diff --git a/.github/actions/load-toolchain-pins/action.yml b/.github/actions/load-toolchain-pins/action.yml
index e929f2a0..5a55fdba 100644
--- a/.github/actions/load-toolchain-pins/action.yml
+++ b/.github/actions/load-toolchain-pins/action.yml
@@ -6,4 +6,4 @@ runs:
   steps:
     - name: Load toolchain-pins.env
       shell: bash
-      run: bash scripts/load-toolchain-pins.sh "${GITHUB_ENV}"
+      run: grep -E '^[A-Z][A-Z0-9_]*=' toolchain-pins.env >> "${GITHUB_ENV}"
diff --git a/.github/actions/setup-guest-toolchain/action.yml b/.github/actions/setup-guest-toolchain/action.yml
index 81d21698..34c881c2 100644
--- a/.github/actions/setup-guest-toolchain/action.yml
+++ b/.github/actions/setup-guest-toolchain/action.yml
@@ -1,45 +1,23 @@
 name: "Setup guest toolchain"
-description: "Install system deps, xgenext2fs, cartesi-machine, QEMU/Buildx, Rust, just, and cross."
+description: "Install system deps, QEMU/Buildx and Rust (rust-toolchain.toml), plus xgenext2fs, cartesi-machine, just and cross at the toolchain-pins.env versions (run ./.github/actions/load-toolchain-pins first)."
 
 inputs:
-  xgenext2fs-version:
-    description: "xgenext2fs release tag"
-    required: true
-  cartesi-machine-version:
-    description: "cartesi-machine release tag"
-    required: true
-  cartesi-machine-sha256-amd64:
-    description: "SHA-256 for the amd64 .deb"
-    required: true
-  cartesi-machine-sha256-arm64:
-    description: "SHA-256 for the arm64 .deb"
-    required: true
-  xgenext2fs-sha256-amd64:
-    description: "SHA-256 for the amd64 xgenext2fs .deb"
-    required: true
-  xgenext2fs-sha256-arm64:
-    description: "SHA-256 for the arm64 xgenext2fs .deb"
-    required: true
   install-foundry:
     description: "Whether to install Foundry (for anvil)"
     required: false
     default: "false"
-  foundry-version:
-    description: "Foundry version tag"
+  cache:
+    description: "Restore and save the Rust build cache and the QEMU binfmt image cache (release builds pass false)"
     required: false
-    default: "v1.5.1"
-  rust-toolchain:
-    description: "Rust toolchain version or channel"
-    required: false
-    default: "1.95.0"
-  rust-components:
-    description: "Extra rustup components (comma-separated)"
-    required: false
-    default: "rustfmt"
+    default: "true"
 
 runs:
   using: composite
   steps:
+    - name: Require toolchain pins
+      shell: bash
+      run: ': "${CARTESI_MACHINE_VERSION:?run ./.github/actions/load-toolchain-pins first}"'
+
     - name: Install system dependencies
       shell: bash
       run: |
@@ -57,16 +35,16 @@ runs:
       run: |
         set -euo pipefail
         ARCH="$(dpkg --print-architecture)"
-        VERSION="${{ inputs.xgenext2fs-version }}"
+        VERSION="${XGENEXT2FS_VERSION}"
 
         case "${ARCH}" in
           amd64)
             ASSET_NAME="xgenext2fs_amd64.deb"
-            EXPECTED_SHA="${{ inputs.xgenext2fs-sha256-amd64 }}"
+            EXPECTED_SHA="${XGENEXT2FS_SHA256_AMD64}"
             ;;
           arm64)
             ASSET_NAME="xgenext2fs_arm64.deb"
-            EXPECTED_SHA="${{ inputs.xgenext2fs-sha256-arm64 }}"
+            EXPECTED_SHA="${XGENEXT2FS_SHA256_ARM64}"
             ;;
           *)
             echo "unsupported arch for xgenext2fs: ${ARCH}" >&2
@@ -82,37 +60,35 @@ runs:
     - name: Install cartesi-machine
       uses: ./.github/actions/install-cartesi-machine
       with:
-        version: ${{ inputs.cartesi-machine-version }}
-        sha256-amd64: ${{ inputs.cartesi-machine-sha256-amd64 }}
-        sha256-arm64: ${{ inputs.cartesi-machine-sha256-arm64 }}
+        version: ${{ env.CARTESI_MACHINE_VERSION }}
+        sha256-amd64: ${{ env.CARTESI_MACHINE_SHA256_AMD64 }}
+        sha256-arm64: ${{ env.CARTESI_MACHINE_SHA256_ARM64 }}
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v4
+      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+      with:
+        cache-image: ${{ inputs.cache }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
+    # rust-toolchain.toml is the only Rust pin. rustup resolves it from the
+    # working directory, so the cross guest build gets the same toolchain.
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        toolchain: ${{ inputs.rust-toolchain }}
-        components: ${{ inputs.rust-components }}
+      shell: bash
+      run: rustup set profile minimal && rustup toolchain install
 
     - name: Cache Rust artifacts
-      uses: Swatinem/rust-cache@v2
+      if: inputs.cache == 'true'
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
     - name: Install Foundry
       if: inputs.install-foundry == 'true'
-      uses: foundry-rs/foundry-toolchain@v1
-      with:
-        version: ${{ inputs.foundry-version }}
-
-    - name: Install just
-      uses: taiki-e/install-action@v2
+      uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
       with:
-        tool: just
+        version: ${{ env.FOUNDRY_VERSION }}
 
-    - name: Install cross
-      uses: taiki-e/install-action@v2
+    - name: Install just and cross
+      uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
       with:
-        tool: cross
+        tool: just@${{ env.JUST_VERSION }},cross@${{ env.CROSS_VERSION }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d3ef9f2..e696674c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,17 +1,37 @@
 name: CI
 
+# Pull requests, plus pushes to main and release tags; a branch is checked
+# through its PR, so it does not also run on push.
 on:
   push:
+    branches: [main]
+    tags: ["v*"]
   pull_request:
 
+# A new push to a PR cancels that PR's older run. Every other run is its own
+# group, so runs on main and tags are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+# Builds are not incremental, and cargo output stays coloured in the logs.
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_TERM_COLOR: always
+
 jobs:
   rust:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
@@ -19,6 +39,9 @@ jobs:
       - name: Verify toolchain pin alignment
         run: bash scripts/verify-toolchain-pins.sh
 
+      - name: Verify action pins
+        run: bash scripts/verify-action-pins.sh
+
       - name: Install system dependencies
         run: |
           sudo apt-get update
@@ -30,7 +53,11 @@ jobs:
             liblua5.4-dev \
             lua-check \
             libcurl4-openssl-dev \
-            libslirp-dev
+            libslirp-dev \
+            shellcheck
+
+      - name: Shell lint
+        run: shellcheck scripts/*.sh watchdog/sequencer-watchdog watchdog/test-guest/nvram.sh
 
       # canonical-test links the emulator through testsi's cartesi-machine
       # bindings, so the workspace build needs the pinned CM .deb and the
@@ -42,19 +69,17 @@ jobs:
           sha256-amd64: ${{ env.CARTESI_MACHINE_SHA256_AMD64 }}
           sha256-arm64: ${{ env.CARTESI_MACHINE_SHA256_ARM64 }}
 
+      # rust-toolchain.toml is the only Rust pin; it lists rustfmt and clippy.
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN }}
-          components: rustfmt, clippy
+        run: rustup set profile minimal && rustup toolchain install
 
       - name: Cache Rust artifacts
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
-          version: v1.5.1
+          version: ${{ env.FOUNDRY_VERSION }}
 
       - name: Build
         run: cargo build --workspace --all-targets --locked
@@ -66,7 +91,7 @@ jobs:
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
       - name: Watchdog Lua lint
-        run: cd watchdog && luacheck --no-color *.lua tests/*.lua
+        run: cd watchdog && luacheck --no-color *.lua tests/*.lua tests/fixtures/*.lua
 
       - name: Watchdog Lua unit tests
         run: |
@@ -81,61 +106,66 @@ jobs:
         run: bash scripts/ci-c-application-smoke.sh
 
   openapi:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
 
       - name: Install Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22
 
       - name: Lint OpenAPI definition
         run: npx --yes "@redocly/cli@${REDOCLY_CLI_VERSION}" lint openapi.yaml
 
-  canonical-guest:
-    runs-on: ubuntu-latest
-    needs: rust
-    timeout-minutes: 45
+  # Policy in deny.toml: crate sources block; advisories report without
+  # failing, since the RustSec database changes under a fixed Cargo.lock.
+  cargo-deny:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
 
-      - name: Setup guest toolchain
-        uses: ./.github/actions/setup-guest-toolchain
+      - name: Install Rust toolchain
+        run: rustup set profile minimal && rustup toolchain install
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
-          rust-toolchain: ${{ env.RUST_TOOLCHAIN }}
-          xgenext2fs-version: ${{ env.XGENEXT2FS_VERSION }}
-          xgenext2fs-sha256-amd64: ${{ env.XGENEXT2FS_SHA256_AMD64 }}
-          xgenext2fs-sha256-arm64: ${{ env.XGENEXT2FS_SHA256_ARM64 }}
-          cartesi-machine-version: ${{ env.CARTESI_MACHINE_VERSION }}
-          cartesi-machine-sha256-amd64: ${{ env.CARTESI_MACHINE_SHA256_AMD64 }}
-          cartesi-machine-sha256-arm64: ${{ env.CARTESI_MACHINE_SHA256_ARM64 }}
+          tool: cargo-deny@${{ env.CARGO_DENY_VERSION }}
 
-      - name: Download canonical app deps
-        run: just canonical download-deps
+      - name: Crate sources
+        run: cargo deny --locked check sources
 
-      - name: Run guest tests
-        run: just canonical-test-guest
+      - name: Advisories (report only)
+        continue-on-error: true
+        run: cargo deny --locked check advisories
 
   rollups-e2e:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: rust
     timeout-minutes: 60
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
@@ -143,24 +173,19 @@ jobs:
       - name: Setup guest toolchain
         uses: ./.github/actions/setup-guest-toolchain
         with:
-          rust-toolchain: ${{ env.RUST_TOOLCHAIN }}
-          xgenext2fs-version: ${{ env.XGENEXT2FS_VERSION }}
-          xgenext2fs-sha256-amd64: ${{ env.XGENEXT2FS_SHA256_AMD64 }}
-          xgenext2fs-sha256-arm64: ${{ env.XGENEXT2FS_SHA256_ARM64 }}
-          cartesi-machine-version: ${{ env.CARTESI_MACHINE_VERSION }}
-          cartesi-machine-sha256-amd64: ${{ env.CARTESI_MACHINE_SHA256_AMD64 }}
-          cartesi-machine-sha256-arm64: ${{ env.CARTESI_MACHINE_SHA256_ARM64 }}
           install-foundry: "true"
 
+      # setup-guest-toolchain already ran apt-get update.
       - name: Install native test dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y faketime libfaketime libclang-dev
+        run: sudo apt-get install -y faketime libfaketime libclang-dev libcurl4-openssl-dev build-essential pkg-config
 
-      - name: Build watchdog Lua deps
-        run: |
-          sudo apt-get install -y libcurl4-openssl-dev build-essential pkg-config
-          just watchdog-lua-deps
+      - name: Download canonical app deps
+        run: just canonical download-deps
+
+      # Builds the devnet machine image, which the e2e recipe's
+      # ensure-machine-image then reuses, so CI builds it once.
+      - name: Run guest tests
+        run: just canonical-test-guest
 
       - name: Run rollups E2E tests (Rust and C hosts)
         run: just test-rollups-e2e
@@ -172,7 +197,7 @@ jobs:
 
       - name: Upload E2E failure logs
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rollups-e2e-logs-${{ github.run_attempt }}
           path: tests/e2e/results/*.log
@@ -181,19 +206,21 @@ jobs:
 
   watchdog-docker:
     name: Watchdog Docker image smoke
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: rust
     timeout-minutes: 30
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and smoke-test watchdog image
         run: bash scripts/ci-watchdog-docker-smoke.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 023a8647..d0b356f9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,6 +1,12 @@
 # Release workflow: git tag v* builds wallet-sequencer tarballs, CM images, and pushes
 # watchdog OCI images to ghcr.io + docker.io (requires DOCKERHUB_USERNAME /
 # DOCKERHUB_TOKEN org or repo secrets, same as cartesi/cli).
+# Release builds start cold: no step restores a cache that other refs wrote.
+# Before tagging, run `bash scripts/verify-toolchain-pins.sh --upstream`, fix
+# what it flags, then run `bash scripts/verify-action-pins.sh --upstream` and
+# bump, or knowingly keep, each pin it flags. An action only this workflow uses gets
+# no CI run, so a bumped one first runs at the tag; if it fails, fix it on main
+# and dispatch this workflow for the same tag.
 
 name: Release
 
@@ -11,7 +17,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. v0.1.0-alpha.1)"
+        description: "Existing release tag to rebuild (e.g. v0.1.0-alpha.1)"
         required: true
         type: string
       prerelease:
@@ -20,14 +26,25 @@ on:
         default: true
         type: boolean
 
+# Jobs that write declare it; everything else only reads.
 permissions:
-  contents: write
-  packages: write
+  contents: read
+
+# A tag push and a dispatch for the same tag run one after the other, never
+# interleaving builds, image pushes or release uploads.
+concurrency:
+  group: release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+# Builds are not incremental, and cargo output stays coloured in the logs.
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_TERM_COLOR: always
 
 jobs:
   build-wallet-sequencer:
     name: Build wallet-sequencer (${{ matrix.arch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -38,8 +55,13 @@ jobs:
             target: aarch64-unknown-linux-gnu
 
     steps:
+      # A push builds the pushed commit; a dispatch builds the named tag, fully
+      # qualified so a branch or SHA input cannot stand in and a missing tag fails.
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.sha }}
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
@@ -56,19 +78,17 @@ jobs:
             pkg-config \
             libssl-dev
 
+      # rust-toolchain.toml is the only Rust pin.
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN }}
-          targets: ${{ matrix.target }}
-
-      - name: Cache Rust artifacts
-        uses: Swatinem/rust-cache@v2
+        run: |
+          rustup set profile minimal
+          rustup toolchain install
+          rustup target add ${{ matrix.target }}
 
       - name: Install cross
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
-          tool: cross
+          tool: cross@${{ env.CROSS_VERSION }}
 
       # `sequencer` is a library crate; the runnable reference binary is the
       # `wallet-sequencer` example app (sequencer lib + the placeholder wallet).
@@ -88,7 +108,7 @@ jobs:
           cp "target/${TARGET}/release/wallet-sequencer" "package/wallet-sequencer-${TAG}-linux-${ARCH}/wallet-sequencer"
           bash scripts/generate-release-manifest.sh \
             --tag "${TAG}" \
-            --git-sha "${GITHUB_SHA}" \
+            --git-sha "$(git rev-parse HEAD)" \
             --output "package/wallet-sequencer-${TAG}-linux-${ARCH}/RELEASE.json"
 
           cat > "package/wallet-sequencer-${TAG}-linux-${ARCH}/RUNNING.md" <<'EOF'
@@ -115,17 +135,22 @@ jobs:
           tar -C package -czf "dist/wallet-sequencer-${TAG}-linux-${ARCH}.tar.gz" "wallet-sequencer-${TAG}-linux-${ARCH}"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wallet-sequencer-linux-${{ matrix.arch }}
           path: dist/wallet-sequencer-*.tar.gz
 
   build-canonical-machine-image:
     name: Build canonical machine images
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
+      # A push builds the pushed commit; a dispatch builds the named tag, fully
+      # qualified so a branch or SHA input cannot stand in and a missing tag fails.
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.sha }}
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
@@ -133,13 +158,7 @@ jobs:
       - name: Setup guest toolchain
         uses: ./.github/actions/setup-guest-toolchain
         with:
-          rust-toolchain: ${{ env.RUST_TOOLCHAIN }}
-          xgenext2fs-version: ${{ env.XGENEXT2FS_VERSION }}
-          xgenext2fs-sha256-amd64: ${{ env.XGENEXT2FS_SHA256_AMD64 }}
-          xgenext2fs-sha256-arm64: ${{ env.XGENEXT2FS_SHA256_ARM64 }}
-          cartesi-machine-version: ${{ env.CARTESI_MACHINE_VERSION }}
-          cartesi-machine-sha256-amd64: ${{ env.CARTESI_MACHINE_SHA256_AMD64 }}
-          cartesi-machine-sha256-arm64: ${{ env.CARTESI_MACHINE_SHA256_ARM64 }}
+          cache: "false"
 
       - name: Download canonical app deps
         run: just canonical download-deps
@@ -162,17 +181,25 @@ jobs:
           tar -C examples/canonical-app/out -czf "dist/canonical-machine-image-sepolia-${TAG}.tar.gz" canonical-machine-image-sepolia
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: canonical-machine-images
           path: dist/canonical-machine-image-*.tar.gz
 
   build-watchdog-image:
     name: Build and push watchdog image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write # ghcr.io push
     steps:
+      # A push builds the pushed commit; a dispatch builds the named tag, fully
+      # qualified so a branch or SHA input cannot stand in and a missing tag fails.
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.sha }}
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
@@ -189,27 +216,37 @@ jobs:
           fi
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          cache-image: false
 
+      # The builder records the Actions context (run, ref, commit, actor, event
+      # payload) in the image's provenance. It stays on: everything in it is
+      # already public for this public repository, and verifiers use it.
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Resolve release commit
+        id: commit
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: Build and push watchdog image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         env:
+          # Also skips the build-record artifact, which broke publish's download.
           DOCKER_BUILD_SUMMARY: "false"
         with:
           context: .
@@ -221,32 +258,40 @@ jobs:
             docker.io/cartesi/sequencer-watchdog:${{ inputs.tag || github.ref_name }}
           build-args: |
             RELEASE_TAG=${{ inputs.tag || github.ref_name }}
-            GIT_COMMIT=${{ github.sha }}
+            GIT_COMMIT=${{ steps.commit.outputs.sha }}
             CARTESI_MACHINE_VERSION=${{ env.CARTESI_MACHINE_VERSION }}
             CARTESI_MACHINE_DEB_SHA256_AMD64=${{ env.CARTESI_MACHINE_SHA256_AMD64 }}
             CARTESI_MACHINE_DEB_SHA256_ARM64=${{ env.CARTESI_MACHINE_SHA256_ARM64 }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
 
   publish:
     name: Publish GitHub Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - build-wallet-sequencer
       - build-canonical-machine-image
       - build-watchdog-image
+    permissions:
+      contents: write # create the release and upload its assets
     steps:
+      # A push builds the pushed commit; a dispatch builds the named tag, fully
+      # qualified so a branch or SHA input cannot stand in and a missing tag fails.
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.sha }}
+          persist-credentials: false
 
       - name: Load toolchain pins
         uses: ./.github/actions/load-toolchain-pins
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: dist
           pattern: "{wallet-sequencer-linux-*,canonical-machine-images}"
+          # The default since v8: an artifact whose bytes changed after upload, in
+          # storage or transit, fails publish.
+          digest-mismatch: error
 
       - name: Flatten artifacts
         env:
@@ -257,7 +302,7 @@ jobs:
           find dist -type f -name '*.tar.gz' -exec cp -v '{}' out/ \;
           bash scripts/generate-release-manifest.sh \
             --tag "${TAG}" \
-            --git-sha "${GITHUB_SHA}" \
+            --git-sha "$(git rev-parse HEAD)" \
             --output "out/release-manifest-${TAG}.json"
 
       - name: Generate checksums
@@ -266,13 +311,30 @@ jobs:
           set -euo pipefail
           sha256sum *.tar.gz *.json > SHA256SUMS
 
+      # gh ships with the runner image, so no third-party code holds contents:write.
+      # A tag push creates the release. A dispatch rebuild finds it, published or
+      # draft, replaces its same-name assets, and publishes it if it was a draft.
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ inputs.tag || github.ref_name }}
-          prerelease: ${{ github.event_name == 'workflow_dispatch' && inputs.prerelease }}
-          fail_on_unmatched_files: true
-          files: |
-            out/*.tar.gz
-            out/*.json
-            out/SHA256SUMS
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          GH_TELEMETRY: "false"
+          TAG: ${{ inputs.tag || github.ref_name }}
+          PRERELEASE: ${{ (github.event_name == 'workflow_dispatch' && inputs.prerelease) || (github.event_name == 'push' && contains(github.ref_name, '-')) }}
+        run: |
+          set -euo pipefail
+          gh --version
+          # An asset glob that matches nothing fails here, before any API call.
+          ls -l out/*.tar.gz out/*.json out/SHA256SUMS
+          assets=(out/*.tar.gz out/*.json out/SHA256SUMS)
+          # A view that fails for another reason also falls through to create, whose
+          # check refuses to duplicate a published release.
+          if gh release view --json url -- "${TAG}" > /dev/null; then
+            gh release upload --clobber -- "${TAG}" "${assets[@]}"
+            gh release edit --prerelease="${PRERELEASE}" --draft=false -- "${TAG}"
+          else
+            # --verify-tag refuses to create a missing tag; gh uploads to a draft
+            # and publishes it last, deleting the draft if an upload fails.
+            gh release create --verify-tag --title "${TAG}" --notes "" \
+              --prerelease="${PRERELEASE}" -- "${TAG}" "${assets[@]}"
+          fi
diff --git a/AGENTS.md b/AGENTS.md
index 1bdcb0a1..63753a79 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,7 +3,8 @@
 Start here for the repository's mental model and working rules. Read this baseline
 once, then use [Reading Routes](#reading-routes) to follow the contracts relevant
 to the work. Those documents own detailed behavior; this guide explains why it
-matters and where to look.
+matters and where to look. Every fact has one home
+([Documentation Practice](#documentation-practice)).
 
 ## Mission
 
@@ -32,35 +33,28 @@ In order of importance:
 - **App-specific sequencer.** The sequencer may link against the application, enabling validation and execution at ingress time. This is a deliberate design choice.
 - **Soft confirmations may be invalidated.** Under adversarial conditions (network, infrastructure, provider, or L1 outages), soft confirmations can be rolled back via recovery. This is by design, not a bug — it is what makes the sequencer sound in the face of liveness failures.
 - **App UX may depend on the sequencer.** Without the sequencer, user experience may degrade substantially. This is an acceptable tradeoff: the on-chain scheduler remains the canonical source of truth; the sequencer only accelerates the UX.
-- **SQLite-centered local coordination.** Components publish and consume durable local facts through their owned SQLite tables. The on-chain scheduler remains canonical authority; SQLite is the sequencer's local coordination plane. HTTP ingress ↔ inclusion lane MPSC/oneshot is the deliberate exception because low-latency request/response over the lane's in-memory application is unwieldy through SQLite. Do not turn that exception into a general in-memory component bus. Full statement: [ADR mechanism 4](docs/plans/2026-08-authority-boundary-adr.md).
+- **SQLite-centered local coordination.** Components publish and consume durable local facts through their owned SQLite tables, and the on-chain scheduler remains canonical authority. HTTP ingress ↔ inclusion lane is the one deliberate in-memory exception, not a precedent for a component bus ([ADR mechanism 4](docs/plans/2026-08-authority-boundary-adr.md)).
 - **Append-oriented storage.** Avoid mutable status flags for open/closed entities; prefer write-once NULL→value transitions with one owner each, and derive cursors and heads from persisted facts rather than duplicating them as mutable fields.
 - **Assumption-driven robustness.** Every hardening mechanism must name the invariant it protects, the assumptions under which it is needed, and a trigger for revisiting them. Machinery for failures outside the supported model enlarges the state surface developers must audit and can make the system less robust rather than more.
 - **The complexity budget belongs to concurrency, mutual exclusion, durability, and hostile-L1 robustness.** This sequencer is not algorithmically complex. A large file is a smell: an invariant we're not seeing, a reasonable assumption we're not taking, or plain over-engineering. Judge every mechanism — current or proposed — against its weight.
 
 ## Sequencer / Scheduler Duality
 
-The system has two components in an asymmetric relationship:
-
-### Scheduler — on-chain canonical authority
-
-The scheduler runs inside the rollup and **defines the canonical transaction ordering**. For each batch read from L1 safe inputs, it processes frames in order: drain all pending direct inputs whose block number is ≤ `safe_block`, then execute the frame's user ops. **The scheduler treats the sequencer as potentially Byzantine** — it enforces ordering and staleness rules regardless of what the sequencer claims.
-
-### Sequencer — off-chain predictor
-
-The sequencer knows the scheduler's algorithm. It uses that knowledge to **predict** what the canonical ordering will be once its batches land on L1, and issues soft confirmations to users ahead of time. The sequencer has **write priority on the execution queue**: as long as it keeps advancing `safe_block` and submitting batches, it controls ordering.
-
-### The `safe_block` synchronization primitive
-
-Each frame carries a `safe_block` chosen by the sequencer. It serves two purposes:
-
-- It tells the scheduler how far to drain direct inputs before executing the frame's user ops.
-- It is the sequencer's commitment that it has accounted for all direct inputs up to that block.
-
-The sequencer must advance `safe_block` honestly. If it freezes `safe_block` (to censor deposits) or stops submitting batches, the staleness mechanism detects this and forces recovery.
-
-### When soft confirmations match canonical order
-
-Under honest sequencer operation and no infrastructure outages, soft confirmations match the canonical order. This is an **optimistic guarantee** — the sequencer is predicting a future the scheduler has not yet computed. When the sequencer goes offline, submits stale batches, or tries to censor direct inputs, the scheduler's force-drain backstop kicks in and the affected soft confirmations become invalid.
+The **scheduler** runs inside the rollup and **defines the canonical transaction
+ordering**. For each batch in L1 safe inputs, it processes frames in order:
+drain every pending direct input whose block number is ≤ `safe_block`, then
+execute the frame's user ops. **It treats the sequencer as potentially
+Byzantine** and enforces ordering and staleness regardless of what the
+sequencer claims.
+
+The **sequencer** knows that algorithm and **predicts** the canonical ordering,
+issuing soft confirmations before its batches land. It has **write priority on
+the execution queue** while it keeps advancing `safe_block` and submitting
+batches. A frame's `safe_block` tells the scheduler how far to drain directs
+before the frame's user ops, and commits the sequencer to having accounted for
+every direct input up to that block. Under honest operation without outages,
+soft confirmations match the canonical order; if the sequencer goes offline or
+freezes `safe_block`, staleness forces recovery and invalidates them.
 
 ### Where the duality lives in code (change one, check all)
 
@@ -75,10 +69,9 @@ Scheduler-acceptance semantics exist in exactly three implementations that must
 2. the off-chain acceptance predicate — `ProtocolTiming::scheduler_accepts` ([`sequencer-core/src/protocol.rs`](sequencer-core/src/protocol.rs)), which feeds `safe_accepted_batches`;
 3. the inclusion lane's live prediction (drain + execution order).
 
-The submitter's expected-nonce scan also depends on this agreement. The
-[scheduler contract](docs/protocol/scheduler-semantics.md#the-three-implementations-and-why-they-agree)
-maps the implementations and the deliberate storage-local copy. Changing one
-requires checking the others.
+[I1](docs/invariants.md#i1-scheduler-acceptance-semantics-agree-across-all-implementations)
+maps them and their one deliberate difference. Changing one requires checking
+the others.
 
 Two mechanical facts the agreement rests on:
 
@@ -87,47 +80,21 @@ Two mechanical facts the agreement rests on:
 
 ## Batch Staleness and Recovery
 
-### Staleness
-
-A batch is **stale** when `inclusion_block - first_frame.safe_block >= MAX_WAIT_BLOCKS` (1200 blocks, ~4h). Staleness catches two failure modes:
-
-1. **Liveness failure** — the sequencer went offline and failed to submit batches in time.
-2. **Censorship** — the sequencer kept submitting batches but froze `safe_block` to hold back direct inputs.
-
-When the scheduler encounters a stale batch, it skips its frames without
-consuming the batch nonce. The overdue-direct backstop still runs. Together,
-these rules prevent the sequencer from holding write priority indefinitely
-without advancing the drain cursor; direct inputs are force-drained at
-`MAX_WAIT_BLOCKS`, giving the ~4h censorship-resistance bound.
-
-### Cascading invalidation
-
-If a batch is stale, all existing subsequent batches are also invalid. The scheduler's expected-nonce counter does not advance on a stale skip, so every subsequent batch arrives at an unexpected nonce and is rejected. Invalidation is a suffix operation: marking batch `N` invalid cascades to `N+1`, `N+2`, …, including the open batch. New batches created after recovery are unaffected.
-
-### Two recovery paths
-
-**Automatic recovery** repairs optimistic history after liveness failures. The
-danger detector signals service to stop when a danger check fires; startup recovery
-settles outstanding submissions and replaces the invalid suffix using local
-SQLite facts and safe L1 history. The danger threshold is a trigger, not proof
-that a batch is doomed. Detection uses safe state, with wall-clock checks when
-the L1 view stops advancing. Expected recovery exits gracefully; diagnosed
-terminal runtime faults abort immediately. The [automatic recovery design](docs/recovery/README.md)
-owns detection, startup ordering, dispatch, and admission.
-
-**Manual cockroach recovery** (`setup --recovery`) rebuilds from a trusted
-canonical application checkpoint and L1 history into a fresh data directory.
-It also applies after sequencer bugs: fix the bug, choose a trusted canonical
-checkpoint, and then run recovery. Historical batches,
-including malformed ones, receive the canonical scheduler's treatment. The
-result accounts for a fixed input prefix from which sequencing can resume; it
-does not need to catch the moving L1 tip or preserve prior soft confirmations.
-The [cockroach recovery guide](docs/recovery/cockroach.md) owns the checkpoint
-requirements, stopping boundary, and rebuild procedure.
-
-Before changing recovery code, read its guide and both current bounded TLA+
-models. The automatic recovery guide's [Formal Verification](docs/recovery/README.md#formal-verification)
-section explains their scopes; the models are not a proof of every recovery path.
+A batch is **stale** when `inclusion_block - first_frame.safe_block >= MAX_WAIT_BLOCKS`
+(1200 blocks, ~4h): the sequencer went offline, or kept submitting while
+freezing `safe_block` to hold back directs. The scheduler skips a stale batch
+without consuming its nonce, and overdue directs are force-drained anyway, which
+bounds censorship at ~4h. Every later batch then arrives at an unexpected nonce,
+so invalidation cascades through the suffix, open batch included
+([scheduler semantics](docs/protocol/scheduler-semantics.md)).
+
+- **Automatic recovery** repairs optimistic history after liveness failures: the
+  danger detector stops the process at a threshold before staleness, and startup
+  settles outstanding submissions and replaces the invalid suffix
+  ([automatic recovery](docs/recovery/README.md)).
+- **Cockroach recovery** (`setup --recovery`) rebuilds a fresh data directory from
+  a trusted canonical checkpoint and L1 history, including after a sequencer bug
+  ([cockroach recovery](docs/recovery/cockroach.md)).
 
 ## Threat Model (brief)
 
@@ -135,11 +102,8 @@ See [`docs/threat-model/README.md`](docs/threat-model/README.md) for the full mo
 
 - **Trusted:** InputBox contract, our own Ethereum node (fail-stop, not byzantine), operator config, batch-submitter key.
 - **Adversarial:** `POST /tx` callers, direct-input senders, the L1 mempool and block builders (zombie transactions are a first-class threat).
-- **RPC endpoint:** single (`CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`), trusted fail-stop, **must be one consistent node** — no fallback tier exists yet (see the threat model's actor table).
-- **Self-trust:** normal operation assumes the sequencer's own code is correct.
-  Invariant violations fail loud. Bug-induced malformed batches require fixing
-  the bug and, when rebuilding is necessary, manual cockroach recovery; automatic
-  recovery does not repair software defects.
+- **RPC endpoint:** single (`CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`), trusted fail-stop, **must be one consistent node** — no fallback tier exists yet ([RPC endpoint](docs/threat-model/README.md#rpc-endpoint)).
+- **Self-trust:** normal operation assumes the sequencer's own code is correct; a bug needs a fix and, when state cannot be trusted, cockroach recovery. Automatic recovery does not repair software defects.
 - **In scope:** correctness bugs *and* exploitation. Under rollup semantics, a correctness bug that causes scheduler/sequencer state divergence is as severe as direct theft.
 
 ## Architecture Map
@@ -163,6 +127,7 @@ signing, and SSZ batch encoding.
 - `examples/canonical-test/` — e2e test harness for the canonical app.
 - `sdk/rust-client/` — Rust client library for the sequencer API.
 - `sdk/guest/` — canonical-guest SDK: `trolley` (guest rollup API over `libcmt-sys`), `rollups-types` (rollups ABI encodings), and `testsi` (host-side guest image tests); provenance in its README.
+- `watchdog/` — Lua watchdog: re-derives canonical state from L1 and compares it with the sequencer's accepted checkpoint ([watchdog README](docs/watchdog/README.md)).
 - `tests/{benchmarks,e2e,harness}/` — test infrastructure.
 
 ### Sequencer module layout
@@ -184,93 +149,23 @@ Paths below are relative to `sequencer/src/`:
 - **Chunk** — bounded list of user ops processed and persisted together to amortize SQLite cost.
 - **Frame** — ordering boundary; commits `safe_block` + user ops.
 - **Batch** — list of frames posted on-chain as one L1 transaction (SSZ-encoded).
-- **Inclusion lane** — the single ordering lane, with a latency-critical user-op regime and a slower L1-reconciliation regime ([ADR mechanism 4](docs/plans/2026-08-authority-boundary-adr.md)); the only writer of open batch/frame state ([I17](docs/invariants.md)) and the system's execution bottleneck.
-- **Batch submitter** — stateless worker that bulk-submits all pending batches each tick. Storage assigns each batch's scheduler nonce at creation (`parent.nonce + 1`, or the deployment anchor for a root); the submitter reads it and selects L1 wallet nonces for submission.
-- **Danger detector** — polls `Storage::check_danger` and signals the process to stop so startup can recover or refuse. It reads local facts; it never writes the DB or talks to L1.
-- **Fee oracle** — setup pins and bootstraps a fixed price or Uniswap V3 TWAP source. The price informs future frame fees; an oracle-only outage is an accepted economic risk. The [threat model's actor table](docs/threat-model/README.md#actors-and-trust) owns the source assumptions and failure policy.
-- **Input reader** — ingests safe inputs from L1 InputBox and maintains the durable safe head, accepted-batch projection, and divergence marker in one atomic transaction (`sequencer/src/storage/l1_inputs.rs`); it hands the lane no in-memory cursor.
-- **L2 tx feed** — DB-backed application-input stream. HTTP snapshot headers
-  provide `(EraId, RecoveryGeneration, ExecutedInputCount)`; WS validates that
-  claim and replays inclusively before following the tip.
-- **Application progress** — engine-owned `(ExecutedInputCount,
-  last_executed_safe_block)`, embedded in every dump. Shared execution verifies
-  the transition and returns the pre-execution offset; storage commits that
-  mandatory offset with its source in `application_inputs`.
-- **History version** — `(EraId, RecoveryGeneration)`. Setup publishes a complete
-  baseline with a fresh era; recovery increments the generation exactly once
-  iff it invalidates at least one valid batch and records the preserved-prefix
-  cut in the same transaction. `/history` can check a saved checkpoint across
-  intervening generations; subscription claims still enforce both identifiers.
-  The [history contract](docs/protocol/application-history.md) owns compatibility.
+- **Tip** — the open batch at the end of the valid branch; recovery invalidates a suffix and opens a new Tip ([automatic recovery](docs/recovery/README.md#the-state-being-repaired)).
+- **Inclusion lane** — the single ordering lane ([ADR mechanism 4](docs/plans/2026-08-authority-boundary-adr.md)); the only writer of open batch/frame state ([I17](docs/invariants.md)) and the system's execution bottleneck.
 - **Soft confirmation** — sequencer's predicted ordering, emitted before the batch lands on L1.
-- **Snapshot** — immutable artifact at every batch close, registered with its
-  local batch identity and application count. Acceptance facts select the
-  recovery/watchdog checkpoint; the era baseline supplies the initial restore
-  point. Lifecycle and leases: [`docs/snapshots/lifecycle.md`](docs/snapshots/lifecycle.md).
+- **Snapshot** — immutable artifact registered at every batch close; acceptance selects the comparison and recovery checkpoint ([snapshot lifecycle](docs/snapshots/lifecycle.md)).
 
 ## Domain Truths
 
 - API validates the EIP-712 signature and enqueues a `SignedUserOp`. Method payload decoding happens during application execution, not at ingress.
 - **Deposits are direct-input-only** (L1 → L2) and must not be represented as user ops.
-- Rejections (`InvalidNonce`, `NonceExhausted`, `InvalidMaxFee`, `InsufficientFeeBalance`) produce no state mutation and are not persisted. These are protocol-level rejection semantics every app must implement: nonces prevent user-op replay, fees prevent spam against the sequencer's DA budget. ("Fee", not "gas" — the fee tracks DA; compute metering, if it ever exists, is a separate future concept.)
-- **The user-nonce rule is contract, not wallet detail:** accounts start at 0, an op must carry exactly the expected nonce, each included op advances it by one, and direct inputs never touch it. `GET /nonce` derives from persisted user ops under this rule instead of asking the app ([application contract](docs/protocol/application-contract.md#user-nonces)).
-- Included txs are persisted as frame/batch data in `batches`, `frames`, `user_ops`, `safe_inputs`, and `application_inputs`. Recovery metadata lives in `safe_accepted_batches`; batch lifecycle state (sealed/invalidated) lives on the `batches` row itself as write-once timestamps.
-- Frame fee is persisted in `frames.fee` and is fixed for the lifetime of that frame. The next frame's fee is currently sampled from `batch_policy_derived.recommended_fee` at rotation; oracle bootstrap writes the price before any Tip can sample it, and `log_slack` applies the 10× margin in log space. This is present behavior, not a reason for the five-block clock policy; hoisting fee to the batch is a later design with its own trade-offs.
-- Wallet balances and nonces live in memory between checkpoints; restart restores
-  a dump and replays persisted application inputs.
-- **EIP-712 domain fields:** `name`, `version`, `chainId`, `verifyingContract`.
-  Setup pins the chain id and app address from `CARTESI_SEQUENCER_BLOCKCHAIN_ID`
-  and `CARTESI_SEQUENCER_APP_ADDRESS`, validating the chain id against RPC. All
-  four fields must be present on both sides; the sequencer and canonical
-  scheduler share `sequencer_core::build_input_domain`.
-
-### InputBox payload classification
-
-- The input reader ingests every `InputAdded` event from InputBox. Each event carries an authenticated `msg_sender` (delivered by the Cartesi framework from `EvmAdvanceCall`).
-- **Classification is by sender address**, not by a tag byte:
-  - Sender == batch-submitter address → SSZ-decoded as `Batch` (scheduler side). The sequencer does not ingest its own batch submissions as direct inputs.
-  - Any other sender → stored verbatim as a direct input (deposit).
-- The payload is opaque to the classification layer. Application-specific decoding happens inside `Application::apply_direct_input`, reached only through the shared `execute_direct_input` boundary.
+- **InputBox payload classification** is by authenticated sender, never by a tag byte: the batch submitter's inputs are batches; any other sender's are direct inputs, stored verbatim ([scheduler semantics](docs/protocol/scheduler-semantics.md#the-one-stream-the-one-classification)).
+- A rejected user op changes no state and is not persisted; the [application contract](docs/protocol/application-contract.md) owns which layer produces each rejection. The charge is a "fee", not "gas": it tracks DA.
+- **The user-nonce rule is contract, not wallet detail** ([user nonces](docs/protocol/application-contract.md#user-nonces)); `GET /nonce` relies on it instead of asking the app.
+- **EIP-712 domain:** both sides build it with `sequencer_core::build_input_domain` ([user-op signatures](docs/protocol/scheduler-semantics.md#user-op-signatures)); setup pins the chain id and app address, validating the chain id against RPC.
 
