry and test_running_tree_refuses_when_git_does_not_hash_every_file (Ran 47 tests, FAILED (failures=12), all 'Refused not raised'). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 47 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag, which shows that the flag refusal runs first and has its own failing cases). (4) Non-directory refusal removed: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 36 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 36 tests, FAILED (failures=2), 'SealError not raised'). Three more for the follow-up, each against tests.test_guards (Ran 13 tests, FAILED (failures=1)). (7) --no-replace-objects removed from the git ls-tree call: the replace-ref test, 'Refused not raised'. (8) The control-character refusal removed: its test fails on the message, because git hash-object then fails and that branch refuses the tree. (9) git hash-object's exit status ignored, and separately its count of hashes ignored: test_running_tree_refuses_when_git_does_not_hash_every_file, 'Refused not raised' in the matching case. The same option on git rev-parse has no test of its own: with a replace ref on the study tree object, both forms return the id of HEAD's tree. Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) recover_seal looks neither above the snapshot path nor at other entries in it. Measured after the repair: under a snapshot root that is a regular file the dry run still makes 16 provider calls before Store.write raises NotADirectoryError; in a snapshot directory that holds only a stray ledger.jsonl.tmp or seal.json.tmp it makes 16 calls before Store.write raises FileExistsError, and the pages it wrote make the next run refuse the directory as partially written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit, and it does not recompute the tree's id from the files: it takes the tree and blob ids that git reads from the object store. (6) A file that is not in the tree is seen only through git status (the untracked and ignored-file checks of review round 9, F9, which this repair does not change), and git status reads the work tree that git is configured with. Probed, not committed: with core.worktree pointing at another clean copy of the files, an untracked package core/a/__init__.py in the study directory, which would shadow core/a.py on import, was not reported and running_tree returned the tree. A change to a tracked file is still refused there, because the content check reads the files under the repository path it is given. Protocol: run_discipline.study_code.rule gains the R2-2 sentence; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the repaired tree 61f939b1c98844875f79feb3512f0119b9e65fc1 and 410 tests ('Ran 410 tests in 302.526s', 'OK'; at 28fafe84, before the follow-up, 'Ran 407 tests in 296.620s', 'OK'). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1229,7 +1229,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 407 tests, 0 failures, 0 errors, 0 skips at draft tree b1cd175496c258e9c899737996981304b331ae5c (2026-10-01); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 410 tests, 0 failures, 0 errors, 0 skips at draft tree 61f939b1c98844875f79feb3512f0119b9e65fc1 (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,

From 89f64e245a7cad26a2cdb4123ca54b176de33af5 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 01:38:26 -0400
Subject: [PATCH 10/15] Mover v3 round 18, second repair, coordinator
 follow-up: unused-path rule (F1), replace refs ignored by every guard (F2)

Two bounded items from the coordinator's ruling on the second repair.

F1 closes R2-3's class. core.store.recover_seal treats a snapshot path as
unused only if it is absent and its nearest existing ancestor is a directory,
or it is an empty directory. A path under a regular file or a dangling link,
and a directory that holds anything without a ledger (a stray
ledger.jsonl.tmp or seal.json.tmp, any other file), are refused as a
SealError before any fetch. The 'partially written' and 'exists and is not a
directory' refusals keep their wording. At 7acb6944 the first two shapes made
the dry run fetch (16 calls) before Store.write failed with NotADirectoryError
or FileExistsError.

F2 moves --no-replace-objects from two calls in running_tree into
core.guards.git_command, which now builds every git command the module runs
(git, git_ok, committed_bytes, verified_merge and the running-tree checks),
so the tree diff behind transport deviations, committed_bytes and every
rev-parse, log and show read the repository's own objects (git(1);
git-replace(1)).

Tests, written first (Ran 57 tests, FAILED (failures=7, errors=8) at
7acb6944): for the dry run and the live samples, a regular file or dangling
link as the snapshot root, a directory holding only a stray file, and unused
paths that are still fetched into and sealed; committed_bytes and
fetch_only_diff under a replace ref. The earlier replace-ref test is kept:
with every git command ignoring replace refs, git status itself now reports
the files as changed, so that is the refusal it asserts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/study/core/guards.py |  40 ++++---
 .../us-equities/mover-v3/study/core/store.py  |  40 +++++--
 .../mover-v3/study/tests/test_guards.py       |  64 ++++++++++-
 .../study/tests/test_seal_recovery.py         | 103 +++++++++++++++++-
 4 files changed, 215 insertions(+), 32 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/core/guards.py b/blueprints/us-equities/mover-v3/study/core/guards.py
index 6017515c7..aba12d8b0 100644
--- a/blueprints/us-equities/mover-v3/study/core/guards.py
+++ b/blueprints/us-equities/mover-v3/study/core/guards.py
@@ -17,6 +17,10 @@
 time comes only from a commit signed by the pinned GitHub web-flow key (verified_merge, M3); a transport deviation
 governs only with the hashed output of a logged run.py transport-check run (check_study_tree, H1); void deviations
 are typed (voids, F4); and every locked package's version and dist-info RECORD digest is checked (check_runtime, L3).
+
+Review round 18, second repair: the running tree is HEAD's only when no index flag hides a tracked file and every
+tracked file's own bytes are its blob (running_tree, R2-2), and every git command this module runs ignores replace
+refs (git_command, follow-up F2), so each guard reads the repository's own commits, trees and blobs.
 """
 from __future__ import annotations
 
@@ -45,12 +49,21 @@ class Refused(Exception):
     pass
 
 
+def git_command(repo, *args) -> list:
+    """The argument list of every git command this module runs (git, git_ok, committed_bytes, verified_merge and the
+    running-tree checks). Review round 18, second repair, follow-up F2: --no-replace-objects (git(1)) makes git ignore
+    replace refs (git-replace(1)), with which a local refs/replace entry puts another commit, tree or blob in place of
+    the one a guard names. So a guard reads the repository's own objects: the tree a run names, the protocol and logs
+    at a commit, the tree diff behind a transport deviation, the commits whose times and signatures it uses."""
+    return ["git", "--no-replace-objects", "-C", str(repo), *args]
+
+
 def git(repo, *args) -> str:
-    return subprocess.check_output(["git", "-C", str(repo), *args], text=True).strip()
+    return subprocess.check_output(git_command(repo, *args), text=True).strip()
 
 
 def git_ok(repo, *args) -> bool:
-    return subprocess.run(["git", "-C", str(repo), *args], stdout=subprocess.DEVNULL,
+    return subprocess.run(git_command(repo, *args), stdout=subprocess.DEVNULL,
                           stderr=subprocess.DEVNULL).returncode == 0
 
 
@@ -58,7 +71,7 @@ def committed_bytes(repo, ref: str, path: str):
     """The bytes of path at ref, or None if the path does not exist there."""
     if not git_ok(repo, "cat-file", "-e", f"{ref}:{path}"):
         return None
-    return subprocess.check_output(["git", "-C", str(repo), "show", f"{ref}:{path}"])
+    return subprocess.check_output(git_command(repo, "show", f"{ref}:{path}"))
 
 
 # ---------------------------------------------------------------- the running tree
@@ -72,9 +85,9 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     no change to a tracked file whose index entry is marked assume-unchanged or skip-worktree (git-update-index(1)),
     nor one that a clean filter maps back to the committed bytes, nor files that match a tree which a replace ref puts
     in place of HEAD's (git-replace(1)). So an index entry with either flag is refused, and every file of the tree
-    returned must be a regular file whose own bytes hash to its blob: the tree is read without replace refs, and the
-    files without the index and without filters. Both checks run here, once, when a run builds its context: a file
-    changed later in the same run is not seen."""
+    returned must be a regular file whose own bytes hash to its blob: the tree is read without replace refs
+    (git_command), and the files without the index and without filters. Both checks run here, once, when a run builds
+    its context: a file changed later in the same run is not seen."""
     dirty = git(repo, "status", "--porcelain", "--untracked-files=all", "--", study_path)
     if dirty:
         raise Refused("the study tree has uncommitted changes; a run executes a committed tree only")
@@ -87,7 +100,7 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
     if masked:
         raise Refused(f"the study tree holds index entries that hide a file's changes from git status: {masked[:5]}; "
                       "a run executes a committed tree only")
-    tree = git(repo, "--no-replace-objects", "rev-parse", f"HEAD:{study_path}")
+    tree = git(repo, "rev-parse", f"HEAD:{study_path}")
     unverified = _unverified_files(repo, tree, study_path)
     if unverified:
         raise Refused(f"the study tree's files are not all regular files that hold the committed bytes, although git "
@@ -99,7 +112,7 @@ def _masked_index_entries(repo, study_path: str) -> list:
     """Every index entry under study_path that is marked assume-unchanged or skip-worktree, as '<path> (<flags>)'.
     git-ls-files(1) -v prints the tag of an assume-unchanged entry in lowercase and that of a skip-worktree entry as S
     (s with both flags)."""
-    out = subprocess.check_output(["git", "-C", str(repo), "ls-files", "-v", "-z", "--", study_path])
+    out = subprocess.check_output(git_command(repo, "ls-files", "-v", "-z", "--", study_path))
     masked = []
     for row in out.split(b"\0"):
         if row:
@@ -116,9 +129,10 @@ def _unverified_files(repo, tree: str, study_path: str) -> list:
     problem. An entry must be a regular-file blob: a symbolic link or submodule entry is refused, because the tree hash
     covers a link's text and not the file it names. Its working file must be a regular file, and its bytes must hash to
     the entry's blob. One git hash-object --no-filters --stdin-paths call hashes the files themselves, so the result
-    depends on no index entry (its flags or its cached stat data) and on no clean filter. The tree is listed with git
-    --no-replace-objects, so the blobs are its own and not those of a tree that a replace ref puts in its place."""
-    out = subprocess.check_output(["git", "-C", str(repo), "--no-replace-objects", "ls-tree", "-r", "-z", tree])
+    depends on no index entry (its flags or its cached stat data) and on no clean filter. The tree is listed without
+    replace refs (git_command), so the blobs are its own and not those of a tree that a replace ref puts in its
+    place."""
+    out = subprocess.check_output(git_command(repo, "ls-tree", "-r", "-z", tree))
     problems, paths, blobs = [], [], []
     for row in out.split(b"\0"):
         if not row:
@@ -143,7 +157,7 @@ def _unverified_files(repo, tree: str, study_path: str) -> list:
                     problems.append(f"{path} is not a regular file")
     if paths:
         base = Path(repo).resolve()
-        hashed = subprocess.run(["git", "-C", str(repo), "hash-object", "--no-filters", "--stdin-paths"],
+        hashed = subprocess.run(git_command(repo, "hash-object", "--no-filters", "--stdin-paths"),
                                 input=b"".join(os.fsencode(str(base / p)) + b"\n" for p in paths),
                                 capture_output=True)
         got = hashed.stdout.decode("ascii", "replace").split()
@@ -196,7 +210,7 @@ def verified_merge(repo, commit: str, key: dict | None = None) -> bool:
     email = git(repo, "show", "-s", "--format=%ce", commit)
     if email == key["committer_email"]:
         env = {"GNUPGHOME": _gnupg_home(key), "PATH": __import__("os").environ.get("PATH", "/usr/bin:/bin")}
-        res = subprocess.run(["git", "-C", str(repo), "-c", "gpg.program=gpg", "verify-commit", "--raw", commit],
+        res = subprocess.run(git_command(repo, "-c", "gpg.program=gpg", "verify-commit", "--raw", commit),
                              capture_output=True, text=True, env=env)
         for line in res.stderr.splitlines():
             parts = line.split()
diff --git a/blueprints/us-equities/mover-v3/study/core/store.py b/blueprints/us-equities/mover-v3/study/core/store.py
index 273509716..759e1b955 100644
--- a/blueprints/us-equities/mover-v3/study/core/store.py
+++ b/blueprints/us-equities/mover-v3/study/core/store.py
@@ -11,8 +11,9 @@
 Every completion stamp's page count equals its attempt's page events. Review round 18 repair (G-H): a recoverable
 seal (the native dry run, a transport-check live sample) also publishes its seal record, seal.json, once and before
 the ledger, and recover_seal adopts such a seal only against that record, never against a digest of the ledger it is
-checking. Second repair (R2-1, R2-3): the record must hold a sha256 of the ledger (a null there turned the
-verification off), and a snapshot path that exists and is not a directory is refused before any fetch.
+checking. Second repair (R2-1, R2-3 and its follow-up F1): the record must hold a sha256 of the ledger (a null there
+turned the verification off), and a snapshot path is fetched into only when it is unused: absent under a directory, or
+an empty directory. Anything else without a ledger is refused before any fetch.
 """
 from __future__ import annotations
 