 ## Application Trait Contract
 
-Implementors of the `Application` trait must respect these contracts. The shared execution boundary verifies application-owned count/clock progress; application-specific determinism and mutation remain self-trusted. The full, code-grounded contract — method table, dump round-trip durability, the safe-block clock — is **owned by [`docs/protocol/application-contract.md`](docs/protocol/application-contract.md)**; the essentials follow.
-
-### Replay determinism
-
-The sequencer persists every included user op and every ingested direct input. On restart, catch-up replays them in order against a fresh `Application` instance to rebuild state. **Any input that succeeded live must succeed on replay.**
-
-- `apply_direct_input` and `apply_valid_user_op` must not return `AppError::Internal` for any byte sequence that previously executed successfully. The canonical scheduler, catch-up, and recovery fold treat `Internal` as fatal: no canonical successor is defined.
-- Validation returns `Accept`, `Reject(InvalidReason)`, or fatal `AppError`. A rejected op changes no state. Included business failures and malformed direct-input no-ops still advance progress; do not turn them into validation rejections. See the application contract for the nonce rule and the wallet's fee semantics.
-- `validate_user_op` must be pure over the current app state. No side effects, no time dependence, no randomness.
-
-### No implicit state
-
-Logical state changes, including `ApplicationProgress`, flow through the `apply_valid_user_op` and `apply_direct_input` hooks. The engine reports progress by value. Mutating state from `validate_user_op` breaks replay determinism; mutable checkpoint creation may replace backing resources while preserving logical state.
-
-### One execution entry point
-
-User ops are executed only through `sequencer_core::application::validate_and_execute_user_op`; already-validated user ops and directs use `execute_valid_user_op` / `execute_direct_input`. The shared boundary preflights the checked successor, then verifies the engine's progress after a successful hook and returns its pre-execution offset. Count zero implies clock zero. Validation purity and native mutation remain self-trusted. `AppError` is fatal and defines no canonical successor; callers discard the instance rather than resume it. The inclusion lane, canonical scheduler, catch-up, and recovery fold all use this boundary — part of the duality agreement.
-
-`Application` requires `Send`, with neither `Clone` nor `Sync`. Dumps must be durable and immutable, and restored engines must remain independent after source deletion. The opaque app prefix may be a file or directory; checkpoint disposal uses ordinary recursive filesystem deletion. Canonical inspection belongs to the separate `CanonicalState` trait; the native sequencer serves the comparison file in the checkpoint. The [C binding guide](docs/protocol/c-application-binding.md) maps the contract to native engines.
-
-## Ordering and Storage
-
-Preserve single-lane deterministic ordering. Do not introduce extra concurrency
-in hot-path ordering logic without explicit approval.
-
-The inclusion lane combines a latency-critical user-op regime with complete L1
-reconciliation. The [authority-boundary ADR](docs/plans/2026-08-authority-boundary-adr.md)
-owns that split, acknowledgement rules, runtime ownership, and command admission.
-The [scheduler contract](docs/protocol/scheduler-semantics.md#sequencer-frame-clock-policy)
-owns the five-safe-block frame clock; the [Application contract](docs/protocol/application-contract.md#5-operational-capacity-for-l1-reconciliation)
-owns the assumption that accumulated directs are digestible without preemption.
-
-Storage changes cross writer boundaries even when the SQL looks local. Read the
-[invariant register](docs/invariants.md) for writer ownership, `valid_*` reads,
-drain attribution, the content-identity/divergence freeze, `WriteHead` coherence,
-and application-history offsets. The [schema](sequencer/src/storage/migrations/0001_schema.sql)
-enforces write-once batch lifecycle, Tip uniqueness, and user-op identity.
+The [application contract](docs/protocol/application-contract.md) owns the `Application` trait; the [C binding guide](docs/protocol/c-application-binding.md) maps it to native engines. Two rules carry the duality: **any input that succeeded live must succeed on replay** (`AppError` is fatal and defines no canonical successor), and the inclusion lane, canonical scheduler, catch-up, and recovery fold execute inputs only through the shared boundary in `sequencer_core::application`, which checks the engine's reported progress.
 
 ## Type Boundaries
 
@@ -285,92 +180,75 @@ enforces write-once batch lifecycle, Tip uniqueness, and user-op identity.
 
 ## HTTP Endpoints
 
-- **Ingress** (public-facing): `POST /tx`, `GET /fee`, `GET /nonce`, `GET /domain`.
-- **Egress** (internal indexers/watchdog): application-input subscriptions,
-  snapshot/state downloads, and health probes. Snapshot/state endpoints have no
-  authentication and **must not be exposed publicly**. Downloads hold a GC lease
-  for their response lifetime ([snapshot lifecycle](docs/snapshots/lifecycle.md)).
-
-Today both sides serve from one listener; the planned API split puts each side on its own port (same binary) so internal probes and subscribers can be firewalled from public submit traffic.
-
-The [README API contract](README.md#api) owns routes, message shapes, caps,
-close codes, and health semantics. [`openapi.yaml`](openapi.yaml) is its
-machine-readable rendering for client generation and documentation tools;
-change both in the same patch. CI lints it; run
-`direnv exec . redocly lint openapi.yaml` locally.
+Only the ingress routes (`POST /tx`, `GET /fee`, `GET /nonce`, `GET /domain`) are
+public; every other route, snapshot and state downloads included, is internal,
+unauthenticated, and **must not be exposed publicly**. The [README API contract](README.md#api)
+owns routes, listeners, shapes, caps, and codes; [`openapi.yaml`](openapi.yaml)
+renders it for client generation and documentation tools, so change both in the
+same patch. CI lints it; run `direnv exec . redocly lint openapi.yaml` locally.
 
 ## Command Configuration
 
-Configuration follows the command phases:
-
-- Plain **`setup`** is L1-read-only and never signs. It pins chain/app/submitter
-  identity and the fee source. **`setup --recovery`** also needs the submitter
-  key to flush its outstanding transactions; see the [rebuild guide](docs/recovery/cockroach.md).
-- **`run`** takes the RPC endpoint and signing key (or key file). It reads the
-  pinned chain id, app address, and submitter address from the database.
-
-**Use a dedicated submitter address.** Plain setup refuses an unsettled wallet
-nonce, so sharing a busy contract-deployer address can trip the detection gate
-while its deployment transactions are not yet safe. The devnet uses Anvil
-account 9 (`DEVNET_SEQUENCER_ADDRESS`), separate from the account-0 deployer.
-
-The [Running guide](README.md#running) gives invocation examples;
-[`commands/config.rs`](sequencer/src/commands/config.rs) owns environment-variable
-names, defaults, and validation. Check configuration there before documenting or
-changing it, including checkpoint and fee-source selection.
+Plain `setup` is L1-read-only and never signs; `run` and `flush-mempool` take the
+signing key and read the pinned identity from the database. [Running](README.md#running)
+owns invocation and why the submitter address must be dedicated (the devnet uses
+Anvil account 9). [`commands/config.rs`](sequencer/src/commands/config.rs) owns
+every variable name, default, and validation; check it before documenting or
+changing configuration.
 
 ## Coding Conventions
 
-- Prefer small, composable functions at module boundaries (`ingress::api` → `ingress::inclusion_lane` → `storage::ingress`; `egress::l2_tx_feed` ← `storage::egress`).
+- Prefer small, composable functions at module boundaries (`ingress::api` → `ingress::inclusion_lane` → `storage::ingress`; `egress::l2_tx_feed` ← `storage::history`).
 - Keep application validation and execution deterministic for a given input/state. No `SystemTime::now()`, `HashMap` iteration order, or floating-point in consensus paths.
-- Surface user-facing errors via `ApiError` (in `http.rs`); keep internal failures descriptive but safe.
+- Surface user-facing errors via `ApiError` (in `http.rs`); keep internal failures descriptive but safe. An error that wraps a cause ends its Display with `: {source}`, because log sinks print Display only. A dependency error whose Display omits its cause (reqwest names only the request kind) is rendered with `l1::provider::error_chain` where it becomes text, in a `String` variant or a log field; it appends only causes the line does not already hold, so it is also safe on our own wrappers of such an error. A failure logs at its verdict's level: ERROR when the cause is a fault or unknown (terminal, unclassified), WARN when the verdict names a planned procedure (a recovery boot, a retry, `setup --recovery`).
 - Avoid introducing heavy dependencies without strong reason.
-- Documentation style: lean. Module headers (1–4 lines) + docs on public methods only when the contract isn't obvious from name+signature.
-- **Comment the non-obvious, not the self-evident.** Keep comments concise; avoid redundant and excessive inline commentary. Do not restate what the code already expresses. Explain the why, edge cases, invariants, and subtle behaviors that cannot be inferred from reading the code alone.
-- Review-item codenames (finding/decision ids from past review ledgers) never appear in code comments or living docs — state the reason itself, or point at the invariant register entry that owns it. Invariant ids (`I1`–`I20`) are stable register references and are fine.
-- **Impossible states fail loud; they are never handled.** Cheap cross-module assertions of *real invariants* are encouraged (assert, trigger `RAISE`, typed error). Failing loud is safety-preserving, not necessarily self-healing: transient failures may clear on restart, while a persistent invariant violation is terminal and may require inspection or cockroach recovery. Silent divergence is never acceptable. Never add graceful fallbacks, neighbor re-validation, or silent absorbers (`INSERT OR IGNORE`, saturating decode of impossible data) for states the contracts rule out; and an assertion must check a real invariant, never an environmental assumption (clock monotonicity is the cautionary tale). Decision test and rationale: [`docs/invariants.md`](docs/invariants.md); trust boundaries: "Self-trust" in [`docs/threat-model/README.md`](docs/threat-model/README.md).
+- **Impossible states fail loud; they are never handled or absorbed.** The [check policy](docs/invariants.md#the-check-policy-fail-loud) owns the decision test and its reasons; [Self-trust](docs/threat-model/README.md#self-trust) owns the trust boundary.
 
 ## Documentation Practice
 
 Write for a reader building a mental model. Start with the purpose, input,
 result, and governing constraint; introduce implementation detail when it
 explains a necessary behavior. Keep an intentional baseline here so important
-concepts are discoverable before anyone knows to ask about them. Summaries
-should point to the owner of a contract rather than becoming a second copy.
+concepts are discoverable before anyone knows to ask about them.
+
+- **One fact, one home.** Elsewhere, name the fact in a clause and link its owner; never restate its conditions, orderings, or lists.
+- **Surprising facts go into the owning doc**, so the next reader does not rediscover them.
+- **Size caps.** A module header (Rust `//!`, Lua `---`) is 1–4 lines and a rustdoc contract about 6; public methods get docs only when name and signature leave the contract unclear. Longer reasoning goes to the owning doc or invariant, linked.
+- **Comment the non-obvious, not the self-evident.** Explain the why, edge cases, invariants, and subtle behavior the code cannot show; do not restate what it expresses.
+- **State a non-guarantee once**, at its owner, and only where a reader would otherwise assume the guarantee.
+- **Table cells hold one sentence.**
+- **Record deliberate absence once**, at the seam where someone would re-add the mechanism, phrased as a positive design statement with its reason. Avoid removal notices scattered across documents.
+- **No review codenames** (finding or decision ids from past review ledgers) in code comments or living docs: state the reason, or point at the invariant register entry that owns it. Invariant ids (`I1`–`I20`) are stable references and are fine.
 
 Keep three kinds of material distinct:
 
-- **Current contracts and designs** describe what holds now and why. Use present
-  tense and reasoning inline, without amendment banners, review codenames, or
-  "previously/no longer" narration. Each topic has one owner. Some current
-  architecture documents live in `docs/plans/`; the directory name does not
-  make their established contracts optional.
-- **Active plans** name open decisions, dependencies, and remaining work. They
-  must distinguish proposed behavior from implemented contracts. On completion,
-  put the durable design in its owner and reduce the plan to its remaining work
-  and links.
-- **Review notes** are temporary working memory. Commit them when they help an
-  active review or handoff, then distill and delete them when that work ends.
-  The [review lifecycle](docs/review/README.md) owns the policy: unresolved work
-  stays in one register or active plan, durable reasoning in its current owner,
-  completed history in Git. Keep dated evidence only for a named ongoing use.
-
-**Record deliberate absence once**, at the seam where someone would re-add the
-mechanism, phrased as a positive design statement with its reason. Avoid removal
-notices scattered across documents.
+- **Current contracts and designs** describe what holds now and why, in present
+  tense, without amendment banners or "previously/no longer" narration. Some
+  current architecture documents live in `docs/plans/`; the directory name does
+  not make their established contracts optional.
+- **Active plans** name open decisions, dependencies, and remaining work, and
+  distinguish proposed behavior from implemented contracts. On completion, put
+  the durable design in its owner and reduce the plan to remaining work and links.
+- **Review notes** are temporary working memory. The [review lifecycle](docs/review/README.md)
+  owns where their conclusions go: unresolved work to the [register](docs/review/register.md),
+  durable reasoning to its owner, completed history to Git.
 
 ## Testing Guidance
 
-Focus tests on:
-
-- Signature + sender-validation edge cases.
-- Nonce progression rules.
-- Fee and rejection behavior.
-- Included-vs-rejected commit behavior.
-- Storage batch atomicity and uniqueness constraints.
-- Scheduler/sequencer agreement — any invariant the two sides share should have at least one test that exercises both.
-
-Prefer black-box tests around `POST /tx` and commit outcomes for integration.
+Concentrate tests where consensus risk lives: signature and sender validation,
+nonce progression, fee and rejection behavior, included-vs-rejected commits, and
+storage batch atomicity and uniqueness. Any invariant the scheduler and
+sequencer share gets at least one test that exercises both sides. Prefer
+black-box tests around `POST /tx` and commit outcomes for integration.
+
+Test placement: unit tests are a child module of the code under test, inline
+`#[cfg(test)] mod tests` or `<module>/tests.rs` (or `<topic>_tests.rs`) once
+large, never `#[path]`. Cross-module in-process tests go in
+`sequencer/src/integration_tests/`; devnet, machine and binary tests go in the
+`tests/*` crates. Shared fixtures live in `crate::test_support`;
+`storage::test_helpers` keeps the storage-domain ones (seeding, the recovery
+fixture trait, divergence markers); cross-crate signing helpers live in
+`sequencer_core::test_support` behind its `test-support` feature.
 
 Some `sequencer` tests use Anvil (Foundry). They run by default and fail with a
 clear message if `anvil` is not on PATH. Use the configured Nix/direnv environment
@@ -382,11 +260,15 @@ both) and libslirp.
 
 Use the configured Nix/direnv environment for Foundry, TLA+, and other project
 tools. For noninteractive commands, prefer `direnv exec . <command>`. Rust is
-pinned to **1.95.0** in [`rust-toolchain.toml`](rust-toolchain.toml); verify both
-`cargo --version` and `rustc --version` in the environment you use. A Nix-provided
+pinned in [`rust-toolchain.toml`](rust-toolchain.toml), the only Rust pin (CI and
+release install from it); verify both `cargo --version` and `rustc --version` in
+the environment you use. A Nix-provided
 Cargo or rustc may bypass rustup, so direnv alone does not guarantee the pinned
 compiler is selected. Correct the toolchain selection before interpreting build
-or dependency errors.
+or dependency errors. `cross` builds the guest with the channel's
+`x86_64-unknown-linux-gnu` toolchain on every host; the guest recipes install
+it, with the riscv64 target and `rust-src`, before each build
+(`just canonical cross-toolchain`).
 
 ```bash
 direnv exec . cargo check
@@ -409,7 +291,7 @@ See [Running](README.md#running) for the two-phase `setup` / `run` workflow.
 - Run at least `cargo check` before finishing.
 - Read the relevant recovery guide and both current TLA+ models before touching
   recovery code, and the threat model before touching trust-boundary code.
-- Check [`docs/invariants.md`](docs/invariants.md) before changing anything it lists as load-bearing, the owning design for its assumptions, and [`docs/review/register.md`](docs/review/register.md) for unresolved work in the code you're about to touch. Verify review claims against current code.
+- Check [`docs/invariants.md`](docs/invariants.md) before changing anything it lists as load-bearing (storage changes cross writer boundaries even when the SQL looks local), the owning design for its assumptions, and [`docs/review/register.md`](docs/review/register.md) for unresolved work in the code you're about to touch. Verify review claims against current code.
 
 ### Ask First
 
@@ -457,8 +339,9 @@ work reaches another boundary.
 | API, subscriber replay, or application-history coordinates | [README API contract](README.md#api) — wire behavior, with [`openapi.yaml`](openapi.yaml) changed alongside it; [application history](docs/protocol/application-history.md) — era, generation, offsets, and recovery boundaries. |
 | Snapshots, restart, export, retention, or watchdog checkpoints | [Snapshot lifecycle](docs/snapshots/lifecycle.md) — durable publication, accepted comparison points, leases, and GC; [wallet format](docs/snapshots/format.md) when changing wallet bytes. |
 | Trust boundaries, provider behavior, or hostile L1 input | [Threat model](docs/threat-model/README.md) — actor assumptions, supported failures, and residual risks. |
-| Submission fees or oracle pricing | [L1 fee policy](docs/l1-fee-policy.md) — estimation and replacement limits; [threat-model actor table](docs/threat-model/README.md#actors-and-trust) — oracle source and outage assumptions. |
+| Submission fees or oracle pricing | [L1 fee policy](docs/l1-fee-policy.md) — estimation and replacement limits; [threat model's fee oracle section](docs/threat-model/README.md#fee-oracle) — oracle source and outage assumptions. |
 | Command setup or deployment configuration | [Running](README.md#running) and [config.rs](sequencer/src/commands/config.rs) — invocation, identity pinning, defaults, and validation. |
 | Watchdog development or operation | [Watchdog README](docs/watchdog/README.md) — contract, state sources, commands, and state; [incident runbook](docs/watchdog/incident-runbook.md) — what a latched divergence requires; [local dev](docs/watchdog/getting-started.md) for Anvil; [operator deployment](docs/watchdog/operator-deployment.md) for Sepolia/mainnet. |
 | Canonical guest, machine images, or a Cartesi Machine bump | [Cartesi Machine facts](docs/cartesi-machine.md) — version pinning, host semantics, storage, memory ranges, and the guest side. |
-| A new mechanism, simplification, or work spanning an active track | Owning design and [invariants](docs/invariants.md) — reasons and assumptions; [review register](docs/review/register.md) — unresolved work; [coordination tracks](docs/plans/2026-07-coordination-tracks.md) — priorities and dependencies. Follow the [review lifecycle](docs/review/README.md) when recording conclusions. |
+| A release, or adding or bumping a GitHub Action | [`release.yml`](.github/workflows/release.yml) header — what to run before tagging; [`verify-action-pins.sh`](scripts/verify-action-pins.sh) — pin form, upstream audit, and why bumps are manual. |
+| A new mechanism, simplification, or work spanning an active track | Owning design and [invariants](docs/invariants.md) — reasons and assumptions; [review register](docs/review/register.md) — unresolved work; [coordination tracks](docs/plans/2026-07-coordination-tracks.md) — priorities and dependencies. |
diff --git a/Cargo.lock b/Cargo.lock
index 7ff8e9c4..afbc7d4c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,9 +39,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-chains"
-version = "0.2.36"
+version = "0.2.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c36ddb69f5e41407e7a93aead3480f7c8ff076e73d01a951ae8f7ea4542c1ca0"
+checksum = "c1c4f6f6f020f38a4ef079428b5c7009e913bf8102e4d65a90c6cb2cf93800eb"
 dependencies = [
  "alloy-primitives",
  "num_enum",
@@ -67,12 +67,12 @@ dependencies = [
  "either",
  "k256",
  "once_cell",
- "rand 0.8.7",
+ "rand 0.8.8",
  "secp256k1 0.30.0",
  "serde",
  "serde_json",
  "serde_with",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -108,7 +108,7 @@ dependencies = [
  "futures",
  "futures-util",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
  "tokio",
  "tracing",
  "wasmtimer",
@@ -116,9 +116,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-core"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8421a5ee9019b6d89f92935d0f8facd9f6ca088b41d7cc47244a02ccde4545f"
+checksum = "c6a70852055d66af821d28497e690c95950020ed1ee4c7a0ab9b02a01ac75ee3"
 dependencies = [
  "alloy-dyn-abi",
  "alloy-json-abi",
@@ -129,9 +129,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-dyn-abi"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a04eb4abc2b5074a18e687ee63918f407cc7990083cba9b999445f839796060"
+checksum = "14b3b9990889736af898bd4e51f7d0c0228d6a9b9c3a5fecb3e6b25a7abc791c"
 dependencies = [
  "alloy-json-abi",
  "alloy-primitives",
@@ -140,7 +140,7 @@ dependencies = [
  "itoa",
  "serde",
  "serde_json",
- "winnow 1.0.4",
+ "winnow",
 ]
 
 [[package]]
@@ -153,14 +153,14 @@ dependencies = [
  "alloy-rlp",
  "crc",
  "serde",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
 name = "alloy-eip2930"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9441120fa82df73e8959ae0e4ab8ade03de2aaae61be313fbf5746277847ce25"
+checksum = "e64579d931b3f8eacc7c9ab0b220e87e9c4816e5c724ede1947b55c2f8e92ae5"
 dependencies = [
  "alloy-primitives",
  "alloy-rlp",
@@ -178,7 +178,7 @@ dependencies = [
  "alloy-rlp",
  "borsh",
  "serde",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -192,7 +192,7 @@ dependencies = [
  "borsh",
  "once_cell",
  "serde",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -205,7 +205,7 @@ dependencies = [
  "alloy-rlp",
  "borsh",
  "serde",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -243,7 +243,7 @@ dependencies = [
  "alloy-provider",
  "alloy-sol-types",
  "async-trait",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -276,9 +276,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-json-abi"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cee30dd4c2f4b23f434fdf675e7bf9681b86768141277266c6f548ef25cba0a"
+checksum = "858acd7fdad1e4a7057fd9c1b39c1f2cd6bcd57ebf3c56e2853c02ead049e816"
 dependencies = [
  "alloy-primitives",
  "alloy-sol-type-parser",
@@ -297,7 +297,7 @@ dependencies = [
  "http",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
  "tracing",
 ]
 
@@ -324,7 +324,7 @@ dependencies = [
  "futures-utils-wasm",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -354,19 +354,19 @@ dependencies = [
  "alloy-signer-local",
  "k256",
  "libc",
- "rand 0.8.7",
+ "rand 0.8.8",
  "serde_json",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror",
  "tracing",
  "url",
 ]
 
 [[package]]
 name = "alloy-primitives"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f007e257069855bdf21d27762fd3f3705a613f805c9a08309bf353503f081d71"
+checksum = "d5e9dbd49258ac3ab893a481d46be29b58be7f734dcac46cd80b6b13ee36566c"
 dependencies = [
  "alloy-rlp",
  "bytes",
@@ -376,7 +376,7 @@ dependencies = [
  "fixed-cache",
  "foldhash",
  "hashbrown 0.17.1",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "itoa",
  "k256",
  "keccak-asm",
@@ -423,10 +423,10 @@ dependencies = [
  "lru",
  "parking_lot",
  "pin-project",
- "reqwest 0.13.4",
+ "reqwest",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
  "tokio",
  "tracing",
  "url",
@@ -467,7 +467,7 @@ dependencies = [
  "alloy-transport-http",
  "futures",
  "pin-project",
- "reqwest 0.13.4",
+ "reqwest",
  "serde",
  "serde_json",
  "tokio",
@@ -537,7 +537,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -563,7 +563,7 @@ dependencies = [
  "either",
  "elliptic-curve",
  "k256",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -578,15 +578,15 @@ dependencies = [
  "alloy-signer",
  "async-trait",
  "k256",
- "rand 0.8.7",
- "thiserror 2.0.19",
+ "rand 0.8.8",
+ "thiserror",
 ]
 
 [[package]]
 name = "alloy-sol-macro"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5655c38d5f84955bf727b2eeb62fddd91ebb98fd1d7ae6eb77f73ea88f9b9cf"
+checksum = "60dd79f578c3912f1fc2a150dbeb8110b8cfb976c60f98ebf6de9d5da5965a2b"
 dependencies = [
  "alloy-sol-macro-expander",
  "alloy-sol-macro-input",
@@ -598,15 +598,15 @@ dependencies = [
 
 [[package]]
 name = "alloy-sol-macro-expander"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6277c780e07b76951e09a59788dde230d1582612324177d11a43a61e21a6bb83"
+checksum = "9edb8520f2f94275e1caa73c85207dcc78ec402a9a4c429240f9a0783a8f16c0"
 dependencies = [
  "alloy-json-abi",
  "alloy-sol-macro-input",
  "const-hex",
  "heck",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "proc-macro-error3",
  "proc-macro2",
  "quote",
@@ -617,9 +617,9 @@ dependencies = [
 
 [[package]]
 name = "alloy-sol-macro-input"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9762b2ad3e5a0c09886de54fe549ab0056681df843cb082e2df7e1c0eb270d30"
+checksum = "66af2d9344882172993be5f5cbfd349fdfa52cb548f7af8715b446fb35ef6001"
 dependencies = [
  "alloy-json-abi",
  "const-hex",
@@ -635,19 +635,19 @@ dependencies = [
 
 [[package]]
 name = "alloy-sol-type-parser"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da4c7130f0f01f4719678bda3db3bc7267fc2f7f9d0565e3bd964cd2bb45050d"
+checksum = "77c2a8abc3334044013b23d5e438cc5dc802e5544cc42b713d0840d5185967cc"
 dependencies = [
  "serde",
- "winnow 1.0.4",
+ "winnow",
 ]
 
 [[package]]
 name = "alloy-sol-types"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96e74d6213180f78dbdccddce8af02a639c160c94b0a543fa35c77c58b8a7fc"
+checksum = "3e6f87cf007caa54e95455875fbd25879b008d0d9c7c340a2c258b3a3400a28c"
 dependencies = [
  "alloy-json-abi",
  "alloy-primitives",
@@ -663,14 +663,14 @@ checksum = "e10be13ab13ddadcfaec3320cc6cee83548a1ae32ada214ff864604cbf5c6f77"
 dependencies = [
  "alloy-json-rpc",
  "auto_impl",
- "base64",
+ "base64 0.22.1",
  "derive_more",
  "futures",
  "futures-utils-wasm",
  "parking_lot",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
  "tokio",
  "tower",
  "tracing",
@@ -687,7 +687,7 @@ dependencies = [
  "alloy-json-rpc",
  "alloy-transport",
  "itertools 0.14.0",
- "reqwest 0.13.4",
+ "reqwest",
  "serde_json",
  "tower",
  "tracing",
@@ -706,7 +706,7 @@ dependencies = [
  "nybbles",
  "serde",
  "smallvec",
- "thiserror 2.0.19",
+ "thiserror",
  "tracing",
 ]
 
@@ -724,9 +724,9 @@ dependencies = [
 
 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
  "libc",
 ]
@@ -791,6 +791,7 @@ dependencies = [
  "ethereum_ssz_derive",
  "rollups-types",
  "sequencer-core",
+ "serde_json",
  "tracing",
 ]
 
@@ -1024,7 +1025,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1df2c09229cbc5a028b1d70e00fdb2acee28b1055dfb5ca73eea49c5a25c4e7c"
 dependencies = [
  "num-traits",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -1034,7 +1035,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94893f1e0c6eeab764ade8dc4c0db24caf4fe7cbbaafc0eba0a9030f447b5185"
 dependencies = [
  "num-traits",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -1044,7 +1045,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "246a225cc6131e9ee4f24619af0f19d67761fff15d7ccc22e42b80846e69449a"
 dependencies = [
  "num-traits",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -1054,7 +1055,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "367c9c827ed431bff6868b7aa926e05b16eb46603cc8b6e768e4a5553fa1d155"
 dependencies = [
  "num-traits",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]
 
 [[package]]
@@ -1087,13 +1088,13 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.91"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -1104,13 +1105,13 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "auto_impl"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffdcb70bdbc4d478427380519163274ac86e52916e10f0a8889adf0f96d3fee7"
+checksum = "683bf733a032aec4f8954e5c0ec9d5c2183c341c49d0939ad77acc0a19fa338a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -1121,9 +1122,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.3"
+version = "1.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1"
+checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -1131,9 +1132,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.43.0"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c"
+checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc"
 dependencies = [
  "cc",
  "cmake",
@@ -1149,7 +1150,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "form_urlencoded",
  "futures-util",
@@ -1171,7 +1172,7 @@ dependencies = [
  "sha1",
  "sync_wrapper",
  "tokio",
- "tokio-tungstenite 0.29.0",
+ "tokio-tungstenite",
  "tower",
  "tower-layer",
  "tower-service",
@@ -1209,6 +1210,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -1232,7 +1239,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tokio",
- "tokio-tungstenite 0.28.0",
+ "tokio-tungstenite",
 ]
 
 [[package]]
@@ -1241,7 +1248,7 @@ version = "0.72.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1257,20 +1264,20 @@ dependencies = [
 
 [[package]]
 name = "bitcoin-consensus-encoding"
-version = "1.1.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "207311705279250ba465076a1bac4b1ac982855fff73fc5f67e22158ac58cdc9"
+checksum = "9daa31138eb443d5751b207f3f64154e2bb09cd59960562ccc7a7112be38147f"
 dependencies = [
  "bitcoin-internals",
- "hex-conservative 1.2.0",
+ "hex-conservative 1.3.0",
  "serde",
 ]
 
 [[package]]
 name = "bitcoin-internals"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d573f4cf32996a8dce612e4348cece65a241f1882ed594047c9ba348e8869fa5"
+checksum = "e8bea3a9f0cfece4564e37cb49a38cc245ca5184719e50d7d0dda3268722c4e2"
 
 [[package]]
 name = "bitcoin-io"
@@ -1288,14 +1295,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bca4c7abb40c8817d77403c880988cfd484f23ab2365726afb2f798363e2c4a2"
 dependencies = [
  "bitcoin-io",
- "hex-conservative 0.2.2",
+ "hex-conservative 0.2.3",
 ]
 
 [[package]]
 name = "bitflags"
-version = "2.13.1"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "bitvec"
@@ -1341,9 +1354,9 @@ dependencies = [
 
 [[package]]
 name = "borsh"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88b7ea17d208c4193f2c1e6de3c35fe71f98c96982d5ced308bdcc749ff6e1f"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
 dependencies = [
  "borsh-derive",
  "bytes",
@@ -1352,15 +1365,15 @@ dependencies = [
 
 [[package]]
 name = "borsh-derive"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8f347189c62a579b8cd5f80714efa178f52e461dc2e6d701d264f5ff22e566c"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
 dependencies = [
  "once_cell",
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -1442,6 +1455,7 @@ dependencies = [
  "app-core",
  "c-app-engine",
  "ethereum_ssz",
+ "rollups-types",
  "sequencer-core",
  "tempfile",
 ]
@@ -1477,27 +1491,29 @@ dependencies = [
  "k256",
  "rollups-types",
  "sequencer-core",
+ "serde",
+ "serde_json",
  "testsi",
 ]
 
 [[package]]
 name = "cartesi-machine"
 version = "2.0.0"
-source = "git+https://github.com/cartesi/dave?rev=79874c0a1b40678465daf533acc976c88301c6d4#79874c0a1b40678465daf533acc976c88301c6d4"
+source = "git+https://github.com/cartesi/dave?rev=612c54cf22d73b364cd57a7058ba6aa449e5c77a#612c54cf22d73b364cd57a7058ba6aa449e5c77a"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "cartesi-machine-sys",
  "derive_builder",
  "hex",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
 name = "cartesi-machine-sys"
 version = "2.0.0"
-source = "git+https://github.com/cartesi/dave?rev=79874c0a1b40678465daf533acc976c88301c6d4#79874c0a1b40678465daf533acc976c88301c6d4"
+source = "git+https://github.com/cartesi/dave?rev=612c54cf22d73b364cd57a7058ba6aa449e5c77a#612c54cf22d73b364cd57a7058ba6aa449e5c77a"
 dependencies = [
  "bindgen",
  "link-cplusplus",
@@ -1516,9 +1532,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.4.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -1537,9 +1553,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "cfg_aliases"
@@ -1549,12 +1565,12 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
  "rand_core 0.10.1",
 ]
 
@@ -1583,9 +1599,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.5"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301b56658598e48f3648647ac6fc887be7e7108eddfa4e9b63fcf3ec58c0cadf"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -1593,9 +1609,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.5"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94a65403d1a1bd28f7dc68eb8506e8874808ee5eecb59298de588e2e1407a078"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -1605,21 +1621,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
 
 [[package]]
 name = "cmake"
@@ -1638,9 +1654,9 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "combine"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
  "memchr",
@@ -1648,9 +1664,9 @@ dependencies = [
 
 [[package]]
 name = "const-hex"
-version = "1.19.1"
+version = "1.19.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e2a781ebdf4467d1428dc4593067825fb646f6871475098d8577421af73558"
+checksum = "0e59eef12462b0f9b0a3620219be5d639afd79fe39dff0a42c3997061f9298b4"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
@@ -1710,6 +1726,12 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1721,9 +1743,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
@@ -1745,9 +1767,9 @@ checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.22"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
 [[package]]
 name = "crunchy"
@@ -1806,6 +1828,16 @@ dependencies = [
  "darling_macro 0.23.0",
 ]
 
+[[package]]
+name = "darling"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
+dependencies = [
+ "darling_core 0.24.1",
+ "darling_macro 0.24.1",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.20.11"
@@ -1834,6 +1866,19 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
@@ -1856,6 +1901,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
+dependencies = [
+ "darling_core 0.24.1",
+ "quote",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "dashmap"
 version = "6.2.1"
@@ -1876,6 +1932,37 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -1888,9 +1975,9 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.5.8"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
 dependencies = [
  "serde_core",
 ]
@@ -1999,7 +2086,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -2043,9 +2130,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.17.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 dependencies = [
  "serde",
 ]
@@ -2087,14 +2174,14 @@ checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
 name = "equivalent"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
 
 [[package]]
 name = "errno"
@@ -2106,6 +2193,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "escape8259"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f0d310082fd5de539d4f41601182241147498444a7695c520288a0cdbead6"
+
 [[package]]
 name = "ethereum_serde_utils"
 version = "0.8.1"
@@ -2208,9 +2301,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
 [[package]]
 name = "fixed-cache"
@@ -2229,7 +2322,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "835c052cb0c08c1acf6ffd71c022172e18723949c8282f2b9f27efbc51e64534"
 dependencies = [
  "byteorder",
- "rand 0.8.7",
+ "rand 0.8.8",
  "rustc-hex",
  "static_assertions",
 ]
@@ -2269,9 +2362,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "futures"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2284,9 +2377,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -2294,15 +2387,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2311,38 +2404,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2462,9 +2555,9 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32069d97bb81e38fa67eab65e3393bf804bb85969f2bc06bf13f64aef5aba248"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
 dependencies = [
  "hashbrown 0.17.1",
 ]
@@ -2477,9 +2570,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284"
 
 [[package]]
 name = "hex"
@@ -2489,18 +2582,18 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hex-conservative"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fda06d18ac606267c40c04e41b9947729bf8b9efe74bd4e82b61a5f26a510b9f"
+checksum = "db3fef046dca3ca91ee1408a8c1b80ab777e80a4d308d1bf4e7adb3fcb047e08"
 dependencies = [
  "arrayvec",
 ]
 
 [[package]]
 name = "hex-conservative"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35431185f361ccf3ffc58254628af5f1f5d5f28531da2e02e5d6c82bbc282a10"
+checksum = "271e0d19bcb473b6675739a2b536076b24a082316cb5199ad918edce10c599e8"
 dependencies = [
  "arrayvec",
 ]
@@ -2536,9 +2629,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2561,22 +2654,21 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.14"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
  "typenum",
 ]
 
 [[package]]
 name = "hyper"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
- "futures-channel",
  "futures-core",
  "http",
  "http-body",
@@ -2591,9 +2683,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.9"
+version = "0.27.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
  "http",
  "hyper",
@@ -2606,16 +2698,17 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http",
  "http-body",
+ "httparse",
  "hyper",
  "ipnet",
  "libc",
@@ -2653,9 +2746,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -2667,9 +2760,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -2680,9 +2773,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -2694,16 +2787,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -2714,15 +2808,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -2793,9 +2887,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
@@ -2805,18 +2899,18 @@ dependencies = [
 
 [[package]]
 name = "inventory"
-version = "0.3.24"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+checksum = "6928282826c822ad91bf1c9a1cb90a30ba1c26770749929b4656cd6be829cd7c"
 dependencies = [
  "rustversion",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.12.1"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -2857,6 +2951,60 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "jiff"
+version = "0.2.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c"
+dependencies = [
+ "defmt",
+ "log",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
 [[package]]
 name = "jni"
 version = "0.22.4"
@@ -2869,7 +3017,7 @@ dependencies = [
  "jni-sys",
  "log",
  "simd_cesu8",
- "thiserror 2.0.19",
+ "thiserror",
  "walkdir",
  "windows-link",
 ]
@@ -2918,9 +3066,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.103"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -2944,20 +3092,21 @@ dependencies = [
 
 [[package]]
 name = "keccak"
-version = "0.2.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
 ]
 
 [[package]]
 name = "keccak-asm"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd5dc2c0d691cbf7595cde551ced329cca99c2387c2cbc97754c5d0cd045d3ee"
+checksum = "f32890f646914a263e39064295005972f0e95b928254061b2aca98445f304ee9"
 dependencies = [
+ "cfg-if",
  "digest 0.10.7",
  "sha3-asm",
 ]
@@ -2979,15 +3128,15 @@ checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
 
 [[package]]
 name = "lazy_static"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "libcmt-sys"
@@ -3014,9 +3163,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6c19a05435c21ac299d71b6a9c13db3e3f47c520517d58990a462a1397a61db"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -3025,13 +3174,14 @@ dependencies = [
 
 [[package]]
 name = "libtest-mimic"
-version = "0.6.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d8de370f98a6cb8a4606618e53e802f93b094ddec0f96988eaec2c27e6e9ce7"
+checksum = "14e6ba06f0ade6e504aff834d7c34298e5155c6baca353cc6a4aaff2f9fd7f33"
 dependencies = [
+ "anstream",
+ "anstyle",
  "clap",
- "termcolor",
- "threadpool",
+ "escape8259",
 ]
 
 [[package]]
@@ -3051,9 +3201,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "lock_api"
@@ -3066,9 +3216,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "lru"
@@ -3081,9 +3231,9 @@ dependencies = [
 
 [[package]]
 name = "lru-slab"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
 
 [[package]]
 name = "macro-string"
@@ -3131,9 +3281,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "mio"
-version = "1.2.2"
+version = "1.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
 dependencies = [
  "libc",
  "wasi",
@@ -3177,9 +3327,9 @@ checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-integer"
-version = "0.1.46"
+version = "0.1.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
 dependencies = [
  "num-traits",
 ]
@@ -3322,11 +3472,13 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.8"
+version = "2.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7df728be843c7070fab6ab7c328c4e9e9d78e23bf749c0669c86ee7ebfa050a2"
+checksum = "b568374ba38b33a6c627141f891faf16902b08d2db26b8ede1bcb0a15b1919fa"
 dependencies = [
  "memchr",
+ "psm",
+ "stacker",
  "ucd-trie",
 ]
 
@@ -3376,9 +3528,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pin-utils"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "13bee6c73da26345c729282832b60b0363cf3dd9f4bfd81d8551b7a1c889a113"
 
 [[package]]
 name = "pkcs8"
@@ -3392,24 +3544,39 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
+dependencies = [
+ "portable-atomic",
+]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
 
 [[package]]
 name = "powerfmt"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
 
 [[package]]
 name = "ppv-lite86"
@@ -3447,7 +3614,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.13+spec-1.1.0",
+ "toml_edit",
 ]
 
 [[package]]
@@ -3483,24 +3650,34 @@ dependencies = [
 
 [[package]]
 name = "proptest"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
+ "chacha20",
+ "core_detect",
  "num-traits",
- "rand 0.9.5",
- "rand_chacha 0.9.0",
+ "rand 0.10.3",
  "rand_xorshift",
  "regex-syntax",
  "unarray",
 ]
 
+[[package]]
+name = "psm"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "200b9ff220857e53e184257720a14553b2f4aa02577d2ed9842d45d4b9654810"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "quinn"
-version = "0.11.11"
+version = "0.11.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -3510,7 +3687,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.19",
+ "thiserror",
  "tokio",
  "tracing",
  "web-time",
@@ -3518,22 +3695,22 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "aws-lc-rs",
  "bytes",
  "getrandom 0.4.3",
  "lru-slab",
- "rand 0.10.2",
+ "rand 0.10.3",
  "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.19",
+ "thiserror",
  "tinyvec",
  "tracing",
  "web-time",
@@ -3541,9 +3718,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
 dependencies = [
  "cfg_aliases",
  "libc",
@@ -3582,9 +3759,9 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -3605,9 +3782,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.2"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -3670,11 +3847,11 @@ dependencies = [
 
 [[package]]
 name = "rand_xorshift"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
 dependencies = [
- "rand_core 0.9.5",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -3692,27 +3869,27 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
 ]
 
 [[package]]
 name = "ref-cast"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -3746,11 +3923,11 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -3758,40 +3935,6 @@ dependencies = [
  "http-body",
  "http-body-util",
  "hyper",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-util",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.13.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
-dependencies = [
- "base64",
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
  "hyper-rustls",
  "hyper-util",
  "js-sys",
@@ -3804,15 +3947,18 @@ dependencies = [
  "rustls-platform-verifier",
  "serde",
  "serde_json",
+ "serde_urlencoded",
  "sync_wrapper",
  "tokio",
  "tokio-rustls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wasm-streams",
  "web-sys",
 ]
 
@@ -3884,7 +4030,7 @@ dependencies = [
  "ethereum_ssz",
  "futures-util",
  "k256",
- "reqwest 0.12.28",
+ "reqwest",
  "rusqlite",
  "sequencer-core",
  "sequencer-rust-client",
@@ -3893,7 +4039,7 @@ dependencies = [
  "tar",
  "tempfile",
  "tokio",
- "tokio-tungstenite 0.28.0",
+ "tokio-tungstenite",
  "toml",
 ]
 
@@ -3912,14 +4058,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
  "hashbrown 0.16.1",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
 name = "ruint"
-version = "1.20.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5e99bff0393163bb25029a6af25d3d8d202ba5b5438a74d1bd8789f5c822970"
+checksum = "2973657b5127d510e230f5c63d2d106af9c8f79393d8b9f4647323e8196bdde5"
 dependencies = [
  "alloy-rlp",
  "ark-ff 0.3.0",
@@ -3935,7 +4081,7 @@ dependencies = [
  "parity-scale-codec",
  "primitive-types",
  "proptest",
- "rand 0.8.7",
+ "rand 0.8.8",
  "rand 0.9.5",
  "rlp",
  "ruint-macro",
@@ -3952,11 +4098,11 @@ checksum = "48fd7bd8a6377e15ad9d42a8ec25371b94ddc67abe7c8b9127bec79bebaaae18"
 
 [[package]]
 name = "rusqlite"
-version = "0.40.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11438310b19e3109b6446c33d1ed5e889428cf2e278407bc7896bc4aaea43323"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -4007,11 +4153,11 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -4020,9 +4166,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.43"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
@@ -4034,9 +4180,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
@@ -4056,9 +4202,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
 dependencies = [
  "core-foundation",
  "core-foundation-sys",
@@ -4077,15 +4223,15 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier-android"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -4137,9 +4283,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
 dependencies = [
  "dyn-clone",
  "ref-cast",
@@ -4175,7 +4321,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b50c5943d326858130af85e049f2661ba3c78b26589b8ab98e65e80ae44a1252"
 dependencies = [
  "bitcoin_hashes",
- "rand 0.8.7",
+ "rand 0.8.8",
  "secp256k1-sys 0.10.1",
  "serde",
 ]
@@ -4215,7 +4361,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -4261,7 +4407,6 @@ name = "sequencer"
 version = "0.1.0"
 dependencies = [
  "alloy",
- "alloy-network-primitives",
  "alloy-primitives",
  "alloy-sol-types",
  "alloy-transport",
@@ -4274,7 +4419,7 @@ dependencies = [
  "ethereum_ssz_derive",
  "futures-util",
  "k256",
- "reqwest 0.12.28",
+ "reqwest",
  "rollups-harness",
  "rusqlite",
  "rusqlite_migration",
@@ -4285,11 +4430,12 @@ dependencies = [
  "sha2",
  "tar",
  "tempfile",
- "thiserror 2.0.19",
+ "thiserror",
  "tokio",
- "tokio-tungstenite 0.28.0",
+ "tokio-tungstenite",
  "tokio-util",
  "toml",
+ "tower",
  "tower-http",
  "tracing",
  "url",
@@ -4307,7 +4453,7 @@ dependencies = [
  "ruint",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -4315,13 +4461,13 @@ name = "sequencer-rust-client"
 version = "0.1.0"
 dependencies = [
  "alloy-primitives",
- "reqwest 0.12.28",
+ "reqwest",
  "sequencer-core",
  "serde",
  "serde_json",
- "thiserror 2.0.19",
+ "thiserror",
  "tokio",
- "tokio-tungstenite 0.28.0",
+ "tokio-tungstenite",
 ]
 
 [[package]]
@@ -4351,14 +4497,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -4380,11 +4526,11 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.9"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -4401,18 +4547,19 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.21.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
+checksum = "df9adc193c780ef8f159aee8b61e2d5801aaa555e6eb0947fe45530ec506296f"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bs58",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
+ "jiff",
  "schemars 0.9.0",
- "schemars 1.2.2",
+ "schemars 1.2.3",
  "serde_core",
  "serde_json",
  "serde_with_macros",
@@ -4421,14 +4568,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.21.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
+checksum = "3e17bbc68e28663bbbb90df47e058aa7eda4fb445b89fe70457bb94fbccf6e49"
 dependencies = [
- "darling 0.23.0",
+ "darling 0.24.1",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -4475,9 +4622,9 @@ dependencies = [
 
 [[package]]
 name = "sha3-asm"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6287fd675f713484342a89cbf0a386abef5f15919cfad607e5e1f19e1e15331"
+checksum = "471668161349031e3d415412f996b030c477488eec267cc3cadae3d06c0a367f"
 dependencies = [
  "cc",
  "cfg-if",
@@ -4542,9 +4689,9 @@ checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "siphasher"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
 
 [[package]]
 name = "slab"
@@ -4554,9 +4701,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.2"
+version = "1.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
 dependencies = [
  "serde",
 ]
@@ -4599,6 +4746,19 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "stacker"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -4641,9 +4801,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4652,9 +4812,9 @@ dependencies = [
 
 [[package]]
 name = "syn-solidity"
-version = "1.6.1"
+version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "083be3061e64d362cbe6ef12cfe1307ba3884326d8856448fe8a120fa2c44ebf"
+checksum = "eb6a2e3c7f7a3e4e83d1752cec5d1e357ced0cf96e85419b6a07f227db3def3a"
 dependencies = [
  "paste",
  "proc-macro2",
@@ -4673,13 +4833,13 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -4712,15 +4872,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
 [[package]]
 name = "testsi"
 version = "0.1.0"
@@ -4730,7 +4881,7 @@ dependencies = [
  "libtest-mimic",
  "rollups-types",
  "testsi-macros",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
@@ -4744,42 +4895,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
-dependencies = [
- "thiserror-impl 2.0.19",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
+ "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.19"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
@@ -4832,9 +4963,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -4842,24 +4973,15 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.53.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e"
 dependencies = [
  "bytes",
  "libc",
@@ -4879,14 +5001,14 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.9",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.4"
+version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
  "rustls",
  "tokio",
@@ -4904,18 +5026,6 @@ dependencies = [
  "tokio-util",
 ]
 
-[[package]]
-name = "tokio-tungstenite"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
-dependencies = [
- "futures-util",
- "log",
- "tokio",
- "tungstenite 0.28.0",
-]
-
 [[package]]
 name = "tokio-tungstenite"
 version = "0.29.0"
@@ -4925,14 +5035,14 @@ dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.29.0",
+ "tungstenite",
 ]
 
 [[package]]
 name = "tokio-util"
-version = "0.7.19"
+version = "0.7.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
 dependencies = [
  "bytes",
  "futures-core",
@@ -4943,74 +5053,54 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.23"
+version = "1.1.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
 dependencies = [
- "serde",
+ "indexmap 2.14.2",
+ "serde_core",
  "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap 2.14.0",
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_write",
- "winnow 0.7.15",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.13+spec-1.1.0"
+version = "0.25.17+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
 dependencies = [
- "indexmap 2.14.0",
- "toml_datetime 1.1.1+spec-1.1.0",
+ "indexmap 2.14.2",
+ "toml_datetime",
  "toml_parser",
- "winnow 1.0.4",
+ "winnow",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
- "winnow 1.0.4",
+ "winnow",
 ]
 
 [[package]]
-name = "toml_write"
-version = "0.1.2"
+name = "toml_writer"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
 
 [[package]]
 name = "tower"
@@ -5034,7 +5124,7 @@ version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "bytes",
  "futures-util",
  "http",
@@ -5135,23 +5225,6 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
-[[package]]
-name = "tungstenite"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
-dependencies = [
- "bytes",
- "data-encoding",
- "http",
- "httparse",
- "log",
- "rand 0.9.5",
- "sha1",
- "thiserror 2.0.19",
- "utf-8",
-]
-
 [[package]]
 name = "tungstenite"
 version = "0.29.0"
@@ -5165,7 +5238,7 @@ dependencies = [
  "log",
  "rand 0.9.5",
  "sha1",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 
 [[package]]
@@ -5200,9 +5273,9 @@ checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.24"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
 
 [[package]]
 name = "unicode-segmentation"
@@ -5235,12 +5308,6 @@ dependencies = [
  "serde_derive",
 ]
 
-[[package]]
-name = "utf-8"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -5293,9 +5360,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -5317,9 +5384,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -5330,19 +5397,20 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.76"
+version = "0.4.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
 dependencies = [
  "js-sys",
+ "tokio",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5350,31 +5418,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "wasm-streams"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
 dependencies = [
  "futures-util",
  "js-sys",
@@ -5408,9 +5476,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.103"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -5585,15 +5653,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "winnow"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "winnow"
 version = "1.0.4"
@@ -5611,9 +5670,9 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "wyz"
@@ -5647,30 +5706,30 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.2"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.55"
+version = "0.8.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.55"
+version = "0.8.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5688,21 +5747,21 @@ dependencies = [
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
  "synstructure",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 dependencies = [
  "zeroize_derive",
 ]
@@ -5720,9 +5779,9 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -5731,9 +5790,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -5742,13 +5801,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index b67553a8..00843a57 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,7 +31,7 @@ license = "Apache-2.0"
 description = "Deterministic sequencer prototype with low-latency soft confirmations"
 homepage = "https://github.com/cartesi/sequencer"
 repository = "https://github.com/cartesi/sequencer"
-readme = "../README.md"
+readme = "README.md"
 authors = [
   "Gabriel Coutinho de Paula <gcdepaula@protonmail.com>",
   "Pedro Argento <pedro.argento@gmail.com>",
@@ -45,29 +45,43 @@ trolley = { version = "0.1", path = "sdk/guest/trolley" }
 testsi = { version = "0.1", path = "sdk/guest/testsi" }
 rollups-types = { version = "0.1", path = "sdk/guest/rollups-types" }
 
-# ── Contracts (exact pin — the single place the version lives) ──
+# ── Contracts (exact pin; equals ROLLUPS_CONTRACTS_VERSION in toolchain-pins.env,
+#    checked by scripts/verify-toolchain-pins.sh) ──
 cartesi-rollups-contracts = "=3.0.0-alpha.10"
 
 # ── Alloy family (must stay on the 2.x line: the contracts crate
 #    requires alloy ^2; the alloy-core crates below stay on 1.x;
 #    feature lists are member-specific) ──
 alloy = "2.5"
-alloy-primitives = { version = "1.6", features = ["serde", "k256"] }
-alloy-sol-types = "1.6"
+alloy-primitives = { version = "1.7", features = ["serde", "k256"] }
+alloy-sol-types = "1.7"
 
 # ── Shared crates (floors track what CI actually tests) ──────
 clap = { version = "4.6", features = ["derive"] }
 futures-util = "0.3"
+# The k256 that alloy-primitives recovers guest signatures with; it moves with
+# alloy-core, behind the consensus vectors.
 k256 = "0.13.4"
-reqwest = { version = "0.12", default-features = false }
+libtest-mimic = "0.8.2"
+reqwest = { version = "0.13", default-features = false }
 rusqlite = { version = "0.40.1", features = ["bundled"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 ssz = { package = "ethereum_ssz", version = "0.10" }
 ssz_derive = { package = "ethereum_ssz_derive", version = "0.10" }
+tar = "0.4"
 tempfile = "3.10"
 thiserror = "2"
 tokio = "1.53"
-tokio-tungstenite = "0.28"
+# Same tungstenite stack as axum's `ws` feature; move to 0.30 with the
+# axum release that requires it.
+tokio-tungstenite = "0.29"
+toml = "1.1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# Line tables keep file:line in backtraces without full variable debuginfo,
+# which shrinks dev and test targets. Release is untouched on purpose: the
+# guest is built with --release and its bytes feed the template hash.
+[profile.dev]
+debug = "line-tables-only"
diff --git a/README.md b/README.md
index d60fff13..86e99183 100644
--- a/README.md
+++ b/README.md
@@ -47,18 +47,12 @@ application-visible clock. Safe-head publication is best effort: if the node
 exposes a multi-block jump, the sequencer creates one frame at the observed tip
 and never fabricates intermediate frames.
 
-Soft confirmations are an **optimistic prediction**: the sequencer also
-cross-checks every at/above-anchor batch its off-chain scheduler simulation
-accepts on L1 against the batch it sealed locally (a content-identity check).
-When a foreign or byte-different landing reaches L1 *safe* finality and the
-input reader ingests it, the same transaction records canonical divergence and
-freezes the accepted frontier; the runtime stops when it next observes that
-fact, and every later boot refuses until an operator performs cockroach
-recovery. User-op chunks committed before runtime observation may still
-acknowledge and be rolled back. This check is a narrow zombie/foreign-batch
-backstop, not proof that arbitrary application or scheduler divergence cannot
-exist, and it does not replace the watchdog. The mechanism and its bounds are
-recorded in [`docs/invariants.md`](docs/invariants.md) (I9 and I15).
+Soft confirmations are an **optimistic prediction**. A narrow content-identity
+check compares each batch that L1 accepts at the sequencer's nonces with the
+batch it sealed locally. A foreign or byte-different landing freezes the
+accepted frontier and stops the runtime, and every later boot refuses until an
+operator performs cockroach recovery. The check does not replace the watchdog;
+its bounds are recorded in [`docs/invariants.md`](docs/invariants.md) (I9 and I15).
 
 ## Recovery
 
@@ -83,7 +77,7 @@ between normal operation's self-trust and manual repair after a bug.
 
 The sequencer is designed to handle:
 
-- **L1 provider outages** — workers retry with exponential backoff. The inclusion lane and API continue operating locally. A wall-clock fallback detects when an outage pushes batches into the danger zone.
+- **L1 provider outages** — each worker retries on its next tick; the RPC client resends a rate-limited or temporarily unavailable request at most twice, a second apart or after the server's requested wait when that is 5 s or less. The inclusion lane and API continue operating locally. A wall-clock fallback detects when an outage pushes batches into the danger zone.
 - **Undiagnosed interruptions (OOM, SIGKILL, reboot)** — restart can recover automatically: every boot derives any required recovery from SQLite and L1 safe state through startup recovery, never assuming the previous exit was clean. Terminal errors returned through a command bracket best-effort record their cause in `terminal_faults`; terminal runtime aborts leave only process diagnostics.
 - **Extended downtime** — startup syncs to the current L1 safe head, flushes if needed, and recovers before admission. A terminal exit requires operator investigation; rebuilding untrustworthy state follows the cockroach recovery procedure above.
 - **Adversarial L1 mempool** — block builders and private mempools are treated as adversarial. Recovery waits until every covered wallet-nonce slot is consumed at safe depth, whether the original transaction or a flush no-op wins, so delayed "zombie" submissions cannot land later.
@@ -126,24 +120,46 @@ For rebuilding from a trusted checkpoint, follow the
 CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT=http://127.0.0.1:8545 \
 CARTESI_SEQUENCER_BLOCKCHAIN_ID=31337 \
 CARTESI_SEQUENCER_APP_ADDRESS=0x1111111111111111111111111111111111111111 \
-CARTESI_SEQUENCER_BATCH_SUBMITTER_ADDRESS=0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 \
+CARTESI_SEQUENCER_FEE_ORACLE_FIXED_LOG_GAS_PRICE=0 \
+CARTESI_SEQUENCER_BATCH_SUBMITTER_ADDRESS=0xa0Ee7A142d267C1f36714E4a8F75612F20a79720 \
 cargo run -p wallet-sequencer -- setup
 
 # Phase B — run the sequencer.
 CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT=http://127.0.0.1:8545 \
-CARTESI_SEQUENCER_AUTH_PRIVATE_KEY=0xac09...f2ff80 \
+CARTESI_SEQUENCER_AUTH_PRIVATE_KEY=0x2a87...d409c6 \
 cargo run -p wallet-sequencer -- run
 ```
 
+`setup` exits 20 (retryable) until the application's deployment block is at or below the L1 safe head, so no reorg can move the block it pins; on Ethereum that is a one-time wait of an epoch or two after deployment, and on Anvil `--slots-in-an-epoch` mined blocks (one in the repo's devnet stack, which sets it to 1; Anvil's default is 32).
+
 A third subcommand, **`flush-mempool`**, settles the batch-submitter wallet
 nonce on demand (keyed operator tool). It is flush-only: it requires a
 completed setup and no canonical divergence, and it never performs
 Sync/Cascade or launches runtime workers.
 
-`setup` requires: `CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`, `CARTESI_SEQUENCER_BLOCKCHAIN_ID`, `CARTESI_SEQUENCER_APP_ADDRESS`, `CARTESI_SEQUENCER_BATCH_SUBMITTER_ADDRESS`.
-`run` requires: `CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`, `CARTESI_SEQUENCER_AUTH_PRIVATE_KEY` (or `_FILE`); it refuses to boot until `setup` has completed.
+`setup` requires: `CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`, `CARTESI_SEQUENCER_BLOCKCHAIN_ID`, `CARTESI_SEQUENCER_APP_ADDRESS`, `CARTESI_SEQUENCER_BATCH_SUBMITTER_ADDRESS`. On chains other than Ethereum mainnet and Sepolia it also requires a fee-oracle source (listed below).
+The submitter address must equal the `sequencer_address` compiled into the canonical machine; nothing checks this at runtime ([scheduler semantics](docs/protocol/scheduler-semantics.md#the-one-stream-the-one-classification)).
+
+**Use a dedicated submitter address.** Plain `setup` refuses an unsettled wallet
+nonce, so sharing a busy contract-deployer address can trip the detection gate
+while its deployment transactions are not yet safe. The devnet uses Anvil
+account 9 (`DEVNET_SEQUENCER_ADDRESS`), separate from the account-0 deployer.
+The Sepolia reference reserves [`SEPOLIA_SEQUENCER_ADDRESS`](examples/app-core/src/application/wallet.rs)
+for this deployment's batch submissions and application fee revenue; do not share
+its signing key with other app or node instances. Changing that compiled address
+requires a rebuilt canonical image and a matching new application deployment,
+not just a runtime signing-key change.
+
+`run` and `flush-mempool` require `CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT` and the signing key, `CARTESI_SEQUENCER_AUTH_PRIVATE_KEY` or `CARTESI_SEQUENCER_AUTH_PRIVATE_KEY_FILE` (whose first line is the key); both refuse to start until `setup` has completed.
 
-Optional: `CARTESI_SEQUENCER_HTTP_ADDR` (default `127.0.0.1:3000`, `run`), `CARTESI_SEQUENCER_DATA_DIR` (default `sequencer-data` — SQLite file is `sequencer.db` inside; created if missing), `CARTESI_SEQUENCER_PREEMPTIVE_MARGIN_BLOCKS` (default `300`), `CARTESI_SEQUENCER_SECONDS_PER_BLOCK` (default `12`), `CARTESI_SEQUENCER_L1_READ_STALE_AFTER_BLOCKS` (default `600`), `CARTESI_SEQUENCER_LONG_BLOCK_RANGE_ERROR_CODES` (default `-32005,-32012,-32600,-32602,-32616`), `CARTESI_SEQUENCER_AUTH_PRIVATE_KEY_FILE` (alternative to `CARTESI_SEQUENCER_AUTH_PRIVATE_KEY`; first line of the file is the key), `CARTESI_SEQUENCER_BATCH_SUBMITTER_IDLE_POLL_INTERVAL_MS`, `CARTESI_SEQUENCER_BATCH_SUBMITTER_CONFIRMATION_DEPTH`.
+Optional variables, by name; each subcommand's `--help` shows their defaults and validation from [`commands/config.rs`](sequencer/src/commands/config.rs):
+
+- Every subcommand: `CARTESI_SEQUENCER_DATA_DIR` (the SQLite file is `sequencer.db` inside; `setup` creates it, and `run` and `flush-mempool` refuse a missing one), `CARTESI_SEQUENCER_SECONDS_PER_BLOCK`, and `CARTESI_SEQUENCER_ALLOW_INSECURE_RPC` (below).
+- `setup` and `run`: `CARTESI_SEQUENCER_PREEMPTIVE_MARGIN_BLOCKS`, `CARTESI_SEQUENCER_L1_READ_STALE_AFTER_BLOCKS`.
+- `setup`: the fee-oracle source it pins, either `CARTESI_SEQUENCER_FEE_ORACLE_FIXED_LOG_GAS_PRICE` or a Uniswap source (the overrides `CARTESI_SEQUENCER_FEE_TOKEN_ADDRESS`, `CARTESI_SEQUENCER_WETH_ADDRESS` and `CARTESI_SEQUENCER_UNISWAP_V3_POOL`, given together and required on other chains, and `CARTESI_SEQUENCER_FEE_ORACLE_TWAP_WINDOW_SECS`); `CARTESI_SEQUENCER_CHECKPOINT_BLOCK`; and, for a [rebuild](docs/recovery/cockroach.md), `CARTESI_SEQUENCER_RECOVERY`, `CARTESI_SEQUENCER_CHECKPOINT_DUMP_DIR` and the signing key.
+- `run`: `CARTESI_SEQUENCER_HTTP_ADDR` (public listener), `CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR` (internal listener), `CARTESI_SEQUENCER_MAX_BATCH_OPEN_SECONDS`, `CARTESI_SEQUENCER_BATCH_SUBMITTER_IDLE_POLL_INTERVAL_MS`, `CARTESI_SEQUENCER_BATCH_SUBMITTER_CONFIRMATION_DEPTH` and `CARTESI_SEQUENCER_FEE_ORACLE_POLL_INTERVAL_MS`.
+
+Logs and errors show only the endpoint's scheme, host and port, since its path, query and userinfo can hold an API key or a password, unless the RPC server echoes them inside a JSON-RPC error message or a malformed result, which alloy builds above the redaction layer, or quotes in an error body only part of them or a different URL that carries them, such as a redirect target on another path. An L1 error's text stays on one line, with each cause cut at 256 bytes. The client follows no redirects: an endpoint that answers 3xx fails with that status, so configure the provider's final URL (setup exits 30 at its chain-id check, since a retry gets the same redirect). Debug-level logging for the `alloy_transport_http` target records the full URL, so keep that target at `info` where logs leave the host.
 
 By default the blockchain endpoint must be `https://` unless its host is loopback (`localhost`, `127.0.0.0/8`, `::1`) — a guard against accidentally sending L1 traffic to a public RPC in the clear. Set `CARTESI_SEQUENCER_ALLOW_INSECURE_RPC=true` (or `--allow-insecure-rpc`) to permit plaintext `http://` to a non-loopback host on a **trusted private network** — e.g. a Docker Compose / Kubernetes service name (`http://anvil:8545`), `host.docker.internal`, or a private-VPC IP.
 