@@ -86,9 +87,9 @@ def _publish(directory: Path, name: str, data: bytes) -> None:
 
 def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
     """core.holdout.collect's recover-if-matching pattern for a recoverable seal (count_only.dry_run and
-    transport_check.seal_live_samples; review round 18, R5, and its repairs). None when directory does not exist, or
-    is a directory that holds no ledger, pages directory or seal record: the caller fetches and seals. Otherwise the
-    sealed (store, sha256, binding), only when:
+    transport_check.seal_live_samples; review round 18, R5, and its repairs). None when directory is unused: it does
+    not exist and its nearest existing ancestor is a directory, or it is an empty directory. The caller then fetches
+    and seals. Otherwise the sealed (store, sha256, binding), only when:
       - the seal record exists and holds a sha256 of the ledger (64 lowercase hexadecimal characters; R2-1: a null
         there would turn Store.read's comparison off), the ledger reads under that sha256, recorded at seal time,
         never under a digest of the ledger being checked (G-H), and the snapshot read gives that record back exactly:
@@ -99,12 +100,11 @@ def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
         running study tree, protocol and runtime lock (H1) and the caller's inputs;
       - the bound request plan equals identity["requests"] (the plan-change check), and the ledger's request records
         are exactly the requests the binding names (G-M), each with its completion stamps.
-    A directory with pages or a seal record but no ledger is partially written, and a path that exists and is not a
-    directory (a regular file, a dangling symbolic link) is not unused (R2-3). Every refusal made here is a SealError
-    naming `what` (L2), and this function neither fetches nor writes. It looks neither above directory nor at any
-    other entry in it: for a path under a regular file, or a directory that holds a stray ledger.jsonl.tmp or
-    seal.json.tmp and none of the three, it returns None, and the caller's Store.write fails after the fetch with an
-    OSError (residuals recorded in the protocol's review_record, round 18)."""
+    A directory with pages or a seal record but no ledger is partially written. Nor is any of these unused: a path
+    that exists and is not a directory (a regular file, a dangling symbolic link; R2-3), a path whose nearest existing
+    ancestor is not a directory, and a directory that holds anything else without a ledger (a stray ledger.jsonl.tmp
+    or seal.json.tmp, any other file; F1, the follow-up on R2-3). Every refusal made here is a SealError naming `what`
+    (L2), made before the caller can fetch; this function neither fetches nor writes."""
     try:
         return _recover_seal(Path(directory), identity, tuple(extra))
     except SealError as exc:
@@ -114,6 +114,13 @@ def recover_seal(directory, identity: dict, what: str, extra: tuple = ()):
             from exc
 
 
+def _nearest_existing(path: Path) -> Path:
+    """path, or its nearest ancestor that exists; a dangling symbolic link exists."""
+    while not os.path.lexists(path) and path != path.parent:
+        path = path.parent
+    return path
+
+
 def _recover_seal(d: Path, identity: dict, extra: tuple):
     # review round 18, second repair (R2-3): a regular file or a dangling symbolic link at the snapshot path holds no
     # ledger, pages or seal record, but it is not an unused directory; returning None for it made the caller fetch
@@ -123,6 +130,17 @@ def _recover_seal(d: Path, identity: dict, extra: tuple):
     if not (d / "ledger.jsonl").exists():
         if (d / "pages").exists() or (d / SEAL_RECORD).exists():
             raise SealError("the snapshot is partially written: it cannot be overwritten or fetched again")
+        # follow-up F1: without a ledger, pages or seal record the path is unused only if it is an empty directory, or
+        # is absent under a directory. Under a regular file or a dangling link, or beside a stray file (a
+        # ledger.jsonl.tmp, a seal.json.tmp, anything else), Store.write would fail after the fetch, or seal beside a
+        # file it did not write
+        if d.is_dir():
+            held = sorted(entry.name for entry in d.iterdir())
+            if held:
+                raise SealError(f"the snapshot directory is not empty and holds no ledger ({held[:5]}): it cannot be "
+                                "overwritten or fetched again")
+        elif not _nearest_existing(d.parent).is_dir():
+            raise SealError("the snapshot path lies under a path that is not a directory: nothing can be sealed there")
         return None
     if not (d / SEAL_RECORD).is_file():
         raise SealError("the snapshot has no seal record, so it cannot be verified and is not adopted")
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_guards.py b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
index 392eff4bb..839f0c396 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_guards.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
@@ -124,11 +124,13 @@ def test_running_tree_refuses_a_committed_symbolic_link(self):
                 guards.running_tree(repo)
 
     def test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree(self):
-        """The blobs compared are those of the tree returned, read without replace refs (git-replace(1); git
-        --no-replace-objects). With a replace ref on HEAD's study tree object, git reads another tree in its place:
-        git status reports nothing for files that match that other tree, no index flag is set, and git ls-tree lists
-        its blobs under the id of HEAD's tree. At 28fafe84 the content check compared the files with those blobs and
-        running_tree returned HEAD's tree."""
+        """running_tree reads HEAD's own tree, without replace refs (git-replace(1); git --no-replace-objects). With a
+        replace ref on HEAD's study tree object, git reads another tree in its place: plain git status reports nothing
+        for files that match that other tree, no index flag is set, and git ls-tree lists its blobs under the id of
+        HEAD's tree. At 28fafe84 the content check compared the files with those blobs and running_tree returned
+        HEAD's tree. At ba106834 the content check listed the tree without replace refs and refused the file. Since
+        follow-up F2 every git command of core.guards ignores replace refs (git_command), so its git status already
+        reports the files as changed."""
         from tests import fixture_repo as FR
         with self.study_repo() as (repo, _):
             head, tree = sh(repo, "rev-parse", "HEAD"), sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}")
@@ -139,7 +141,9 @@ def test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree(self)
             self.assertEqual(sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
             self.assertEqual((status(repo), (repo / TRANSPORT).read_text()), ("", "HOST = 'changed'\n"))
             self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
-            with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} differs from HEAD's blob")):
+            self.assertEqual(guards.git(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+            self.assertIn(TRANSPORT, guards.git(repo, "status", "--porcelain", "--", STUDY_PATH))
+            with self.assertRaisesRegex(guards.Refused, "^the study tree has uncommitted changes"):
                 guards.running_tree(repo)
 
     def test_running_tree_refuses_a_file_name_that_one_line_cannot_carry(self):
@@ -173,6 +177,54 @@ def run(command, *args, **kwargs):
                     guards.running_tree(repo)
 
 
+class RealObjects(unittest.TestCase):
+    """Review round 18, second repair, follow-up F2: every git command core.guards runs is built by
+    core.guards.git_command with --no-replace-objects (git(1); git-replace(1)), so a guard reads the repository's own
+    commit, tree or blob and not an object that a local replace ref puts in its place. The running-tree case is
+    RunningTreeContent.test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree; these are two other
+    guards. In each, git without the option gives the replacement, which the test shows first."""
+
+    def test_committed_bytes_returns_the_real_blob_under_a_replace_ref(self):
+        """committed_bytes reads the protocol, the logs and the deviations at a commit (frozen_protocol, void_records,
+        first_reach). With a replace ref on the committed blob, git show prints the replacement."""
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.init_repo(Path(tmp) / "repo")
+            committed = FR.write(repo / PROTOCOL_PATH, json.dumps({"status": "frozen"})).read_bytes()
+            first = FR.commit_push(repo, "2026-10-01T21:30:00+00:00", "the protocol")
+            FR.write(repo / PROTOCOL_PATH, json.dumps({"status": "edited"}))
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "another protocol")
+            sh(repo, "replace", sh(repo, "rev-parse", f"{first}:{PROTOCOL_PATH}"),
+               sh(repo, "rev-parse", f"HEAD:{PROTOCOL_PATH}"))
+            self.assertEqual(json.loads(sh(repo, "show", f"{first}:{PROTOCOL_PATH}")), {"status": "edited"})
+            self.assertEqual(guards.committed_bytes(repo, first, PROTOCOL_PATH), committed)
+
+    def test_the_transport_deviation_diff_compares_the_real_trees_under_a_replace_ref(self):
+        """fetch_only_diff decides whether a running tree differs from the pinned tree only under fetch/ (the
+        transport-deviation rule, check_study_tree; run.py transport-check lists the changed paths the same way).
+        Here the trees also differ in core/a.py. With a replace ref that puts the pinned tree's core/ in place of the
+        other tree's, git diff-tree lists the transport alone."""
+        from tests import fixture_repo as FR
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = FR.init_repo(Path(tmp) / "repo")
+            FR.write(repo / STUDY_PATH / "core" / "a.py", "x = 1\n")
+            FR.write(repo / TRANSPORT, "HOST = 'fixture'\n")
+            first = FR.commit_push(repo, "2026-10-01T21:30:00+00:00", "the pinned tree")
+            FR.write(repo / STUDY_PATH / "core" / "a.py", "x = 2\n")
+            FR.write(repo / TRANSPORT, "HOST = 'changed'\n")
+            FR.commit_push(repo, "2026-10-01T22:00:00+00:00", "a tree that also changes core/")
+            pinned, tree = (sh(repo, "rev-parse", f"{commit}:{STUDY_PATH}") for commit in (first, "HEAD"))
+            self.assertEqual(sh(repo, "diff-tree", "-r", "--name-only", pinned, tree).splitlines(),
+                             ["core/a.py", "fetch/transport.py"])
+            sh(repo, "replace", sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}/core"),
+               sh(repo, "rev-parse", f"{first}:{STUDY_PATH}/core"))
+            self.assertEqual(sh(repo, "diff-tree", "-r", "--name-only", pinned, tree).splitlines(),
+                             ["fetch/transport.py"])
+            self.assertFalse(guards.fetch_only_diff(repo, pinned, tree))
+            self.assertEqual(guards.git(repo, "diff-tree", "-r", "--name-only", pinned, tree).splitlines(),
+                             ["core/a.py", "fetch/transport.py"])
+
+
 class Guards(unittest.TestCase):
     def test_require_frozen_and_matching_tree(self):
         tree = "a" * 40
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
index a2bc8bf28..782bf2835 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_seal_recovery.py
@@ -38,6 +38,10 @@
 NOT_A_SHA256 = ("null", "missing", "number", "list", "short", "trailing_newline", "uppercase", "not_hexadecimal")
 # R2-3: what can stand at a snapshot path in place of a directory
 NOT_A_DIRECTORY = ("regular_file", "dangling_link")
+# F1 (the coordinator's follow-up on R2-3): what a snapshot directory can hold without a ledger, pages or seal record
+STRAY_FILES = ("ledger.jsonl.tmp", "seal.json.tmp", "unrelated.txt")
+# F1: snapshot paths that are unused, and so are still fetched into and sealed
+FRESH_PATHS = ("absent", "absent_under_absent_directories", "empty_directory")
 