@@ -155,15 +171,9 @@ environment:
   CARTESI_SEQUENCER_ALLOW_INSECURE_RPC: "true"
 ```
 
-Process exit codes follow the orchestrator exit-code contract: `0` clean shutdown, `10` restart (expect a recovery boot), `20` transient refusal (retry with backoff), `30` terminal command refusal (operator required — e.g. setup not complete, identity mismatch, canonical divergence, persistent storage/application invariant failure), `40` a previous instance left work past the checkpoint (wipe the data directory and run `setup --recovery`), and `1` for an unclassified operational failure. Diagnosed terminal runtime faults, including worker panics, immediately call `abort()` (SIGABRT, status 134), without worker drain or database settlement. Supervisors must treat SIGABRT as terminal class. Ordinary shutdown, expected recovery, and transient errors still drain gracefully. Startup panics caught by the command harness are projected to `30`; panics after runtime scope creation abort; `101` remains possible before the command harness starts. The constants live in `sequencer/src/commands/error.rs`; supervisor recipes are in [`docs/watchdog/operator-deployment.md`](docs/watchdog/operator-deployment.md).
-
-Fixed protocol identity (EIP-712):
+Process exit codes follow the orchestrator exit-code contract: `0` clean shutdown, `10` restart (expect a recovery boot), `20` transient refusal (retry with backoff), `30` terminal command refusal (operator required — e.g. setup not complete, identity mismatch, canonical divergence, persistent storage/application invariant failure), `40` a previous instance left work past the checkpoint (wipe the data directory and run `setup --recovery`), and `1` for an unclassified operational failure. Diagnosed terminal runtime faults, including worker panics and an undecodable batch landed by the submitter key, immediately call `abort()` (SIGABRT, status 134), without worker drain or database settlement. Supervisors must treat SIGABRT as terminal class. Ordinary shutdown, expected recovery, and transient errors still drain gracefully. Startup panics caught by the command harness are projected to `30`; panics after runtime scope creation abort; `101` remains possible before the command harness starts. The constants live in `sequencer/src/commands/error.rs`; supervisor recipes are in [`docs/watchdog/operator-deployment.md`](docs/watchdog/operator-deployment.md).
 
-- domain name: `CartesiAppSequencer`
-- domain version: `1`
-- `chain_id` and `verifying_contract` come from `CARTESI_SEQUENCER_BLOCKCHAIN_ID` and `CARTESI_SEQUENCER_APP_ADDRESS`
-
-Most queue sizes, polling intervals, and safety limits are now internal runtime constants instead of public launch-time configuration.
+The [EIP-712 domain](docs/protocol/scheduler-semantics.md#user-op-signatures) is fixed except `chainId` and `verifyingContract`, which come from `CARTESI_SEQUENCER_BLOCKCHAIN_ID` and `CARTESI_SEQUENCER_APP_ADDRESS`.
 
 ## API
 
@@ -171,6 +181,13 @@ This section owns the wire contract. [`openapi.yaml`](openapi.yaml) renders it
 as OpenAPI 3.1 for client generation and documentation tools; change both
 together.
 
+The sequencer serves two listeners. The public one
+(`CARTESI_SEQUENCER_HTTP_ADDR`) serves only `POST /tx`, `GET /fee`,
+`GET /nonce`, and `GET /domain`. Every other route, health probes included, is
+internal and served only on the internal listener
+(`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`), without authentication; keep it off
+the public network.
+
 Errors use one JSON shape, `{ "ok": false, "code": "<CODE>", "message": "<text>" }`,
 with these codes: `400` `BAD_REQUEST` or `INVALID_SIGNATURE`, `413`
 `PAYLOAD_TOO_LARGE`, `422` `EXECUTION_REJECTED`, `429` `OVERLOADED`, `500`
@@ -441,9 +458,8 @@ checkpoint selection, and subscription.
 ### Operator snapshot endpoints (internal only)
 
 These serve application state to the operator's watchdog and indexers.
-**They are operator-internal — no auth — and must not be exposed publicly**
-(gated by network controls today; bound to a separate internal port once the
-api split lands).
+**They are operator-internal — no auth — and must not be exposed publicly**:
+they are served only on the internal listener, behind network controls.
 
 - `GET /finalized_state/inclusion_block` — cheap JSON the watchdog polls:
   `{ "inclusion_block": <u64>, "executed_input_count": <u64> }`.
@@ -498,50 +514,27 @@ They do not certify L1 freshness, submitter balance, or canonical agreement.
 - `safe_inputs`: every raw InputBox observation, including batch envelopes
 - `history_state`: immutable era baseline (application count and accounted L1 block) plus recovery generation
 - `snapshots` and `dumps`: immutable batch-close/baseline artifacts and streaming leases; accepted status is derived from `safe_accepted_batches`
-- `batch_policy`: singleton knobs and constants for DA-style batch sizing and fee derivation; `batch_policy_derived` exposes `recommended_fee` and `batch_size_target`. A batch closes on whichever fires first: the derived `batch_size_target` byte budget or the `max_batch_open` wall-clock deadline (an inclusion-lane setting, `CARTESI_SEQUENCER_MAX_BATCH_OPEN_SECONDS`, not a `batch_policy` column). Setup writes the first `log_gas_price` (and observation stamp) for both Fixed and Uniswap modes, failing if the initial Uniswap quote cannot be read. Fixed local pricing has no oracle worker; Uniswap starts from the persisted price and refreshes lazily via the setup-pinned WETH/fee-token TWAP source, retaining that price across transient source failures. Host tick-to-price conversion uses approximate floating-point arithmetic before checked integer gas-cost calculation and log encoding; recorded frame fees execute with deterministic integer arithmetic. `log_slack = log(10)` applies the 10× safety margin in log space. Fees are app-token smallest units — initially USDC (6 decimals) for the wallet prototype — not a protocol-level USDC invariant.
+- `batch_policy`: singleton fee and batch-sizing knobs; `batch_policy_derived` exposes `recommended_fee` and `batch_size_target` ([formula](sequencer/src/storage/migrations/0001_schema.sql)). A batch closes when its `batch_size_target` byte budget fills or `CARTESI_SEQUENCER_MAX_BATCH_OPEN_SECONDS` elapses, whichever comes first. The [threat model](docs/threat-model/README.md#fee-oracle) owns how the oracle prices and refreshes.
 
 ## Project Layout
 
-- `sequencer/src/lib.rs`: public crate surface (`run`, `RunConfig`) — the sequencer is a library; app crates build the binary (see `examples/wallet-sequencer/`)
-- `examples/wallet-sequencer/`: binary crate composing the sequencer library with the placeholder wallet app
-- `sequencer/src/http.rs`: shared HTTP error type, JSON error shape, and `axum::serve` orchestration
-- `sequencer/src/runtime/`: process lock and shutdown scope; command bootstrap and config live in `commands/`, the shared clock in `clock.rs`, and EIP-712 domain construction in `sequencer-core/`
-- `sequencer/src/ingress/`: public-facing — `POST /tx`, `GET /fee`, `GET /nonce`, and `GET /domain` (`api.rs`) and the inclusion lane (`inclusion_lane/`: hot-path loop, chunk/frame/batch rotation, catch-up, snapshot lifecycle)
-- `sequencer/src/egress/`: internal read path — WS subscribe + health probes (`api/`) and the DB-backed ordered-L2Tx feed (`l2_tx_feed/`)
-- `sequencer/src/l1/`: L1 client surface — input reader, batch submitter, fee oracle, shared EIP-1559 estimation, provider, partition helper
-- `sequencer/src/recovery/`: preemptive recovery startup, runtime danger detector, mempool flusher
-- `sequencer/src/storage/`: schema, migrations, SQLite persistence (split per writer role), and replay reads
-- `sequencer-core/src/`: shared domain types and interfaces (`Application`, `SignedUserOp`, `SequencedL2Tx`, feed message types)
-- `examples/app-core/src/`: wallet prototype implementing `Application`
-- [`bindings/c-app-engine/`](bindings/c-app-engine/README.md): reusable C ABI adapter and external static-archive integration guide
-- `bindings/c-app-sequencer/`: optional C-engine CLI host and external-archive binary
-- `examples/c-wallet-engine/`: reference wallet C ABI exports, genesis tool, and conformance tests
-- `examples/c-wallet-sequencer/`: binary composing the C-engine host with the reference wallet engine
-- `tests/benchmarks/`: benchmark harnesses and benchmark spec
-
-Related docs:
-
-- C application binding: [`docs/protocol/c-application-binding.md`](docs/protocol/c-application-binding.md)
-- App snapshots (format + lifecycle): `docs/snapshots/`
-- Watchdog — local dev: [`docs/watchdog/getting-started.md`](docs/watchdog/getting-started.md); Sepolia/mainnet: [`docs/watchdog/operator-deployment.md`](docs/watchdog/operator-deployment.md)
-
-The watchdog ships as a multi-arch container image per release tag `vX`:
+The sequencer is a library: an application crate composes it with its
+`Application` implementation into a binary, as
+[`examples/wallet-sequencer/`](examples/wallet-sequencer/) does with the
+placeholder wallet in [`examples/app-core/`](examples/app-core/). Native engines
+bind through the [C ABI adapter](bindings/c-app-engine/README.md). The
+[architecture map](AGENTS.md#architecture-map) covers the workspace and the
+sequencer's modules.
 
-```bash
-docker pull ghcr.io/cartesi/sequencer-watchdog:vX
-# mirror: docker.io/cartesi/sequencer-watchdog:vX
-```
+The watchdog ships as a multi-arch container image per release tag; the
+[operator deployment guide](docs/watchdog/operator-deployment.md) gives the
+image names and how to run it.
 
 ## Prototype Limits
 
 - The `Application` trait defines dump/load behavior ([format](docs/snapshots/format.md)). Every batch close registers a durable snapshot atomically with the seal. Restart restores the latest valid snapshot and replays application inputs from its count. Acceptance determines the recovery checkpoint and garbage-collection frontier without mutating artifact metadata. [Snapshot lifecycle](docs/snapshots/lifecycle.md) documents leases and crash ordering.
 - Schema and migrations are still in prototype mode and may change.
 
-## Local Test Prerequisites
-
-- Some `sequencer` tests spin up `Anvil`; install Foundry locally if you want the full test suite:
-- Self-contained benchmarks also spawn `Anvil` from a preloaded rollups state dump.
-
 ## Development
 
 The shared [development commands](AGENTS.md#shell-and-commands) cover Rust
@@ -551,18 +544,9 @@ validation for a change; some tests require Anvil or libslirp.
 
 ## Further Reading
 
-- [`AGENTS.md`](AGENTS.md) — developer guide: architecture, conventions, duality, recovery, invariants, rules.
-- [`CLAUDE.md`](CLAUDE.md) — Claude entrypoint to the shared agent guide.
-- [`docs/threat-model/README.md`](docs/threat-model/README.md) — trust boundaries, in-scope and out-of-scope threats.
-- [`docs/recovery/README.md`](docs/recovery/README.md) — automatic recovery, TLA+ formal verification, design history.
-- [`docs/recovery/cockroach.md`](docs/recovery/cockroach.md) — manual rebuild after lost state or a sequencer bug.
-- [Application history and replay](docs/protocol/application-history.md) — progress, history identity, and replica bootstrap/resume.
-- [Snapshots](docs/snapshots/README.md) — engine checkpoints, lifecycle, accepted comparison, and wallet encoding.
-- [`docs/watchdog/getting-started.md`](docs/watchdog/getting-started.md) — step-by-step: run the watchdog with a local sequencer.
-- [`docs/watchdog/operator-deployment.md`](docs/watchdog/operator-deployment.md) — watchdog on live L1 (Sepolia staging, mainnet production).
-- [`docs/watchdog/README.md`](docs/watchdog/README.md) — watchdog architecture, modules, and test commands.
-- [`sequencer-core/`](sequencer-core/) — shared domain types (`Application`, `SignedUserOp`, `Batch`, `Frame`).
-- [`examples/app-core/`](examples/app-core/) — placeholder wallet app implementing the `Application` trait.
+[`AGENTS.md`](AGENTS.md) is the developer guide: architecture, conventions, and
+rules. Its [Reading Routes](AGENTS.md#reading-routes) name the document that
+owns each contract.
 
 ## License
 
diff --git a/bindings/c-app-engine/Cargo.toml b/bindings/c-app-engine/Cargo.toml
index 98f6443a..fed6a699 100644
--- a/bindings/c-app-engine/Cargo.toml
+++ b/bindings/c-app-engine/Cargo.toml
@@ -11,7 +11,8 @@ authors.workspace = true
 
 [build-dependencies]
 # Generates the FFI declarations from the engine header at build time. It decides how this host
-# reads every record crossing the seam, so a bump changes the ABI interpretation.
+# reads every record crossing the seam, so a bump changes the ABI interpretation. 0.73 changed
+# layout and bitfield code generation; take it with seam v1.
 bindgen = "0.72"
 
 [dependencies]
diff --git a/bindings/c-app-engine/build.rs b/bindings/c-app-engine/build.rs
index 34c43379..ba0a04c5 100644
--- a/bindings/c-app-engine/build.rs
+++ b/bindings/c-app-engine/build.rs
@@ -2,10 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 //! Links the application's engine archive and generates the FFI declarations from its header.
-//!
 //! The two environment variables are the whole application-specific binding, documented in
-//! `README.md`. With none of them set this crate links no archive,
-//! and the binary that uses it supplies the engine instead.
+//! `README.md`. With none of them set this crate links no archive, and the binary that uses it
+//! supplies the engine instead.
 
 use std::env;
 use std::path::{Path, PathBuf};
diff --git a/bindings/c-app-engine/src/lib.rs b/bindings/c-app-engine/src/lib.rs
index b6a4b378..2167c64e 100644
--- a/bindings/c-app-engine/src/lib.rs
+++ b/bindings/c-app-engine/src/lib.rs
@@ -67,7 +67,19 @@ fn internal(reason: impl Into<String>) -> AppError {
     }
 }
 
+/// Validation, execution and draining. NOT_FOUND and INVALID_DUMP describe
+/// lifecycle failures only, so here they break the contract and are fatal.
 fn check(status: i32, operation: &str) -> Result<(), AppError> {
+    check_status(status, operation, false)
+}
+
+/// `from_dump` and `create_dump`, where a missing or invalid dump is an
+/// operational I/O failure.
+fn check_lifecycle(status: i32, operation: &str) -> Result<(), AppError> {
+    check_status(status, operation, true)
+}
+
+fn check_status(status: i32, operation: &str, lifecycle: bool) -> Result<(), AppError> {
     if status == sys::APPLICATION_ENGINE_STATUS_OK {
         return Ok(());
     }
@@ -77,8 +89,8 @@ fn check(status: i32, operation: &str) -> Result<(), AppError> {
     );
     let kind = match status {
         sys::APPLICATION_ENGINE_STATUS_IO_ERROR => std::io::ErrorKind::Other,
-        sys::APPLICATION_ENGINE_STATUS_NOT_FOUND => std::io::ErrorKind::NotFound,
-        sys::APPLICATION_ENGINE_STATUS_INVALID_DUMP => std::io::ErrorKind::InvalidData,
+        sys::APPLICATION_ENGINE_STATUS_NOT_FOUND if lifecycle => std::io::ErrorKind::NotFound,
+        sys::APPLICATION_ENGINE_STATUS_INVALID_DUMP if lifecycle => std::io::ErrorKind::InvalidData,
         _ => return Err(internal(reason)),
     };
     Err(AppError::Io(std::io::Error::new(kind, reason)))
@@ -257,7 +269,7 @@ impl Application for EngineApp {
     fn from_dump(prefix: &Path) -> Result<Self, AppError> {
         let prefix = path_to_cstring(prefix);
         let mut engine = std::ptr::null_mut();
-        check(
+        check_lifecycle(
             unsafe { sys::application_engine_from_dump(prefix.as_ptr(), &mut engine) },
             "from_dump",
         )?;
@@ -270,7 +282,7 @@ impl Application for EngineApp {
 
     fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
         let prefix = path_to_cstring(prefix);
-        check(
+        check_lifecycle(
             unsafe { sys::application_engine_create_dump(self.engine, prefix.as_ptr()) },
             "create_dump",
         )
diff --git a/bindings/c-app-engine/src/sys.rs b/bindings/c-app-engine/src/sys.rs
index 87325e0d..82d7c2ed 100644
--- a/bindings/c-app-engine/src/sys.rs
+++ b/bindings/c-app-engine/src/sys.rs
@@ -1,12 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The engine C ABI, generated by bindgen from the header. Nothing here is written by hand, so
-//! to change what crosses, change the header.
-//!
-//! Enums arrive as plain integer constants, never Rust enums, so a value an engine adds later is
-//! a number this host can refuse rather than undefined behavior. Records carry generated layout
-//! assertions.
+//! The engine C ABI, generated by bindgen from the header: change the header, not
+//! this file. Enums arrive as integer constants, so a value an engine adds later is
+//! refused rather than undefined behavior; records carry generated layout assertions.
 
 // Generated code follows C's naming and carries the whole surface, including what this host has
 // no call for yet
diff --git a/bindings/c-app-engine/src/tests.rs b/bindings/c-app-engine/src/tests.rs
index 194743f3..a3934548 100644
--- a/bindings/c-app-engine/src/tests.rs
+++ b/bindings/c-app-engine/src/tests.rs
@@ -111,3 +111,24 @@ fn drain_preserves_output_order_and_copies_reused_payloads() {
         ]
     );
 }
+
+#[test]
+fn lifecycle_statuses_are_fatal_outside_dump_lifecycle_calls() {
+    for status in [
+        sys::APPLICATION_ENGINE_STATUS_NOT_FOUND,
+        sys::APPLICATION_ENGINE_STATUS_INVALID_DUMP,
+    ] {
+        assert!(matches!(
+            check(status, "execute_direct_input"),
+            Err(AppError::Internal { .. })
+        ));
+        assert!(matches!(
+            check_lifecycle(status, "from_dump"),
+            Err(AppError::Io(_))
+        ));
+    }
+    assert!(matches!(
+        check(sys::APPLICATION_ENGINE_STATUS_IO_ERROR, "drain_output"),
+        Err(AppError::Io(_))
+    ));
+}
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..71929faf
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,19 @@
+# cargo-deny gate on the crate graph (the cargo-deny job in
+# .github/workflows/ci.yml). Sources are deterministic for a given Cargo.lock
+# and block. Advisories change with the RustSec database under a fixed lock,
+# so CI reports them without failing.
+
+[graph]
+all-features = true
+
+[advisories]
+# Unmaintained notices count only for direct dependencies of our crates.
+unmaintained = "workspace"
+# Each entry: an advisory id plus why it does not reach a shipped binary.
+ignore = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+# testsi's cartesi-machine bindings, pinned by rev (sdk/guest/testsi/Cargo.toml).
+allow-git = ["https://github.com/cartesi/dave"]
diff --git a/docs/cartesi-machine.md b/docs/cartesi-machine.md
index 288dbebf..bef11873 100644
--- a/docs/cartesi-machine.md
+++ b/docs/cartesi-machine.md
@@ -5,32 +5,93 @@ drives it, the canonical guest is built for it, and cockroach recovery exports
 from it. This page records the CM behavior those components depend on,
 especially behavior that is easy to assume wrongly. Everything here holds for
 the pinned version (`CARTESI_MACHINE_VERSION` in
-[`toolchain-pins.env`](../toolchain-pins.env), currently v0.21.0) and was
-checked against the emulator source at that tag. Re-check it on every bump.
+[`toolchain-pins.env`](../toolchain-pins.env), currently v0.22.0) and was
+checked against the emulator source at that tag. Re-check it, and the Dave pin
+under [rollup host semantics](#rollup-host-semantics), on every bump of either.
 
 ## Versions are all-or-nothing
 
-A stored machine records a config archive version and the emulator's machine
-identifiers; loading rejects any mismatch. A CM bump therefore invalidates every
-stored image, release tarball, and watchdog checkpoint: rebuild the canonical
-images and re-`init` watchdog state directories. The kernel
-(`machine-linux-image`) and guest tools (`machine-guest-tools`) are paired with
-the emulator release and move with it. The development shell pins the same
-emulator through the parent flake.
+A stored machine records a config archive version (8) and the emulator's
+machine identifiers (`marchid` 22, and `mimpid`, major × 1000 + minor); loading
+rejects any mismatch, and nothing converts a stored machine to another version
+(`skip_version_check` skips only the identifiers). A bump to another minor
+release therefore invalidates every stored image, release tarball, and
+watchdog checkpoint: rebuild the canonical images and the watchdog test guest
+(the recipes reuse an image that exists), and start each new deployment's
+watchdog from a new state directory
+([upgrades](watchdog/operator-deployment.md#upgrades)). A patch release of the
+same minor loads them and, by the emulator's design since 0.15.2, keeps the
+root hash; the pins name the exact release all the same. The kernel and guest
+tools are the ones the emulator release's `dependencies.lock` names, and move
+with it: kernels are
+[`cartesi/linux`](https://github.com/cartesi/linux/releases) releases named by
+kernel version, guest tools are `machine-guest-tools` releases;
+`scripts/verify-toolchain-pins.sh --upstream` checks the pairing. The
+development shell pins the same emulator through the parent flake.
 
 **A deployed application is pinned to its emulator version.** Its on-chain
 template hash is the root hash of a machine built with one emulator release,
-and the machine identifiers are part of that hash. A machine rebuilt with
-another release has a different root hash, and the old release's stored
-machines do not load. Every canonical machine for a deployment, the
-watchdog's included, must run the release its template was built with; moving
-to a new emulator release means a new application deployment.
+and the machine identifiers are part of that hash. A machine rebuilt with a
+release of another minor has a different root hash, and the old release's
+stored machines do not load; within a minor, only the pins enforce the
+release. Every canonical machine for a deployment, the watchdog's
+included, must run the release its template was built with; moving to a new
+emulator release means a new application deployment.
+
+**What moves the template hash.** The hash covers every byte of the stored
+machine, so it moves when any input to the image moves, even when behavior does
+not:
+
+- the emulator's minor release, even with every other input fixed (the machine
+  identifiers and the microarchitecture's state are part of the root hash, and
+  execution fixes change what runs), and its kernel (`toolchain-pins.env`);
+- the rootfs: the guest Dockerfile, `machine-guest-tools`, and `xgenext2fs`;
+- whether the cross toolchain has `rust-src`: with it, rustc embeds local
+  standard-library paths in panic locations instead of the remapped
+  `/rustc/<hash>/` ones. cross 0.2.5 adds it only on a run after the one that
+  installs the riscv64 target, so the guest recipes install both first
+  (`cross-toolchain`) and a cold build is reproducible;
+- the dapp binary: the `rust-toolchain.toml` channel, every `Cargo.lock` entry
+  in `canonical-app`'s build graph, the cross image digest in
+  `examples/canonical-app/Cross.toml`, and `CROSS_VERSION`. The build graph
+  includes the proc macros and build-dependencies that only run on the host
+  (`syn`, `bindgen` for libcmt, `ruint` for the fee table): a version bump
+  anywhere in the graph can move the binary, most likely because each crate's
+  metadata hash covers its dependencies and feeds symbol names and code
+  layout. The host half of
+  the graph is `x86_64-unknown-linux-gnu`, cross's container, whatever the
+  machine; `cargo tree -p canonical-app --target all -e normal,build` lists a
+  superset from any machine, and an update outside it leaves the binary
+  byte-identical;
+- any source change in a guest crate (`sequencer-core`, `sdk/guest/*`,
+  `examples/app-core`, `examples/canonical-app`), even in code the guest never
+  calls: recompiling a crate shifts its constants and code layout.
+
+The checkout path does not enter the hash, and `just canonical-print-build-hashes`
+prints all four inputs to compare; compare cold builds, since a warm `target/`
+can hold crates compiled before `rust-src` arrived. A move that is meant to preserve behavior is
+checked against [`tests/fixtures/consensus_vectors_v1.json`](../tests/fixtures/consensus_vectors_v1.json),
+which pins the consensus bytes (EIP-712 hashes, signature recovery, SSZ, fee
+table, output payloads) natively and, through `canonical-test`'s golden cases,
+in the built image, where each signature variant is checked for running as the
+signer or not. The fixture is never regenerated: a mismatch is a behavior
+change to explain. A release that moves the hash says so, and deployed
+applications keep their old image, which the watchdog checks against the
+on-chain hash.
 
 ## Rollup host semantics
 
-The reference host loop is the `cartesi-machine` CLI (`run_advance_state_epoch`
-in `src/cartesi-machine.lua`); Dave's PRT client implements the same rules.
-Any other host, including the watchdog, must match it exactly:
+The Solidity step defines the per-input transition: Dave treats it as the
+authority, and the release CLI as no independent reference (Dave's
+`docs/computation-hash.md`). The watchdog follows two pinned implementations of
+it: Dave's sling node, `MachineStf` (`feed`, `run_big`, `restore_rejected`,
+`terminal_fixed`, `manual_yield_reason`) at dave@dbcca7d4, and the v0.22.0
+CLI's epoch driver without a hash builder (`run_advance_state_epoch` and
+`run_advance_state_input`, running `run_to_stop` with the null builder), which
+is the test oracle. They differ only at the corners stated below, at the rule
+each qualifies; there the watchdog follows the step and sling, apart from the
+deliberate differences the
+[watchdog README](watchdog/README.md#why-it-is-built-this-way) lists.
 
 | Guest outcome after an input | Host action |
 |---|---|
@@ -38,26 +99,80 @@ Any other host, including the watchdog, must match it exactly:
 | `RX_REJECTED` manual yield | restore the pre-input snapshot |
 | `TX_EXCEPTION`, halt, any other manual yield, or mcycle overflow | fixed point: the machine stays there forever, with no revert |
 
+A pending manual yield decides the outcome, as the step reads it: an
+`RX_ACCEPTED` yield takes the next input and an `RX_REJECTED` one reverts, even
+on the budget's last cycle or on a machine preset halted. A halt or an
+exhausted budget is a fixed point only with no yield pending (sling's
+`MachineStf::terminal_fixed` at dave@dbcca7d4).
+
+A host classifies a pending yield as the step does: `iflags.Y`, then tohost's
+device, command and reason, never its data field (sling's
+`MachineStf::manual_yield_reason` at dave@dbcca7d4). A guest that bypasses
+libcmt can declare data past the 2 MiB TX buffer, which `receive_cmio_request`
+refuses; the CLI reads every yield through it and aborts there. `iflags.Y`
+under another device or command, which only a preset template carries, is a
+fixed point.
+
+The emulator's run break reason ranks a halt first (halt, then manual yield,
+then an exhausted budget), and the CLI's epoch loop follows it. The two orders
+differ only on a preset image with both `iflags.H` and `iflags.Y` set, which
+execution never produces and our image recipes reject
+(`--assert-rolling-template` exits 2 on it): the step delivers the next input
+and the machine then stays halted, while the CLI ends the epoch at the halt, a
+case Dave's `docs/computation-hash.md` lists among the CLI's named exclusions.
+
 - The host reads the root hash, snapshots, then sends the input together with
-  that root as the *revert root hash*. The emulator refuses an advance unless
-  the machine sits at an `RX_ACCEPTED` yield and the revert root hash equals the
-  current root, so a host cannot silently continue from a rejected state.
-- Each input gets an mcycle budget of 2^48 (`imcyclemax`). Exhausting it is a
-  fixed point, not a reject. At realistic speeds this takes days, so a stuck
-  guest shows up as a hung host long before the budget ends.
+  that root as the *revert root hash*. At an `RX_ACCEPTED` yield the emulator
+  refuses an advance without a revert root hash or with one that differs from
+  the current root, and at any state it refuses a revert root hash on any
+  other response. Every other undeliverable response is a silent no-op that
+  leaves the machine unchanged, like the logged and proven transition: no
+  pending yield, an advance at any yield other than `RX_ACCEPTED` (an
+  unreverted rejection included), or data larger than the 2 MiB RX buffer.
+  Only delivery clears `iflags.Y`. Sling asserts an `RX_ACCEPTED` header
+  before sending, and the CLI trusts the last yield it read; neither checks
+  afterwards. At an `RX_ACCEPTED` yield the one undeliverable advance is data
+  over the RX buffer, which both take as an accept with the state unchanged.
+  No chain input reaches it: the pinned InputBox (rollups-contracts
+  `ROLLUPS_CONTRACTS_VERSION` in `toolchain-pins.env`) refuses an encoded
+  input over 65,536 bytes (`InputTooLarge`, as Dave's
+  `LeafTournamentGasFixture` pins for the same release).
+- Each delivered advance sets the budget `imcyclemax` to the current mcycle
+  plus 2^48 − 1. Exhausting it with no halt or yield pending is a fixed point,
+  not a reject. At realistic speeds this takes days, so a stuck guest shows up
+  as a hung host long before the budget ends.
 - An inspect query is legal only at an `RX_ACCEPTED` yield and runs on a
   snapshot the host discards. Inspect execution is never part of canonical
-  history, and its single report is bounded by the 2 MiB CMIO TX buffer.
+  history, and its single report is bounded by the 2 MiB CMIO TX buffer. The
+  emulator itself delivers an inspect at any pending manual yield; the host
+  enforces `RX_ACCEPTED` (the CLI asserts it).
 
 A fixed point is permanent: once the canonical machine reaches one, no later
-input is ever processed for that application.
+input is ever processed for that application. The inputs still arrive: sling
+records each later input as a window that carries the frozen state and
+defends the epoch, which can never be staged (Dave's `docs/epoch-lifecycle.md`),
+and the CLI ends the epoch at the fixed point. Both hold the same state.
+
+Epochs change no machine state. Under Dave each epoch starts from the previous
+one's final state (`DaveConsensus` instantiates the next tournament from it;
+sling's `roll_epoch` re-registers it as the next epoch's first snapshot), so
+the uninterrupted InputBox sequence is the machine's history. The one exception
+is the epoch's input span: an epoch admits at most 2^24 inputs, and past that
+the contracts never feed the tail and a Dave node panics (Dave's
+`docs/dimensioning.md`), while a host replaying the whole InputBox sequence
+executes it. Reaching it takes about 5e11 gas of inputs in one epoch on L1, and
+a cheaper throughput flood breaks Dave settlement first, so the gap is
+accepted on cost; revisit it before deploying on a cheap L2, where such floods
+cost about a thousand times less.
 
 ## Storage, sharing, and snapshots
 
 - **Loading** defaults to `SHARING_NONE`: every backing file is mapped
   privately and never modified, under a shared `flock`. `SHARING_ALL` maps the
   files shared and runs the machine in place on disk, under an exclusive
-  `flock`, so one directory cannot be open both ways at once.
+  `flock` on each writable file (read-only ranges keep a shared one), so one
+  directory cannot be open both ways at once. `SHARING_ALL` refuses a writable
+  range whose backing file has no write permission or more than one hard link.
 - **`store`** writes every range in full as sparse files, refuses an existing
   directory, and does **not** fsync. Durable publication uses `sync_stored`
   (fsyncs files, the directory, and its parent), then `rename_stored` (atomic,
@@ -65,16 +180,19 @@ input is ever processed for that application.
 - **`clone_stored`** reflinks writable files (`clonefile` on macOS APFS,
   `FICLONE` on Linux btrfs/XFS), hardlinks read-only ones, and falls back to a
   sparse copy when the filesystem cannot link (`ENOTSUP`, `EXDEV`, `EPERM`). It
-  always works; it is cheap only on copy-on-write filesystems.
+  always works; it is cheap only on copy-on-write filesystems. It hard-links
+  only files without write permission, so a clone still loads with
+  `SHARING_ALL`; a copy hard-linked by hand (`cp -l`) does not.
 - **Snapshots come in two families.** An in-place (`SHARING_ALL`) machine
   snapshots by closing, cloning its directory, and reopening; this is the CLI's
   `--revert-mode=stored` and Dave's sling node. The CLI's default
   `--revert-mode=fork` instead forks a JSON-RPC machine server process, which
-  refuses to fork a machine with shared ranges (both processes would see the
-  writes). We run the machine in-process and use the clone family only.
+  refuses to fork a machine with shared backing stores, its hash-tree files
+  included (both processes would see the writes). We run the machine
+  in-process and use the clone family only.
 
-Measured on APFS (Apple M5 Max) with a machine holding a 1 GiB NVRAM, 768 MiB
-of it non-zero:
+Measured with v0.21.0 on APFS (Apple M5 Max) with a machine holding a 1 GiB
+NVRAM, 768 MiB of it non-zero:
 
 | Operation | Cost |
 |---|---|
@@ -93,8 +211,8 @@ answering an inspect query:
 
 - **NVRAM** (`--nvram=label:<l>,...`) appears in the guest as `/dev/uioN`. It
   has no filesystem layer and no page cache: guest writes through `mmap` are
-  immediately in the machine state. It requires the paired kernel with UIO
-  (ctsi-2 and later).
+  immediately in the machine state. It requires a kernel with UIO
+  (`CONFIG_UIO`, `CONFIG_UIO_PDRV_GENIRQ`), which the pinned kernel has.
 - **Flash drives** appear as `/dev/pmemN`. Guest writes go through the page
   cache, so the application must flush (`fsync`, `msync(MS_SYNC)`, or
   `O_DIRECT`) before finishing each input; otherwise the drive holds a stale
@@ -112,11 +230,11 @@ answering an inspect query:
 
 ## The guest side
 
-- **The guest–host interface is unchanged from v0.20.** Yield reasons, CMIO
-  buffer addresses, and ioctl numbers are the same; only the names moved to
-  `HTIF_*`. The revert root hash and the per-input cycle budget are host-side.
-  libcmt 0.18 bundles its ioctl header, so the guest build needs no kernel
-  headers.
+- **The guest–host interface is the same from v0.20 through v0.22.** Yield
+  reasons, CMIO buffer addresses, and ioctl numbers match; only the names moved
+  to `HTIF_*`. The revert root hash and the per-input cycle budget are
+  host-side. libcmt 0.18 bundles its ioctl header, so the guest build needs no
+  kernel headers.
 - **Some guest tools are glibc builds.** The `nvram`/`flashdrive` label helpers,
   which the CLI's generated init script calls for every NVRAM and for flash
   drives it formats, mounts, or chowns, and `xhalt`, which `cartesi-init` calls
@@ -151,14 +269,24 @@ The CLI is a script, not a module: it parses the global `arg` and ends in
 `cartesi.util`, `cartesi.hash-tree`, `cartesi.jsonrpc`). When tests run the CLI
 as a reference:
 
-- `--cmio-advance-state` checks the outputs Merkle root from genesis by default;
-  resuming from a mid-history checkpoint needs `check_outputs_merkle_root:false`.
-- `--max-mcycle` reached mid-input exits 0 and stores the mid-input state.
+- `--cmio-advance-state` reads input files `input_file_index_begin` to
+  `input_file_index_end`−1 (the end defaults to the begin, so name both) and
+  rejects unknown keys. It checks the outputs Merkle root, starting from the
+  empty tree unless `last_output_proof` (or, with `resumable:true` and
+  `begin_epoch:false`, an `outputs_frontier` file) seeds it; a run resumed
+  from a mid-history checkpoint with neither needs
+  `check_outputs_merkle_root:false`.
+- `--max-mcycle` reached mid-input exits 0 and stores the mid-input state
+  (without `resumable`).
 - Exit codes do not distinguish outcomes (a halt with payload 0 exits 0); load
   the stored machine and read its state instead, cross-checked with
   `--final-hash`.
-- An inspect query is delivered even to a machine at an exception yield, and
-  its own outcome is not reported.
+- `--assert-rolling-template` runs after `--store`: it requires an
+  `RX_ACCEPTED` yield whose TX buffer holds the expected outputs Merkle root
+  (by default the empty tree's, which libcmt writes on its first accept) and
+  exits 2 otherwise, leaving the stored image in place.
+- `--cmio-inspect-state` asserts an `RX_ACCEPTED` yield before the query and
+  exits nonzero otherwise; the query's own accept or reject does not set the
+  exit code.
 - `--remote-spawn` leaves machine servers running unless `--remote-shutdown` is
-  also given. `--no-rollback` no longer exists; use `--no-revert`, which cannot
-  get past a rejected input: the emulator refuses the next advance.
+  also given. `--no-revert` aborts the run at the first rejected input.
diff --git a/docs/invariants.md b/docs/invariants.md
index 0a68a8d9..664dcec5 100644
--- a/docs/invariants.md
+++ b/docs/invariants.md
@@ -29,34 +29,12 @@ When you change anything listed under *enforced by*, re-check every line under
 - **Never absorb silently.** No `INSERT OR IGNORE`, saturating decode, or
   `unwrap_or_default` on data the contracts make impossible; use the loud
   variant of the same operation.
-- **Command admission is fact-derived; terminal runtime faults abort the
-  process.** Three facts (the kernel process lock, two-sided
-  `setup_complete`, `canonical_divergence`), no admission state machine, no
-  operator acknowledgement, and a verdict-neutral black box; the statement,
-  the accepted trade, and the termination policy are owned by the
-  [authority-boundary ADR](plans/2026-08-authority-boundary-adr.md)
-  (mechanisms 1 and 2). What this policy adds: telemetry writes are
-  verdict-neutral — a failed black-box record loses only the black-box copy,
-  and the exit code and logs still carry the verdict. Runtime aborts skip
-  settlement entirely. The [I15](#i15-divergence-marker-present--acceptance-frontier-frozen)
-  freeze applies immediately to its named tables; runtime reaction still
-  requires a worker to observe the committed marker.
-- **Maintenance is flush-only.** `flush-mempool` is an operator command,
-  not a startup-recovery alias: it settles the wallet nonce and never acquires
-  Sync/Cascade semantics. It requires completed setup and no divergence.
-  There is no verdict state for a flush to erase, and a successful wallet
-  flush proves nothing about the rest of the runtime.
-- **Normal run repair and admission share one selection policy.** Local
-  absorbing facts are inspected before fallible provider facts; startup
-  selects one repair and checks its result. The flush's safe-block witness
-  is boot-local, and Sync must catch the persisted view up through it before
-  Cascade. Final admission checks one consistent fact set and yields
-  the single-use `RuntimeAdmission` witness consumed by the infallible,
-  non-yielding launch; no refusal or retry can construct it, and raw worker
-  and HTTP launch surfaces are crate-private. Design:
-  [`docs/recovery/README.md`](recovery/README.md). Mutation and output
-  authorization remains role-local at the durable boundaries documented
-  below; public low-level storage helpers are not an authority API.
+- **Admission, terminal faults, the maintenance flush, and startup repair**
+  follow the [authority-boundary ADR](plans/2026-08-authority-boundary-adr.md)
+  (mechanisms 1–3) and the [recovery design](recovery/README.md). Raw worker
+  and HTTP launch surfaces are crate-private, and public low-level storage
+  helpers are not an authority API: mutation and output authorization stay
+  role-local at the durable boundaries this register lists.
 - An assertion must check a **real invariant** — true in every legitimate
   execution, including crash-recovery, replays, and clock steps — never an
   environmental assumption. (Cautionary tale: `sealed_at_ms >= created_at_ms`
@@ -87,7 +65,6 @@ by writer and are write-once (`0001_schema.sql`).
 | setup | `deployment_identity` (pinned once), `batch_tree_anchor` (the root nonce, frozen once setup completes), the initial `dumps` + `snapshots` rows and rebuild root `batches`/`frames` (atomic with the complete history baseline), the `setup_complete` fact (written once), `batch_policy.log_gas_price` + `log_gas_price_updated_at_ms` (first write; Fixed and Uniswap) |
 | snapshot GC (the lane after reconciliation, `run`'s startup hygiene) | obsolete `snapshots` and unreferenced `dumps` row deletion (`gc_unreferenced_dumps`), including a superseded baseline artifact |
 | command brackets (run, setup, flush) | `terminal_faults` (append-only, best-effort at settlement) |
-| admin | `batch_policy` alpha knobs (`log_alpha`, `log_one_plus_alpha`) |
 | fee oracle | `batch_policy.log_gas_price` + `log_gas_price_updated_at_ms` (Uniswap mode only; stamps on every successful refresh) |
 
 ### I1. Scheduler-acceptance semantics agree across all implementations
@@ -97,21 +74,17 @@ by writer and are write-once (`0001_schema.sql`).
   `sequencer-core/src/scheduler/mod.rs`), the off-chain predicate
   (`ProtocolTiming::scheduler_accepts`, `sequencer-core/src/protocol.rs`), and
   the inclusion lane's live prediction produce the same
-  accept/reject/ordering decisions for every input. (Known, documented
+  accept/reject/ordering decisions for every input. The recovery fold
+  (`fold_replay`) drives `Scheduler<A>` itself, not a copy. (Known, documented
   exception: the predicate omits the two structural rejections — self-trust,
   since the simulator only runs over the sequencer's own well-formed batches;
-  the omission is documented in `scheduler-semantics.md` and test-pinned by
+  the reason is recorded at `scheduler_accepts`, and it is test-pinned by
   the I1 duality test in `sequencer-core/src/scheduler/mod.rs`, which asserts
   the canonical fold and the predicate diverge exactly and only there.)
 - **Enforced by:** review + the duality test. No structural mechanism.
 - **Depended on by:** everything — the gold frontier, recovery's cascade pivot,
   checkpoint selection, soft-confirmation honesty.
 - **Breaks:** silent permanent scheduler/sequencer divergence.
-- The expected-nonce fold is homed next to `scheduler_accepts` as
-  `advance_expected_batch_nonce`; `decide_submit_start` consumes it, while
-  `populate_safe_accepted_batches` keeps a deliberate inline copy (its advance
-  interleaves with storage-only side effects that can't move below the protocol
-  layer — see the call-site comment).
 
 ### I2. Drain attribution: accumulated directs land in the clock-advanced frame
 
@@ -131,19 +104,14 @@ by writer and are write-once (`0001_schema.sql`).
 
 ### I3. Frame `safe_block`s are non-decreasing along the spine
 
-- **Holds:** during an admitted live run, logical frame time advances directly
-  to the latest observed safe head `H` only when `H - S >= 5`, where `S` is the
-  open frame's persisted `safe_block`. An observation jump creates one frame at
-  `H` and resets the anchor; no intermediary frames are synthesized. Batch
-  closure may create a structural successor frame at the unchanged `S`, so
-  equality is valid. Bootstrap and recovery are anchoring transitions, not
-  live clock ticks: they may open a fresh Tip at a proven checkpoint/current
-  safe head without applying the five-block delta.
-- **Enforced by:** lane flow + `append_safe_inputs`' monotonicity asserts
+- **Holds:** frame `safe_block`s never decrease along the valid spine; equal
+  adjacent clocks are valid. The [frame-clock policy](protocol/scheduler-semantics.md#sequencer-frame-clock-policy)
+  says when the lane advances the clock, including the anchoring exception
+  for bootstrap and recovery.
+- **Enforced by:** lane flow + `append_ingested_safe_inputs_with_timestamp`'s monotonicity asserts
   (`storage/l1_inputs.rs`) +
-  `ProtocolTiming::FRAME_CLOCK_INTERVAL_SAFE_BLOCKS` (homed with its timing
-  siblings in `sequencer-core/src/protocol.rs`; prose owner is the
-  scheduler-semantics frame-clock section). The lane's frontier time gate
+  `ProtocolTiming::FRAME_CLOCK_INTERVAL_SAFE_BLOCKS`
+  (`sequencer-core/src/protocol.rs`). The lane's frontier time gate
   bounds SQLite observation load and is not part of the clock semantics.
 - **Depended on by:** `check_danger`'s arm ordering (see I4); the scheduler's
   within-batch monotonicity check; "if the frontier batch is fresh, all are".
@@ -172,9 +140,12 @@ by writer and are write-once (`0001_schema.sql`).
   identifies the completely accounted L1 prefix. Reconciliation executes all
   external directs in the newly safe interval before committing its next frame
   and application rows. Envelopes-only intervals advance the clock with no rows.
-- **Enforced by:** complete-block ingestion; the lane's indivisible reconciliation
-  turn; storage range and execution-receipt checks. Batch closure preserves the
-  current frame clock.
+- **Enforced by:** complete-block ingestion: every committed `safe_inputs` /
+  `l1_safe_head` pair holds every input through its head, witnessed by index
+  contiguity plus the InputBox count at that head (`l1/reader.rs`), above a
+  scan floor setup pins only once the deployment is safe; the lane's
+  indivisible reconciliation turn; storage range and execution-receipt checks.
+  Batch closure preserves the current frame clock.
 - **Breaks:** skipping or double-applying directs after restart/recovery.
 
 ### I7. Every committed batch close has an immutable snapshot
@@ -219,9 +190,9 @@ by writer and are write-once (`0001_schema.sql`).
 - **Depended on by:** the gold frontier, cascade pivot selection, checkpoint selection,
   local-state ↔ canonical-state agreement.
 - **Breaks:** would be silent divergence (a zombie replay of our own stale tx
-  winning a nonce slot; a power-loss re-seal at the same nonce with different
-  content); instead it is a detected `CanonicalDivergence` refusal whose
-  remedy is cockroach recovery.
+  winning a wallet-nonce slot; a power-loss re-seal at the same batch nonce
+  with different content); instead it is a detected `CanonicalDivergence`
+  refusal whose remedy is cockroach recovery.
 - **Completeness boundary:** the check completely enforces the accepted-batch
   identity predicate above; it is intentionally not a general canonical/application
   divergence oracle. The entire L1 prefix through baseline block `C` is opaque,
@@ -254,9 +225,10 @@ by writer and are write-once (`0001_schema.sql`).
 - **Holds:** `safe_inputs` retains every InputBox observation. The storage/lane
   boundary selects external directs by the setup-pinned submitter address;
   only those inputs and included user ops enter `application_inputs`.
-- **Enforced by:** classified direct reads and complete receipt validation at
-  append. Standard startup recovery attributes undrained directs to the new Tip;
-  lane catch-up executes them before processing queued user operations. Manual
+- **Enforced by:** append-only `safe_inputs` triggers; classified direct reads
+  and complete receipt validation at append. Standard startup recovery
+  attributes undrained directs to the new Tip; lane catch-up executes them
+  before processing queued user operations. Manual
   rebuild represents the folded prefix through `C` in its baseline snapshot,
   with no application-history rows for that prefix. Replay and WS need no
   envelope filter because every row executes.
@@ -265,8 +237,8 @@ by writer and are write-once (`0001_schema.sql`).
 ### I12. Safe head advances only on real observation; `synced_at_ms` is genuine progress time
 
 - **Holds:** the reader early-returns when the fetched head doesn't advance;
-  `append_safe_inputs` asserts monotonicity and stamps `synced_at_ms` only on
-  commit.
+  `append_ingested_safe_inputs_with_timestamp` asserts monotonicity and stamps
+  `synced_at_ms` only on commit.
 - **Enforced by:** reader floor check + asserts (`storage/l1_inputs.rs`).
 - **Depended on by:** the wall-clock danger arms (`L1ViewStale`,
   `EstimatedBatchInDanger`) — their baseline must be true progress time, or
@@ -308,63 +280,57 @@ by writer and are write-once (`0001_schema.sql`).
 
 ### I15. Divergence marker present ⇒ acceptance frontier frozen
 
-- **Holds:** a fully-accepted landing that
-  fails the content-identity check writes the `canonical_divergence`
-  singleton **in the same transaction** as the sync that detected it, and
-  `populate_safe_accepted_batches` returns early whenever the marker exists —
-  so no acceptance row or gold-frontier advance can ever
-  happen past a detected divergence.
-- **Enforced by:** the `trg_*_frozen_on_divergence` trigger family
-  (`0001_schema.sql`) — specifically batch-tree writes and snapshot collection RAISE in the engine while the marker exists. This is
-  the immediate persisted freeze for those named tables, not a general
-  user-op hot-path barrier. The accepted frontier itself has no trigger: its
-  single writer refuses past the marker — the guard at the top of
-  `populate_safe_accepted_batches`. The typed error surface also includes
-  `check_danger`'s first arm (`CanonicalDivergence`, ranked ahead of every
-  other arm). Startup inspection refuses before any provider query, and
-  each repair transaction reasserts its durable preconditions and the
-  absence of divergence before writing. A clean worker drain waits for
-  in-flight reader appends: `run` then re-reads the marker on
-  its Ok path (`refuse_divergence_on_clean_exit`) and exits terminal rather
-  than 0, the one code that would break the supervisor's restart-then-refuse
-  rediscovery. The admission and preemptive TLA+ models verify the
-  controller ordering (`LocalTerminalDominance` in `admission.tla`) and
-  slot/batch safety respectively.
-- **Runtime reaction:** the danger detector owns prompt process-wide reaction,
-  reading `check_danger` on its poll interval (`DANGER_DETECTOR_POLL_INTERVAL`). Independently, the inclusion lane's existing time-gated
-  SQLite read returns `SafeFrontierState::CanonicalDivergence` instead of an
-  `Open` frontier when the marker is already present. The lane then exits
-  with a terminal error, causing the supervisor to abort, before direct execution or the five-block rotation decision. This is opportunistic
-  refusal at an existing read, not another detector or a timing guarantee.
-  One bounded dequeue chunk (`max_user_ops_per_chunk`) is the fast-turn limit, so rejected traffic cannot
-  starve the read once its time gate is due. There is deliberately no
-  per-chunk marker query or extra poll.
-- **Race bound:** a lane turn that already read `Open` may finish if the reader
-  commits divergence concurrently. Preventing that would require a lock or
-  transaction spanning application execution. Existing freeze triggers stop
-  conflicting batch-tree writes; the detector and next typed read
-  stop the process. A chunk committed before either runtime observation may
-  acknowledge and later roll back.
-- **Watchdog boundary:** accepted-checkpoint selection checks for divergence
-  in the same transaction as selection and any download lease, refusing while
-  the marker is present. A matching batch
-  before a divergent acceptance in the same L1 block cannot represent that
-  block's final state. Because the watchdog skips replay when the finalized
-  inclusion block is unchanged, it
-  does not subsume this wire-identity detector. Conversely, the check does
-  not subsume the watchdog's broader independent application-state
-  comparison.
+- **Holds:** a fully accepted landing that fails the content-identity check
+  writes the `canonical_divergence` singleton **in the detecting sync's
+  transaction**, and `populate_safe_accepted_batches` returns early while the
+  marker exists, so no acceptance row or gold-frontier advance follows a
+  detected divergence.
+- **Enforced by:** the `trg_*_frozen_on_divergence` triggers
+  (`0001_schema.sql`) make batch-tree writes and snapshot collection RAISE
+  while the marker exists: an immediate, persisted freeze of those tables, not
+  a user-op hot-path barrier. The accepted frontier has no trigger; its single
+  writer's guard refuses. `check_danger`'s first arm is `CanonicalDivergence`.
+  Startup inspection refuses before any provider query, and each repair
+  transaction reasserts its preconditions and the marker's absence before
+  writing. A clean worker drain waits for in-flight reader appends; `run` then
+  re-reads the marker (`refuse_divergence_on_clean_exit`) and exits terminal,
+  not 0, the one code that would break the supervisor's restart-then-refuse
+  rediscovery. `admission.tla` checks the controller ordering
+  (`LocalTerminalDominance`); `preemptive.tla` checks slot and batch safety.
+- **Runtime reaction:** the danger detector owns the prompt process-wide
+  reaction, polling `check_danger` every `DANGER_DETECTOR_POLL_INTERVAL`.
+  Independently, the lane's existing time-gated SQLite read returns
+  `SafeFrontierState::CanonicalDivergence` instead of `Open`, and the lane
+  exits terminal, so the supervisor aborts, before direct execution or the
+  five-block rotation decision. This is opportunistic refusal at an existing
+  read, not another detector or a timing guarantee, and there is deliberately
+  no per-chunk marker query or extra poll. One `max_user_ops_per_chunk` chunk
+  is the fast-turn limit, so rejected traffic cannot starve the read once its
+  time gate is due.
+- **Race bound:** a lane turn that already read `Open` may finish while the
+  reader commits divergence; preventing that would need a lock or transaction
+  spanning application execution. The freeze triggers stop conflicting
+  batch-tree writes, and the detector or the next typed read stops the
+  process, so a chunk committed before either may acknowledge and later roll
+  back.
+- **Watchdog boundary:** accepted-checkpoint selection checks the marker in
+  the same transaction as selection and any download lease, and refuses while
+  it is present. A matching batch before a divergent acceptance in the same L1
+  block is not that block's final state, and the watchdog skips replay when
+  the finalized inclusion block is unchanged, so it does not subsume this
+  wire-identity detector. Nor does the check subsume the watchdog's broader,
+  independent application-state comparison.
 - **Depended on by:** standard recovery never running on a diverged frontier
-  (a flush+cascade there would compound the divergence); egress never
-  publishing a diverged landing; the remedy being cockroach recovery only.
-- **Breaks:** silent permanent scheduler/sequencer divergence — the
+  (a flush and cascade there would compound the divergence); egress never
+  publishing a diverged landing; cockroach recovery as the only remedy.
+- **Breaks:** silent permanent scheduler/sequencer divergence, the
   theft-equivalent failure.
 - **Baseline-aware frontier:** accepted-batch scanning starts strictly after
-  the immutable baseline L1 block `C`, seeded with anchor nonce `N'`. The whole
-  prefix is opaque, including previously rejected future-nonce batches; it must
-  never be reinterpreted using a later expected nonce. Subsequent scans resume
-  after the last acceptance. Rebuild defers the projection until the complete
-  baseline and anchor are published.
+  the immutable baseline L1 block `C`, seeded with anchor nonce `N'`; the
+  prefix through `C` is opaque
+  ([I9](#i9-acceptance-identity-accepted-nonce-n-means-our-valid-batch-n)).
+  Later scans resume after the last acceptance. Rebuild defers the projection
+  until the complete baseline and anchor are published.
 
 ### I16. The batch tree has exactly one valid parentless root, carrying the deployment's anchor nonce
 
@@ -449,29 +415,6 @@ by writer and are write-once (`0001_schema.sql`).
   Checkpoint state, inclusion block, and next nonce are trusted operator inputs;
   neither clone detection nor distributed fencing is implied.
 
-### Do-not-simplify (deliberate shapes that look like cleanup targets)
-
-The refactorer-facing mirror of the register above — each of these *looks*
-like a simplification and would break a registered invariant:
-
-- **Don't move filesystem work into `storage/snapshot_dumps.rs`** — the
-  module boundary *is* the GC crash-ordering guarantee (I13).
-- **Don't reorder `check_danger`'s arms** or merge its two `find_*` helpers
-  into one that consults the Tip first — the closed-frontier-first order is
-  the dispatch table's meaning (I4).
-- **Don't derive application order from L1 positions** — optimistic user ops
-  precede their envelope and have no general one-to-one L1 mapping.
-- **Don't retain a numeric resume offset without its history identity** —
-  recovery deliberately reuses suffix counts (I18).
-- **Don't discard a valid snapshot beyond the accepted frontier** — that exact
-  batch can become the next required recovery checkpoint (I7).
-- **Don't add internal retry loops to the flusher/submitter for provider
-  errors** — the orchestrator respawn is the retry mechanism; internal
-  retries mask exactly the failures the danger machinery routes on.
-- **Don't unify the two staleness references** (inclusion-relative vs
-  current-relative) — deliberately different formulas for different
-  questions.
-
 ### I19. Application progress follows the shared execution contract
 
 - **Holds:** `ApplicationProgress` is the pair
@@ -519,3 +462,26 @@ like a simplification and would break a registered invariant:
 - **Performance boundary:** head discovery uses the integer primary-key maximum;
   replay seeks directly by offset and joins bounded source rows. Neither scans
   invalidated history. Chunk insertion adds no durability transaction or actor.
+
+## Do-not-simplify (deliberate shapes that look like cleanup targets)
+
+The refactorer-facing mirror of the register above — each of these *looks*
+like a simplification and would break a registered invariant:
+
+- **Don't move filesystem work into `storage/snapshot_dumps.rs`** — the
+  module boundary *is* the GC crash-ordering guarantee (I13).
+- **Don't reorder `check_danger`'s arms** or merge its two `find_*` helpers
+  into one that consults the Tip first — the closed-frontier-first order is
+  the dispatch table's meaning (I4).
+- **Don't derive application order from L1 positions** — optimistic user ops
+  precede their envelope and have no general one-to-one L1 mapping.
+- **Don't retain a numeric resume offset without its history identity** —
+  recovery deliberately reuses suffix counts (I18).
+- **Don't discard a valid snapshot beyond the accepted frontier** — that exact
+  batch can become the next required recovery checkpoint (I7).
+- **Don't add internal retry loops to the flusher/submitter for provider
+  errors** — the orchestrator respawn is the retry mechanism; internal
+  retries mask exactly the failures the danger machinery routes on.
+- **Don't unify the two staleness references** (inclusion-relative vs
+  current-relative) — deliberately different formulas for different
+  questions.
diff --git a/docs/l1-fee-policy.md b/docs/l1-fee-policy.md
index 2292317b..0602c721 100644
--- a/docs/l1-fee-policy.md
+++ b/docs/l1-fee-policy.md
@@ -51,14 +51,13 @@ the Ethereum node's pending transactions.
 
 ## Why this policy
 
-The [#34 review history](https://github.com/cartesi/sequencer/pull/34) explored
-asymmetric bumps, remembered suffix hashes, compounding fee floors, and a
-market-relative ceiling. Those implementations introduced invalid fee pairs,
-payload/hash-association bugs, funding pressure, and recovery incompatibility.
-[#35](https://github.com/cartesi/sequencer/pull/35) retains the independent
-gas-estimation and flusher fee-validity fixes while removing that escalation
-state. These failures motivate the current choice; they do not prove that
-every bounded replacement policy would be unsound.
+Escalating replacements were tried in
+[#34](https://github.com/cartesi/sequencer/pull/34): asymmetric bumps,
+remembered suffix hashes, compounding fee floors, and a market-relative
+ceiling. They introduced invalid fee pairs, payload/hash-association bugs,
+funding pressure, and recovery incompatibility. These failures motivate the
+current choice; they do not prove that every bounded replacement policy would
+be unsound.
 
 Revisit with evidence of sustained batch delays, recovery frequency or
 duration, and submission cost. Record the logs and affected L1 block range.
diff --git a/docs/plans/2026-07-coordination-tracks.md b/docs/plans/2026-07-coordination-tracks.md
index 873892b6..a2b43f9e 100644
--- a/docs/plans/2026-07-coordination-tracks.md
+++ b/docs/plans/2026-07-coordination-tracks.md
@@ -12,38 +12,45 @@ freely at this stage — no backward-compatibility constraints.
 
 | # | Track | Owner | Status |
 |---|-------|-------|--------|
-| 3 | Feed & replay protocol redesign | us (design) → us/Stephen (impl) | **repository API implemented; post-merge adoption and deployment work remain** — [follow-up sequence](2026-07-track3-feed-replay-design.md#follow-up-sequence) and [ownership](2026-07-track3-feed-replay-design.md#merge-scope-and-follow-up-ownership) |
-| 5 | Fee exponentiation LUT | us | **deferred** — decided exact-floor if built (the table *is* the spec, algorithm-free; replay continuity across the upgrade explicitly not preserved); a separate pending design decision may make log-space fees defunct — revisit after syncing with Bart |
+| 3 | Feed & replay protocol redesign | us (design) → us/Stephen (impl) | **implemented; client adoption and deployment work remain; frozen until the shared recovery tool and a new client sync** — [scope](#track-3--feed--replay-protocol-redesign) |
+| 5 | Fee exponentiation LUT | us | **unblocked, needs Bart** — fees stay in log space; the batch-level alternative is deferred with [batch-scoped replay protection](2026-10-batch-scoped-replay-protection.md). Shape decided: exact-floor table, algorithm-free; a consensus change agreed with Bart before implementation; the log-additive `batch_policy` design is frozen until then |
 | 6 | Dump / `Application` API redesign | us + Bart | **interface and reference C binding implemented** — [Application contract](../protocol/application-contract.md); native-engine integration gates remain |
 
 **Current campaign order:**
 
-1. Merge the implemented egress API after repository review/checks. Bart can then integrate his client; adjust the API from concrete feedback without waiting for downstream completion.
+1. Bart's client integrates the feed and treats cockroach recoveries as out of scope; we fix bugs it finds, and other feedback is input to the new sync. A shared recovery tool, still to be designed, will produce both the sequencer's and the client's startup state from a checkpoint. Until it lands, `setup --recovery`, `fold.rs` and the cockroach reader seams get bug fixes only.
 2. Application integrators/operators validate the private engine, canonical-to-native exporter and recovery drill, and representative capacity before production use. Reference C-host lifecycle coverage is part of repository CI.
-3. Track 5 (fee LUT) only after the log-space-fees decision.
+3. Track 5 (fee LUT) after a sync with Bart, batched with other guest-image changes.
 
 Full restore archives now support file and directory application prefixes.
 Additional snapshot retention or transport mechanisms require a measured consumer need.
 
 ## Track 3 — Feed & replay protocol redesign
 
-The current [history contract](../protocol/application-history.md) owns replica
-bootstrap, history identity, replay, and recovery boundaries. The
-[API contract](../../README.md#api) owns wire behavior. The wallet's cold replica
-and canonical recovery/watchdog gates have a
-[validation record](../review/2026-09-16-track3-validation.md).
+The egress API is implemented. The [history contract](../protocol/application-history.md),
+the [projection contract](../protocol/projection-replay.md) and the
+[API contract](../../README.md#api) own its behavior; the
+[integration plan](2026-07-track3-feed-replay-design.md) owns deployment follow-ups.
 
-Readers whose projections contain information absent from the latest application
-state can use the implemented fixed-prefix historical L1 API and checkpoint
-metadata. The [projection contract](../protocol/projection-replay.md) owns that
-workflow; the history contract owns implemented checkpoint compatibility across
-standard recoveries. The [integration plan](2026-07-track3-feed-replay-design.md)
-owns follow-up requirements and their owners. Native-engine integration and
-representative deployment latency remain open after merge; they are not egress
-API merge prerequisites. Other transport or retention mechanisms require a
-measured need.
+A shared recovery tool will produce the sequencer's and a client's startup
+state from one checkpoint, and a new client sync follows its design. Until
+then, what they replace gets bug fixes only, and its docs are not polished:
 
-## Track 5 — Fee exponentiation LUT (deferred)
+- Deleted when the tool lands: projection replay across a rebuild
+  (`/historical-l1-inputs`, the SDK's `historical_l1_inputs`, the main
+  `historical_bootstrap` test, the projection contract, and the integration
+  plan). First move the projection contract's seed/replay rules and worked
+  boundary into the tool's design and tests, move the integration plan's
+  deployment follow-ups to the register, and repoint the links to both files.
+- Reshaped or retired with the new sync: the WS wire format, the SDK
+  snapshot-then-subscribe bootstrap, `/latest_snapshot` and its history headers,
+  `/history`'s baseline, accepted checkpoint and compatibility query, and the
+  era/generation identity types. In-era generation signalling survives in some form.
+
+Not frozen: the ingress routes, `/finalized_state` and its probes,
+`/finalized_snapshot`, download leases, and the canonical page reader with `HistoryClaim`.
+
+## Track 5 — Fee exponentiation LUT
 
 `fee_to_linear` is consensus-critical (scheduler fold, guest agreement, app
 fee charging) and must be bit-identical across the Rust sequencer, the
@@ -56,8 +63,10 @@ If built, the shape is decided: a full lookup table of exact
 550 KB). The checked-in table *is* the cross-implementation spec artifact
 (algorithm-free, golden-hash-tested); `build.rs` verifies rather than
 generates; C++ consumes the same file byte-identically; and replay
-continuity across the upgrade is explicitly not preserved. Do not implement
-until the pending log-space-fees decision lands (with Bart).
+continuity across the upgrade is explicitly not preserved. Fees stay in log
+space; [batch-scoped replay protection](2026-10-batch-scoped-replay-protection.md)
+records the deferred design that would move the fee to the batch. Agree the
+table with Bart and ship it with the other guest-image changes.
 
 ## Track 6 — Dump / `Application` API redesign
 
diff --git a/docs/plans/2026-07-track3-feed-replay-design.md b/docs/plans/2026-07-track3-feed-replay-design.md
index 31e06fe6..a4ed71df 100644
--- a/docs/plans/2026-07-track3-feed-replay-design.md
+++ b/docs/plans/2026-07-track3-feed-replay-design.md
@@ -14,12 +14,14 @@ The repository delivery includes the egress contracts, storage, SDK, and referen
 replay/recovery tests. Its merge criteria are review and the relevant repository
 checks. Private-engine integration, operational rehearsal, and representative
 capacity measurements are follow-up work; they do not block merging this API.
-Merge the implementation, let consumers integrate, and adjust the API from
-concrete feedback. There are no live deployments requiring compatibility.
+Merge the implementation and let consumers integrate. Bugs they find are fixed;
+other feedback is input to the new client sync
+([Track 3](2026-07-coordination-tracks.md#track-3--feed--replay-protocol-redesign)).
+There are no live deployments requiring compatibility.
 
 | Follow-up | Owner | When it is needed |
 |---|---|---|
-| Private DEX scheduler, indexer, and database backups | Bart / application integration | After merge, while adopting the API. Verify complete checkpoint/claim association and scheduler replay; report missing fields or awkward workflow for adjustment. |
+| Private DEX indexer and database backups | Bart / application integration | While adopting the API. Report bugs for fixing; missing fields or awkward workflow feed the new client sync. |
 | Canonical-to-native export and incident rehearsal | Application integration and operators, under Track 6 | Before relying on that application's recovery procedure in production. |
 | Ingress latency, indexing headroom, and recovery capacity | Sequencer/application maintainers and deployment operators | Before claiming support for the target deployment workload; measure historical serving alongside ordinary traffic. |
 
@@ -76,20 +78,18 @@ replacement directs, empty/no-op invalidation, nonzero baselines, and rollback.
 |---|---|
 | Historical bootstrap | Implemented: replay the complete fixed prefix and join the feed at `K`, including after a nonzero rebuild. |
 | Standard recovery | Implemented: choose the nearest retained checkpoint whose prefix survived every intervening generation change, then restore/resubscribe. |
-| Cockroach reader recovery | Core replay/metadata workflow and reference checkpoint restore implemented; Bart's actual checkpoint preparation, incident validation, and fallback rehearsal remain. |
+| Cockroach reader recovery | Core replay/metadata workflow and reference checkpoint restore implemented. Superseded for clients by the planned shared recovery tool; bug fixes only, with no client follow-up. |
 | Stable coordinates | Existing era/generation/application count for claims; separate InputBox indices for raw paging. Counts alone do not certify cross-era compatibility. |
 | Bounded serving cost | Page/item/response bounds implemented; representative bootstrap must preserve the ingress latency target and demonstrate catch-up headroom. |
 | Operational readiness | Each production application supplies its canonical-to-native exporter, runbook, and non-genesis recovery drill under Track 6. |
 
 ### Follow-up sequence
 
-1. **Consumer adoption after merge.** Bart integrates accepted-boundary checkpoint
-   preparation and scheduler replay using the implemented API. Sequencer
-   maintainers address concrete feedback as it arrives; downstream completion
-   is not a prerequisite for repository delivery. Before production use, rehearse
-   identifying an unsound projection checkpoint, including one below new `K`,
-   and restoring an earlier trusted backup or genesis. The API does not certify
-   the client's projection.
+1. **Consumer adoption.** Bart's client follows the feed and treats cockroach
+   recoveries as out of scope. A planned shared recovery tool will produce both
+   the sequencer's and the client's startup state from a checkpoint, so clients
+   never resume across a rebuild; new client work should not build on the
+   projection-replay path, which receives bug fixes only.
 2. **Deployment readiness.** Validate the private native engine and measure
    latency, historical serving cost, projection throughput,
    catch-up headroom, and recovery time. Track 6 independently owns the versioned
diff --git a/docs/plans/2026-10-batch-scoped-replay-protection.md b/docs/plans/2026-10-batch-scoped-replay-protection.md
new file mode 100644
index 00000000..89510eed
--- /dev/null
+++ b/docs/plans/2026-10-batch-scoped-replay-protection.md
@@ -0,0 +1,137 @@
+# Batch-scoped replay protection (deferred)
+
+**Status:** deferred design, not implemented. The current rule is the
+per-sender nonce in the [application contract](../protocol/application-contract.md#user-nonces).
+Revisit when replay state must become prunable, or when the fee moves from the
+frame to the batch.
+
+## Why
+
+The nonce rule makes replay protection depend on all history. Every account's
+expected nonce lives in application state forever, so state cannot be pruned.
+That state is the "historical fold" each implementation must carry.
+
+Moving the fee to the batch, signed by the user, hits a race. A user who reads
+the current fee, signs, and submits can find the batch already sealed. The
+batch-scoped design fixes that race too.
+
+## Design
+
+**Signed coordinates.** The user signs `(b, i)` in place of a nonce:
+
+- `b` is the scheduler batch nonce the op targets: the canonical batch sequence
+  number, not the sequencer's local `batch_index`.
+- `i` orders the sender's ops within `b`.
+
+**Look-back.** The sequencer adds an unsigned field `k` (2 bits, so `k` ∈ 0..=3)
+when it builds the batch. Executing batch `c`, the scheduler recovers
+`b = c - k` and verifies the signature over it. `b` itself never goes on the
+wire. A user who signed for a batch that sealed meanwhile is still included,
+in a later batch with `k ≥ 1`.
+
+**Acceptance.** Per sender, keep the last consumed `(b, i)`. Accept an op only
+if its `(b, i)` is lexicographically greater, then store it.
+
+- `i` need not equal the op's position or start at 0, so a rejected op does not
+  break the ones after it.
+- Ops of one sender targeting the same `b` may split across batches `b..b+3`;
+  order is still enforced.
+
+**Pruning.** Drop a sender's entry once its stored `b < c - 3`. This is sound:
+any op still in the window has `b ≥ c - 3`, so it would pass the comparison
+against the dropped entry anyway. State is bounded by the senders active in the
+last four batches, not by every account ever seen.
+
+**Why the state is needed.** Without look-back (`k = 0` always), uniqueness of
+`i` within batch `b` is checkable inside the batch, and the rule is stateless.
+With look-back, a check confined to the including batch is replayable by a
+Byzantine sequencer:
+
+```
+user signs X with (b=10, i=0)
+batch 10: X with k=0 → recovers b=10, accepted
+batch 11: X with k=1 → recovers b=10, accepted again under a within-batch check
+```
+
+The per-sender `(b, i)` entry rejects the second inclusion.
+
+## Fee at the batch
+
+- Each batch carries one fee, fixed when the batch opens and published before
+  users sign. Signing `b` commits the user to `fee(b)`; no `max_fee` is signed.
+- An op included through look-back pays `fee(b)`, not `fee(c)`. The scheduler
+  therefore keeps the fees of the last four batches, a bounded addition to its
+  state.
+- Users minimize cost by targeting the cheapest batch in the window, so a fee
+  increase fully applies only after `look-back` batches. The 10× fee headroom
+  over DA cost absorbs that delay.
+
+## Wire and DA
+
+- Per op, the 4-byte nonce and 2-byte `max_fee` are replaced by a small `i`
+  plus 2 bits of `k`. The fee appears once per batch, not per frame.
+- The distribution of `i` is skewed toward 0, which leaves room for later
+  compression.
+
+## Recovery and invalidation
+
+A stale batch does not consume its nonce, so a cascade rolls the open batch
+back and replacements reuse the nonces. An op from an invalidated batch never
+executed, but its signature stays executable while canonical `c <= b + 3`,
+including when its `b` is above the rolled-back open batch. That breaks
+re-signing, which today's nonce makes safe:
+
+```
+user signs X with (15, 0); batches 10..15 are invalidated; open batch is 10
+user re-signs X' with (10, 0); it executes and stores (10, 0)
+canonical c reaches 15: X arrives with k=0, (15, 0) > (10, 0), accepted again
+```
+
+The coordinates name a nonce, not a batch's content, so a lower re-signed copy
+does not exclude the original. Adopting the design requires binding ops to
+their branch; [open questions](#open-questions) lists tentative fixes.
+
+The fee commitment has the same gap: a replacement batch at a reused nonce
+`b` opens with its own fee, so an op signed against the original `fee(b)` can
+be charged a fee it never saw.
+
+The window state (per-sender `(b, i)`, recent fees, and any anchors) is
+canonical state. Checkpoints and the cockroach recovery tool must carry it.
+
+## What changes together
+
+This is one coordinated contract change, agreed with the engine owner:
+
+- the EIP-712 `UserOp` type;
+- `WireUserOp`, and `Frame`/`Batch` (the fee moves to the batch);
+- scheduler acceptance, the application contract's nonce rule, and the C ABI's
+  validation inputs;
+- `GET /nonce` and `GET /fee` (they become the open batch's nonce and fee, plus
+  the sender's next `i`), and the SDK.
+
+## Open questions
+
+- **Binding ops to their branch (required before adoption).** Tentative fixes,
+  not yet analyzed in depth. Most promising: each op also signs an anchor, the hash of the canonical batch at nonce `b - 1`, which the
+  scheduler keeps for the window. A rebuilt `b - 1` then invalidates every
+  signature made against the old branch, as a recent block hash does elsewhere,
+  and re-signing becomes safe. Alternatives: clients and `GET /nonce` never
+  quote coordinates below a sender's outstanding signed op until `c > b + 3`;
+  or the sequencer re-includes invalidated ops itself and users never re-sign.
+- **Signing the fee.** Sign `fee(b)` without putting it on the wire: the
+  scheduler fills it from its window, so a replacement batch with another fee
+  makes the op recover a different address and skip, instead of overcharging.
+  Or state that a replacement may charge its own fee, within policy.
+- **Window width in time.** Four batches shrink to seconds under load, when
+  batches seal on size. Size `k` against a minimum batch lifetime, or bound the
+  sealing cadence.
+- **Owner of the window state.** Replay protection is protocol-level. The
+  scheduler could own it at the shared execution boundary, which would remove
+  nonce logic from every application.
+- **Width and encoding of `i`,** and its exhaustion rule.
+
+## Why deferred
+
+The per-sender nonce works, and the engine owner no longer needs to prune
+replay state. The change spans signing, wire format, scheduler, ABI and API at
+once, so it waits for a concrete trigger.
diff --git a/docs/protocol/application-contract.md b/docs/protocol/application-contract.md
index 7776b9e3..add97ae6 100644
--- a/docs/protocol/application-contract.md
+++ b/docs/protocol/application-contract.md
@@ -119,12 +119,20 @@ its post-rebuild ops. An engine outside the rule (gapped or keyed
 nonces, a deposit that resets one) makes `GET /nonce` quote nonces the engine
 rejects.
 
+The rule keeps every account's nonce in state forever. A batch-scoped
+alternative makes replay state prunable and lets the fee move to the batch; it
+is a [deferred design](../plans/2026-10-batch-scoped-replay-protection.md).
+
 ### 3. The safe-block clock — `last_executed_safe_block`
 
 The clock is the maximum block carried by an executed input: frame `safe_block`
 for user ops, L1 inclusion block for directs, or zero at genesis. On success,
-the engine advances it with `max(old_clock, input_clock)`. Count zero implies
-clock zero. Both fields survive checkpoint round-trips.
+the engine advances it with `max(old_clock, input_clock)`. Input clocks are
+not monotone: [gate d](scheduler-semantics.md#processing-an-input) orders
+frame clocks only within a batch, so a later batch's user ops may run at a
+`safe_block` below an earlier input's clock (a direct never runs below the
+stored clock); the `max` keeps the stored clock monotone. Count zero implies clock zero. Both
+fields survive checkpoint round-trips.
 
 The [frame-clock policy](scheduler-semantics.md#sequencer-frame-clock-policy)
 may deliver a delayed head jump as one step. Newly covered directs execute
diff --git a/docs/protocol/application-history.md b/docs/protocol/application-history.md
index ed3e3bff..f249d67e 100644
--- a/docs/protocol/application-history.md
+++ b/docs/protocol/application-history.md
@@ -181,7 +181,7 @@ writers become supported.
 | Boundary | Code and tests |
 |---|---|
 | Coordinates and claim ordering | [`sequencer-core/src/history.rs`](../../sequencer-core/src/history.rs) — identity before position, inclusive head, checked counts. |
-| Coherent application pages | [`storage/egress/canonical.rs`](../../sequencer/src/storage/egress/canonical.rs) and its tests — source context, nonzero baselines, replacement offsets, concurrent recovery, gaps and SQL limits. |
+| Coherent application pages | [`storage/history/canonical.rs`](../../sequencer/src/storage/history/canonical.rs) and its tests — source context, nonzero baselines, replacement offsets, concurrent recovery, gaps and SQL limits. |
 | Replay followed by live delivery | [`l2_tx_feed`](../../sequencer/src/egress/l2_tx_feed/) — bounded deep replay, identity refusals, shutdown and persistent faults; [`catch_up.rs`](../../sequencer/src/ingress/inclusion_lane/catch_up.rs) for native replay. |
 | Artifact and claim association | [`snapshot_endpoints.rs`](../../sequencer/src/integration_tests/snapshot_endpoints.rs) — headers, restore, archive contents, and lease lifetime. |
 | Checkpoint compatibility | [`storage/history.rs`](../../sequencer/src/storage/history.rs) and recovery tests — immutable cuts, complete lineage, and transaction rollback; [`recovery_compatibility.rs`](../../sequencer/src/integration_tests/historical_bootstrap/recovery_compatibility.rs) — saved projections across missed recoveries and HTTP lookup/WS admission races. |
diff --git a/docs/protocol/projection-replay.md b/docs/protocol/projection-replay.md
index 7278c485..1667c59b 100644
--- a/docs/protocol/projection-replay.md
+++ b/docs/protocol/projection-replay.md
@@ -8,6 +8,10 @@ scheduler remains the ordering authority. The [README API](../../README.md#histo
 owns routes, fields, limits, and refusals; the
 [history contract](application-history.md) owns application coordinates.
 
+The planned shared recovery tool supersedes this workflow, so it gets bug fixes
+only; new client work should not build on it
+([Track 3](../plans/2026-07-coordination-tracks.md#track-3--feed--replay-protocol-redesign)).
+
 ## Bootstrap and handoff
 
 1. Read `/history`. Pin the deployment identity and era, baseline application
diff --git a/docs/protocol/scheduler-semantics.md b/docs/protocol/scheduler-semantics.md
index b76a43d6..195cf00f 100644
--- a/docs/protocol/scheduler-semantics.md
+++ b/docs/protocol/scheduler-semantics.md
@@ -1,131 +1,189 @@
 # Scheduler acceptance semantics
 
-The canonical ordering rule. The on-chain scheduler reads a stream of L1 safe
-inputs and folds them into application state in one deterministic order. Every
-other component that *predicts* that order — the gold frontier, the inclusion
-lane, the recovery fold — must reproduce this algorithm exactly. Disagreement is
-silent scheduler/sequencer divergence, the most severe failure in the system
-([I1](../invariants.md#i1-scheduler-acceptance-semantics-agree-across-all-implementations)).
-
-This document **owns** that algorithm. [`AGENTS.md`](../../AGENTS.md) §"Sequencer /
-Scheduler Duality" is the map; this is the detail. The reference implementation
-is [`Scheduler<A>`](../../sequencer-core/src/scheduler/mod.rs) — the same source
-compiled into the on-chain canonical machine and run bare-metal by the recovery
-fold, so those two targets agree *by construction*. This prose is the intended
-protocol contract; the reference implementation embodies it but remains code
-that can contain bugs and require hardening.
-
----
+The canonical scheduler folds an application's L1 inputs, in L1 order, into
+application state. This page specifies that fold for anyone who reimplements
+it. The reference is [`Scheduler<A>`](../../sequencer-core/src/scheduler/mod.rs),
+run in the canonical machine by the [canonical-app harness](../../examples/canonical-app/src/scheduler/mod.rs).
+This text is the contract and the reference can have bugs, so report any
+disagreement. The [application contract](application-contract.md) owns what
+the application does with each input. Rules marked **pending** describe the
+reference today; changing one changes the canonical machine image or its wire
+format, so they are settled with the C++ port's author
+([register](../review/register.md#canonical-rules-open-for-the-c-port)).
 
 ## The one stream, the one classification
 
-The scheduler consumes `InputAdded` events from the InputBox in L1 order. Each
-event carries an authenticated `msg_sender`. Classification is **by sender
-address, never by a tag byte** ([`process_input`](../../sequencer-core/src/scheduler/mod.rs)):
+Each input is a Cartesi Rollups `EvmAdvance` from the InputBox. The scheduler
+reads its `msgSender`, its `blockNumber` (the *inclusion block*), its `chainId`
+and `appContract` (the signature domain), and its `payload`. It classifies by
+sender only, never by payload content:
 
-| Sender | Treated as | Effect |
-|---|---|---|
-| `== sequencer_address` | a **batch** (SSZ-encoded `Batch`) | folded through the acceptance algorithm below |
-| anything else | a **direct input** (deposit) | appended to the *fridge* (the direct-input FIFO), drained later |
+- `msgSender == sequencer_address`: the payload is a **batch**.
+- Any other sender: a **direct input**, appended unchanged to the *fridge*,
+  the FIFO of directs not yet executed.
 
-The payload is opaque to classification; app-specific decoding happens inside
-the `Application::apply_direct_input` hook, reached through
-the shared `execute_direct_input` boundary (see the
-[application contract](application-contract.md)).
+`sequencer_address` is deployment data compiled into the canonical machine. It
+must equal the batch-submitter address that `setup` pins; nothing checks this
+at runtime. If they differ, the machine treats every batch as a direct input
+while the sequencer still reports its batches accepted, so only a watchdog
+comparison reveals it.
 
----
+The scheduler's state is `next_batch_nonce` (`u64`, 0 at genesis), the fridge,
+and the application, which holds its executed-input count and clock. Nothing
+else carries over between inputs: no earlier batch's `safe_block` is kept. The
+fridge has no size bound (**pending**).
 
-## The algorithm (`process_input`)
+## Wire format
 
-Every input — batch or direct — first runs the **censorship backstop**, then is
-classified.
+A batch payload is the SSZ encoding of `Batch`
+([`batch.rs`](../../sequencer-core/src/batch.rs)), fields in this order:
 
-```
-process_input(input):
-  1. force_execute_overdue(input.inclusion_block)   ── backstop, runs for EVERY input
-  2. if input.sender != sequencer_address:
-         fridge.push_back(input)                    ── DirectEnqueued
-     else:
-         process_batch_payload(input)               ── the acceptance algorithm
+```text
+Batch      { nonce: uint64, frames: List[Frame] }
+Frame      { user_ops: List[WireUserOp], safe_block: uint64, fee_price: uint16 }
+WireUserOp { nonce: uint32, max_fee: uint16, data: List[uint8], signature: List[uint8] }
 ```
 
-### Step 1 — Force-execute overdue directs (the backstop)
+Integers are little-endian. Each variable-size field has a 4-byte offset in its
+container's fixed part, and the variable parts follow in field order. A list of
+containers starts with one 4-byte offset per element. Lists have no length
+limit. Decoding is strict: offsets must start right after the fixed part, never
+decrease and stay in bounds, so only the canonical encoding of a `Batch`
+decodes, and re-encoding returns the same bytes.
+`max_fee` and `fee_price` are fee exponents ([constants](#constants)). A
+`signature` of any length decodes, but only 65 bytes can recover a sender; a
+fixed 65-byte field is **pending**.
+
+## User-op signatures
+
+A user op signs the EIP-712 struct `UserOp(uint32 nonce,uint16 max_fee,bytes data)`
+([`user_op.rs`](../../sequencer-core/src/user_op.rs)) under the domain
+`EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)`:
+name `CartesiAppSequencer`, version `1`, the input's `chainId`, its
+`appContract` as `verifyingContract`, and no salt
+([`build_input_domain`](../../sequencer-core/src/lib.rs)). The sender is not
+signed; it is recovered from `r ‖ s ‖ v` (alloy's `Signature::from_raw` and
+`recover_address_from_prehash`), and any failure drops the op:
+
+1. The signature must be 65 bytes, and `v` must be 0, 1, 27, 28 or at least 35.
+   The y-parity is `v` for 0 and 1; for `v ≥ 27` it is 1 when `v` is even,
+   else 0.
+2. `r` and `s` must lie in `[1, n − 1]`, where `n` is the secp256k1 order.
+3. If `s > n / 2`, `s` becomes `n − s` and the parity flips, so a high-`s`
+   signature and its low-`s` twin of opposite parity recover the same sender.
+4. The sender is the address of the public key recovered from `(r, s, parity)`
+   and the EIP-712 signing hash.
+
+This acceptance set is the library's, pinned on both the batch path and
+`POST /tx` by the signature vectors except for `s ≥ n` and `v` from 29 to 34;
+it is **pending**. Batches the sequencer
+builds carry `v ∈ {27, 28}`, but keep a user's `s` as signed.
+
+## Processing an input
+
+Every input first runs the **censorship backstop**: pop and execute directs
+from the front of the fridge while
+`input.inclusion_block − front.inclusion_block ≥ MAX_WAIT_BLOCKS`. This bounds how
+long a sequencer that stops submitting, or freezes `safe_block`, can hold a
+direct back. Then a direct joins the fridge, and a batch runs these gates in
+order; the first that applies decides the outcome:
+
+| # | Gate | Outcome | `next_batch_nonce` |
+|---|---|---|---|
+| a | payload does not SSZ-decode as `Batch` | rejected | kept |
+| b | `batch.nonce != next_batch_nonce` | rejected | kept |
+| c | `frames` is empty | executed, as a no-op | +1 |
+| d | frame structure is invalid (below) | rejected | kept |
+| e | `inclusion_block − frames[0].safe_block ≥ MAX_WAIT_BLOCKS` | skipped as stale | kept |
+| f | otherwise: execute every frame (below) | executed | +1 |
+
+Ages saturate at zero. An empty batch is valid at any age, since it has no
+first frame (**pending**). Gate d rejects a batch whose frames include a
+`safe_block` above `inclusion_block`, or a `safe_block` lower than the previous
+frame's. It looks only inside the batch: a later batch may start below an
+earlier one's last `safe_block`, and its user ops then see the lower value. A
+stale batch keeps the nonce, so every later batch fails gate b until one
+reuses that nonce, as a batch rebuilt after sequencer recovery does. A
+rejected and a skipped batch have the same effect: no state change, nonce
+kept. The reject reason the reference reports is diagnostic.
+
+### Frame execution (gate f)
+
+For each frame, in order:
+
+1. **Drain covered directs.** Pop and execute directs from the front of the
+   fridge while their `inclusion_block ≤ frame.safe_block`. The `safe_block` is
+   the sequencer's claim that it accounted for every direct up to that block;
+   the scheduler enforces the drain whatever the sequencer did.
+2. **Execute the user ops** in order. Skip an op, with no effect, if (checked
+   in this order) its sender cannot be recovered, `max_fee < frame.fee_price`,
+   the application rejects it at fee `frame.fee_price`, or its `nonce` is
+   `u32::MAX`, which has no successor. Otherwise apply it with fee
+   `frame.fee_price` and clock `frame.safe_block`
+   ([`validate_and_execute_user_op`](../../sequencer-core/src/application/mod.rs)).
+
+The scheduler does not range-check `fee_price`; the reference wallet halts on
+converting an exponent above `MAX_EXPONENT` (**pending**).
+
+## Outputs and the executed-input count
+
+An input's outputs are the application's notices and vouchers in execution
+order: overdue directs, then each frame's drained directs and applied ops.
+Reports are diagnostics outside the outputs tree: the reference reports a
+rejected batch with one fixed string and a stale skip not at all, and the
+[golden guest tests](../../examples/canonical-test/src/golden.rs) ignore them.
+
+The executed-input count is canonical state too. It advances by one for each
+executed direct and each applied user op, including an app-level no-op or
+business failure, and for nothing else: not for queueing a direct, a skipped
+op, a batch envelope or an empty batch. A rejected or stale batch can still
+advance it through the backstop. The [application contract](application-contract.md#4-canonical-history-cursor-executed_input_count)
+owns the count; the [history contract](application-history.md) owns how
+catch-up, recovery and the API use it.
+
+## Fatal conditions
+
+The reference panics, halting the machine, when the application returns an
+error; when the batch nonce or the executed-input count has no `u64`
+successor; and when `blockNumber` or `chainId` does not fit `u64`. A halt is a
+permanent fixed point, not a reject ([rollup host semantics](../cartesi-machine.md#rollup-host-semantics)),
+so a port must halt on the same inputs. No canonical successor state exists.
+
+## Constants
+
+| Constant | Value | Home |
+|---|---|---|
+| `MAX_WAIT_BLOCKS` | 1200 L1 blocks, about 4 h | [`lib.rs`](../../sequencer-core/src/lib.rs) |
+| `MAX_EXPONENT` | 17101 | [`fee.rs`](../../sequencer-core/src/fee.rs) (`build.rs` generates it) |
+| `sequencer_address` | per deployment | compiled into the canonical machine |
 
-Before *anything* else, drain every fridge direct that has gone **overdue**:
-`current_block − direct.inclusion_block ≥ MAX_WAIT_BLOCKS`
-([`force_execute_overdue`](../../sequencer-core/src/scheduler/mod.rs)). This is
-the censorship-resistance guarantee: a direct cannot be held in the fridge
-forever by a sequencer that freezes `safe_block` or stops submitting batches —
-once it ages out, it executes regardless of any frame. It runs on every input
-tick (even a malformed batch advances `current_block` and can trip the
-backstop). Drained directs execute in FIFO (ascending `inclusion_block`) order.
+A fee exponent `n` stands for `(129/128)^n` smallest token units. The
+application converts it; [`fee_to_linear`](../../sequencer-core/src/fee.rs)
+owns the bit-exact conversion. A checked-in lookup table in its place is
+**pending** ([Track 5](../plans/2026-07-coordination-tracks.md#track-5--fee-exponentiation-lut)).
 
-### Step 2 — Batch acceptance (`process_batch_payload`)
+## Conformance
 
-A batch from the sequencer address runs this gauntlet, in order. The first
-failing gate decides the outcome; only `BatchExecuted` (including the empty-batch
-case) **consumes the nonce**.
+[`consensus_vectors_v1.json`](../../tests/fixtures/consensus_vectors_v1.json)
+pins EIP-712 hashes, keccak256, the signature cases above (every accepted `v`
+form, `v = 2`, high `s`, 64 bytes, `r = 0`, `s = 0`, `r = n`) with the sender
+each path recovers, SSZ bytes, fee conversions, `EvmAdvance` calldata, and
+guest scenarios with their exact outputs. It is never regenerated: a mismatch
+is a consensus change. Gate edge cases are pinned by the reference's unit tests
+and the [guest tests](../../examples/canonical-test/src/main.rs); vectors for
+them are **pending**.
 