 
 def snapshot_bytes(root):
@@ -147,10 +151,22 @@ def break_record_digest(self, directory, kind):
     def replace_with_a_non_directory(self, directory, kind):
         """R2-3: the snapshot path itself stops being a directory (NOT_A_DIRECTORY)."""
         shutil.rmtree(directory)
+        self.put_a_non_directory(directory, kind)
+
+    def put_a_non_directory(self, path, kind):
+        """A regular file or a dangling symbolic link at `path` (NOT_A_DIRECTORY)."""
         if kind == "regular_file":
-            directory.write_bytes(b"not a snapshot directory\n")
+            path.write_bytes(b"not a snapshot directory\n")
         else:
-            directory.symlink_to(directory.parent / "absent-target")
+            path.symlink_to(path.parent / "absent-target")
+
+    def leave_only_a_stray_file(self, directory, name):
+        """F1: the snapshot directory holds one file that is no ledger, pages directory or seal record
+        (STRAY_FILES)."""
+        if directory.exists():
+            shutil.rmtree(directory)
+        directory.mkdir()
+        (directory / name).write_bytes(b"stray\n")
 
     def renumber_attempt(self, directory, key, old, new) -> list:
         """R2-4: one attempt of `key` gets another id, in its page events and in its completion stamp; the seal record
@@ -428,6 +444,48 @@ def test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests(self):
                 self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
                                               "^dry-run: the snapshot path exists and is not a directory")
 
+    def test_a_snapshot_root_that_is_not_a_directory_refuses_without_requests(self):
+        """F1, the first shape R2-3's repair left: the snapshot root, one level above the snapshot path, is a regular
+        file or a dangling symbolic link. The path itself does not exist, so at 7acb6944 it counted as unused: the
+        dry run made its 16 calls and Store.write then failed (NotADirectoryError for the file). A path is unused
+        only under a directory."""
+        for kind in NOT_A_DIRECTORY:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "snapshot-root"
+                self.put_a_non_directory(root, kind)
+                self.assertIn("snapshot-root", snapshot_bytes(tmp))
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(root),
+                                              "^dry-run: the snapshot path lies under a path that is not a directory")
+
+    def test_a_snapshot_directory_that_holds_only_stray_files_refuses_without_requests(self):
+        """F1, the second shape: a snapshot directory with no ledger, pages or seal record that is not empty. At
+        7acb6944 it counted as unused: with a stray ledger.jsonl.tmp or seal.json.tmp the dry run made its 16 calls
+        and Store.write then failed with FileExistsError, leaving pages behind; with any other file it fetched and
+        sealed beside it. A directory is unused only when it is empty."""
+        for stray in STRAY_FILES:
+            with self.subTest(stray=stray), tempfile.TemporaryDirectory() as tmp:
+                self.leave_only_a_stray_file(Path(tmp) / "dry-run", stray)
+                self.assert_refuses_unchanged(tmp, self.market, lambda: self.run_dry(tmp),
+                                              "^dry-run: the snapshot directory is not empty and holds no ledger")
+
+    def test_an_unused_snapshot_path_is_fetched_and_sealed(self):
+        """F1's other side: an unused path is still fetched into and sealed, and the seal is then recovered. Unused
+        means absent under an existing directory (also when several directories above it are absent) or an existing
+        empty directory."""
+        for kind in FRESH_PATHS:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "not" / "yet" / "made" if kind == "absent_under_absent_directories" else Path(tmp)
+                if kind == "empty_directory":
+                    (root / "dry-run").mkdir()
+                calls = len(self.market.calls)
+                first = self.run_dry(root)
+                self.assertGreater(len(self.market.calls), calls)
+                record = json.loads((root / "dry-run" / SEAL_RECORD).read_bytes())
+                self.assertEqual(record["ledger_sha256"], first["snapshot_sha256"])
+                before, calls = snapshot_bytes(tmp), len(self.market.calls)
+                self.assertEqual(self.run_dry(root), first)
+                self.assertEqual((self.market.calls[calls:], snapshot_bytes(tmp)), ([], before))
+
     def fail_the_last_requests_first_attempt(self) -> dict:
         """The L1 test's setup: the last request in key order fails its first call and its 3 retries, so it is sealed
         incomplete at attempt 0 and complete at attempt 1. Returns that request."""
@@ -644,6 +702,47 @@ def test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests(self):
                         tmp, self.market, lambda: self.seal_samples(tmp),
                         f"^live sample {re.escape(repr(label))}: the snapshot path exists and is not a directory")
 
+    def test_a_live_root_that_is_not_a_directory_refuses_without_requests(self):
+        """F1 for the live samples: the live root, one level above every label's path, is a regular file or a dangling
+        symbolic link. Every label lies under that one root, so the refusal names the first label."""
+        for kind in NOT_A_DIRECTORY:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "live-root"
+                self.put_a_non_directory(root, kind)
+                self.assertIn("live-root", snapshot_bytes(tmp))
+                self.assert_refuses_unchanged(
+                    tmp, self.market, lambda: self.seal_samples(root),
+                    "^live sample 'stage': the snapshot path lies under a path that is not a directory")
+
+    def test_a_label_directory_that_holds_only_stray_files_refuses_without_requests(self):
+        """F1 for each label, as the dry run's: the label's directory holds one stray file and no ledger, pages or
+        seal record. The other label's seal is adopted, and this one is refused without a request."""
+        for label in self.sources:
+            for stray in STRAY_FILES:
+                with self.subTest(label=label, stray=stray), tempfile.TemporaryDirectory() as tmp:
+                    self.seal_samples(tmp)
+                    self.leave_only_a_stray_file(Path(tmp) / label, stray)
+                    self.assert_refuses_unchanged(
+                        tmp, self.market, lambda: self.seal_samples(tmp),
+                        f"^live sample {re.escape(repr(label))}: the snapshot directory is not empty and holds no "
+                        "ledger")
+
+    def test_an_unused_label_path_is_fetched_and_sealed(self):
+        """F1's other side for the live samples: each label's unused path (absent, absent under absent directories, or
+        an existing empty directory) is fetched into once and sealed, and the seals are then recovered."""
+        for kind in FRESH_PATHS:
+            with self.subTest(kind=kind), tempfile.TemporaryDirectory() as tmp:
+                root = Path(tmp) / "not" / "yet" / "made" if kind == "absent_under_absent_directories" else Path(tmp)
+                if kind == "empty_directory":
+                    for label in self.sources:
+                        (root / label).mkdir()
+                calls = len(self.market.calls)
+                first = self.seal_samples(root)
+                self.assertEqual((len(self.market.calls) - calls, set(first)), (len(self.sources), set(self.sources)))
+                before, calls = snapshot_bytes(tmp), len(self.market.calls)
+                self.assertEqual(self.seal_samples(root), first)
+                self.assertEqual((self.market.calls[calls:], snapshot_bytes(tmp)), ([], before))
+
     def test_a_resealed_attempt_id_change_refuses(self):
         """R2-4, mutant A, for each label: the sample's one attempt becomes attempt 7 in its page event and its
         completion stamp, with everything else kept and the seal record's ledger_sha256 resealed."""

From cd36752e8758ac7bb228330a83dc33a98cf069bb Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 01:39:36 -0400
Subject: [PATCH 11/15] Mover v3 round 18, coordinator follow-up: the
 replace-ref test asserts the refusal before its supporting observations

tests/test_guards.py only. With the helper's --no-replace-objects removed,
test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree now
fails on running_tree itself ('Refused not raised') instead of on the
supporting git status observation that preceded it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 blueprints/us-equities/mover-v3/study/tests/test_guards.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/tests/test_guards.py b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
index 839f0c396..5bc3ddeee 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_guards.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
@@ -141,10 +141,11 @@ def test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree(self)
             self.assertEqual(sh(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
             self.assertEqual((status(repo), (repo / TRANSPORT).read_text()), ("", "HOST = 'changed'\n"))
             self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
-            self.assertEqual(guards.git(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
-            self.assertIn(TRANSPORT, guards.git(repo, "status", "--porcelain", "--", STUDY_PATH))
             with self.assertRaisesRegex(guards.Refused, "^the study tree has uncommitted changes"):
                 guards.running_tree(repo)
+            # the module's own git names the same tree and, unlike plain git status above, reports the file
+            self.assertEqual(guards.git(repo, "rev-parse", f"HEAD:{STUDY_PATH}"), tree)
+            self.assertIn(TRANSPORT, guards.git(repo, "status", "--porcelain", "--", STUDY_PATH))
 
     def test_running_tree_refuses_a_file_name_that_one_line_cannot_carry(self):
         """git hash-object --stdin-paths reads one path per line, so a tracked file whose name holds a control

From ace564858df5132ddfeba34451de675ad21eea82 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 01:52:05 -0400
Subject: [PATCH 12/15] Mover v3 round 18, coordinator follow-up: review record
 and pins for the final study tree (F1, F2)

protocol-core-draft.json, after the study commits 89f64e24 and cd36752e:

- review_record: the second-repair entry of 2026-10-01 (not yet reviewed)
  now records the coordinator's two follow-up items. F1: a snapshot path is
  unused only if it is absent under a directory or an empty directory, which
  closes the residual that entry had listed as (4). F2: every git command of
  core.guards ignores replace refs, which closes the untested option on
  rev-parse and the other guards' git calls. It gives their failing-first
  output (Ran 57 tests, FAILED (failures=7, errors=8)), the mutant runs
  repeated on the final tree and the two new ones (F1's rule removed: Ran 42
  tests, FAILED (failures=5, errors=8); the helper's protection removed: Ran
  55 tests, FAILED (failures=3)), and drops the sentences those items made
  untrue.
- run_discipline.study_code.rule: the R2-2 sentences state F2's rule.
- draft_tree_at_this_revision, test_record and freeze_acceptance entry 7:
  draft tree 5ebe141ddaf1fd75b09cf4596b74568cc584535c, 418 tests
  (Ran 418 tests in 282.984s, OK).