-| # | Gate | On failure | Nonce? |
-|---|---|---|---|
-| a | SSZ-decode the payload as `Batch` | `BatchRejected(DecodeFailed)` | not consumed |
-| b | `batch.nonce == next_expected_batch_nonce` | `BatchRejected(WrongNonce)` | not consumed |
-| c | *empty frames?* → accept as a no-op | `BatchExecuted` | **consumed** |
-| d | structural frame check (below) | `BatchRejected(SafeBlockAboveInclusionBlock \| NonMonotonicSafeBlocks)` | not consumed |
-| e | staleness: `inclusion_block − frames[0].safe_block ≥ MAX_WAIT_BLOCKS` | `BatchSkippedStale` | **not consumed** |
-| f | execute every frame (below) | `BatchExecuted` | **consumed** |
-
-**Gate d — structural frame check**
-([`batch_reject_reason_for_block`](../../sequencer-core/src/scheduler/mod.rs)):
-
-- every frame's `safe_block ≤ inclusion_block` (a frame cannot claim to have
-  accounted for L1 state it was included before) — else
-  `SafeBlockAboveInclusionBlock`;
-- frame `safe_block`s are **non-decreasing** across the batch — else
-  `NonMonotonicSafeBlocks`.
-
-**Gate e — staleness** is measured against the **first** frame only
-(`has_elapsed_since`, mirrored off-chain by
-[`ProtocolTiming::is_scheduler_stale`](../../sequencer-core/src/protocol.rs)). A
-stale batch is a **true no-op in nonce space**: the expected nonce does *not*
-advance, so the next batch — including a freshly-rebuilt one reusing the same
-nonce after recovery — is what the scheduler accepts next. This is the
-mechanism behind cascading invalidation (AGENTS.md §"Cascading invalidation").
-
-### Step 2f — Frame execution order (drain-before-ops)
-
-For each frame, in order ([`process_batch_payload`](../../sequencer-core/src/scheduler/mod.rs)):
-
-1. **Drain covered directs first**: pop every fridge direct with
-   `inclusion_block ≤ frame.safe_block` and execute it
-   ([`drain_directs_safe_at`](../../sequencer-core/src/scheduler/mod.rs)). The
-   `safe_block` is the sequencer's commitment that it has accounted for all
-   directs up to that block; the scheduler enforces the drain regardless.
-2. **Then execute the frame's user ops**, each through the single entry point
-   [`validate_and_execute_user_op`](../../sequencer-core/src/application/mod.rs)
-   with `(frame.fee_price, frame.safe_block)`. A user op is silently skipped
-   (no state change, no output) when its signature is unrecoverable, when app
-   `validate_user_op` rejects it, or when a protocol guard fails
-   (`max_fee ≥ fee_price`, or a nonce of `u32::MAX`, which has no
-   successor) — the fold is a pure deterministic function and emits no
-   diagnostics at the library seam.
-
-An `AppError` from either execution path is fatal: there is no canonical
-successor to the partially evaluated input, so the canonical harness,
-inclusion lane, catch-up, and recovery fold all stop rather than continue.
-
-This ordering — directs ≤ `S_K` then ops validated on top of them — is exactly
-what the inclusion lane writes into frame K's wire content
-([I2](../invariants.md#i2-drain-attribution-accumulated-directs-land-in-the-clock-advanced-frame)),
-which is what keeps the off-chain prediction faithful.
+## Sequencer side
+
+The rest of this page is for sequencer developers.
 
 ### Sequencer frame-clock policy
 
-The scheduler constrains frame clocks to be non-decreasing and no later than
-the batch inclusion block; it does not require a frame for every L1 block.
-During an admitted live run, the sequencer advances logical frame time when the
-latest persisted safe head `H` is at least five blocks beyond the open frame
-clock `S`. It then opens exactly one frame at `H`, drains the complete
+Gate d constrains frame clocks only within a batch: non-decreasing and no later
+than its inclusion block. The scheduler does not require a frame for every L1
+block. During an admitted live run, the sequencer advances logical frame time
+when the latest persisted safe head `H` is at least five blocks beyond the open
+frame clock `S`. It then opens exactly one frame at `H`, drains the complete
 newly-covered direct range, and uses `H` for subsequent user ops. An observation
 jump from 100 to 132 therefore creates one frame at 132, not synthetic frames at
 each missed five-block boundary. Intermediate empty frames would execute
@@ -147,156 +205,15 @@ deposit budget. If actual safe-head publication cadence threatens that budget,
 revisit the constant from measurements rather than adding interpolation or a
 second timer.
 
----
-
-## The application-history offset
-
-The feed offset is semantically
-[`Application::executed_input_count()`](application-contract.md#4-canonical-history-cursor-executed_input_count).
-It starts at zero and names the next application input to execute. An
-application at count `X` is ready for history entry `X`; successfully executing
-that entry advances the application to `X + 1`.
-
-The scheduler determines which InputBox material becomes an executed
-application input. Its count transitions are therefore:
-
-| Scheduler event | Application execution | Count effect |
-|---|---|---|
-| Direct arrives and is appended to the fridge | none yet | unchanged |
-| Covered or overdue direct is successfully executed | `execute_direct_input` returns `Ok` | exactly `+1` |
-| User op passes signature, protocol, and app validation and is successfully executed | `execute_valid_user_op` returns `Ok` | exactly `+1` |
-| User op has an unrecoverable signature or is rejected by protocol/app validation | none | unchanged |
-| Batch envelope is decoded, accepted, skipped, or rejected | none for the envelope itself; contained executions are counted by the rows above | unchanged for the envelope |
-| Empty batch | none | unchanged |
-| Either execution method returns `AppError` | fatal invariant failure | no canonical successor is defined |
-
-The censorship backstop still runs before classification, so a malformed,
-stale, or otherwise rejected batch can indirectly advance the count by causing
-overdue directs to execute first. The batch itself never contributes an entry.
-
-This coordinate must agree across the canonical fold, the inclusion lane,
-catch-up/replay, and recovery. Standard recovery may replace an invalidated
-suffix at the same application offsets; cockroach recovery resumes from the
-absolute count persisted in the recovered application state even when older
-history is no longer locally available.
-
-The durable `application_inputs` sequence uses these same offsets. HTTP
-snapshots carry the history version and application count; WS subscriptions
-must claim both before inclusive replay. See the [history contract](application-history.md).
-
----
-
-## The three implementations (and why they agree)
-
-I1 names three places this algorithm lives. They are not three rewrites; two are
-*derived* from the first.
-
-| # | Implementation | Role | Source |
-|---|---|---|---|
-| 1 | **Canonical fold** `Scheduler<A>` | on-chain authority + bare-metal recovery fold | [`scheduler/mod.rs`](../../sequencer-core/src/scheduler/mod.rs) |
-| 2 | **Off-chain predicate** `scheduler_accepts` + `advance_expected_batch_nonce` | builds the gold frontier (`safe_accepted_batches`) | [`protocol.rs`](../../sequencer-core/src/protocol.rs) |
-| 3 | **Inclusion lane live prediction** | drains + executes ahead of L1 to issue soft confirmations | [`ingress/inclusion_lane/`](../../sequencer/src/ingress/inclusion_lane/) |
-
-- **#1 is the authority.** It is the literal scheduler source; the recovery
-  engine [`fold_replay`](../../sequencer-core/src/scheduler/fold.rs) *drives* it
-  (seeds the fridge, replays the stream), so recovery is consistent with L1 by
-  construction rather than by a parallel re-implementation. It is not a fourth
-  copy.
-- **#2 is a predicate, not the full fold.** `scheduler_accepts` answers only
-  "would the scheduler accept this batch into the frontier?" — it checks sender,
-  decode, staleness, and nonce, and **deliberately omits gate d** (the
-  structural frame checks). That omission is sound by *self-trust*: the frontier
-  simulator runs over the sequencer's **own** batch submissions, which are
-  well-formed by construction; a structurally-malformed batch would be a
-  self-bug (a fault state to crash on), not an adversarial input to predict.
-  This document is the cross-reference home for the omission — the asymmetry is
-  intentional, not a missing check.
-- **The content-identity check is complete relative to #2, not an independent oracle for #1.** For
-  every at/above-anchor landing that `scheduler_accepts` accepts, the frontier
-  builder exhaustively finds a byte-identical valid local closed batch
-  (`Match`), no local batch (`Foreign`), or different bytes (`Mismatch`); the
-  latter two durably freeze the frontier. Because the check shares #2 and its
-  structural omissions, it cannot prove that #1, application state, or trusted
-  collapsed history is correct. Its false-positive boundary is recorded once
-  at I9; see I9/I15 for the runtime and recovery boundary.
-- **The expected-nonce fold** is homed once, next to `scheduler_accepts`, as
-  [`advance_expected_batch_nonce`](../../sequencer-core/src/protocol.rs). The
-  submitter's `decide_submit_start` consumes it directly. The frontier builder
-  `populate_safe_accepted_batches` keeps a deliberate inline copy of the same
-  advance — its loop interleaves the advance with two storage-only side effects
-  (the content-identity check and the `canonical_divergence` freeze) that
-  cannot move below the protocol layer; sharing the fold there would force a
-  callback contract. The duplication is intentional and documented at the call
-  site.
-
-**Why the agreement is load-bearing:** the gold frontier (#2) is what
-recovery's cascade pivots on and what accepted-checkpoint selection trusts; the lane (#3) is what
-users see as soft confirmations. If any of the three computes a different
-accept/reject/order than the canonical fold (#1), the sequencer will have
-promised users a future the scheduler will not produce. No mechanism enforces
-the agreement — only review and the duality tests. **Change one, check all.**
-
----
-
-## Invariants this rests on
-
-- [I1](../invariants.md#i1-scheduler-acceptance-semantics-agree-across-all-implementations)
-  — the three implementations agree (this document is its prose).
-- [I2](../invariants.md#i2-drain-attribution-accumulated-directs-land-in-the-clock-advanced-frame)
-  — drained directs land in the new frame, so the lane's wire content matches
-  the fold's drain-before-ops order.
-- [I3](../invariants.md#i3-frame-safe_blocks-are-non-decreasing-along-the-spine)
-  — frame `safe_block`s are non-decreasing, the lane-side mirror of gate d's
-  monotonicity rule.
-- [I19](../invariants.md#i19-application-progress-follows-the-shared-execution-contract)
-  — every successful application input advances one typed count/clock pair;
-  rejected inputs do not, and `AppError` is terminal.
-
-## Test-pinned properties
-
-The duality's load-bearing edge cases each have at least one test
-([`scheduler/mod.rs`](../../sequencer-core/src/scheduler/mod.rs) tests,
-[`protocol.rs`](../../sequencer-core/src/protocol.rs) tests):
-
-- **Empty batches are valid no-ops that consume the nonce** — no first frame to
-  measure staleness against (`empty_batches_are_valid_noops`,
-  `scheduler_accepts_empty_frames_batch_regardless_of_age`).
-- **Stale batches do not consume the nonce** and the next batch reuses it
-  (`stale_batch_is_skipped_without_consuming_nonce`).
-- **Drain uses an inclusive `inclusion_block ≤ safe_block` rule**
-  (`frame_drain_uses_consistent_inclusive_safe_block_rule`).
-- **The backstop drains all overdue directs before the batch**
-  (`pre_batch_backstop_executes_overdue_directs_before_user_ops`,
-  `backstop_drains_all_overdue_directs`).
-- **Staleness boundary is `≥ MAX_WAIT_BLOCKS`** — accepted at `MAX_WAIT − 1`,
-  skipped at `MAX_WAIT` (`scheduler_accepts_boundary_just_below_stale`,
-  `is_scheduler_stale_reports_true_at_and_past_threshold`).
-- **Structural rejects don't consume the nonce**
-  (`non_monotonic_safe_blocks_invalidate_batch`,
-  `frame_safe_block_above_inclusion_block_invalidates_batch`,
-  `wrong_batch_nonce_is_rejected_without_consuming_nonce`).
-
----
-
-## Reference-scheduler count discipline
-
-Every canonical input crosses the same typed execution
-boundary in the scheduler, live lane, catch-up, and recovery fold:
-
-1. Successful directs and validated user ops return their pre-execution
-   `ExecutedInputCount` and advance exactly once with checked arithmetic.
-   Rejection, bad signatures, envelopes, empty batches, and stale/structural
-   skips leave it unchanged.
-2. `AppError` is fatal everywhere; there is no parallel scheduler-only
-   transition after a possibly partial hook failure.
-3. The engine advances its embedded progress in each successful apply hook.
-   The shared boundary preflights overflow and asserts the exact expected
-   successor after success. Validation purity and native-engine mutation
-   remain self-trusted.
-4. Tests pin direct/user advancement, every skip/reject family, pre-batch
-   overdue-drain ordering, overflow, dump round-trips, nonzero recovery bases,
-   and live/replay mapping agreement.
-
-Additional scheduler changes may still be batched separately, but they must
-preserve the transition table above and the shared boundary rather than
-reintroducing a scheduler-local count.
+### The three implementations and why they agree
+
+The sequencer predicts this fold in two more places: the off-chain predicate
+`scheduler_accepts`, which builds the gold frontier, and the inclusion lane's
+live prediction. The recovery fold drives `Scheduler<A>` itself.
+[I1](../invariants.md#i1-scheduler-acceptance-semantics-agree-across-all-implementations)
+maps all three and their one deliberate difference: the predicate skips gate d.
+[I2](../invariants.md#i2-drain-attribution-accumulated-directs-land-in-the-clock-advanced-frame)
+and [I3](../invariants.md#i3-frame-safe_blocks-are-non-decreasing-along-the-spine)
+are the lane's mirrors of the drain order and of frame monotonicity, and
+[I19](../invariants.md#i19-application-progress-follows-the-shared-execution-contract)
+covers the shared execution boundary. Change one, check all.
diff --git a/docs/recovery/README.md b/docs/recovery/README.md
index 1a45fa52..f12e6a47 100644
--- a/docs/recovery/README.md
+++ b/docs/recovery/README.md
@@ -127,6 +127,14 @@ in [`TimingArgs`](../../sequencer/src/commands/config.rs): with `MAX_WAIT_BLOCKS
 1200 and margin 300, observed danger starts at age 900 blocks. Neither that
 margin nor the fee policy bounds the time required to finish recovery.
 
+A Tip ages from its first frame, so `run` also refuses a
+`max_batch_open_seconds` that, rounded up to blocks at `seconds_per_block`,
+exceeds the danger threshold minus `BATCH_SUBMISSION_MARGIN_BLOCKS`
+([`RunConfig`](../../sequencer/src/commands/config.rs)); otherwise a low-volume
+Tip reaches danger before it can be sealed, submitted and safe-accepted. The
+check assumes L1 blocks are no faster than `seconds_per_block` and does not
+bound inclusion time.
+
 ### When safe-head progress stops
 
 A responsive RPC endpoint can keep returning an old view. The detector uses
@@ -159,7 +167,7 @@ may cover a slot that was never used; it must not leave a sent slot uncovered
 ([I14](../invariants.md#i14-watermark--wallet-nonce-of-every-tx-ever-broadcast)).
 