Relative to 406ad3c5 the protocol gains one review_record entry. Status stays
draft_pending_independent_pre_outcome_review; nothing read an outcome.
manifests/evidence.json is not touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/protocol-core-draft.json    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index e88d0ca44..807923ead 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -576,14 +576,14 @@
   },
   "run_discipline": {
     "study_code": {
-      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend. Review round 18, second repair (R2-2): the tree a run names is HEAD's study tree, which core.guards.running_tree returns only when git status reports no change to the study tree, no index entry of it is marked assume-unchanged or skip-worktree, and every file of that tree is a regular file in the working copy whose own bytes hash to its blob (git hash-object --no-filters, which reads neither the index nor a filter; the tree is read with git --no-replace-objects, so no replace ref stands in for it). The check runs once, when a run builds its context: a file changed later in the same run is not detected.",
+      "rule": "The frozen protocol records study_code = {tree: the git tree hash of blueprints/us-equities/mover-v3/study/, fetch_tree: the git tree hash of blueprints/us-equities/mover-v3/study/fetch/}. It pins trees only, never a commit: the repository squash-merges, so a PR-branch commit becomes unreachable, and every run appends run-log, access-log and amendment lines outside the tree, which moves HEAD (review round 7, C5). The study tree is merged to main before the freeze pull request, which does not change it. Every run checks out a commit reachable from origin/main whose blueprints/us-equities/mover-v3/study tree equals the pinned tree (or a passing transport deviation of it), executes that tree, and reads the logs and data files of that same commit; the commit is recorded as provenance only. The tree holds the study code, the count-only code, the request plan and records (core/), the fetch transport (study/fetch/: HTTP client, authentication, pagination and retry only; review round 8, R8-1), the pinned copies (pinned_copies), the synthetic tests and study/runtime.lock. runtime.lock pins the Python version and numpy, pandas, exchange_calendars 4.13.2 and duckdb (review round 8, E1), with their dependencies. Every fetch and evaluation entry point refuses to run unless the protocol file at its fixed path has status frozen and study_code.tree equals the running tree, and unless study_code.parameters equals the code's parameters (review round 8, R8-4 and R8-2; core/guards.py, core/runner.py). The tree holds no data file (data_files). Every run, fetch and evaluator call names the tree and runtime it ran from. Development, validation and every holdout 'count' and 'read' run from this one tree, and the evaluator refuses any other (holdout_gate.evaluator_refusals). The only tree changes that keep a stage are transport deviations (transport_deviations). Review round 9: every entry point is run.py, run as python -I -B (runtime.lock run_command), which sets sys.pycache_prefix to a fresh directory before any study module is imported, so no bytecode cache in the tree is read; the tree may hold no other ignored file (F9). core.runner.context also refuses unless HEAD is reachable from origin/main and the run log, access log, deviations file and amendment files equal their origin/main content (F2; they are no longer ignored by .gitignore), and it reads the protocol from the freeze commit's blob, refusing a working copy or HEAD that differs from it (F3). A library call that bypasses run.py writes no run-log line, so its result can never govern (F8). Review round 10: core.runner.context (and the pre-freeze count-only and dry-run path, L1) also refuses unless the local origin/main equals the remote's main by git ls-remote (H2) and every version of the run log, access log, deviations file and amendment files on origin/main's first-parent history is a prefix of the next (M1). Every time the evaluator uses (the freeze time, and the reach times of amendment lines, access-log records, '_fetch' lines and the validation results) is the committer time of a commit whose signature verifies against GitHub's web-flow key, pinned as study/pinned/github-web-flow.gpg with fingerprint 968479A1AFF927E37D1A566BB5690EEEBB952194 (core.guards.verified_merge; M3), so a backdated client commit gives no time. The fetch transport runs in a child process (core/transport_proc.py), so no process that plans, parses or evaluates imports study/fetch/ (H1). runtime.lock pins every package's version and the sha256 of each installed dist-info RECORD, and the evaluator refuses any difference (L3). New entry points: run.py dry-run, transport-check and amend. Review round 18, second repair (R2-2): the tree a run names is HEAD's study tree, which core.guards.running_tree returns only when git status reports no change to the study tree, no index entry of it is marked assume-unchanged or skip-worktree, and every file of that tree is a regular file in the working copy whose own bytes hash to its blob (git hash-object --no-filters, which reads neither the index nor a filter). Every git command core.guards runs ignores replace refs (git --no-replace-objects), so no replace ref stands in for a commit, tree or blob that a guard reads. running_tree checks once, when a run builds its context: a file changed later in the same run is not detected.",
       "path": "blueprints/us-equities/mover-v3/study/",
       "fetch_path": "blueprints/us-equities/mover-v3/study/fetch/",
       "tree": null,
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "61f939b1c98844875f79feb3512f0119b9e65fc1",
+        "tree": "5ebe141ddaf1fd75b09cf4596b74568cc584535c",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
@@ -591,11 +591,11 @@
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
         "date": "2026-10-01",
-        "tree": "61f939b1c98844875f79feb3512f0119b9e65fc1",
+        "tree": "5ebe141ddaf1fd75b09cf4596b74568cc584535c",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
         "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
         "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
-        "tests_run": 410,
+        "tests_run": 418,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -1174,7 +1174,7 @@
       "date": "2026-10-01",
       "round": 18,
       "input": "Cross-family re-check of the round-18 repair of PR #360 at 406ad3c5 (the repair 1e3fd5a1 with origin/main at 3361b342 merged in; study tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17). GPT-6.1 Sol (cx/gpt-6.1-sol, effort max, Codex 0.159.2, read-only, through the packaged lane on OmniRoute, tools/sota-convergence/landscape-sweep/codex_call.sh), 2026-10-01 03:42-04:18Z. Verdict: changes needed; four findings, each reproduced by the reviewer's own probe. R2-1 (high): a seal record whose ledger_sha256 is JSON null turned ledger verification off. core.store._recover_seal passed the recorded value to Store.read, which compares no digest when it is given None, and seal_record_of gave the null back, so the record comparison passed too. R2-2 (high): the study tree in a seal identity could differ from the files that ran. core.guards.running_tree returned HEAD's study tree whenever git status reported no change, and git status reports none for a tracked file whose index entry is marked assume-unchanged or skip-worktree; core.runner.seal_run_identity copies that tree into every seal identity, so H1's binding could be bypassed. R2-3 (medium): a snapshot path that was a regular file held no ledger, pages or seal record, so it counted as unused; the caller fetched again and Store.write then raised NotADirectoryError, outside SealError. R2-4 (medium): two stamp controls had no test. Mutant A (st['attempt'] replaced by 0 in seal_record_of's stamp entries) passed all 27 recovery tests, and mutant B (Store.read's refusal of a second completion stamp removed) passed the 393 tests the reviewer ran. The same re-check confirmed that the seven mutants the earlier entry names are killed by their named tests, that its three residuals are stated accurately, and that the protocol status and the recorded draft tree were correct.",
-      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, a file name with a control character (git hash-object reads one path per line), a symbolic-link or submodule entry, and a git hash-object call that fails or prints too few hashes are refused. It reads the tree id and lists the tree with git --no-replace-objects, so the blobs compared are the tree's own. That option came in a follow-up commit of this repair (ba106834), after a direct probe of the content check as first committed (28fafe84): with a replace ref on HEAD's study tree object (git replace), git status reported nothing for files that matched the replacement tree, no index flag was set, git ls-tree listed the replacement's blobs under the id of HEAD's tree, and running_tree returned HEAD's tree. It belongs to R2-2: it is the correctness of the content check that this repair adds for R2-2, not a fifth finding. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths; git(1) --no-replace-objects and git-replace(1). run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes; residual (4) lists what still fails after a fetch. (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests: 15 in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py, 12 of them written first. On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. The follow-up added three tests to tests/test_guards.py: the replace-ref state, which failed first at 28fafe84 ('Ran 13 tests in 3.251s', 'FAILED (failures=1)', 'AssertionError: Refused not raised'), and two for branches of the content check that no test reached (a line break in a tracked file name; git hash-object exiting with an error or printing one hash too few), which pass at 28fafe84 and have mutants (8) and (9) as their failing evidence. After the repair the three modules give 'Ran 49 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. (1), (4), (5) and (6) ran at 28fafe84, and core/store.py and their tests are unchanged since; the others ran at ba106834. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed, test_running_tree_refuses_a_committed_symbolic_link, test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree, test_running_tree_refuses_a_file_name_that_one_line_cannot_carry and test_running_tree_refuses_when_git_does_not_hash_every_file (Ran 47 tests, FAILED (failures=12), all 'Refused not raised'). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 47 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag, which shows that the flag refusal runs first and has its own failing cases). (4) Non-directory refusal removed: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 36 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 36 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 36 tests, FAILED (failures=2), 'SealError not raised'). Three more for the follow-up, each against tests.test_guards (Ran 13 tests, FAILED (failures=1)). (7) --no-replace-objects removed from the git ls-tree call: the replace-ref test, 'Refused not raised'. (8) The control-character refusal removed: its test fails on the message, because git hash-object then fails and that branch refuses the tree. (9) git hash-object's exit status ignored, and separately its count of hashes ignored: test_running_tree_refuses_when_git_does_not_hash_every_file, 'Refused not raised' in the matching case. The same option on git rev-parse has no test of its own: with a replace ref on the study tree object, both forms return the id of HEAD's tree. Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) recover_seal looks neither above the snapshot path nor at other entries in it. Measured after the repair: under a snapshot root that is a regular file the dry run still makes 16 provider calls before Store.write raises NotADirectoryError; in a snapshot directory that holds only a stray ledger.jsonl.tmp or seal.json.tmp it makes 16 calls before Store.write raises FileExistsError, and the pages it wrote make the next run refuse the directory as partially written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit, and it does not recompute the tree's id from the files: it takes the tree and blob ids that git reads from the object store. (6) A file that is not in the tree is seen only through git status (the untracked and ignored-file checks of review round 9, F9, which this repair does not change), and git status reads the work tree that git is configured with. Probed, not committed: with core.worktree pointing at another clean copy of the files, an untracked package core/a/__init__.py in the study directory, which would shadow core/a.py on import, was not reported and running_tree returned the tree. A change to a tracked file is still refused there, because the content check reads the files under the repository path it is given. Protocol: run_discipline.study_code.rule gains the R2-2 sentence; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the repaired tree 61f939b1c98844875f79feb3512f0119b9e65fc1 and 410 tests ('Ran 410 tests in 302.526s', 'OK'; at 28fafe84, before the follow-up, 'Ran 407 tests in 296.620s', 'OK'). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, a file name with a control character (git hash-object reads one path per line), a symbolic-link or submodule entry, and a git hash-object call that fails or prints too few hashes are refused. Every git command core.guards runs ignores replace refs: core.guards.git_command builds each one with --no-replace-objects. The option first came in a follow-up commit of this repair (ba106834), on the two git calls of running_tree, after a direct probe of the content check as first committed (28fafe84): with a replace ref on HEAD's study tree object (git replace), git status reported nothing for files that matched the replacement tree, no index flag was set, git ls-tree listed the replacement's blobs under the id of HEAD's tree, and running_tree returned HEAD's tree. The coordinator ruled that this belongs to R2-2 (it is the correctness of the content check that this repair adds, not a fifth finding) and asked for it in the shared helper (follow-up F2, 89f64e24), so that committed_bytes, the tree diff behind transport deviations (fetch_only_diff, and the changed paths run.py transport-check lists) and every rev-parse, log, show and verify-commit read the repository's own objects as well. With it, running_tree's own git status reports files that match a replacement tree as changed. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths; git(1) --no-replace-objects and git-replace(1). run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. Follow-up F1 (the coordinator's ruling, 89f64e24) closes the class: a snapshot path counts as unused, and is fetched into, only if it is absent and its nearest existing ancestor is a directory, or it is an empty directory. A path under a regular file or a dangling link, and a directory that holds anything without a ledger (a stray ledger.jsonl.tmp or seal.json.tmp, any other file), are refused as a SealError before any fetch; a directory with pages or a seal record keeps its 'partially written' refusal. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes, and after F1 a snapshot path of any shape listed under R2-3 is refused there, before a fetch. What can still fail after a fetch, outside SealError, is an operating-system error while Store.write writes (permissions, a full disk, a path changed between the check and the write). (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests: 23 in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py: 12 written first for the four findings, 3 with the first follow-up and 8 with the coordinator's follow-up. On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. The first follow-up added three tests to tests/test_guards.py: the replace-ref state, which failed first at 28fafe84 ('Ran 13 tests in 3.251s', 'FAILED (failures=1)', 'AssertionError: Refused not raised'), and two for branches of the content check that no test reached (a line break in a tracked file name; git hash-object exiting with an error or printing one hash too few), which pass at 28fafe84 and have mutants (7) and (8) as their failing evidence. The coordinator's follow-up added eight, written first. For F1, in tests/test_seal_recovery.py, for the dry run and for the live samples: a regular file or a dangling link as the snapshot root; a directory that holds only a stray ledger.jsonl.tmp, seal.json.tmp or other file; and unused paths (absent, absent under absent directories, an existing empty directory) that are still fetched into and sealed. For F2, in tests/test_guards.py: committed_bytes and fetch_only_diff under a replace ref. On the code of 7acb6944 the three modules gave 'Ran 57 tests in 16.168s' and 'FAILED (failures=7, errors=8)'. Six tests failed: the four F1 refusal tests (NotADirectoryError under a regular-file root, FileExistsError beside a stray ledger.jsonl.tmp or seal.json.tmp, 'SealError not raised' beside any other file, and Store.write's own SealError after the fetch under a dangling-link root), committed_bytes returning the replacement blob, and fetch_only_diff returning true for trees that also differ in core/. The two unused-path tests pass there by construction: they guard against refusing a path that is unused. The replace-ref test of the first follow-up is kept: with every git command ignoring replace refs, running_tree's own git status reports the files as changed, and that is the refusal it now asserts. After the repair the three modules give 'Ran 57 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. All were run on the final tree (cd36752e), except (9), run at 89f64e24, since when core/store.py and tests/test_seal_recovery.py are unchanged. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed, test_running_tree_refuses_a_committed_symbolic_link, test_running_tree_refuses_a_file_name_that_one_line_cannot_carry and test_running_tree_refuses_when_git_does_not_hash_every_file (Ran 55 tests, FAILED (failures=11), all 'Refused not raised'; at ba106834 the replace-ref test failed here too, and since F2 git status itself refuses that state). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 55 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag, which shows that the flag refusal runs first and has its own failing cases). (4) Non-directory refusal at the snapshot path removed, with F1's rule kept: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 42 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 42 tests, FAILED (failures=2), 'SealError not raised'). (7) The control-character refusal removed: its test fails on the message, because git hash-object then fails and that branch refuses the tree (Ran 15 tests, FAILED (failures=1)). (8) git hash-object's exit status ignored, and separately its count of hashes ignored: test_running_tree_refuses_when_git_does_not_hash_every_file, 'Refused not raised' in the matching case (Ran 15 tests, FAILED (failures=1), each). (9) F1's rule removed, which falls back to the R2-3 check: test_a_snapshot_root_that_is_not_a_directory_refuses_without_requests, test_a_snapshot_directory_that_holds_only_stray_files_refuses_without_requests, test_a_live_root_that_is_not_a_directory_refuses_without_requests and test_a_label_directory_that_holds_only_stray_files_refuses_without_requests (Ran 42 tests, FAILED (failures=5, errors=8)). (10) --no-replace-objects removed from core.guards.git_command: test_committed_bytes_returns_the_real_blob_under_a_replace_ref, test_the_transport_deviation_diff_compares_the_real_trees_under_a_replace_ref and test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree, the last with 'Refused not raised' (Ran 55 tests, FAILED (failures=3)). Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) Closed by follow-up F1. Before it (measured with core/store.py as at 28fafe84, which F1 was the next commit to change), under a snapshot root that was a regular file the dry run made 16 provider calls before Store.write raised NotADirectoryError, and in a snapshot directory that held only a stray ledger.jsonl.tmp or seal.json.tmp it made 16 calls before Store.write raised FileExistsError, leaving pages behind. On the final tree each of these, and a directory that holds any other file, is refused as a SealError with 0 provider calls, and nothing is written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit, and it does not recompute the tree's id from the files: it takes the tree and blob ids that git reads from the object store. (6) A file that is not in the tree is seen only through git status (the untracked and ignored-file checks of review round 9, F9, which this repair does not change), and git status reads the work tree that git is configured with. Probed, not committed: with core.worktree pointing at another clean copy of the files, an untracked package core/a/__init__.py in the study directory, which would shadow core/a.py on import, was not reported and running_tree returned the tree. A change to a tracked file is still refused there, because the content check reads the files under the repository path it is given. Protocol: run_discipline.study_code.rule gains the R2-2 sentences, with F2's rule that every git command of core.guards ignores replace refs; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the final tree 5ebe141ddaf1fd75b09cf4596b74568cc584535c and 418 tests ('Ran 418 tests in 282.984s', 'OK'; earlier in this repair, 'Ran 407 tests in 296.620s', 'OK' at 28fafe84 and 'Ran 410 tests in 302.526s', 'OK' at ba106834). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1229,7 +1229,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 410 tests, 0 failures, 0 errors, 0 skips at draft tree 61f939b1c98844875f79feb3512f0119b9e65fc1 (2026-10-01); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 418 tests, 0 failures, 0 errors, 0 skips at draft tree 5ebe141ddaf1fd75b09cf4596b74568cc584535c (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,

From 50fd6836af5d4281ca09e340b730f9549ab9b508 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 04:18:26 -0400
Subject: [PATCH 13/15] Mover v3 round 18, after the independent verification
 of ace56485: --no-filters test (T1), index-flag refusal message (T2)

The independent Opus verification of ace56485 (C7) confirmed the repair and
found one test gap and one misleading message.

T1 (test only). No test protected --no-filters in running_tree: removing it
left the module tests green (reproduced: Ran 55 tests, OK). git hash-object
--stdin-paths receives absolute paths, and git applies no anchored
repository-relative attribute pattern to an absolute path (probed on git
2.43.0: a basename or **/ pattern applies, an anchored one does not), so the
clean filter of test_running_tree_refuses_a_change_that_a_clean_filter_hides
never reached the content check. The test now uses a basename pattern,
checks that git hash-object filters the absolute path running_tree passes
unless --no-filters is given, and its docstring says so. With --no-filters
removed it now fails ('Refused not raised'; Ran 56 tests, FAILED
(failures=1)).

T2 (message only). With core.ignoreStat=true git marks every file it checks
out assume-unchanged, so a fresh, byte-identical checkout is refused. The
refusal stays; its message now says that the index marks the files
assume-unchanged or skip-worktree, so the run cannot verify them, and how to
clear the bits. Unsetting core.ignoreStat alone leaves the bits (probed), so
the message names both steps. New test, which failed first on the old
wording: test_running_tree_refuses_a_checkout_made_under_core_ignore_stat_and_says_how_to_clear_it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/study/core/guards.py |  8 ++-
 .../mover-v3/study/tests/test_guards.py       | 49 +++++++++++++++++--
 2 files changed, 50 insertions(+), 7 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/study/core/guards.py b/blueprints/us-equities/mover-v3/study/core/guards.py
index aba12d8b0..412f6fa19 100644
--- a/blueprints/us-equities/mover-v3/study/core/guards.py
+++ b/blueprints/us-equities/mover-v3/study/core/guards.py
@@ -98,8 +98,12 @@ def running_tree(repo, study_path: str = STUDY_PATH) -> str:
         raise Refused(f"the study tree holds ignored files that are not bytecode caches: {planted[:5]}")
     masked = _masked_index_entries(repo, study_path)
     if masked:
-        raise Refused(f"the study tree holds index entries that hide a file's changes from git status: {masked[:5]}; "
-                      "a run executes a committed tree only")
+        # the independent verification of ace56485 (C7): with core.ignoreStat=true every file git checks out is marked
+        # assume-unchanged, so a bit need not hide a change; the refusal stays, and the message says how to clear it
+        raise Refused(f"the index marks study files assume-unchanged or skip-worktree, so git status does not check "
+                      f"them and the run cannot verify them: {masked[:5]}; clear the bits (git update-index "
+                      "--no-assume-unchanged or --no-skip-worktree on those files) and, if core.ignoreStat is true, "
+                      "unset it, or git marks every file it checks out assume-unchanged again")
     tree = git(repo, "rev-parse", f"HEAD:{study_path}")
     unverified = _unverified_files(repo, tree, study_path)
     if unverified:
diff --git a/blueprints/us-equities/mover-v3/study/tests/test_guards.py b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
index 5bc3ddeee..da95f8dcb 100644
--- a/blueprints/us-equities/mover-v3/study/tests/test_guards.py
+++ b/blueprints/us-equities/mover-v3/study/tests/test_guards.py
@@ -78,6 +78,32 @@ def test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_wor
                     with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} ({flag})")):
                         guards.running_tree(repo)
 