 The flusher submits zero-value self-transfers at unresolved slots from the
-account's Latest nonce through `max(Pending, W + 1) - 1`. It completes only when:
+account's Latest wallet nonce through `max(Pending, W + 1) - 1`. It completes only when:
 
 ```text
 Pending <= Safe  &&  Safe >= W + 1
@@ -216,7 +224,9 @@ the same suspected prediction alive without solving that cycle.
 `EnsureOpenTip` is a separate action. Its transaction requires `Safe`, no Tip,
 no divergence, and a rollback-safe checkpoint. It opens the Tip without
 invalidating history. Guarded writes matter even without concurrent writers:
-wall-clock aging alone can change the decision after inspection.
+wall-clock aging alone can change the decision after inspection, which retries.
+An open Tip found by the guard refuses instead: aging cannot create one, so
+only another writer or an inspection bug can.
 
 ### Atomic history change and replay
 
@@ -348,8 +358,8 @@ just -f docs/recovery/justfile check-all
 | Concern | Owner and useful tests |
 |---|---|
 | Startup dispatch, error classification, final admission | [`recovery/mod.rs`](../../sequencer/src/recovery/mod.rs); procedure tests substitute only L1 sync/flush, keeping real SQLite inspections and repairs. |
-| Detection, mutation guards, pivot and atomic cascade | [`storage/recovery.rs`](../../sequencer/src/storage/recovery.rs), [`recovery_tests.rs`](../../sequencer/src/storage/recovery_tests.rs); exact Tip guard, safe-view floor, unconditional post-flush policy, generation rollback, root nonce, and direct replay. |
-| Observed danger versus estimates, accepted frontier and content identity | [`storage/l1_submission.rs` tests](../../sequencer/src/storage/l1_submission.rs), [`safe_accepted_batches.rs`](../../sequencer/src/storage/safe_accepted_batches.rs); stale-view precedence, clock faults, reused nonces, divergence freeze. |
+| Detection, mutation guards, pivot and atomic cascade | [`storage/recovery.rs`](../../sequencer/src/storage/recovery.rs), [`recovery/tests.rs`](../../sequencer/src/storage/recovery/tests.rs); exact Tip guard, safe-view floor, unconditional post-flush policy, generation rollback, root nonce, and direct replay. |
+| Observed danger versus estimates, accepted frontier and content identity | [`recovery/tests.rs`](../../sequencer/src/storage/recovery/tests.rs) (`check_danger`): stale-view precedence, clock faults; [`safe_accepted_batches.rs`](../../sequencer/src/storage/safe_accepted_batches.rs) tests: accepted frontier, content identity, divergence freeze; [`l1_submission.rs`](../../sequencer/src/storage/l1_submission.rs) tests: reused nonces. |
 | Slot settlement and broadcast coverage | [`recovery/flusher.rs`](../../sequencer/src/recovery/flusher.rs), [`l1/watermark.rs`](../../sequencer/src/l1/watermark.rs), [`submitter/poster.rs`](../../sequencer/src/l1/submitter/poster.rs). |
 | Task-free preparation, launch, restore and catch-up | [`commands/run/`](../../sequencer/src/commands/run/), [`inclusion_lane/mod.rs`](../../sequencer/src/ingress/inclusion_lane/mod.rs). |
 
diff --git a/docs/recovery/cockroach.md b/docs/recovery/cockroach.md
index c714065e..2a33cb4d 100644
--- a/docs/recovery/cockroach.md
+++ b/docs/recovery/cockroach.md
@@ -243,8 +243,9 @@ make normal reconciliation execute already-accounted direct inputs again.
 
 ### Flush and stopping block
 
-The lost database cannot supply its previous wallet-nonce watermark. Flushing
-therefore depends on the provider's pool view. A transaction dropped there but
+Recovery reads the wallet-nonce watermark from the fresh data directory, so the
+previous database's watermark is not used, even when that database survives.
+Flushing therefore depends on the provider's pool view. A transaction dropped there but
 alive elsewhere may escape; a later accepted foreign or mismatched landing
 freezes the rebuilt instance and requires another rebuild. The provider is
 trusted fail-stop, as specified in the [threat model](../threat-model/README.md).
diff --git a/docs/recovery/justfile b/docs/recovery/justfile
index 723602ba..e3d078c6 100644
--- a/docs/recovery/justfile
+++ b/docs/recovery/justfile
@@ -8,9 +8,10 @@ check-admission:
 check-preemptive:
     {{tlc}} -workers auto -deadlock preemptive.tla
 
-# Check the optimistic recovery spec (~3min)
+# Check the historical optimistic design (~3min). A dev analysis tool for
+# revisiting that design, not a check of the current procedure.
 check-optimistic:
     {{tlc}} -workers auto -deadlock history/optimistic.tla
 
-# Check all specs
-check-all: check-admission check-preemptive check-optimistic
+# Check the specs of the current recovery procedure
+check-all: check-admission check-preemptive
diff --git a/docs/review/2026-09-16-track3-validation.md b/docs/review/2026-09-16-track3-validation.md
index b5491328..b1498882 100644
--- a/docs/review/2026-09-16-track3-validation.md
+++ b/docs/review/2026-09-16-track3-validation.md
@@ -12,10 +12,12 @@ measurements must not be attributed to its rebased trees. The latency baseline
 already contains the initial versioned-history foundation; it isolates the
 subsequent application-history refactor, not the cost of the complete stack.
 
-Retained for the [Track 3 integration gates](../plans/2026-07-track3-feed-replay-design.md):
-this is the wallet baseline against which native-engine and deployment results
-can be assessed. Replace or delete it when those decisions no longer use these
-measurements. It describes the named revisions, not ongoing validation of HEAD.
+Retained for the [Track 3 integration gates](../plans/2026-07-track3-feed-replay-design.md)
+and the ADR's [performance posture](../plans/2026-08-authority-boundary-adr.md#performance-posture),
+which cites its ACK latency as regression evidence: this is the wallet baseline
+against which native-engine and deployment results can be assessed. Replace or
+delete it when those decisions no longer use these measurements. It describes
+the named revisions, not ongoing validation of HEAD.
 
 ## Environment and canonical agreement
 
diff --git a/docs/review/2026-09-18-stack-review-validation.md b/docs/review/2026-09-18-stack-review-validation.md
deleted file mode 100644
index b4845fd3..00000000
--- a/docs/review/2026-09-18-stack-review-validation.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Stack review closeout validation
-
-Evidence for reviewing and landing the closing change on
-`codex/stack-review-fixes`, above reviewed tip
-`62ec150f18a27697220158f1ca4d84ec4a6fee06`. The implementation and regression tests
-are at `18e99e4fe2d03426954f72df5641196d12103e99`; the closing documentation commit
-adds contract corrections, this record, and a storage rustdoc correction only.
-Retire this record after stack landing when no ongoing review decision uses it.
-
-## Environment and results
-
-Run on macOS arm64 through the project's parent Nix/direnv shell. Cargo and
-rustc were both 1.95.0, Anvil was 1.5.1, and the locally rebuilt canonical guest
-used the repository-pinned Cartesi Machine 0.20.0. Local Anvil differs from CI's
-1.4.3 pin; these are local results, not a new CI run.
-
-| Check | Result |
-|---|---|
-| `cargo check --locked --workspace --all-targets` | Passed |
-| `cargo fmt --all -- --check` and `git diff --check` | Passed |
-| `cargo clippy --locked --workspace --all-targets --all-features -- -D warnings` | Passed |
-| `cargo test --locked --workspace --exclude canonical-test -- --test-threads=1` | 754 passed; one existing ignored doc test |
-| `lua watchdog/tests/run.lua` | 62 passed |
-| `just canonical build-machine-image`, then `cargo run --locked -p canonical-test` | Fresh image; 10 guest scheduler tests passed |
-| `bash scripts/ci-c-application-smoke.sh` | External archive, generic host, and independent downstream consumer built and ran their CLI smoke checks |
-
-The process binaries were rebuilt after the final SDK change. Each of these
-scenario filters passed for both the Rust wallet host and the C wallet host:
-
-- `cold_replica_snapshot_backlog_live_recovery_test`
-- `restart_and_replay_test`
-- `recovery_after_stale_batches_test`
-- `setup_recovery_round_trip_test`
-
-These eight process runs include canonical watchdog comparison after recovery
-and rebuild. Their prerequisites were the checksum-verified rollups-contracts
-Anvil fixture, locally built test contracts, and watchdog Lua dependencies.
-The first attempted process run lacked the fixture and stopped before startup;
-setup supplied it before the successful runs.
-
-## Discriminating regressions and independent review
-
-- A matching local batch followed by a foreign accepted batch in the same block
-  returned HTTP 200 before the finalized-selection guard. The canonical scheduler
-  advances beyond that local snapshot. With the guard, all three finalized routes
-  return 503, including a conditional state request, without acquiring a lease.
-- With checkpoint clock 900, checkpoint block 901, and stop 899, the unguarded
-  deterministic rebuild phase reached artifact creation. The new check refuses
-  with exit 20 before replay or publication. A later resync reaching the checkpoint
-  does not substitute for the fixed stop; equality and genesis still succeed.
-- Without the SDK header timeout, the stalled-header regression exceeded its
-  outer two-second limit. With the configured header deadline restored, all
-  13 SDK tests passed, including a body that outlives that deadline.
-
-Separate reviewers checked finalized selection and streamed I/O classification,
-and the manual-recovery guard and exit classification. No blocking findings
-remained. Persistent SQLite errors still reach terminal classification through
-the new error wrapper; operational filesystem errors remain nonterminal.
-
-## Limits and landing work
-
-A repeated parallel host run reproduced the already registered
-`dropped_runtime_scope_keeps_lock_until_detached_worker_stops` failure: final
-reacquisition returned `Locked`. Its isolated rerun passed, and the complete
-serial suite passed. This does not resolve the concurrency investigation; it
-remains in the [review register](register.md#bounded-investigations-and-cleanup).
-
-The full 49-scenario rollups suite and Sepolia-image scenarios were not rerun.
-Private-engine conformance/export and representative deployment capacity remain
-in their existing integration plans. The two current recovery TLA+ models were
-read but not changed or rerun; neither models these new boundary checks.
-
-No lower stack branch was rewritten. Reconcile the known C-host test ancestry
-once at landing, retaining the evolved coverage at the reviewed tip and the
-new independent post-recovery assertions. No push, PR creation, or merge was
-performed during this implementation.
diff --git a/docs/review/2026-09-19-review-followup-validation.md b/docs/review/2026-09-19-review-followup-validation.md
deleted file mode 100644
index 8b1a0063..00000000
--- a/docs/review/2026-09-19-review-followup-validation.md
+++ /dev/null
@@ -1,82 +0,0 @@
-# Review follow-up validation
-
-Evidence for the ongoing stack review and landing, covering changes above
-`f504c2e88e2b432718493e29e3c56f74fce3ad00` on `codex/stack-review-fixes`.
-Local validation below includes the filesystem-identity fix at
-`8b6da04374c7a4aef61fba8e7963e71d3cd55122`, CI diagnostics at
-`93e6a49ad19c35fe78f4c46d639eb8fd556c58ba`, and the accompanying documentation
-clarifications. Those clarifications change no executable behavior.
-Retire this record after landing when no ongoing review decision uses it.
-
-## Changes and discriminating checks
-
-- Startup compares filesystem device/inode identities after inspecting every
-  retained reference. Regressions preserve relative/absolute, leading-dot,
-  symlink, and macOS firmlink aliases, including mixed literal/aliased references,
-  while removing genuine orphans. The firmlink test fails against the old
-  canonical-path comparison because it deletes the registered artifact, and
-  passes with identity matching. A missing reference stops the sweep before any
-  deletion. Dangling orphan links are removed without following their targets.
-  All eleven startup hygiene tests pass. The firmlink regression runs on macOS;
-  no Linux bind-mount scenario was run locally.
-- A scheduler/fold regression establishes that `A < B` can coexist with a
-  pending direct at `A` after a same-block frame and a later empty batch. It
-  verifies recovery from an eligible earlier checkpoint preserves every direct,
-  application progress, and the scheduler nonce. The
-  [checkpoint contract](../recovery/cockroach.md#checkpoint-eligibility) requires
-  canonical exporters to inspect the pending queue and refuse such candidates.
-- The accepted-prefix fixture now places the old future-nonce input both below
-  and exactly at `C`, before the nonce-0 batch in L1 order. Temporarily changing
-  the production query from `> C` to `>= C` fails specifically at the equality
-  case. Restoring `>` passes all four acceptance-projection tests.
-- API documentation states the existing address-casing/normalization contract,
-  WS admission statuses, health-probe semantics, and internal deployment
-  boundary. Writer ownership and stale source references were corrected. The
-  submitter's own-sender decode error remains visible under self-trust.
-- CI retains harness logs from failed rollups E2E jobs for seven days. This adds
-  evidence for the unclassified C-host recovery WebSocket reset in the
-  [register](register.md), without changing test or recovery behavior.
-
-Separate reviewers examined snapshot cleanup and checkpoint eligibility. Review
-caught the dangling-orphan-link case before final validation; its regression is
-included. No findings remain within the implemented scope.
-
-## Validation
-
-macOS arm64, parent Nix/direnv environment, Rust and Cargo 1.95.0:
-
-| Check | Result |
-|---|---|
-| `cargo test --locked --workspace --exclude canonical-test -- --test-threads=1` | 760 passed; zero failed; one existing ignored harness doc test |
-| `cargo check --locked --workspace --all-targets` | Passed |
-| `cargo clippy --locked --workspace --all-targets --all-features -- -D warnings` | Passed |
-| `cargo fmt --all -- --check` and `git diff --check` | Passed |
-| Relative Markdown links and code fences across repository Markdown files | 409 targets/anchors checked |
-| CI workflow YAML parsing | Passed; artifact upload itself requires a failed GitHub job |
-
-The full host suite includes the new regressions. Guest execution, standalone
-rollups E2Es, watchdog Lua tests, and TLA+ model runs were not repeated for this
-follow-up. Both current recovery models were read; their modeled transitions
-are unchanged. Earlier validation remains in the
-[initial closeout record](2026-09-18-stack-review-validation.md).
-
-## Remaining integration and landing work
-
-The bundle carries no canonical queue evidence, and no canonical-to-native
-exporter is implemented here. The eligibility change is a supported-checkpoint
-precondition and executable scheduler regression, not loader enforcement or a
-completed CM export drill. The application's exporter must enforce refusal and
-demonstrate fallback and eligible pending-queue recovery; the
-[integration plan](../plans/2026-07-coordination-tracks.md#track-6--dump--application-api-redesign)
-tracks that work. Canonical acceptance semantics and artifact formats are unchanged.
-
-Archive concurrency limits remain deferred pending deployment workload needs.
-The existing process-lock concurrency investigation remains open; this host run
-used the serial suite. The C-host WebSocket reset is a separate unresolved
-investigation; one successful run cannot classify its cause.
-
-The lower-stack ancestry is reconciled: PR #38 is at
-`7f3229f2e42585e055f2fabb8e280c4d42dd5a81`, and GitHub reports PR #42 mergeable
-at `35697691d7a5ba5a2c868f51b3a45c3dd5b6ee44` (checked 2026-09-19).
-Consult CI for the pushed revision before landing; local host checks do not
-replace guest, watchdog, or standalone rollups E2E execution.
diff --git a/docs/review/2026-10-13-whole-repo-findings.md b/docs/review/2026-10-13-whole-repo-findings.md
new file mode 100644
index 00000000..2581c3bb
--- /dev/null
+++ b/docs/review/2026-10-13-whole-repo-findings.md
@@ -0,0 +1,1795 @@
+# Whole-repo review, 2026-10-13: findings appendix
+
+Generated from the read-only review fleet at `1a9615d`. The plan and triage live in [the review record](2026-10-13-whole-repo-review.md). Delete this file with the record.
+
+Status: **confirmed** or **partially** (the claim shown is the skeptic's correction) survived an adversarial skeptic; **disputed** means an independent trace refuted a skeptic-confirmed claim; **unverified** and **skeptic-added** are single-source. Line deltas are estimates (negative = removal). BC = behavior change.
+
+
+## A. Application trait, core domain and wire types, C ABI (consumer surface: app integrators)
+
+Verdict: This area is the integrator surface. It has three parts: the Application trait with its shared execution boundary (about 350 production lines), the wire and domain types (UserOp, SignedUserOp, WireUserOp, Batch, Frame and the history identity types, about 410 lines), and the C ABI bridge (header, adapter and build.rs, about 835 lines, of which about 280 are comment lines in the header). The Rust core is proportionate. The trait is small, the outcome and error types are minimal and covered by tests, and the progress check costs two progress() reads per input while guarding I19 (silent application-history divergence). The problems are at the seam, not in the logic. The header is about 70% prose and repeats an application contract that is already stated in three other places. Two host concerns leak into every engine: rejection reasons only the boundary can produce, and an obligation to fsync a directory the host owns. The stateful drain protocol and the path callback (Track 6) are what a C++ integrator will trip on; they should be decided in one 'seam v1' change with Bart, together with N8, before libdex freezes its header. history.rs's era/generation identity (about 180 lines, plus history_api.rs and broadcast.rs) serves the subscribe-across-recovery egress model that the new direction replaces, so it should be frozen. I found no scheduler/sequencer divergence bug: both sides use validate_and_execute_user_op, build_input_domain and Signature::from_raw over the same canonical 65 signature bytes. Keep the engine-owned progress, the integer-constant enums that refuse unknown values, and fees crossing the ABI as log-space exponents.
+
+
+### A1. Rejection reasons only the boundary can produce leak into the app's and the C ABI's vocabularies
+
+`medium · confirmed · -40 lines · S · c-abi`  
+Where: `sequencer-core/src/application/mod.rs:111-131`, `sequencer-core/src/application/mod.rs:169-174`, `sequencer-core/src/application/mod.rs:278-294`, `bindings/c-app-engine/include/application-engine.h:141-148`, `bindings/c-app-engine/include/application-engine.h:172-191`
+
+- Claim: As stated. Two additions strengthen it. First, AGENTS.md:216 tells integrators that every app must implement NonceExhausted and InvalidMaxFee, which contradicts mod.rs:165-167 and header:300-302. Second, the scheduler's test double RecordingApp (sequencer-core/src/scheduler/mod.rs:503-510) re-implements the max-fee guard and returns InvalidMaxFee, which the boundary at mod.rs:279 makes dead. With AppRejection that becomes a type error. The net line delta is nearer -25 than -40, because the AppRejection enum and its conversion add about 15 lines.
+- Fix: Have validate_user_op return Reject(AppRejection), where AppRejection has only InvalidNonce and InsufficientFeeBalance. The boundary wraps it into InvalidReason (an App(..) variant plus InvalidMaxFee and NonceExhausted, or a flat enum with From<AppRejection>), and the Display text stays the same. In the header, delete the two codes and ApplicationEngineInvalidMaxFee, marking values 1 and 3 as reserved, and pass the engine only (nonce, data) for validation. With that, the type makes the misuse impossible.
+- Decision: C ABI change: agree it with the libdex owner and land it in the same seam-v1 change as the Track 6 items and N8.
+
+### A2. Every engine must fsync a directory the host owns
+
+`medium · confirmed · -6 lines · S · BC · application-trait`  
+Where: `sequencer-core/src/application/mod.rs:234-241`, `bindings/c-app-engine/include/application-engine.h:362-364`, `docs/protocol/application-contract.md:207-211`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:136-148`
+
+- Claim: As stated. Every production checkpoint write goes through create_dump_dir_with_info: setup/mod.rs:799,844,901, setup/fill.rs:62 and inclusion_lane/snapshot.rs:51. The host fsyncs dump_dir only in write_info (dump_info.rs:170), which runs before app.create_dump creates the `state` entry (dump_info.rs:143). It then fsyncs the dumps directory (dump_info.rs:144-147). The `state` dentry therefore depends on the engine today. The wallet does it at wallet.rs:383-385, under a wrong comment: 'dumps_dir/ contains prefix's dentry' at wallet.rs:382, where the parent is actually the per-checkpoint dump_dir. Once the host fsyncs dump_dir, the wallet can drop those three lines.
+- Fix: Add File::open(dump_dir)?.sync_all()? right after app.create_dump in create_dump_dir_with_info. Shrink the engine contract to 'fsync everything you wrote at and beneath prefix', and move the WAL-ordering rationale into dump_info.rs. Update the trait doc, the header and application-contract.md to match.
+
+### A3. The Application contract is stated in four places, and the header is about 70% prose
+
+`medium · partially · -180 lines · M · docs-only`  
+Where: `bindings/c-app-engine/include/application-engine.h:9-68`, `bindings/c-app-engine/include/application-engine.h:107-123`, `bindings/c-app-engine/include/application-engine.h:186-187`, `bindings/c-app-engine/include/application-engine.h:356-395`, `sequencer-core/src/application/mod.rs:124-126`
+
+- Claim: The cross-cutting duplication is real. The nonce rule appears at AGENTS.md:216-217, header:53-57, contract:96-120 and mod.rs:176-180. The fee conversion appears at header:59-63 and c-application-binding.md:39-46. Dump obligations are restated in mod.rs:225-251, header:356-378, contract:207-234 and README:25-34. The design-rationale lines can go: header:107-109, 115-116, 121-123 and 186-187. But the header cannot shrink to a 10-line preamble. It is the self-contained ABI for bindgen and C++ consumers ('the header carries the compatibility obligation on its own', header:31-34), and c-application-binding.md:37 defers buffer lifetimes to it. The per-entry ownership, lifetime, reentrancy and status rules must stay in the header (header:255-266, 318-320, 339-344, 391-393). README:119-124 is a runnable recipe, not a test inventory, so keep it. batch.rs:7-39 duplicates the batch_policy comment in 0001_schema.sql:557-606, and it describes the CHECK as a linear 'batch_size_target < const_max_batch_bytes' when the actual constraint is log-space (0001_schema.sql:587). A realistic delta is about -100 to -130.
+- Fix: Make application-contract.md the only owner. The header keeps a preamble of about 10 lines that links the contract sections, plus a terse @pre/@post/@returns per entry point. The trait docs shrink to one or two lines per method with a section link. The README drops the restatement at 13-34 and the test inventory at 105-129 (link the tests instead). batch.rs keeps two lines and a link to fee.rs.
+
+### A4. Freeze the era/generation history-identity types; they serve the egress model being replaced
+
+`low · partially · +0 lines · L · http-api`  
+Where: `sequencer-core/src/history.rs:45-223`, `sequencer-core/src/history_api.rs`, `sequencer-core/src/broadcast.rs:28-88`, `docs/protocol/application-contract.md:152-155`
+
+- Claim: Freezing is fine: no uuid-crate swap and no reworked wire codes for EraId (history.rs:45-139) or HistoryPolicyError (history.rs:212-223). But RecoveryGeneration and the generation cuts are I18 machinery for standard recoveries, not cockroach ones. That covers the exact +1 generation trigger, history_generation_cuts and cascade_and_reopen (docs/invariants.md I18). The new direction removes subscribing across a rebuild, which is an era change. Any future sync must still detect a standard-recovery suffix replacement while a client is subscribed (I18 'Breaks: a client silently resumes a replaced suffix'), and the Do-not-simplify list forbids keeping a numeric resume offset without its history identity. Catch-up also pages through the shared claim-based reader (catch_up.rs:53-72). So the ~-350-line deletion does not follow from the direction. At most EraId's wire role shrinks, and generation will probably survive in some form.
+- Fix: Freeze these types and do not polish them: no uuid-crate swap, no reworked error codes. Keep ExecutedInputCount (history.rs:10-43), which is application progress, and move it next to ApplicationProgress when history.rs is retired. Retiring the module requires re-homing the catch-up's identity check.
+- Decision: Confirm that the new sequencer<->client sync retires era/generation claims; the deletion (about -350 lines) waits for that design.
+
+### A5. Overridable progress shortcuts on the trait can disagree with progress()
+
+`nit · partially · -15 lines · S · application-trait`  
+Where: `sequencer-core/src/application/mod.rs:198-213`, `examples/app-core/src/application/wallet.rs:159-161`
+
+- Claim: Overridable default methods do exist (mod.rs:203-213) and the wallet shadows one inherently (wallet.rs:159-161). But no implementation overrides them. Rust application code is self-trusted (application-contract.md:6-9, I19 'Scope'), so an override that disagrees with progress() is an app bug inside the trust boundary, not an unverified path. An extension trait would not leave call sites unchanged either: every calling module would need to `use` the new trait. The cheap, worthwhile part is deleting the wallet's inherent shadow and the duplicated doc text.
+- Fix: Move the two methods to an extension trait with a blanket impl (impl<A: Application> AppProgressExt for A), so they cannot be overridden and call sites stay unchanged. Drop the duplicated doc text and the wallet's inherent shadow.
+
+### A6. The adapter turns lifecycle statuses from execute, validate or drain into retryable I/O errors
+
+`low · confirmed · +4 lines · S · BC`  
+Where: `bindings/c-app-engine/src/lib.rs:70-85`, `bindings/c-app-engine/include/application-engine.h:47-49`, `docs/protocol/application-contract.md:86-90`
+
+- Claim: As stated. Note that the reference engine blurs the same line on its own side: its shared report() (c-wallet-engine lib.rs:52-70) maps Io kinds to NOT_FOUND or INVALID_DUMP for validate, execute and drain alike. The lane classifies any AppError::Io from ExecuteUserOp or ExecuteDirectInput as non-terminal (sequencer/src/ingress/inclusion_lane/error.rs:57-59,71-73), so a contract-violating status causes a restart loop instead of a terminal stop.
+- Fix: Pass a lifecycle flag to check(), set only by from_dump and create_dump. Everywhere else, map NOT_FOUND and INVALID_DUMP to AppError::Internal with the status in the reason.
+
+### A7. The frame fee has four names across the integrator surface
+
+`nit · unverified-nit · +0 lines · S · c-abi`  
+Where: `sequencer-core/src/application/mod.rs:118-121`, `sequencer-core/src/application/mod.rs:173`, `sequencer-core/src/batch.rs:58`, `sequencer-core/src/l2_tx.rs:18`, `bindings/c-app-engine/include/application-engine.h:156`
+
+- Claim: The same quantity is called current_fee (trait and validate ABI), fee_price (Frame), fee (ValidUserOp, and the header's ValidUserOp), and base_fee (InvalidReason and ApplicationEngineInvalidMaxFee). 'nonce' likewise has three meanings: user op, batch and L1 wallet (see N14).
+- Fix: Use one term (for example frame_fee) in Rust and C. The SSZ field name does not affect the wire format. The header field rename is source-breaking for engines, so do it in the seam-v1 change and in the same naming pass as N14.
+- Decision: Choose the term; whether the /tx rejection Display text may change.
+
+### A8. The scheduler builds the same UserOp twice per op
+
+`nit · unverified-nit · -2 lines · S`  
+Where: `sequencer-core/src/scheduler/mod.rs:333-334`, `sequencer-core/src/scheduler/mod.rs:350-356`, `sequencer-core/src/batch.rs:73-79`, `sequencer-core/src/application/mod.rs:296-300`
+
+- Claim: recover_sender calls to_user_op() (which clones data), the caller calls to_user_op() again, and the boundary then copies data into ValidUserOp: three payload copies per op in the canonical machine. The cost is negligible next to ecrecover; the point is that the wire-to-signed conversion is spelled twice.
+- Fix: Build the UserOp once and pass it to recover_sender. Fold this into the N7 change.
+
+### AS1. AGENTS.md tells every app to implement the two rejections only the boundary may produce
+
+`low · skeptic-added · +0 lines · S · docs-only`  
+Where: `AGENTS.md:216`, `sequencer-core/src/application/mod.rs:165-167`, `bindings/c-app-engine/include/application-engine.h:299-302`, `bindings/c-app-engine/src/lib.rs:193-197`, `sequencer/src/ingress/inclusion_lane/error.rs:71-73`
+
+- Claim: AGENTS.md:216 lists InvalidNonce, NonceExhausted, InvalidMaxFee and InsufficientFeeBalance as 'protocol-level rejection semantics every app must implement'. The trait doc and the header say the opposite: the boundary owns the max-fee and exhausted-nonce guards, and an engine never returns them. A C engine that follows AGENTS.md and reports NONCE_EXHAUSTED for an account at u32::MAX gets AppError::Internal from the adapter. The lane classifies that as terminal (error.rs:71-73; validate errors surface as ExecuteUserOp at inclusion_lane/mod.rs:401).
+- Fix: Reword AGENTS.md:216: apps reject only InvalidNonce and InsufficientFeeBalance, and the shared boundary adds InvalidMaxFee and NonceExhausted. This is a one-line doc fix, independent of A1's ABI change, and can land now.
+
+Keep (load-bearing):
+
+- Shared execution boundary with a progress assert (sequencer-core/src/application/mod.rs:324-349): two progress() reads per input catch the silent application-history divergence I19 describes, and the overflow preflight runs before any mutation. This is proportionate.
+- Engine-owned progress instead of a host mirror or AppWithProgress wrapper (an alternative the jury refuted): cockroach recovery must recover the count and clock from the canonical checkpoint (docs/protocol/application-contract.md:244-249), so they belong in the app's state.
+- ApplicationProgress::try_new (mod.rs:62-73): the single coherence check for imported progress (dumps and C engines); it fails loud in the adapter (bindings/c-app-engine/src/lib.rs:250-254).
+- ExecutedInputCount newtype with checked arithmetic (sequencer-core/src/history.rs:10-43): stops the app-history offset being confused with SQLite cursors or advanced with wrapping math.
+- Separate ValidationOutcome and ExecutionOutcome enums: named outcomes read better than a nested Result<Result<..>> and keep rejection distinct from fatal AppError.
+- AppError with exactly Internal and Io: the terminal-versus-retryable split that startup classification relies on (application-contract.md:86-90, 230-234).
+- Fees crossing the ABI as log-space exponents, with the linear conversion inside the engine: the same engine code runs natively and canonically, so there is one conversion implementation per engine. Passing a linear amount from the host would add a second implementation that must stay bit-exact.
+- Max-fee guard before app validation and the u32::MAX guard after it (mod.rs:278-294): this order gives correct diagnostics, tests pin it, and the sequencer and scheduler share it.
+- C enums generated as integer constants that refuse unknown values (bindings/c-app-engine/build.rs:29-31; src/lib.rs:128-132,194-197): drift between engine and host becomes a loud error instead of undefined behavior.
+- EngineApp is Send but not Sync or Clone (bindings/c-app-engine/src/lib.rs:87-94): matches the lane's single owner of the engine; an independent fork goes through checkpoint and restore.
+- create_dump/from_dump isolation and durability contract (minus the parent fsync, see A2): checkpoint GC (I13) and snapshot leases depend on it.
+- SSZ decode-robustness tests on adversarial bytes (sequencer-core/src/batch.rs:163-217): the scheduler decodes L1 input, so this pins totality.
+- The scheduler silently dropping ops whose signature cannot be recovered (sequencer-core/src/scheduler/mod.rs:330-333): the fold must stay deterministic and free of side effects.
+
+## B. Scheduler and protocol spec (consumer surface: scheduler reimplementers)
+
+Verdict: Area B is the canonical scheduler: `Scheduler<A>` (~420 production lines), the recovery fold `fold_replay` (~150), the off-chain mirror in protocol.rs (~455), the guest harness (~140) and a 302-line spec. The fold itself is small, correct and proportionate. I found no Byzantine path that breaks it. Gate d runs before staleness, so N9 is fixed; the fridge drains in order, the nonce check runs before any state changes, and stale or rejected batches never consume a nonce. The size problems are next to the core, not in it. Only about 60 of protocol.rs's ~455 production lines mirror the scheduler; the rest is sequencer-local danger and wall-clock policy, plus re-validation asserts needed only because the struct fields are public. About half of scheduler-semantics.md is sequencer architecture repeated from I1/I2/I3/I19. Meanwhile the spec leaves out what a C++ port needs most: the SSZ schema, how the EIP-712 domain is built, and the signature acceptance rules. Today those rules are whatever alloy 1.6.1 does (v byte in {0,1,27,28,35..=255}, high-s normalized and accepted). That is the biggest risk before the port. The most valuable code change is to have `scheduler_accepts` mirror gate d. That removes the one documented exception to I1, along with the false positive in I9, and turns a self-bug that today causes silent divergence into a visible stall. `fold_replay` is already shaped like the future standalone recovery tool (pure, takes iterators, trusts the checkpoint nonce). Keep it and its fail-loud asserts, and add the missing `inclusion_block <= C` assert.
+
+
+### B1. Spec omits wire, domain and signature rules a port needs; the signature rules come from alloy, not from the spec
+
+`medium · partially · +70 lines · S · docs-only`  
+Where: `docs/protocol/scheduler-semantics.md:63-111`, `sequencer-core/src/scheduler/mod.rs:350-358`, `sequencer-core/src/batch.rs:46-68`, `sequencer-core/src/lib.rs:21-43`, `examples/canonical-app/src/scheduler/mod.rs:33-35`
+
+- Claim: The spec does leave out the SSZ layout, the EIP-712 domain (lib.rs:23-43), the UserOp type, the MAX_WAIT value (1200, lib.rs:21) and the signature rules. The acceptance set really is alloy 1.6.1's: from_raw requires exactly 65 bytes, normalize_v accepts 0|1|27|28|35.., and both recovery backends call normalized_s() (sig.rs:380, sig.rs:407). The honest-path risk is narrower than claimed, though. Storage re-encodes every signature with Signature::as_bytes (sequencer/src/storage/ingress.rs:723), and as_bytes writes v_byte(), which is 27 or 28. So sequencer-built batches always carry v in {27,28}, and the wider v set only matters for batch bytes this sequencer did not produce. as_bytes copies s as-is (sig.rs:174-179), so user-supplied high-s does reach batches. High-s is the live divergence hazard for a port that enforces low-s. This is a documentation gap that guards a future implementation, not a present bug.
+- Fix: Add a normative 'Wire and signature rules' section (~40 lines): the SSZ containers and field order, the domain, the UserOp EIP-712 type, the accepted v set, the high-s rule, how a wrong-length signature is handled, and the constants. Add a pinned test-vector table to the scheduler tests (v = 0, 1, 27, 28, 35, 255; high-s; a 64-byte signature) so both an alloy bump and the C++ port are checked against it. Separately, decide whether to narrow the accepted set (for example v in {27,28}, low-s only) while the port forces a new machine anyway.
+- Decision: Should the canonical signature acceptance set be narrowed (a consensus change needing a new machine image) or documented exactly as it is?
+- Independent trace: confirmed. The code facts check out: from_raw accepts any s, recovery calls normalized_s() first, and storage re-serializes s exactly as received.
+
+### B2. scheduler_accepts should mirror gate d; dropping the 'documented omission' simplifies I1 and I9
+
+`medium · disputed · -40 lines · S · BC`  
+Where: `sequencer-core/src/protocol.rs:353-388`, `sequencer-core/src/scheduler/mod.rs:295-317`, `sequencer-core/src/scheduler/mod.rs:1513-1539`, `docs/protocol/scheduler-semantics.md:205-213`, `docs/invariants.md:100-105`
+
+- Claim: The off-chain predicate skips the structural checks on a self-trust argument, but in the self-bug case it is the predicate that fails silently. Suppose an own batch has a frame with safe_block > inclusion_block or decreasing safe_blocks. The canonical scheduler rejects it without consuming the nonce. `scheduler_accepts` accepts it, and the content-identity check returns Match because these are our own bytes. The frontier advances while every later own batch gets WrongNonce on chain: silent, growing divergence. Conversely, a foreign batch that is structurally invalid triggers a false CanonicalDivergence and forces a manual cockroach recovery. `batch_reject_reason_for_block` never uses `&self`.
+- Fix: Make it a free `pub fn batch_reject_reason(inclusion_block, frames) -> Option<BatchRejectReason>` in scheduler/mod.rs and call it from `scheduler_accepts` after decoding. Then delete the exception prose in four places (protocol.rs:353-362, spec 205-213, I1 parenthetical, I9 false-positive sentence), turn the special-case block in the duality test into ordinary agree cases, and simplify the l1_submission test. I1 then holds with no exceptions.
+- Decision: This reverses a deliberate self-trust omission (needs maintainer sign-off). The added cost is only an O(frames) check.
+- Independent trace: refuted. The asymmetry is real and pinned by tests.
+
+### B3. fold_replay claims it enforces 'everything <= C' fail-loud but never checks replay batches against stop_block
+
+`low · partially · +6 lines · S · BC`  
+Where: `sequencer-core/src/scheduler/fold.rs:79-85`, `sequencer-core/src/scheduler/fold.rs:107-133`, `sequencer-core/src/scheduler/fold.rs:140-150`
+
+- Claim: The comment at fold.rs:79-81 claims 'everything <= C' is enforced fail-loud, but nothing compares replay or seed blocks against stop_block. A replay batch above C is folded in silently. A direct above C also escapes the post-drain fridge assert (fold.rs:144-150) whenever a later batch above C has a frame that drains it. The only production caller bounds its inputs (setup/mod.rs:488 and :494 use safe_inputs_in_block_range(.., stop_block)), so nothing reaches this today. It is a comment overclaim plus a missing cheap assert.
+- Fix: Add `assert!(input.inclusion_block <= stop_block, ...)` in the replay loop, and the same for seeds. The post-drain fridge assert then becomes a consequence of these checks; keep it as a cheap backstop.
+- Independent trace: confirmed. The code matches the finding. fold.rs:79-81 says the input contract "everything `<= C`" is "enforced fail-loud".
+
+### B4. protocol.rs is mostly sequencer-local danger policy shipped inside the guest-shared crate
+
+`low · partially · -10 lines · M · public-rust-api`  
+Where: `sequencer-core/src/protocol.rs:4-24`, `sequencer-core/src/protocol.rs:30-97`, `sequencer-core/src/protocol.rs:185-324`, `sequencer-core/src/protocol.rs:326-454`
+
+- Claim: protocol.rs does mix about 60-100 lines that mirror the scheduler (age_exceeds, is_scheduler_stale, scheduler_accepts, SafeInputView, AcceptedBatch) with about 300 lines of sequencer-local timing policy. The struct is a deliberate 'single source of truth' (protocol.rs:7-18) that puts the mirrored max_wait_blocks next to the local fields. Splitting it means changing scheduler_accepts' signature and touching roughly 20 consumer files across sequencer/src and tests/e2e (tests/e2e/src/test_cases.rs:52 reads FRAME_CLOCK_INTERVAL_SAFE_BLOCKS from sequencer_core::protocol). The net delta is about -10 lines and no defect is fixed.
+- Fix: Pure move, no behavior change. Move the danger, wall-clock and L1-view timing plus their errors into the sequencer crate (for example sequencer/src/recovery/timing.rs). Move `scheduler_accepts(max_wait, submitter, input, expected)` next to `Scheduler` (scheduler/predicate.rs) so all scheduler-mirroring code sits in one module. Do it in a separate patch from B2 and B6.
+
+### B5. advance_expected_batch_nonce is described as a gold-frontier scheduler mirror, but it is a submitter heuristic
+
+`low · confirmed · -25 lines · S · docs-only`  
+Where: `docs/protocol/scheduler-semantics.md:197`, `docs/protocol/scheduler-semantics.md:222-230`, `docs/invariants.md:110-114`, `sequencer-core/src/protocol.rs:399-435`, `sequencer/src/l1/submitter/worker.rs:99-108`
+
+- Claim: The spec table row #2 says that `scheduler_accepts` plus `advance_expected_batch_nonce` 'builds the gold frontier'. In fact the frontier uses an inline copy, and the function's only consumer is `decide_submit_start`. That caller folds latest (not safe) events and applies no staleness, so the function does not mirror the scheduler's nonce rule (a stale batch does not consume its nonce on chain).
+- Fix: Move the function into submitter/worker.rs as a private helper and delete the spec rows 197 and 222-230 and the I1 bullet at 110-114. The scheduler spec then describes only the scheduler.
+
+### B6. Public ProtocolTiming fields force re-validation asserts in every accessor, plus five tests for them
+
+`medium · confirmed · -90 lines · S · public-rust-api`  
+Where: `sequencer-core/src/protocol.rs:103-106`, `sequencer-core/src/protocol.rs:137-142`, `sequencer-core/src/protocol.rs:191-198`, `sequencer-core/src/protocol.rs:205-212`, `sequencer-core/src/protocol.rs:222-225`
+
+- Claim: `try_new` validates every field relationship once, but the fields are public 'to keep test fixtures concise'. So five methods re-assert the same invariants at runtime, and five tests (`*_fails_loud_on_*_direct_construction`) cover those asserts. A struct that cannot be built invalid makes all of this unnecessary.
+- Fix: Make the fields private, add a `max_wait_blocks()` getter, and switch the ~8 fixtures to `try_new(..).expect(..)`. Delete the five assert blocks, the five fails-loud tests and the two 'fields stay public' comments.
+
+### B7. Three spellings of one staleness predicate, plus alias re-exports
+
+`low · confirmed · -30 lines · S · public-rust-api`  
+Where: `sequencer-core/src/scheduler/mod.rs:17`, `sequencer-core/src/scheduler/mod.rs:409-419`, `sequencer-core/src/scheduler/mod.rs:73-88`, `sequencer-core/src/protocol.rs:391-397`
+
+- Claim: `has_elapsed_since(start, wait, current)` wraps `age_exceeds(current, start, wait)` with the arguments reversed, and needs a doc comment to warn about the reversal. `age_exceeds` names its second parameter `first_frame_safe_block` even though the backstop passes a direct's inclusion block (mod.rs:387-391). `scheduler::MAX_WAIT_BLOCKS` and `input_domain` are pure aliases of `crate::MAX_WAIT_BLOCKS` and `build_input_domain`. Cross-type `PartialEq` exists only as test sugar.
+- Fix: Keep a single `age_exceeds(now, start, window)` with neutral parameter names and delete `has_elapsed_since` and both aliases. Tests should compare `.outcome`. This merges spellings of the same formula only; it does not unify the two staleness references on the Do-not-simplify list.
+
+### B8. QueuedDirectInput duplicates DirectInput; two near-identical drain loops each clone the payload
+
+`low · confirmed · -25 lines · S`  
+Where: `sequencer-core/src/scheduler/mod.rs:115-120`, `sequencer-core/src/scheduler/mod.rs:360-406`, `sequencer-core/src/scheduler/mod.rs:1308`
+
+- Claim: The fridge stores {sender, payload, inclusion_block} and then rebuilds an identical `DirectInput` on every drain. Each drain loop clones the payload before popping, which momentarily doubles a payload the fridge is already holding (see the register's fridge-memory entry). AppError is fatal everywhere, so the queue state after an error has no meaning, and popping first is safe.
+- Fix: Queue `DirectInput` directly and add one `drain_front_while(pred)` helper that pops, then executes, with no clone. Update the 1308 assertion. This is not the refuted retain-over-expect change.
+
+### B9. Zero-frame batches consume a nonce at any age, and the sequencer never sends one
+
+`low · confirmed · -10 lines · S · BC · wire`  
+Where: `sequencer-core/src/scheduler/mod.rs:250-256`, `sequencer-core/src/protocol.rs:373-377`, `docs/protocol/scheduler-semantics.md:72`, `AGENTS.md:86`
+
+- Claim: Gate c accepts `frames == []` regardless of age and consumes the nonce, so every implementation, the C++ port included, must carry this special case, and the predicate needs `unwrap_or(0)` plus an `!is_empty()` guard. The lane always opens a batch with a frame (I3: batch closure creates the successor's first frame), so the rule serves no honest traffic. Its only effect is a nonce consumer that never expires.
+- Fix: If the C++ port forces a new canonical machine anyway, consider making empty `frames` a structural reject in gate d. Staleness then always has a first frame, and gate c disappears. Otherwise leave it and only document it.
+- Decision: Changing the empty-batch rule is a canonical acceptance change. Is it worth doing now, alongside the port's new machine?
+
+### B10. Spec does not say gate d is within-batch only, or that the reject reason is diagnostic
+
+`low · confirmed · +4 lines · S · docs-only`  
+Where: `docs/protocol/scheduler-semantics.md:78-85`, `sequencer-core/src/scheduler/mod.rs:305-314`, `sequencer-core/src/application/mod.rs:91-99`
+
+- Claim: 'non-decreasing across the batch' could be read as a check against previous batches. In fact no cross-batch check exists: a later batch may use a lower safe_block, and user ops then see a non-monotone `safe_block`, while application progress clamps it with max. A port that adds a cross-batch check, or that depends on the per-frame interleaved order of reasons, would diverge or over-specify.
+- Fix: Two spec sentences: 'monotonicity is checked within a batch only; no cross-batch state' and 'the reject reason is diagnostic; consensus only distinguishes accept/skip/reject'. Apps must not assume user-op safe_block is monotone across batches.
+
+### B11. scheduler-semantics.md: about half is sequencer architecture repeated from the invariants
+
+`medium · partially · -120 lines · M · docs-only`  
+Where: `docs/protocol/scheduler-semantics.md:122-148`, `docs/protocol/scheduler-semantics.md:189-237`, `docs/protocol/scheduler-semantics.md:255-277`, `docs/protocol/scheduler-semantics.md:281-302`
+
+- Claim: Two sections are real redundancy and can go: 'Reference-scheduler count discipline' (281-302), which restates the table at 163-171 and I19 and carries process notes, and the test-name inventory (255-277). All 11 test names in that inventory exist today, so 'will go stale' is a forecast, not an observed problem; test vectors would replace the list. The other two sections are not copies of invariants. The frame-clock section (122-148) is the designated prose owner, linked from invariants.md:146, AGENTS.md:265, application-contract.md:129 and protocol.rs:132. 'The three implementations' (189-237) is I1's authoritative prose (invariants.md:96) and is linked from AGENTS.md:79. Those two must be moved into sequencer-side docs with their links updated, not deleted. Realistic net is about -50 lines for the spec, plus relocation.
+- Fix: Restructure into a normative porter spec of ~130 lines: inputs and metadata mapping, state (nonce, fridge), wire (B1), gates, drain, outputs, constants, test vectors. Add a five-line 'sequencer mirrors' pointer to I1/I2/I3. Delete the test-name inventory; the test vectors from B1 replace it.
+
+### B12. N16: MAX_WAIT_BLOCKS is a crate constant hidden behind SchedulerConfig::new
+
+`low · partially · +10 lines · M · db-schema`  
+Where: `sequencer-core/src/lib.rs:19-21`, `sequencer-core/src/scheduler/mod.rs:17`, `sequencer-core/src/scheduler/mod.rs:29-39`, `examples/canonical-app/src/bin/canonical-app-devnet.rs:11`, `examples/canonical-app/src/bin/canonical-app-sepolia.rs:11`
+
+- Claim: MAX_WAIT_BLOCKS is one constant (lib.rs:21) that the guest (through SchedulerConfig::new), run (config.rs:76) and the recovery fold (setup/mod.rs:591) all read, so they agree by construction within a source tree. The proposal would make it an operator-supplied setup input stored in DeploymentIdentity. That is a db-schema change, and it creates a new way for the sequencer's window to drift from the guest's compiled window, the same drift class as the submitter address (see BS1). No observed need for per-network windows was shown. The only cheap, uncontroversial part: test fixtures hardcode 1200 at detector.rs:198, l1_submission.rs:511 and storage/recovery_tests.rs:2771 (the last one is missing from the evidence list) and should reference the constant.
+- Fix: Treat max_wait_blocks like sequencer_address. Guest: put per-network constants next to DEVNET/SEPOLIA_SEQUENCER_ADDRESS in app-core, and have the bins build `SchedulerConfig { sequencer_address, max_wait_blocks }` explicitly. Sequencer: setup takes it as a required input, records it in DeploymentIdentity, and run and the recovery fold read it from there (`ProtocolTiming::try_new(identity.max_wait_blocks, ..)`). Delete `crate::MAX_WAIT_BLOCKS`, the alias and `SchedulerConfig::new`. Replace the test literals with a test constant. Optionally, later, the guest's 'state' inspect could also report its config so setup can cross-check it; only add that if a mismatch is observed in practice.
+- Decision: Should setup take max_wait_blocks as a required CLI input (no default), and how is the guest value pinned (per-network bin constant vs a rootfs config file)?
+
+### B13. Guest reports and fold asserts leave out the context needed under error
+
+`low · partially · +10 lines · S`  
+Where: `examples/canonical-app/src/scheduler/mod.rs:44-57`, `sequencer-core/src/scheduler/fold.rs:90-93`, `sequencer-core/src/scheduler/fold.rs:117-125`
+
+- Claim: Confirmed facts: a fixed reason-less report string (canonical-app/src/scheduler/mod.rs:51-57), no report for stale skips, no block or sender in the fatal panic at :46, and no values in the fold assert messages at fold.rs:92 and :119. Correction: reports are not part of the outputs tree, so this is consensus-neutral, but any change to the guest binary produces a new canonical machine image (template hash). It cannot ship to an existing deployment on its own and should ride with the next canonical-machine change (the C++ port or the fridge bound). The fold-assert message changes are host-only and can ship anytime.
+- Fix: Use `format!("batch rejected at block {b}: {reason:?}")`, and add a report for `BatchSkippedStale`. Reports are not part of the output Merkle tree, so this is safe. Include inclusion_block and sender in the :46 panic, and prev/current blocks in the fold asserts.
+
+### B14. Comments that narrate history or repeat the same rationale several times
+
+`nit · unverified-nit · -40 lines · S · docs-only`  
+Where: `sequencer-core/src/scheduler/mod.rs:1210-1218`, `sequencer-core/src/scheduler/mod.rs:1544-1548`, `sequencer-core/src/scheduler/mod.rs:1605-1606`, `sequencer-core/src/scheduler/mod.rs:193-195`, `sequencer-core/src/protocol.rs:20-24`
+
+- Claim: Representative examples. History narration: 'Nothing exercised both until now' (1215), 'Previously tested only alongside an ACCEPTED batch' (1547), 'only the head case was tested' (1605), '`pub` (not `pub(super)`) because ... is now a separate crate' (194-195). The I1 section header at 1210 sits above five unrelated tests (1220-1376). 'The address is identity, not timing' appears four times (protocol.rs:20-24, 99-101, 344-347, safe_accepted_batches.rs:110-112). fold.rs explains its fail-loud rationale three times (19-20, 79-85, 140-143). protocol.rs:33-36 explains why a Result is better than a panic.
+- Fix: Delete the history narration, move the I1 header to sit just above the duality helpers (1378), and keep each rationale once at its owning site.
+
+### B15. Spec ties the scheduler's count to the egress snapshot/WS contract; freeze that part
+