+    def test_running_tree_refuses_a_checkout_made_under_core_ignore_stat_and_says_how_to_clear_it(self):
+        """With core.ignoreStat=true git marks every file it checks out assume-unchanged (git-config(1)), so in a fresh
+        clone made with it every study file is masked although each holds HEAD's bytes. The refusal stays, by design:
+        git status does not check those files, and the run cannot verify them through it. The message says that the
+        index marks them and how to clear the bits; at ace56485 it said that they hide a change, which misled for this
+        case (the independent verification of ace56485, C7). Unsetting core.ignoreStat alone leaves the bits; clearing
+        them lets the same files run."""
+        with self.study_repo() as (repo, tmp):
+            sh(tmp, "clone", "-q", "-c", "core.ignoreStat=true", str(repo), "clone")
+            clone = tmp / "clone"
+            tree, files = sh(clone, "rev-parse", f"HEAD:{STUDY_PATH}"), sh(clone, "ls-files", "--", STUDY_PATH).split()
+            self.assertEqual(sh(clone, "ls-files", "-v", "--", STUDY_PATH).splitlines(), [f"h {f}" for f in files])
+            self.assertEqual((status(clone), guards._unverified_files(clone, tree, STUDY_PATH)), ("", []))
+            with self.assertRaises(guards.Refused) as refused:
+                guards.running_tree(clone)
+            for part in ("the index marks study files assume-unchanged or skip-worktree",
+                         "so git status does not check them and the run cannot verify them", f"{TRANSPORT} (assume",
+                         "clear the bits (git update-index --no-assume-unchanged or --no-skip-worktree",
+                         "if core.ignoreStat is true, unset it"):
+                self.assertIn(part, str(refused.exception))
+            sh(clone, "config", "--unset", "core.ignoreStat")
+            with self.assertRaisesRegex(guards.Refused, "^the index marks study files"):
+                guards.running_tree(clone)
+            sh(clone, "update-index", "--no-assume-unchanged", "--", *files)
+            self.assertEqual(guards.running_tree(clone), tree)
+
     def test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed(self):
         """The content check alone: with the index-flag refusal bypassed, a flagged file that changed, was deleted or
         was replaced by a link to the same bytes is still refused, because the working file's own bytes are hashed."""
@@ -95,19 +121,32 @@ def test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_re
                         guards.running_tree(repo)
 
     def test_running_tree_refuses_a_change_that_a_clean_filter_hides(self):
-        """Only the content check can refuse this one: no index flag is set, and git status reports nothing because a
-        clean filter (set in the repository's own configuration and .git/info/attributes, neither of them tracked)
-        gives the committed bytes back for the edited file. git hash-object --no-filters hashes the file itself."""
+        """Only the content check can refuse this one, and only because it hashes with --no-filters: no index flag is
+        set, and git status reports nothing because a clean filter (set in the repository's own configuration and
+        .git/info/attributes, neither of them tracked) gives the committed bytes back for the edited file. The
+        attribute is a basename pattern, which git applies both to the repository-relative path git status checks and
+        to the absolute path running_tree gives git hash-object --stdin-paths, so without --no-filters that call would
+        hash the committed bytes as well. At ace56485 the pattern was the anchored repository-relative path, which git
+        does not apply to an absolute path: the filter never reached the content check, and removing --no-filters
+        passed this test (the independent verification of ace56485, C7)."""
         from tests import fixture_repo as FR
         with self.study_repo() as (repo, tmp):
             committed = FR.write(tmp / "transport-committed.py", (repo / TRANSPORT).read_bytes())
             sh(repo, "config", "filter.committed.clean", f"cat {shlex.quote(str(committed))}")
-            FR.write(repo / ".git" / "info" / "attributes", f"{TRANSPORT} filter=committed\n")
+            FR.write(repo / ".git" / "info" / "attributes", f"{Path(TRANSPORT).name} filter=committed\n")
             (repo / TRANSPORT).write_text("HOST = 'changed'\n")      # the committed length: git compares content
             self.assertEqual(len("HOST = 'changed'\n"), len(committed.read_bytes()))
             self.assertEqual(status(repo), "")
             self.assertEqual(sh(repo, "ls-files", "-v", "--", TRANSPORT), f"H {TRANSPORT}")
-            self.assertEqual(sh(repo, "hash-object", TRANSPORT), sh(repo, "rev-parse", f"HEAD:{TRANSPORT}"))
+            blob = sh(repo, "rev-parse", f"HEAD:{TRANSPORT}")
+            self.assertEqual(sh(repo, "hash-object", TRANSPORT), blob)
+
+            def hashed(*options):
+                """git hash-object given the file as running_tree gives it: an absolute path, one per line."""
+                return subprocess.run(["git", "-C", str(repo), "hash-object", *options, "--stdin-paths"],
+                                      input=f"{Path(repo).resolve() / TRANSPORT}\n", capture_output=True, text=True,
+                                      check=True).stdout.strip()
+            self.assertEqual((hashed() == blob, hashed("--no-filters") == blob), (True, False))
             with self.assertRaisesRegex(guards.Refused, re.escape(f"{TRANSPORT} differs from HEAD's blob")):
                 guards.running_tree(repo)
 

From 850a3d9ca7e0c5a7a847e89973e920b5d5f96715 Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 04:24:26 -0400
Subject: [PATCH 14/15] Mover v3 round 18: review record and pins after the
 independent verification of ace56485 (T1, T2)

protocol-core-draft.json, after the study commit 50fd6836:

- review_record[48] (the same unpushed second-repair entry): one sentence on
  the independent Opus verification of ace56485 and its two fixes (the
  --no-filters test gap, Ran 55 tests, OK with the option removed before
  the fix, Ran 56 tests, FAILED (failures=1) after it; and the index-flag
  refusal's message under core.ignoreStat=true). The test count and the
  wording that named cd36752e as the final tree are updated to match.
- draft_tree_at_this_revision, test_record and freeze_acceptance entry 7:
  draft tree cc7ecaecfc0207b61bd20fa4178bfa6769bbc857, 419 tests
  (Ran 419 tests in 273.947s, OK).

Relative to 406ad3c5 the protocol still gains one review_record entry.
Status stays draft_pending_independent_pre_outcome_review; nothing read an
outcome. manifests/evidence.json is not touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../us-equities/mover-v3/protocol-core-draft.json      | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/blueprints/us-equities/mover-v3/protocol-core-draft.json b/blueprints/us-equities/mover-v3/protocol-core-draft.json
index 807923ead..b72ab79af 100644
--- a/blueprints/us-equities/mover-v3/protocol-core-draft.json
+++ b/blueprints/us-equities/mover-v3/protocol-core-draft.json
@@ -583,7 +583,7 @@
       "fetch_tree": null,
       "tree_note": "tree and fetch_tree are filled in at the freeze (freeze_preconditions). draft_tree_at_this_revision records the draft tree this protocol revision was written against, for review only; it pins nothing.",
       "draft_tree_at_this_revision": {
-        "tree": "5ebe141ddaf1fd75b09cf4596b74568cc584535c",
+        "tree": "cc7ecaecfc0207b61bd20fa4178bfa6769bbc857",
         "fetch_tree": "f288cf2360f4c5448ff72a7fcaef2e064e6ba3bb"
       },
       "runtime_lock": "blueprints/us-equities/mover-v3/study/runtime.lock",
@@ -591,11 +591,11 @@
       "test_command": "uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
       "test_record": {
         "date": "2026-10-01",
-        "tree": "5ebe141ddaf1fd75b09cf4596b74568cc584535c",
+        "tree": "cc7ecaecfc0207b61bd20fa4178bfa6769bbc857",
         "runtime": "uv 0.12.17, uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6 (study/runtime-requirements.txt, RECORD digests equal to runtime.lock record_sha256s); git 2.43.0 and GnuPG 2.4.4",
         "command": "TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 UV_NO_CONFIG=1 UV_OFFLINE=1 uv run --no-project --managed-python --python 3.13.15 --with-requirements blueprints/us-equities/mover-v3/study/runtime-requirements.txt python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study",
         "command_note": "The command run: study_code.test_command with a temporary directory, no bytecode written or read (PYTHONDONTWRITEBYTECODE, -B), no uv configuration file and no network fetch by uv (UV_NO_CONFIG, UV_OFFLINE); the tests and the runtime are the test_command's.",
-        "tests_run": 418,
+        "tests_run": 419,
         "failures": 0,
         "errors": 0,
         "skipped": 0,
@@ -1174,7 +1174,7 @@
       "date": "2026-10-01",
       "round": 18,
       "input": "Cross-family re-check of the round-18 repair of PR #360 at 406ad3c5 (the repair 1e3fd5a1 with origin/main at 3361b342 merged in; study tree 6cb88f03b45fad24f0fb95568b21e2834b9cdc17). GPT-6.1 Sol (cx/gpt-6.1-sol, effort max, Codex 0.159.2, read-only, through the packaged lane on OmniRoute, tools/sota-convergence/landscape-sweep/codex_call.sh), 2026-10-01 03:42-04:18Z. Verdict: changes needed; four findings, each reproduced by the reviewer's own probe. R2-1 (high): a seal record whose ledger_sha256 is JSON null turned ledger verification off. core.store._recover_seal passed the recorded value to Store.read, which compares no digest when it is given None, and seal_record_of gave the null back, so the record comparison passed too. R2-2 (high): the study tree in a seal identity could differ from the files that ran. core.guards.running_tree returned HEAD's study tree whenever git status reported no change, and git status reports none for a tracked file whose index entry is marked assume-unchanged or skip-worktree; core.runner.seal_run_identity copies that tree into every seal identity, so H1's binding could be bypassed. R2-3 (medium): a snapshot path that was a regular file held no ledger, pages or seal record, so it counted as unused; the caller fetched again and Store.write then raised NotADirectoryError, outside SealError. R2-4 (medium): two stamp controls had no test. Mutant A (st['attempt'] replaced by 0 in seal_record_of's stamp entries) passed all 27 recovery tests, and mutant B (Store.read's refusal of a second completion stamp removed) passed the 393 tests the reviewer ran. The same re-check confirmed that the seven mutants the earlier entry names are killed by their named tests, that its three residuals are stated accurately, and that the protocol status and the recorded draft tree were correct.",
-      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, a file name with a control character (git hash-object reads one path per line), a symbolic-link or submodule entry, and a git hash-object call that fails or prints too few hashes are refused. Every git command core.guards runs ignores replace refs: core.guards.git_command builds each one with --no-replace-objects. The option first came in a follow-up commit of this repair (ba106834), on the two git calls of running_tree, after a direct probe of the content check as first committed (28fafe84): with a replace ref on HEAD's study tree object (git replace), git status reported nothing for files that matched the replacement tree, no index flag was set, git ls-tree listed the replacement's blobs under the id of HEAD's tree, and running_tree returned HEAD's tree. The coordinator ruled that this belongs to R2-2 (it is the correctness of the content check that this repair adds, not a fifth finding) and asked for it in the shared helper (follow-up F2, 89f64e24), so that committed_bytes, the tree diff behind transport deviations (fetch_only_diff, and the changed paths run.py transport-check lists) and every rev-parse, log, show and verify-commit read the repository's own objects as well. With it, running_tree's own git status reports files that match a replacement tree as changed. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths; git(1) --no-replace-objects and git-replace(1). run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. Follow-up F1 (the coordinator's ruling, 89f64e24) closes the class: a snapshot path counts as unused, and is fetched into, only if it is absent and its nearest existing ancestor is a directory, or it is an empty directory. A path under a regular file or a dangling link, and a directory that holds anything without a ledger (a stray ledger.jsonl.tmp or seal.json.tmp, any other file), are refused as a SealError before any fetch; a directory with pages or a seal record keeps its 'partially written' refusal. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes, and after F1 a snapshot path of any shape listed under R2-3 is refused there, before a fetch. What can still fail after a fetch, outside SealError, is an operating-system error while Store.write writes (permissions, a full disk, a path changed between the check and the write). (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests: 23 in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py: 12 written first for the four findings, 3 with the first follow-up and 8 with the coordinator's follow-up. On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. The first follow-up added three tests to tests/test_guards.py: the replace-ref state, which failed first at 28fafe84 ('Ran 13 tests in 3.251s', 'FAILED (failures=1)', 'AssertionError: Refused not raised'), and two for branches of the content check that no test reached (a line break in a tracked file name; git hash-object exiting with an error or printing one hash too few), which pass at 28fafe84 and have mutants (7) and (8) as their failing evidence. The coordinator's follow-up added eight, written first. For F1, in tests/test_seal_recovery.py, for the dry run and for the live samples: a regular file or a dangling link as the snapshot root; a directory that holds only a stray ledger.jsonl.tmp, seal.json.tmp or other file; and unused paths (absent, absent under absent directories, an existing empty directory) that are still fetched into and sealed. For F2, in tests/test_guards.py: committed_bytes and fetch_only_diff under a replace ref. On the code of 7acb6944 the three modules gave 'Ran 57 tests in 16.168s' and 'FAILED (failures=7, errors=8)'. Six tests failed: the four F1 refusal tests (NotADirectoryError under a regular-file root, FileExistsError beside a stray ledger.jsonl.tmp or seal.json.tmp, 'SealError not raised' beside any other file, and Store.write's own SealError after the fetch under a dangling-link root), committed_bytes returning the replacement blob, and fetch_only_diff returning true for trees that also differ in core/. The two unused-path tests pass there by construction: they guard against refusing a path that is unused. The replace-ref test of the first follow-up is kept: with every git command ignoring replace refs, running_tree's own git status reports the files as changed, and that is the refusal it now asserts. After the repair the three modules give 'Ran 57 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. All were run on the final tree (cd36752e), except (9), run at 89f64e24, since when core/store.py and tests/test_seal_recovery.py are unchanged. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed, test_running_tree_refuses_a_committed_symbolic_link, test_running_tree_refuses_a_file_name_that_one_line_cannot_carry and test_running_tree_refuses_when_git_does_not_hash_every_file (Ran 55 tests, FAILED (failures=11), all 'Refused not raised'; at ba106834 the replace-ref test failed here too, and since F2 git status itself refuses that state). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 55 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag, which shows that the flag refusal runs first and has its own failing cases). (4) Non-directory refusal at the snapshot path removed, with F1's rule kept: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 42 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 42 tests, FAILED (failures=2), 'SealError not raised'). (7) The control-character refusal removed: its test fails on the message, because git hash-object then fails and that branch refuses the tree (Ran 15 tests, FAILED (failures=1)). (8) git hash-object's exit status ignored, and separately its count of hashes ignored: test_running_tree_refuses_when_git_does_not_hash_every_file, 'Refused not raised' in the matching case (Ran 15 tests, FAILED (failures=1), each). (9) F1's rule removed, which falls back to the R2-3 check: test_a_snapshot_root_that_is_not_a_directory_refuses_without_requests, test_a_snapshot_directory_that_holds_only_stray_files_refuses_without_requests, test_a_live_root_that_is_not_a_directory_refuses_without_requests and test_a_label_directory_that_holds_only_stray_files_refuses_without_requests (Ran 42 tests, FAILED (failures=5, errors=8)). (10) --no-replace-objects removed from core.guards.git_command: test_committed_bytes_returns_the_real_blob_under_a_replace_ref, test_the_transport_deviation_diff_compares_the_real_trees_under_a_replace_ref and test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree, the last with 'Refused not raised' (Ran 55 tests, FAILED (failures=3)). Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) Closed by follow-up F1. Before it (measured with core/store.py as at 28fafe84, which F1 was the next commit to change), under a snapshot root that was a regular file the dry run made 16 provider calls before Store.write raised NotADirectoryError, and in a snapshot directory that held only a stray ledger.jsonl.tmp or seal.json.tmp it made 16 calls before Store.write raised FileExistsError, leaving pages behind. On the final tree each of these, and a directory that holds any other file, is refused as a SealError with 0 provider calls, and nothing is written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit, and it does not recompute the tree's id from the files: it takes the tree and blob ids that git reads from the object store. (6) A file that is not in the tree is seen only through git status (the untracked and ignored-file checks of review round 9, F9, which this repair does not change), and git status reads the work tree that git is configured with. Probed, not committed: with core.worktree pointing at another clean copy of the files, an untracked package core/a/__init__.py in the study directory, which would shadow core/a.py on import, was not reported and running_tree returned the tree. A change to a tracked file is still refused there, because the content check reads the files under the repository path it is given. Protocol: run_discipline.study_code.rule gains the R2-2 sentences, with F2's rule that every git command of core.guards ignores replace refs; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the final tree 5ebe141ddaf1fd75b09cf4596b74568cc584535c and 418 tests ('Ran 418 tests in 282.984s', 'OK'; earlier in this repair, 'Ran 407 tests in 296.620s', 'OK' at 28fafe84 and 'Ran 410 tests in 302.526s', 'OK' at ba106834). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
+      "resolution": "R2-1: core/store.py _recover_seal requires the seal record's ledger_sha256 to be 64 lowercase hexadecimal characters before it reads the ledger. Null, a missing field and any other value are refused as a SealError ('the seal record holds no sha256 of its ledger'), so no record turns the comparison off. Store.read's own rule (no comparison when it is given no digest) is unchanged. R2-2: core/guards.py running_tree, which every entry point's context calls (core.runner.context and count_only_context; its signature is unchanged), runs two checks after git status. First, it refuses any index entry of the study tree that git ls-files -v tags in lowercase (assume-unchanged) or as S (skip-worktree; s with both), with a message that names the file and the flag. Second, it lists the tree it returns (git ls-tree -r) and requires each entry to be a regular-file blob whose working file is a regular file with the blob's bytes, hashed by one git hash-object --no-filters --stdin-paths call, which reads neither the index nor a filter. A missing file, a working file that is not a regular file, a file name with a control character (git hash-object reads one path per line), a symbolic-link or submodule entry, and a git hash-object call that fails or prints too few hashes are refused. Every git command core.guards runs ignores replace refs: core.guards.git_command builds each one with --no-replace-objects. The option first came in a follow-up commit of this repair (ba106834), on the two git calls of running_tree, after a direct probe of the content check as first committed (28fafe84): with a replace ref on HEAD's study tree object (git replace), git status reported nothing for files that matched the replacement tree, no index flag was set, git ls-tree listed the replacement's blobs under the id of HEAD's tree, and running_tree returned HEAD's tree. The coordinator ruled that this belongs to R2-2 (it is the correctness of the content check that this repair adds, not a fifth finding) and asked for it in the shared helper (follow-up F2, 89f64e24), so that committed_bytes, the tree diff behind transport deviations (fetch_only_diff, and the changed paths run.py transport-check lists) and every rev-parse, log, show and verify-commit read the repository's own objects as well. With it, running_tree's own git status reports files that match a replacement tree as changed. Upstream reference (git 2.43.0 manual): git-ls-files(1) -t and -v; git-update-index(1), 'Using assume unchanged bit' and 'Skip-worktree bit'; git-hash-object(1) --no-filters and --stdin-paths; git(1) --no-replace-objects and git-replace(1). run_discipline.study_code.rule now states this check and its limit. R2-3: _recover_seal refuses, before its ledger check, a snapshot path that exists and is not a directory (a regular file, a dangling symbolic link), as a SealError naming the dry run or the label; nothing is fetched. Follow-up F1 (the coordinator's ruling, 89f64e24) closes the class: a snapshot path counts as unused, and is fetched into, only if it is absent and its nearest existing ancestor is a directory, or it is an empty directory. A path under a regular file or a dangling link, and a directory that holds anything without a ledger (a stray ledger.jsonl.tmp or seal.json.tmp, any other file), are refused as a SealError before any fetch; a directory with pages or a seal record keeps its 'partially written' refusal. R2-4: no code change. tests/test_seal_recovery.py test_a_resealed_attempt_id_change_refuses (dry run, and each live-sample label) gives one attempt another id in its page events and its completion stamp, keeps every count, status, page and digest, and reseals only ledger_sha256; for the dry run it is the second attempt of a re-fetched request (1 to 7). tests/test_store.py test_a_second_completion_stamp_for_one_attempt_is_refused reads, under its own sha256, a ledger with two completion stamps for one key and attempt. Both pass at 406ad3c5 by construction; mutants A and B below are their failing evidence. Correction of the earlier round-18 entry of 2026-10-01: three of its sentences were not true at 406ad3c5. (a) 'every refusal is a SealError naming the dry run or the live-sample label': a regular file at the snapshot path escaped as NotADirectoryError after 16 further provider calls (dry run) or 1 (each live label), and a dangling link was refused after the same calls by Store.write's own SealError, which names neither. It now holds for every refusal core.store.recover_seal makes, and after F1 a snapshot path of any shape listed under R2-3 is refused there, before a fetch. What can still fail after a fetch, outside SealError, is an operating-system error while Store.write writes (permissions, a full disk, a path changed between the check and the write). (b) 'It reads the ledger under the recorded sha256': a record whose value was null read the ledger under none. (c) The identity's study tree, 'from core.runner.seal_run_identity (H1)', was HEAD's tree and not necessarily the tree of the files that ran. Tests: 24 in tests/test_seal_recovery.py, tests/test_guards.py and tests/test_store.py: 12 written first for the four findings, 3 with the first follow-up, 8 with the coordinator's follow-up and 1 after the independent verification below. On the unchanged code of 406ad3c5 those three modules gave 'Ran 46 tests in 16.764s' and 'FAILED (failures=64, errors=9)'. R2-1: 48 failed subtests over the dry run and both labels; the 6 null cases, with and without edited vintages and durations, with 'AssertionError: SealError not raised' (adopted), and the 42 malformed or missing values on the message, because Store.read or a KeyError refused them, not a check of the record. R2-2: 9 subtests of the index-flag test and the clean-filter, symbolic-link and command-level tests (2 subtests) with 'AssertionError: Refused not raised', and 6 errors of the test that bypasses the flag refusal, whose helper did not exist yet. R2-3: 3 errors with NotADirectoryError and 3 failures on the message for the dangling link. The first follow-up added three tests to tests/test_guards.py: the replace-ref state, which failed first at 28fafe84 ('Ran 13 tests in 3.251s', 'FAILED (failures=1)', 'AssertionError: Refused not raised'), and two for branches of the content check that no test reached (a line break in a tracked file name; git hash-object exiting with an error or printing one hash too few), which pass at 28fafe84 and have mutants (7) and (8) as their failing evidence. The coordinator's follow-up added eight, written first. For F1, in tests/test_seal_recovery.py, for the dry run and for the live samples: a regular file or a dangling link as the snapshot root; a directory that holds only a stray ledger.jsonl.tmp, seal.json.tmp or other file; and unused paths (absent, absent under absent directories, an existing empty directory) that are still fetched into and sealed. For F2, in tests/test_guards.py: committed_bytes and fetch_only_diff under a replace ref. On the code of 7acb6944 the three modules gave 'Ran 57 tests in 16.168s' and 'FAILED (failures=7, errors=8)'. Six tests failed: the four F1 refusal tests (NotADirectoryError under a regular-file root, FileExistsError beside a stray ledger.jsonl.tmp or seal.json.tmp, 'SealError not raised' beside any other file, and Store.write's own SealError after the fetch under a dangling-link root), committed_bytes returning the replacement blob, and fetch_only_diff returning true for trees that also differ in core/. The two unused-path tests pass there by construction: they guard against refusing a path that is unused. The replace-ref test of the first follow-up is kept: with every git command ignoring replace refs, running_tree's own git status reports the files as changed, and that is the refusal it now asserts. After the repair the three modules give 'Ran 57 tests' and 'OK'. Reproduced directly at 406ad3c5 (not committed). R2-1: a dry-run seal whose vintages and durations were edited and whose record's ledger_sha256 was set to null was adopted with 0 provider calls; the snapshot sha256 it returned was null and the measured elapsed time went from 0.00216 s to 16000.00216 s. Both live samples were adopted the same way. R2-2: in the command fixture, with fetch/transport.py changed under each flag, git status reported nothing; run.py dry-run opened a start line and its next run adopted the seal that the failed run left, with 0 provider calls, and the output and its complete run-log line named HEAD's tree. A same-size edit written in place with its modification time restored (core.trustctime false) is also unreported by git status, with no flag set; the content check refuses it. R2-3: as in (a). After the repair each of these is refused with 0 provider calls. Mutants, each applied to the repaired tree, run against the modules of its named tests and restored; no other test of those modules failed. All were run at cd36752e, except (9), run at 89f64e24, since when core/store.py and tests/test_seal_recovery.py are unchanged. (1) ledger_sha256 validation removed: test_a_seal_record_without_a_ledger_sha256_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=48), 6 of them 'SealError not raised'). (2) Content check removed from running_tree: test_running_tree_refuses_a_change_that_a_clean_filter_hides, test_running_tree_compares_every_tracked_file_with_its_blob_when_the_flag_refusal_is_bypassed, test_running_tree_refuses_a_committed_symbolic_link, test_running_tree_refuses_a_file_name_that_one_line_cannot_carry and test_running_tree_refuses_when_git_does_not_hash_every_file (Ran 55 tests, FAILED (failures=11), all 'Refused not raised'; at ba106834 the replace-ref test failed here too, and since F2 git status itself refuses that state). (3) Index-flag refusal removed from running_tree: test_running_tree_refuses_an_index_entry_marked_assume_unchanged_or_skip_worktree and the command-level test_a_transport_change_hidden_by_an_index_flag_is_refused_before_the_seal_is_adopted (Ran 55 tests, FAILED (failures=11): the 3 cases with an unchanged file are not refused, and the 8 with a changed or deleted file are refused by the content check, whose message names no flag, which shows that the flag refusal runs first and has its own failing cases). (4) Non-directory refusal at the snapshot path removed, with F1's rule kept: test_a_snapshot_path_that_is_not_a_directory_refuses_without_requests, dry run and live samples (Ran 42 tests, FAILED (failures=3, errors=3)). (5) Mutant A: test_a_resealed_attempt_id_change_refuses, dry run and live samples (Ran 42 tests, FAILED (failures=3), 'SealError not raised'). (6) Mutant B: test_a_second_completion_stamp_for_one_attempt_is_refused (Ran 42 tests, FAILED (failures=2), 'SealError not raised'). (7) The control-character refusal removed: its test fails on the message, because git hash-object then fails and that branch refuses the tree (Ran 15 tests, FAILED (failures=1)). (8) git hash-object's exit status ignored, and separately its count of hashes ignored: test_running_tree_refuses_when_git_does_not_hash_every_file, 'Refused not raised' in the matching case (Ran 15 tests, FAILED (failures=1), each). (9) F1's rule removed, which falls back to the R2-3 check: test_a_snapshot_root_that_is_not_a_directory_refuses_without_requests, test_a_snapshot_directory_that_holds_only_stray_files_refuses_without_requests, test_a_live_root_that_is_not_a_directory_refuses_without_requests and test_a_label_directory_that_holds_only_stray_files_refuses_without_requests (Ran 42 tests, FAILED (failures=5, errors=8)). (10) --no-replace-objects removed from core.guards.git_command: test_committed_bytes_returns_the_real_blob_under_a_replace_ref, test_the_transport_deviation_diff_compares_the_real_trees_under_a_replace_ref and test_running_tree_refuses_files_that_match_a_replacement_of_heads_tree, the last with 'Refused not raised' (Ran 55 tests, FAILED (failures=3)). An independent Opus verification of ace56485 (stack-verifier, read-only, 2026-10-01 06:01-07:58Z) confirmed the repair (full suite 418 OK, each mutant above killed, scope and pins correct) and found two defects, both fixed in 50fd6836: no test protected --no-filters, because git applies no anchored repository-relative attribute pattern to the absolute paths running_tree gives git hash-object, so the clean filter of test_running_tree_refuses_a_change_that_a_clean_filter_hides never reached the content check (with the option removed, Ran 55 tests, OK), and that test now uses a basename pattern and fails without the option (Ran 56 tests, FAILED (failures=1), 'Refused not raised'); and the index-flag refusal's message said that the bits hide a change, which misled for a checkout made under core.ignoreStat=true, where git marks every file it checks out assume-unchanged, so the refusal stays and its message now says that the index marks the files, so the run cannot verify them, and how to clear the bits (test_running_tree_refuses_a_checkout_made_under_core_ignore_stat_and_says_how_to_clear_it, which failed first on the old wording). Not changed, and residuals recorded and not fixed. The earlier entry's residuals (1) to (3) stand: seal.json is not an external anchor, core.holdout.collect reads its seal under a digest of its own ledger, and the orphan-output paths verify against the sha256 values an output body names. (4) Closed by follow-up F1. Before it (measured with core/store.py as at 28fafe84, which F1 was the next commit to change), under a snapshot root that was a regular file the dry run made 16 provider calls before Store.write raised NotADirectoryError, and in a snapshot directory that held only a stray ledger.jsonl.tmp or seal.json.tmp it made 16 calls before Store.write raised FileExistsError, leaving pages behind. On the final tree each of these, and a directory that holds any other file, is refused as a SealError with 0 provider calls, and nothing is written. (5) running_tree checks once, when a run builds its context. The transport child process, and any module first imported after that point, read the files as they are then, so a file changed during a run is not detected. It does not compare the executable bit, and it does not recompute the tree's id from the files: it takes the tree and blob ids that git reads from the object store. (6) A file that is not in the tree is seen only through git status (the untracked and ignored-file checks of review round 9, F9, which this repair does not change), and git status reads the work tree that git is configured with. Probed, not committed: with core.worktree pointing at another clean copy of the files, an untracked package core/a/__init__.py in the study directory, which would shadow core/a.py on import, was not reported and running_tree returned the tree. A change to a tracked file is still refused there, because the content check reads the files under the repository path it is given. Protocol: run_discipline.study_code.rule gains the R2-2 sentences, with F2's rule that every git command of core.guards ignores replace refs; the rule sentences of freeze_preconditions and run_discipline.transport_deviations are unchanged. run_discipline.study_code.draft_tree_at_this_revision, test_record and freeze_acceptance entry 7 name the final tree cc7ecaecfc0207b61bd20fa4178bfa6769bbc857 and 419 tests ('Ran 419 tests in 273.947s', 'OK'; earlier in this repair, 'Ran 407 tests in 296.620s', 'OK' at 28fafe84, 'Ran 410 tests in 302.526s', 'OK' at ba106834 and 'Ran 418 tests in 282.984s', 'OK' at cd36752e). Synthetic tests only; nothing read an outcome; the protocol remains draft_pending_independent_pre_outcome_review with frozen_before_outcomes false."
     }
   ],
   "overturn": "Any headline result is overturned if a rerun on the same frozen inputs, study tree and runtime.lock does not reproduce it byte for byte, if an independent quote sample puts the cost table off by more than 2x, or if the access log shows a holdout read that no committed granted entry preceded.",
@@ -1229,7 +1229,7 @@
         {
           "index": 7,
           "status": "done in draft",
-          "evidence": "run_discipline.study_code.test_record: 418 tests, 0 failures, 0 errors, 0 skips at draft tree 5ebe141ddaf1fd75b09cf4596b74568cc584535c (2026-10-01); it must be rerun on the tree the freeze pins."
+          "evidence": "run_discipline.study_code.test_record: 419 tests, 0 failures, 0 errors, 0 skips at draft tree cc7ecaecfc0207b61bd20fa4178bfa6769bbc857 (2026-10-01); it must be rerun on the tree the freeze pins."
         },
         {
           "index": 8,

From 56bbb2cd8c96359300adbfd75b812c34369535fd Mon Sep 17 00:00:00 2001
From: Scout <scout@local>
Date: Thu, 1 Oct 2026 04:27:42 -0400
Subject: [PATCH 15/15] Re-register the round-18 protocol in the evidence
 manifest (hot-file protocol, last commit)

protocol-core-draft.json changed in the second repair (sha256 87a955fe..., 361469 bytes).
Only its entry changes; component_matrix.py --write and new_host_grand_list.py --write
re-run (no change). scripts/validate.py exit 0; scripts/evidence_manifest.py --check passed
(8655 files). The branch is re-merged with main at its train slot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 manifests/evidence.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/manifests/evidence.json b/manifests/evidence.json
index 1c743f0d9..037f7b3ae 100644
--- a/manifests/evidence.json
+++ b/manifests/evidence.json
@@ -13560,8 +13560,8 @@
     },
     {
       "path": "blueprints/us-equities/mover-v3/protocol-core-draft.json",
-      "sha256": "9b69018bb7a30c02e9fd46864e8884c72846430a286750255e7f533e59adb135",
-      "bytes": 343133
+      "sha256": "87a955fe3d6b6f171609afd3fd7b544de9cd292adc82b2a55a2c66d0b89307ac",
+      "bytes": 361469
     },
     {
       "path": "blueprints/us-equities/mover-v3/protocol-draft.json",