+`nit · partially · -8 lines · S · docs-only`  
+Where: `docs/protocol/scheduler-semantics.md:177-185`, `openapi.yaml:375`
+
+- Claim: Only spec lines 183-185 (3 lines) tie the count to HTTP snapshots and WS claims. Lines 177-181 describe catch-up and recovery, which the recovery tool still needs. The API field is HistoryInfo.baseline.next_batch_nonce (sequencer-core/src/history_api.rs:29,36; openapi.yaml:375), which belongs to the egress/history area, not the scheduler.
+- Fix: Don't polish it. When restructuring (B11), replace it with a one-line pointer to application-history.md. Leave the fold API (fold_replay, resume_at, enqueue_direct, drain_covered_at, finish) as it is: it is already the core the standalone tool needs.
+
+### BS1. Nothing checks that the guest's compiled sequencer_address equals the sequencer's batch_submitter_address, and the spec never says where it comes from
+
+`medium · skeptic-added · +5 lines · S · docs-only`  
+Where: `examples/app-core/src/application/wallet.rs:73`, `examples/app-core/src/application/wallet.rs:85`, `examples/canonical-app/src/bin/canonical-app-devnet.rs:4`, `sequencer/src/commands/setup/mod.rs:580`, `sequencer/src/commands/setup/mod.rs:591`
+
+- Claim: Classification is entirely sender == sequencer_address. The guest takes that address from a per-network constant compiled into app-core (wallet.rs:73,85, used by the canonical-app bins). The sequencer, its frontier predicate and the recovery fold use identity.batch_submitter_address instead (setup/mod.rs:580,591). No production code compares the two: git grep for sequencer_address in sequencer/src finds only a doc comment at setup/mod.rs:473. If they differ, the guest files every sequencer batch as a direct input, so no user op executes canonically. Meanwhile the frontier and the fold, which both use the identity address, agree with each other and report acceptance. The result is total silent divergence that only the watchdog's state compare can catch. The spec states the rule (26-29) but never says the address is deployment data compiled into the machine that must equal the submitter key. A porter or operator has nothing to check against.
+- Fix: First (docs-only, S): add one spec sentence saying sequencer_address is deployment data compiled into the canonical machine and must equal the sequencer's batch_submitter_address, and put the same item in the deployment/setup checklist. Optional, only if the cost is acceptable: have the guest's 'state' (or a new 'config') inspect report its SchedulerConfig so that setup can refuse on a mismatch. That is a one-time check at setup and adds no runtime machinery. The guest change would ride with the next canonical-machine rebuild.
+- Decision: Is a docs and checklist rule enough, or should setup cross-check against an inspect-reported guest config (a guest change that would ride with the next machine rebuild)?
+
+Keep (load-bearing):
+
+- fold_replay's always-on assert! contract checks (sequencer-core/src/scheduler/fold.rs:88-150): run once per recovery, so negligible cost; they turn a dropped direct, which would silently produce a wrong S', into a crash. Extend them (B3), don't remove them.
+- fold_replay's pure, iterator-based API, the trusted checkpoint nonce, and the Scheduler fold hooks resume_at/enqueue_direct/drain_covered_at/finish/queued_direct_len (scheduler/mod.rs:122-191): this is the core the planned standalone recovery tool needs, and it drives the canonical source instead of a fourth copy.
+- Gate order, with stale and rejected batches never consuming the nonce (scheduler/mod.rs:241-274): cascading invalidation and same-nonce rebuilds depend on it.
+- Preflighting nonce exhaustion before any frame mutates state (scheduler/mod.rs:276-278, 289-293): no partially mutated state can exist before the panic.
+- Classification by msg_sender, never by decoding (scheduler/mod.rs:214): the payload stays opaque, and a direct can never be misread as a batch.
+- The censorship backstop running before classification on every input (scheduler/mod.rs:210-212): the guarantee that the sequencer can't freeze directs. I9's effect-equality argument relies on it being a FIFO prefix of frame 0's drain.
+- saturating_sub in age_exceeds (protocol.rs:395-397): keeps the consensus path a total function. Don't turn it into a panic in the guest, even where gate d makes the case unreachable.
+- The I1 duality test (scheduler/mod.rs:1401-1540): the only mechanical check of I1. Keep it; B2 just turns its exception block into ordinary agree cases.
+- The deliberate inline nonce advance in populate_safe_accepted_batches (sequencer/src/storage/safe_accepted_batches.rs:121-130): it interleaves with the content-identity check and the divergence freeze.
+- Graceful inspect errors in the guest (examples/canonical-app/src/scheduler/mod.rs:59-73): a public read-only query must never halt the canonical machine.
+- sequencer_address as deployment data rather than a library constant (scheduler/mod.rs:21-25): N16 should give max_wait_blocks the same shape.
+- ProtocolTiming::try_new's cross-field validation (protocol.rs:143-183): keep the validation; B6 removes only the re-validation that public fields make necessary.
+
+## C. Fee and numeric stack
+
+Verdict: This area has two parts of very different weight. The consensus core is about 90 lines in sequencer-core/src/fee.rs (fee_to_linear, fee_to_linear_fixed, fixed_mul) plus the 119-line build.rs table generator. Both are recomputed by the guest and by Bart's C++ engine, so their exactness is mandatory. The other ~1,200 lines are sequencer-local: the Uniswap TWAP worker, the oracle math, the log-additive batch_policy view and admin knobs. Nothing re-derives any of their outputs. The frame fee is published and the scheduler only consumes it (scheduler/mod.rs:330-341, wallet.rs:244,264). The worker lifecycle is proportionate: it validates the source at setup, builds the runtime source without RPC, retains the last price on transient failures and absorbs contention. The numeric rigor is not proportionate. The TickMath port is already gone (7cfb474, uniswap.rs:247 is f64), but its doctrine remains. An f64 quote goes through checked U256 ceil-division, which adds up to 4x overcharge at sub-gwei L1 gas. A U512 binary search then encodes it, guarded by a 'fail rather than undercharge' error that the view's saturation contradicts downstream. The consensus crate also exports three inverse functions whose only callers are tests, so a porter cannot tell which parts are contract. The biggest open issue is a correctness question: a frame fee above MAX_EXPONENT panics canonical execution instead of being a structural batch rejection, and no C++ port can reproduce that. The batch-fee hoist is not designed anywhere in the repo; AGENTS.md:218 only mentions it. So batch_policy should be frozen, not polished. Keep: the fee_to_linear spec text and fixed_mul truncation argument, frame-fee immutability, the no-RPC runtime source, exact "OLD" revert decoding, and the queries.rs clamp that keeps the sequencer from emitting an out-of-range fee.
+
+
+### C1. Out-of-range frame fee_price panics canonical execution; the behavior is unspecified for ports
+
+`low · confirmed · +15 lines · S · BC · wire`  
+Where: `sequencer-core/src/fee.rs:68-71`, `sequencer-core/src/scheduler/mod.rs:100-105`, `sequencer-core/src/scheduler/mod.rs:229-262`, `sequencer-core/src/scheduler/mod.rs:330-341`, `examples/app-core/src/application/wallet.rs:244`
+
+- Claim: As stated. The trigger needs two things: a frame with fee_price > MAX_EXPONENT (~17.1k), and an included op with a valid nonce and max_fee >= fee_price. Ingress never bounds max_fee, so anyone can sign 65535 and leave such an op waiting. The sequencer's own inclusion path would panic natively first (wallet.rs:244 runs on the host too), so the realistic source is a bug in the batch encoder or persistence, or a compromised key.
+- Fix: Decide the rule with Bart before any Track 5 work, since a lookup table has the same bound question. (a) Add one structural rejection (e.g. BatchRejectReason::FeeAboveMax, checked in batch_reject_reason_for_block over all frames, ~10 lines) and document it in scheduler-semantics.md and the C header. Or (b) declare the panic part of the contract (guest halts) and say so in application-engine.h. Ship it as its own behavior patch.
+- Decision: Should a sequencer-authored out-of-range frame fee be a graceful structural batch rejection (like DecodeFailed) or an impossible state that halts the guest? Bart's engine must implement the same rule.
+- Independent trace: confirmed. The code path reproduces exactly as claimed, but the framing needs three corrections.
+
+### C2. Oracle price pipeline: an integer ceil in linear units/gas overcharges up to 4x at sub-gwei gas; collapse it to one f64 log expression
+
+`medium · partially · -120 lines · M · BC`  
+Where: `sequencer/src/l1/fee_oracle/math.rs:4`, `sequencer/src/l1/fee_oracle/math.rs:9-57`, `sequencer/src/l1/fee_oracle/uniswap.rs:152-176`, `sequencer/src/l1/fee_oracle/uniswap.rs:237-252`, `sequencer/src/l1/fee_oracle/worker.rs:38-39`
+
+- Claim: The whole-unit ceil at math.rs:33-40 overcharges by at most about 2x, when the true value is just above 1 unit/gas (e.g. 1.25 becomes 2 at 0.5 gwei for USDC at $2500, which is 1.6x). The '4x at 0.1 gwei' example is not caused by the ceil. It comes from the exponent-0 floor: fee_from_linear_ceil returns 0 for anything <= 1 (fee.rs:136-138), and the column has CHECK log_gas_price >= 0 (schema:573). The proposed f64 formula with clamp(...,0,...) keeps that floor, so it would not fix the 4x (see CS1). The 'contradiction' with the view's saturation cannot happen in practice: FatalMath needs about 1e53 units/gas, and Overflow needs gas above about 1e20 wei. That strengthens the case for deleting it, but it is not a live inconsistency. The simplification itself holds (MathError, FatalMath and the U256 quote plumbing go), as long as the 'never undercharge' doc is dropped explicitly: an f64 ceil can land one exponent (0.78%) low near boundaries, which the 10x slack absorbs.
+- Fix: Compute log_gas_price = clamp(ceil((ln(base+priority) + directed_tick*ln(1.0001)) / ln(129/128)), 0, MAX_EXPONENT) in f64, with base+priority = 0 mapping to 0. TokenPriceSource returns the mean tick. While there, destructure observe's two cumulatives with a checked pattern that returns Provider, instead of indexing at uniswap.rs:159-164. Delete compute_x_units_per_gas, encode_log_gas_price, MathError, FeeOracleError::FatalMath and the U256 quote plumbing. Keep the tick range check, and log the f64 linear value for operators. Tests switch to tolerance comparisons. If deferred, the stopgap is the 3-line comment fix at math.rs:4.
+
+### C3. The consensus crate exports sequencer-local inverses whose only callers are tests
+
+`medium · partially · -250 lines · S · public-rust-api`  
+Where: `sequencer-core/src/fee.rs:15-16`, `sequencer-core/src/fee.rs:27-31`, `sequencer-core/src/fee.rs:81-127`, `sequencer-core/src/fee.rs:174-219`, `sequencer-core/src/fee.rs:104-115`
+
+- Claim: The dead code is real. fee_from_linear (fee.rs:81-127) is called only by tests (fee.rs:292,364-386; math.rs:119). log_fee_ratio (fee.rs:174-219) is called only by set_alpha. set_alpha (admin.rs:15-34) is called only by tests (inclusion_lane/tests.rs:1284,1850; admin.rs:115). FEE_BASE_NUM/DENOM are unused, and build.rs:71 hardcodes 129<<57. The same lower-bound binary search is copied three times. The 'porter cannot tell which parts are contract' reason is overstated: fee.rs:10-11 and c-application-binding.md:41-43 already pin the contract to fee_to_linear. Deleting set_alpha also removes the only typed writer listed in the invariants register writer table (docs/invariants.md:90, 'admin'), so update that row and schema:567, and replace the two lane-test calls with raw SQL fixtures. Counted alone, without C2's deletions, the delta is about -200, not -250.
+- Fix: Delete fee_from_linear, log_fee_ratio, FEE_BASE_NUM/DENOM and set_alpha, along with their tests. Keep the 296 = log(10) derivation as the schema comment it already is. After C2, delete fee_from_linear_ceil and FeeEncodeError too. Move suggested_signing_max_fee and its slack constant next to FeeQuote (api.rs:130-147). fee.rs is then exactly the consensus core that Track 5 would replace.
+
+### C4. FEE2: every 12s poll opens a FULL-sync writer and commits an unchanged price
+
+`nit · partially · -3 lines · S · BC`  
+Where: `sequencer/src/l1/fee_oracle/worker.rs:133-134`, `sequencer/src/l1/fee_oracle/worker.rs:146-162`, `sequencer/src/storage/fee_oracle.rs:30-41`, `sequencer/src/storage/open.rs:166-173`, `sequencer/src/l1/fee_oracle/worker.rs:386-419`
+
+- Claim: The mechanics are right: a new writer connection and an unconditional UPDATE on every poll (worker.rs:151-154, storage/fee_oracle.rs:30-41, open.rs:166-173). By the reviewer's own numbers the cost is negligible (under 0.1%), and the proposal pre-empts an open register decision. 'Fee-observation visibility' (register.md:175-181) keeps 'operator SQL inspection suffices' as an option, and that option needs exactly the per-poll 'last successful observation' semantics. A last-change stamp would lose liveness information. invariants.md:91 also records 'stamps on every successful refresh' as the writer contract. This is not a standalone finding; it belongs to the register entry. The one concrete test defect: worker.rs:419 asserts the stamp with >=, which passes even if no second write happened.
+- Fix: Write only when the exponent changes. The stamp then means 'last change', or it is dropped once the register entry is decided. Update invariants.md:91 and worker.rs:133-134. If staleness visibility matters, put the retained price's age in the transient warn (C8) rather than in a per-poll write.
+- Decision: Should log_gas_price_updated_at_ms become a last-change stamp or be dropped? The register entry 'Fee-observation visibility' owns this.
+
+### C5. PriceSourceError is classified twice and passes through a tuple and an extra enum on the setup path
+
+`low · confirmed · -35 lines · S`  
+Where: `sequencer/src/l1/fee_oracle/uniswap.rs:221-230`, `sequencer/src/l1/fee_oracle/worker.rs:230-243`, `sequencer/src/l1/fee_oracle/bootstrap.rs:15-46`, `sequencer/src/commands/setup/mod.rs:164-178`
+
+- Claim: As stated. The same transient/misconfig split is coded at uniswap.rs:224-230 and worker.rs:230-243. The setup path goes PriceSourceError, then (bool,String), then UniswapConnectError (bootstrap.rs:17-23,37-44), then BootstrapError (setup/mod.rs:170-178). The single-field struct variant is matched with '..' (setup/mod.rs:171). The net delta is closer to -25 once is_transient() is added.
+- Fix: Add PriceSourceError::is_transient(&self) and use it in both places. connect_uniswap returns PriceSourceError, with create_provider failures mapped at the call site, and setup maps the error once. Delete UniswapConnectError, bootstrap_price_source_error and its test. This does not merge BootstrapError variants.
+
+### C6. Freeze the log-additive batch_policy design until the batch-fee hoist (~250 lines)
+
+`low · partially · -200 lines · M · BC · db-schema`  
+Where: `sequencer/src/storage/migrations/0001_schema.sql:535-625`, `sequencer/src/storage/queries.rs:139-177`, `sequencer/src/storage/mod.rs:297-303`, `sequencer/src/storage/mod.rs:375-384`, `sequencer/src/storage/admin.rs:37-135`
+
+- Claim: Freezing batch_policy is reasonable, but for a different reason than given. coordination-tracks.md:16 records a pending decision that 'may make log-space fees defunct', and AGENTS.md:218 defers the batch-fee hoist. Neither is the stated future direction (a shared cockroach-recovery tool plus a new client sync). This is 'frozen pending a fee decision', not 'superseded-by-direction', and its -200 lines and db-schema change are speculative while no design exists. The claim that the CHECK log_gas_price >= 0 floor is 'a log-space artifact the hoist removes' is wrong. log_gas_price is only summed with about +1356 of constants (schema:617-621), so a negative exponent stays representable. The floor comes from the unsigned u16 oracle output and the CHECK, and it can be fixed now (CS1).
+- Fix: Don't polish this now. When the hoist lands: compute a linear batch fee in app code, turn the batch target into a plain byte knob, and drop the view, the clamps, set_alpha's coupling and batch_size_target_bytes. Revisit the /fee quote shape at the same time.
+- Decision: The batch-fee hoist design itself, including whether the user signs a linear or a log-space batch fee. It decides C6 and whether Track 5 is ever built.
+
+### C7. Fee docs: a wrong view comment, a stale name, and the 10x-slack fact repeated in 6+ places
+
+`low · confirmed · -30 lines · S · docs-only`  
+Where: `sequencer/src/storage/migrations/0001_schema.sql:618`, `sequencer-core/src/batch.rs:19-21`, `sequencer-core/src/batch.rs:23-38`, `sequencer/src/storage/migrations/0001_schema.sql:537-552`, `sequencer/src/storage/migrations/0001_schema.sql:577-578`
+
+- Claim: As stated, with two small fixes. The wrong comment is at schema:619, not 618: the sum adds log_user_op_bytes, so the result is a per-op fee, and the wallet charges fee_to_linear(frame_fee) per op. fee.rs:226-227 is not a redundant restatement: it tells the 1.5x signing slack apart from log_slack and should stay. The other slack restatements (schema:545-546,578; batch.rs:34-35; math.rs:20-21; uniswap.rs:234; threat-model:24) are real duplication.
+- Fix: Keep the fee derivation in one place, the schema header, and replace batch.rs:23-38 with one line pointing to it. Fix the two errors, drop the TickMath reference, and cut the restating doc lines.
+
+### C8. Oracle logs say little during outages and may print the RPC URL every 12s
+
+`nit · partially · +5 lines · S`  
+Where: `sequencer/src/l1/fee_oracle/worker.rs:164-184`, `sequencer/src/l1/fee_oracle/worker.rs:201-205`, `sequencer/src/l1/fee_oracle/worker.rs:206-216`, `sequencer/src/l1/fee_oracle/uniswap.rs:90-110`, `sequencer/src/l1/fee_oracle/uniswap.rs:333-340`
+
+- Claim: Two parts hold. A change is logged twice: info at worker.rs:164-173 and debug at worker.rs:202-204. The changed= field is constant in each branch (worker.rs:171,181). The step-label point applies only at setup: at runtime only observe produces PriceSourceError::Provider (uniswap.rs:158), and gas failures carry their own string (eip1559.rs:40,47). Rate limiting and tracking failure counts or age adds state, which a cosmetic problem does not justify: about 300 warns per hour during a pool-only outage is acceptable. URL exposure is plausible, since reqwest transport errors print the URL and estimate_fees stringifies them too. But that is the class already covered by the open register entry 'Startup logs the full RPC URL', whose Next step already says to check diagnostic paths (register.md:133-135). It belongs in that entry's triage, not in a new finding.
+- Fix: Log a change once. Add retained-price age and failure count to the warn and rate-limit it. Add a step label to Provider. Route provider errors through whatever endpoint redaction the RPC-URL register entry settles on.
+
+### C9. Ceremony around the 'OLD' revert classification
+
+`nit · unverified-nit · -15 lines · S`  
+Where: `sequencer/src/l1/fee_oracle/uniswap.rs:191-219`, `sequencer/src/l1/fee_oracle/uniswap.rs:296-304`
+
+- Claim: is_old_observation_reason wraps reason == "OLD" in its own function with its own doc comment, and has a 5-assert test of string equality. The two doc comments above it repeat each other.
+- Fix: Inline Some(r) if r.reason == "OLD", keep one doc comment, and drop the equality test.
+
+### CS1. Oracle floors log_gas_price at exponent 0 (1 smallest unit per gas), overcharging 6-decimal fee tokens by 1/x at low gas
+
+`medium · skeptic-added · +10 lines · S · BC · db-schema`  
+Where: `sequencer/src/storage/migrations/0001_schema.sql:573`, `sequencer/src/l1/fee_oracle/math.rs:33-40`, `sequencer-core/src/fee.rs:136-138`, `sequencer/src/storage/fee_oracle.rs:12,30`, `sequencer/src/commands/config.rs:120`
+
+- Claim: compute_x_units_per_gas rounds any nonzero quote up to at least 1 unit/gas, and fee_from_linear_ceil maps values <= 1 to exponent 0. log_gas_price is a u16 end to end, and the column has CHECK log_gas_price >= 0. With USDC (the wallet prototype's token, schema:543) and ETH at $2500, the true cost is 2.5 x gas_gwei units/gas. Below 0.4 gwei the oracle therefore reports 1 unit/gas, an overcharge of 1/x: 4x at 0.1 gwei, 10x at 0.04 gwei. The 10x safety margin is applied a second time, by accident. The floor is not inherent to log space: log_gas_price is only added to about +1356 of constant exponents in the view, so values down to about -1356 still give a valid non-negative frame fee.
+- Fix: Let the oracle produce a signed exponent: i16 in RefreshResult, set_log_gas_price, log_gas_price() and FeeOracleMode::Fixed. Relax the CHECK to a lower bound that keeps the derived fee >= 0, e.g. log_gas_price + log_slack + log_one_plus_alpha + log_delta + log_user_op_bytes >= 0. Do it together with C2: the f64 log formula then clamps at that bound instead of 0. Ship it as its own behavior patch. This is a schema change, so ask first.
+- Decision: Should the oracle price below 1 smallest unit per L1 gas (relax the schema CHECK and make the exponent signed), or is the fee token's smallest unit an accepted floor? Either way, record the trade-off in the schema header.
+
+Keep (load-bearing):
+
+- fee_to_linear's contract text and the fixed_mul truncation argument (sequencer-core/src/fee.rs:44-59, 248-251): this is the cross-implementation spec Bart's C++ engine ports (c-application-binding.md:39-46), and the doc is the spec until a Track 5 table exists.
+- build.rs table generation plus the MAX_EXPONENT assert (sequencer-core/build.rs:42-80, fee.rs:68-71): this is consensus data and its bound fails loud. Track 5 only turns build.rs into a verifier.
+- query_batch_policy's asymmetric clamp and panic (sequencer/src/storage/queries.rs:146-176): the clamp is why the sequencer never emits a frame fee above MAX_EXPONENT, which keeps C1 unreachable today.
+- Frame fee sampled at frame open and immutable for the frame (AGENTS.md:218, storage/mod.rs:345-372): this is what lets the oracle's math be free. The scheduler only consumes the published exponent.
+- Setup-time connect and validate plus no-RPC runtime construction (bootstrap.rs:28-67, uniswap.rs:83-150): this keeps run independent of the pool, and it is what fixed FEE1.
+- Exact decoding of the Error(string) 'OLD' revert rather than substring matching (uniswap.rs:202-219): this is correct classification of an availability failure. Only the wrapper ceremony should go (C9).
+- is_sqlite_contention absorption and the transient-retention loop (worker.rs:62-72, 195-227): these match the accepted oracle-outage policy in threat-model README:24 and avoid restart storms.
+- FeeOracle's process_lock with spawn_blocking_with_lock (worker.rs:92-95, 146-162): it keeps data-directory exclusivity if the awaiting task is cancelled.
+- SUGGESTED_MAX_FEE_SLACK as a ceil (53) rather than the nearest value (fee.rs:221-239, test 337-347): nearest rounding would understate the 1.5x margin that lets quotes survive a frame rotation.
+- Pinned Alloy estimator constants test (sequencer/src/l1/eip1559.rs:65-76): it guards the external policy that both the poster and the oracle depend on.
+- Schema CHECK log_base_gas - log_alpha - log_delta < log_max_batch_bytes (0001_schema.sql:590): it enforces the batch-size bound until the hoist replaces the design.
+
+## D. Ingress and inclusion lane (hot path)
+
+Verdict: The ingress/lane area takes a signed user op from POST /tx, checks only size and signature (api.rs:131-156), and hands it to a single blocking lane over a bounded channel. The lane executes bounded chunks, commits each accepted chunk with FULL sync before acking (mod.rs:183-206, 311-335), and on a separate time-gated cadence does L1 reconciliation and batch close with a snapshot. I traced the hot path end to end and found no correctness bug and no per-op clone worth removing. Ops move by value and execute by reference. The real latency sources are the per-chunk fsync, the inline WAL checkpoint, and the occasional batch-close or reconciliation stall, and those are already in the register. Size is mostly proportionate. The lane is about 500 lines of essential concurrency and durability code. storage/ingress.rs (1668 lines) is about 900 lines of tests plus about 770 production lines, but roughly 240 of those are #[cfg(test)] fixtures mixed into production code. Some of those fixtures only test themselves, and a few public helpers are dead. A lean file keeps about 530 lines. The biggest real problem is diagnostic: when the lane dies, the error that gets logged and written to the black-box record drops its cause, so an AppError reason or a rusqlite detail never reaches the operator. After that come one redundant piece of in-memory state (the drain cursor) and a set of stale or untrue comments. The good parts must stay: ack only after a durable commit, bounded fast turns so rejected floods cannot starve reconciliation, WriteHead counter checks before the transaction, the re-derivation and receipt assert at frame rotation, hash-at-seal, file-first snapshots, fixed public 500 messages, and the documented no-nonce-precheck admission policy. N10 is already implemented: frames rotate on the 5-block clock whether or not there are direct inputs. N24 (the listener split) is cheap and should go ahead as a small PR. The egress snapshot-lease machinery in http.rs falls under the future direction and should be frozen, not polished.
+
+
+### D1. Fatal lane errors lose their cause in the exit log and the black-box record
+
+`medium · partially · +10 lines · S · BC`  
+Where: `sequencer/src/ingress/inclusion_lane/error.rs:17-44`, `sequencer/src/commands/error.rs:515-516`, `sequencer/src/commands/error.rs:572-573`, `sequencer/src/harness.rs:129`, `sequencer/src/commands/mod.rs:65`
+
+- Claim: The core claim holds. ExecuteUserOp, ExecuteDirectInput, CatchUp, Snapshot and Gc display fixed strings (inclusion_lane/error.rs:17-21, 29-44). WorkerStop::Source is `#[error("{0}")]` (commands/error.rs:572-573), and every log sink formats Display only, so the AppError reason, the rusqlite detail, and even CatchUpError's own detail (e.g. the SnapshotExecutionCountMismatch numbers) never reach the operator. The sink list is wrong, though. A terminal lane error (e.g. AppError::Internal) never reaches harness.rs:129 or the black-box write at commands/mod.rs:65. Runtime::finish aborts first (commands/run/workers.rs:372-375), and abort_terminal logs `error = %error` and calls abort() (runtime/shutdown.rs:16-18). README.md:158 documents this: terminal runtime faults abort without settlement. Non-terminal lane errors reach harness.rs:129 (Unclassified) or workers.rs:460 during the drain. A sink-side chain renderer would therefore have to cover abort_terminal, harness.rs:129 and workers.rs:460, not commands/mod.rs:65. Inlining `: {source}` in the five #[error] strings, matching CatchUpError (error.rs:105, 110) and LoadFromDump (error.rs:41), covers every sink with no other change and is the smaller fix.
+- Fix: Pick one fix. Either inline `{source}` into the five InclusionLaneError #[error] strings, matching CatchUpError, or render the full source chain once at the two top-level sinks (harness.rs:129 and commands/mod.rs:65). The second fixes every worker at once. Either way, the operator sees e.g. 'inclusion lane: user op execution failed: <AppError reason>'.
+- Decision: Choose between per-variant inlining and a chain renderer at the sink. The renderer covers the other workers too, but touches files outside this area.
+
+### D2. storage/ingress.rs mixes about 240 lines of test-only fixtures, some self-testing, into production code; two helpers are dead
+
+`medium · confirmed · -110 lines · M`  
+Where: `sequencer/src/storage/ingress.rs:93-153`, `sequencer/src/storage/ingress.rs:216-286`, `sequencer/src/storage/ingress.rs:323-405`, `sequencer/src/storage/ingress.rs:440-442`, `sequencer/src/storage/ingress.rs:635-702`
+
+- Claim: Confirmed as stated. About 237 #[cfg(test)] lines sit in the production half of storage/ingress.rs: 93-114, 115-145, 147-153, 216-286, 323-348, 365-379, 381-405, 635-650 and 679-702. fill_safe_inputs (216-286) is used only by the half-open-interval test at l1_inputs.rs:466-508, so that test largely tests its own fixture. It could use the existing production read safe_inputs_in_block_range (l1_inputs.rs:120) instead of a new SELECT. open_recovery_tip's guard (147-153) is exercised only by ingress.rs:1185-1188. WriteHead::open_frame_has_user_ops (storage/mod.rs:342-344) has no callers anywhere in the repo. Storage::batch_policy (ingress.rs:440-442) has only test callers (admin.rs:56/80/107, fee_oracle.rs:70, ingress.rs:1195+). append_user_ops_chunk has the two test users the reviewer names. The integration_tests module compiles in-crate (lib.rs:33-35), so cfg(test) items are visible to it.
+- Fix: Delete fill_safe_inputs and replace the test read-back with a 5-line SELECT. Delete open_recovery_tip and its assertion, since the guard belongs at the external boundary that already exists. Delete open_frame_has_user_ops. Make batch_policy cfg(test) or move it into test_helpers. Port the two physical-only fixture users to the production append. Move the remaining fixtures (initialize_open_state, ensure_open_tip, close_frame_only/close_frame_derived_in, close_frame_and_batch) into storage/test_helpers.rs. The production file drops to about 530 lines and contains only lane writes, the in-transaction helpers, and the two public reads. Do this as a pure refactor patch.
+
+### D4. Redundant checks and parameters around snapshot restore and batch close
+
+`low · confirmed · -25 lines · S`  
+Where: `sequencer/src/ingress/inclusion_lane/mod.rs:102-109`, `sequencer/src/ingress/inclusion_lane/catch_up.rs:16-31`, `sequencer/src/ingress/inclusion_lane/catch_up.rs:47-52`, `sequencer/src/storage/ingress.rs:409-420`, `sequencer/src/ingress/inclusion_lane/snapshot.rs:48-57`
+
+- Claim: Confirmed with one correction. The count check at mod.rs:102-109 repeats catch_up.rs:47-52 on the same values: checkpoint.executed_input_count is passed straight through run_forever, run_catch_up and catch_up_application as `start`, and nothing touches the app in between. CatchUpSnapshot (catch_up.rs:16-31) only re-wraps latest_snapshot's prefix and count. close_frame_and_batch_with_snapshot's batch_index parameter only feeds an assert, which is tautological in production (snapshot.rs:48, 56; ingress.rs:417-420). The correction is that it has one production caller but six test callers (snapshot_dumps.rs:504, ingress.rs:838, integration_tests/snapshot_endpoints.rs:125/156/197, recovery_compatibility.rs:124, egress/historical/tests.rs:324), which must change with it. Expect about -15 to -20 lines rather than -25.
+- Fix: Keep the check in catch_up, which is the place tests exercise, and drop the copy in start(). Return the storage snapshot row from catch_up_snapshot, or inline it. Remove the batch_index parameter and use head.batch_index inside storage.
+
+### D5. Stale or untrue comments in the hot-path files
+
+`low · confirmed · -10 lines · S · docs-only`  
+Where: `sequencer/src/storage/mutations.rs:22-24`, `sequencer/src/storage/ingress.rs:603-608`, `sequencer/src/storage/queries.rs:178-183`, `sequencer/src/clock.rs:6-8`, `sequencer/src/ingress/inclusion_lane/types.rs:33-37`
+
+- Claim: Items 1, 2, 3 and 5 are confirmed as stated. mutations.rs:22-24 is stale: production passes Some(0) via open_fresh_tip_in_tx (ingress.rs:491) and open_recovery_tip_in_tx (ingress.rs:526). The close_frame_in doc (ingress.rs:603-608) is wrong because close_frame_derived_in does not call close_frame_in. decode_l2_tx_row is #[cfg(test)] (queries.rs:178-184). types.rs:36 is wrong because queue-full is ApiError::overloaded at api.rs:266 and Unavailable maps only to 503 (http.rs:96, 113-114). For item 4 the conclusion is right but the evidence is weak: the cited sites (mod.rs:363, api.rs:261, snapshot.rs:70) need a SystemTime or nanos, not 'now in Unix-ms'. The real contradiction is that production storage has its own duplicate Unix-ms helper, storage/convert.rs:66 now_unix_ms(), used at ingress.rs:452 and lifecycle.rs:126, which bypasses clock::unix_now_ms. No test clock exists anywhere.
+- Fix: Correct or delete each one. For clock.rs, say what it is (a saturating Unix-ms helper) and drop the test-clock promise.
+
+### D6. Verbose comments that restate the code or repeat neighbouring docs
+
+`nit · unverified-nit · -40 lines · S · docs-only`  
+Where: `sequencer/src/storage/ingress.rs:116-136`, `sequencer/src/storage/ingress.rs:4-11`, `sequencer/src/ingress/inclusion_lane/mod.rs:69-81`, `sequencer/src/ingress/inclusion_lane/mod.rs:130-135`, `sequencer/src/ingress/inclusion_lane/mod.rs:155-159`
+
+- Claim: Representative examples: a 21-line doc on an 8-line test-only fn, mostly describing production behavior that lives elsewhere (ingress.rs:116-136); a module doc that says 'live here too' twice (ingress.rs:4-11); InclusionLane::start's 13-line doc mixing three topics (mod.rs:69-81); an inline comment repeating that doc (mod.rs:130-135); a batch-close comment restating snapshot.rs:39-40 and I7 (mod.rs:155-159); a doc explaining that &Transaction coerces to &Connection (mutations.rs:146-151). The module doc also has a single line over 150 columns (mod.rs:14).
+- Fix: Cut each to one or two lines that state the non-obvious reason, or link the invariant (I7, I17). Rewrap mod.rs:14.
+
+### D8. Duplicated shutdown gate and a redundant constructor in api.rs
+
+`nit · unverified-nit · -15 lines · S`  
+Where: `sequencer/src/ingress/api.rs:51-80`, `sequencer/src/ingress/api.rs:92-108`
+
+- Claim: SubmitState and ReadState each carry an identical reject_if_shutting_down. SubmitState also has a 4-argument new() even though all its fields are pub.
+- Fix: Make one free fn reject_if_shutting_down(&RuntimeScope). Pick either pub fields or a constructor. Fold this into the N24 split PR, which touches this wiring anyway.
+
+### DS1. A graceful shutdown racing a frontier check or rotation surfaces as ChannelClosed and exits 1 instead of 0
+
+`low · skeptic-added · +4 lines · S · BC`  
+Where: `sequencer/src/ingress/inclusion_lane/mod.rs:143-150`, `sequencer/src/ingress/inclusion_lane/mod.rs:439-443`, `sequencer/src/http.rs:297-352`, `sequencer/src/commands/run/workers.rs:454-470`, `sequencer/src/commands/error.rs:179-185`
+
+- Claim: The lane checks the shutdown flag only at the top of its loop (mod.rs:144), then runs maybe_advance_safe_frontier, which can rotate the frame and run GC (mod.rs:254-265), before try_recv. The only lane senders are owned by the HTTP router (SubmitState and HealthState, http.rs:305-315), and they drop as soon as graceful HTTP shutdown completes. If shutdown is requested after the flag check and the server finishes first, try_recv sees Disconnected with attempted == 0 and the lane returns InclusionLaneError::ChannelClosed (mod.rs:440-442) instead of Ok(()). The drain treats that as an error (workers.rs:456-463). It is non-terminal, so it is classified Unclassified (error.rs:179-185) and a clean SIGTERM exits 1 with a 'component errored during runtime drain' warning.
+- Fix: In the Disconnected arm, or where run_fast_turn's error is handled, treat ChannelClosed as a graceful stop when self.shutdown.is_shutdown_requested(): reject anything pending and return Ok(()). That is about 3-5 lines and adds no new machinery.
+
+Refuted:
+
+- D3. The lane's in-memory drain cursor duplicates a value storage already re-derives and asserts on every frame rotation. The proposal weakens a fail-loud cross-check that protects against silent scheduler divergence (I6 drain completeness, 'impossible states fail loud').
+- D7. Egress snapshot-lease release supervisor lives in the shared http.rs; freeze it and move it with egress at the split. The 'superseded-by-direction' premise fails: the same lease machinery serves the watchdog and operator recovery endpoints, which the direction keeps and probably relies on.
+
+Keep (load-bearing):
+
+- Ack only after the FULL-synced chunk commit (mod.rs:311-335, ingress.rs:297-321). The commit is the durability authority behind a 200 (I20).
+- Bounded fast turn plus time-gated frontier check, with TurnOutcome's three states (mod.rs:7-18, 337-356, 423-453). This stops a continuously nonempty, all-rejected queue from starving reconciliation.
+- WriteHead counters are checked for overflow before the transaction, and the cache is updated only after commit (ingress.rs:305-320; I17).
+- Range re-derivation and execution-receipt equality assert at frame rotation (ingress.rs:616-623, mutations.rs:169-173, 210-262). This enforces I6/I19/I20 and runs only once per safe-head tick, not per op.
+- Hash-at-seal inside the seal transaction (ingress.rs:582-590). The content-identity check needs the hash atomically with the seal.
+- File-first dump, then atomic seal plus snapshot registration (snapshot.rs:39-60, ingress.rs:409-438; I7).
+- Unique dump-dir naming with nonce, nanos and a counter (snapshot.rs:62-75). Nonces are reused across recovery cascades.
+- is_terminal_invariant classification and its tests (error.rs:52-138, 140-237). It drives the exit codes the supervisor relies on.
+- storage_task classifies errors inside the blocking task and aborts on persistent faults (http.rs:213-267). Cancelling the HTTP request must not discard a persistent fault.
+- No nonce/max_fee precheck at ingress, with a named revisit trigger (api.rs:18-23). A precheck would add a SQLite read to every honest submit.
+- Fixed public error messages: no AppError, serde or rusqlite detail in 4xx/5xx bodies (mod.rs:392-401, api.rs:230-248).
+- next_user_nonce's valid_batches filter (ingress.rs:43-47, 73-91). Cascades reuse nonces from invalidated rows.
+- The asymmetric clamp/fail-loud in query_batch_policy (queries.rs:146-171). Operator-writable bounds are clamped; contract-impossible ones panic.
+- catch_up_application_paged's page-size parameter (catch_up.rs:41-46). It is the test seam for page-boundary coverage.
+- SnapshotReleaseDrain (http.rs:150-211). It is correct and load-bearing for lease release on shutdown, but superseded by direction, so freeze it rather than delete it.
+
+## E. Egress API and client SDK (consumer surface: clients/indexers)
+
+Verdict: Area E is the internal consumer surface. It has five parts: a WebSocket feed that replays and then follows the tip, keyed by a mandatory (era, generation, next_input) claim; /history metadata with standard-recovery compatibility; a pager for the era's raw L1 prefix (/historical-l1-inputs); health probes; and a Rust SDK. The core is sound and proportionate. One DB-backed cursor re-validates identity on every page inside a single deferred read transaction, refusals are typed and returned as 409 before the upgrade, and the base offset K and the generation cuts are implemented and fail loud on gaps. I found no correctness bug in the replay/subscribe handoff or in the history-identity checks, and N11/N12 are done. The future direction does not justify the current size: about 1,600 lines (code, tests and docs) exist only so a client can rebuild a projection across a cockroach rebuild (/historical-l1-inputs, projection-replay.md, the historical_bootstrap integration test, and half of /history), and the shared recovery tool replaces exactly that. About 1,400 more lines (WS wire format, SDK snapshot-then-subscribe bootstrap) should be frozen until the new sync is designed. The real problems besides supersession: the contract is written out in three places (README, openapi.yaml, protocol docs); the feed re-implements http::storage_task's terminal-fault policy with two near-identical error enums; WS error logs drop their SQLite causes; and the SDK has dead surface. Keep the claim identity (I18), per-page revalidation, cuts with the complete-lineage assert, base_executed_input_count, and the canonical reader. That reader is shared with native restart and should move out of storage/egress before the freeze.
+
+
+### E1. Freeze /historical-l1-inputs and the projection-replay path (~1,600 lines)
+
+`medium · partially · -1600 lines · M · BC · http-api`  
+Where: `sequencer/src/egress/api/history.rs:37-46`, `sequencer/src/egress/api/history.rs:101-176`, `sequencer/src/storage/egress/historical.rs:115-260`, `sequencer-core/src/history_api.rs:11-13`, `sequencer-core/src/history_api.rs:56-81`
+
+- Claim: The direction does supersede the raw-prefix pager. Its only consumer is projection replay across a rebuild (projection-replay.md:12-28; the genesis prefix is empty). Freezing it is right. The removal plan is wrong in two places. (a) historical_bootstrap.rs is also the parent module of recovery_compatibility.rs (historical_bootstrap.rs:7, 403 lines, which uses `super::*` at recovery_compatibility.rs:15). That file tests in-era standard-recovery checkpoint compatibility, which E2 says survives. Deleting historical_bootstrap.rs would drop it together with the helpers it reuses (domain/config/execute, historical_bootstrap.rs:53-204). (b) projection-replay.md:56-93 (checkpoint eligibility: seed directs after A, replay (B,C], terminal drain) and the worked boundary at 95-118 specify exactly the client-state reconstruction the shared tool must perform. The main historical_bootstrap test is a ready-made oracle for it. They should move into the tool's design and tests, not be deleted. Only the HTTP route, raw_page_in/first_input_after_block_in, the HistoricalL1Input* wire types, the SDK method and the README/openapi prose are pure deletions.
+- Fix: Freeze now: no new features, no polish, and do not implement the Track 3 'Cockroach reader recovery' follow-up (track3 plan:79,86-92). When the shared tool lands, delete the route, raw_page_in/first_input_after_block_in, HistoricalL1Input*, the SDK method, projection-replay.md and historical_bootstrap.rs in one removal patch. Keep historical_end_in only if /history still reports R.
+- Decision: Confirm that the shared tool will produce the client's projection from the client's own checkpoint. If any client must still rebuild a projection from raw L1 after a rebuild, this route survives.
+
+### E2. /history: baseline and accepted_checkpoint serve cross-era projection prep; history and compatibility survive
+
+`low · partially · -150 lines · S · BC · http-api`  
+Where: `sequencer-core/src/history_api.rs:15-54`, `sequencer/src/storage/egress/historical.rs:41-113`, `sequencer/src/storage/egress/historical.rs:28-38`, `sequencer/src/egress/api/history.rs:84-86`, `README.md:318-390`
+
+- Claim: baseline.{l1_stop_block,l1_end_input_index,next_batch_nonce} and accepted_checkpoint serve only projection replay and manual-recovery checkpoint prep. They appear only in the README, openapi, projection-replay.md, the SDK and tests (git grep), so freezing them is right. The duplicate check is real: api/history.rs:84-86 makes historical.rs:54-58 unreachable through the route, though historical/tests.rs:403 still exercises it. Two corrections. (a) BadRequest-from-storage cannot simply be dropped. The 'from_generation exceeds the current recovery generation' check (historical.rs:59-63) needs the generation read inside the transaction, so after E1 it still needs a storage-side refusal. Only the pager's BadRequests (130-150) and 54-58 go away. (b) The claim that compatibility 'survives the direction' is not established. It exists so a client can reuse a replica checkpoint and resubscribe over WS after standard recovery. That is the claim/feed model E3 freezes, so it should be frozen with E3, not declared a keeper.
+- Fix: Freeze. When E1 is removed, reshape /history to {deployment, history, compatibility} and drop the unreachable storage-side era check together with BadRequest-from-storage. No change before then.
+- Decision: Is accepted_checkpoint still needed by the watchdog or operators once client recovery goes through the shared tool? The snapshot reviewer owns finalized_dump_in.
+
+### E3. Freeze the WS wire format and SDK snapshot-to-subscribe bootstrap; record their defects as inputs to the new sync
+
+`medium · partially · +0 lines · S · wire`  
+Where: `sequencer/src/egress/api/subscribe.rs:1-140`, `sequencer-core/src/broadcast.rs:12-46`, `sequencer-core/src/api.rs:189`, `sdk/rust-client/src/lib.rs:27-34`, `sdk/rust-client/src/lib.rs:177-228`
+
+- Claim: The snapshot-then-subscribe replica bootstrap (lib.rs:177-228) is the shared-state assumption the direction rejects, so freezing the WS wire format and the SDK bootstrap is right. All five listed defects are real: String fields at broadcast.rs:15-45 vs typed fields at history_api.rs:62-71; the casing split documented at openapi.yaml:16-20; the alias at api.rs:189; the raw stream at lib.rs:27; no timeout at lib.rs:222-228. Defect (5) should not be frozen, though. subscribe() can hang forever on a stalled server, while every sibling method is bounded (lib.rs:104, 154, 185). The fix is about 3 lines, the same pattern as latest_snapshot at lib.rs:185, and the harness already works around the hang at tests/harness/src/ws.rs:24. If the WS feed stays as the interim sync (the open needs_decision), fix (5) now and put (1)-(4) in the design brief.
+- Fix: Do not build a typed SDK stream, WSS, in-band invalidation notices, or a casing fix now. Add these five items to the new-sync design brief so they are designed once. The server-side cursor (canonical_history_page plus claim) probably survives the redesign; see E4.
+- Decision: Does the existing WS feed stay as the interim sync for Bart's client until the new design lands, or is it frozen immediately?
+
+### E4. The canonical application-history reader lives under storage/egress but is shared with native restart
+
+`low · confirmed · +0 lines · S`  
+Where: `sequencer/src/storage/egress/canonical.rs:40-143`, `sequencer/src/storage/egress.rs:18-73`, `sequencer/src/ingress/inclusion_lane/catch_up.rs:65`, `sequencer/src/commands/setup/fill.rs:409`
+
+- Claim: canonical_history_page, history_bounds, ApplicationInputRow, L2TxContext and decode_application_input (storage/egress/canonical.rs:40-143, storage/egress.rs:18-73) are the single application-history reader. Native restart catch-up (ingress/inclusion_lane/catch_up.rs:54,65) and setup fill (commands/setup/fill.rs:409) both use it. Minor correction: history_bounds lives in canonical.rs:41-43/63-71, not next to next_executed_input_count_in. The move target is storage/history.rs, a single file today, or a new history/ directory. The stale module doc l2_tx_feed/mod.rs:4 should be fixed in the same pure move (see ES1).
+- Fix: Pure move: put canonical.rs and the row/context/decode types under storage/history/ next to history_bounds and next_executed_input_count_in. storage/egress then holds only historical.rs, which E1/E2 freeze. No behavior change.
+
+### E5. L2TxFeed duplicates http::storage_task's terminal-fault policy with two near-identical error enums
+
+`low · confirmed · -90 lines · S`  
+Where: `sequencer/src/egress/l2_tx_feed/mod.rs:80-109`, `sequencer/src/egress/l2_tx_feed/mod.rs:121-141`, `sequencer/src/egress/l2_tx_feed/error.rs:11-87`, `sequencer/src/http.rs:224-266`, `sequencer/src/egress/l2_tx_feed/mod.rs:47-53`
+
+- Claim: prepare() (l2_tx_feed/mod.rs:80-109) re-implements storage_task (http.rs:224-249). SubscribeError and SubscriptionError (error.rs:11-83) are four-variant twins of what persistent_storage_error (http.rs:251-266) already classifies. open_error_is_persistent is an alias (error.rs:85-87). task is always Some (mod.rs:145), so the early return in finish (169-171) is dead. runtime_scope() has one caller (subscribe.rs:89), and its select arm duplicates Subscription::recv's shutdown arm (mod.rs:157-161). send_ws_event warns on an infallible serialization of Strings and integers (subscribe.rs:127-133 vs the expect at :63). Also dead: the `Join => source.is_panic()` arms (error.rs:46, 80). Panics abort before any Join is built (mod.rs:95-106, 136-139), and SubscriptionError::Join is built only in finish() (mod.rs:175), after the classification at :132. Moving to storage_task keeps the lock-retention guarantee: it holds a RuntimeScope clone (http.rs:234), which retains the process lock (shutdown.rs:28-33). Persistent-fault detection still works because HistoryReadError::Storage exposes its rusqlite source via #[from] (canonical.rs:36-37).
+- Fix: Run prepare through storage_task and, in the handler, downcast HistoryReadError::Policy to the 409 the same way api/history.rs:149-161 does. Reduce SubscriptionError to one small enum checked with persistent_storage_error. Destructure self in finish(). Drop the shutdown arm in run_ws_session, runtime_scope(), and send_ws_message; use expect in send_ws_event. Do this only when the feed is next touched (see E3).
+- Decision: Worth doing only if the server-side feed cursor survives the sync redesign; otherwise leave it frozen.
+
+### E6. WS and history error logs drop their SQLite cause and mislabel what failed
+
+`low · confirmed · +0 lines · S`  
+Where: `sequencer/src/egress/api/subscribe.rs:72`, `sequencer/src/egress/api/subscribe.rs:121-123`, `sequencer/src/egress/l2_tx_feed/error.rs:13-22`, `sequencer/src/egress/l2_tx_feed/error.rs:56-66`, `sequencer/src/storage/egress/historical.rs:36-37`
+
+- Claim: The feed's error Displays drop their SQLite cause. 'cannot open subscription storage' and 'cannot load feed head offset' (error.rs:13-22) and 'cannot load ordered tx page from offset {offset}' (error.rs:61-66) all keep the cause only in #[source]. That loses it in the warn logs (subscribe.rs:72, 122) and, more importantly, in the terminal abort message. For a persistent fault, mod.rs:92 and :133 call abort_terminal with `{error}`, and abort_terminal logs only Display (runtime/shutdown.rs:16-18). The process therefore aborts on, say, a corrupt database with no SQLite reason in the log. By contrast, storage_task paths keep the cause, because StorageOpenError is transparent (storage/mod.rs:267-270) and HistoryReadError::Storage formats {0} (canonical.rs:36). The From impl (error.rs:32-38) actively degrades the more informative HistoryReadError. HistoricalReadError::Storage's 'reading historical L1 inputs' label (historical.rs:36) does include the cause and is only mislabelled for /history. The fix (include {source}, or adopt E5) changes log text only.
+- Fix: Include {source} in these Display strings, or log through an error-chain formatter. Rename the end-of-session log to 'tx feed subscription ended with error'. Rename LoadHeadOffset to ReadPage. Use neutral 'reading history' wording. This changes log text only.
+
+### E7. SDK dead surface and a misnamed transport error
+
+`low · partially · -35 lines · S · public-rust-api`  
+Where: `sdk/rust-client/src/errors.rs:12-48`, `sdk/rust-client/src/errors.rs:62-87`, `sdk/rust-client/src/lib.rs:68-75`, `sdk/rust-client/src/lib.rs:81-86`, `sdk/rust-client/src/lib.rs:150-162`
+
+- Claim: Dead SDK surface is confirmed. SubmitTxError::{TimeoutWrite,TimeoutFlush,IoWrite,IoFlush,Parse} (errors.rs:16-31) are never constructed: map_reqwest_error (lib.rs:238-250) and the body-read maps are the only constructors. SubscribeError::InvalidEndpoint (errors.rs:83-84) is never constructed. host_port (lib.rs:68-75) has no callers. QueryError::Transport wraps SubmitTxError (errors.rs:65-68; lib.rs:150). There are two more mapping defects. Body-read failures, including reqwest per-request timeouts, are mapped to IoRead rather than TimeoutRead (lib.rs:111-114, 159-162), so benchmark breakdown keys (tests/benchmarks/src/rejection.rs:23) mislabel timeouts as io_read. A client build failure is reported as ClientBuildError::InvalidEndpoint (lib.rs:55-56). The with_request_timeout sub-proposal is wrong. The rebuild differs from the constructor's successful build only in the timeout values, which reqwest's build() does not fail on, so the expect at lib.rs:84 encodes an impossible state. Under AGENTS.md that fails loud by design, and returning a Result would add public-API churn for an unreachable error.
+- Fix: Rename SubmitTxError to TransportError, drop the dead variants, InvalidEndpoint and host_port, and make with_request_timeout return a Result. Defer unifying the seven error enums into one {route, transport | status+typed ApiError body | decode | history} type until the N24 split creates separate public and internal clients.
+
+### E8. The 50,001-row 'no total cap' feed test duplicates pure validate() coverage
+
+`low · confirmed · -50 lines · S`  
+Where: `sequencer/src/egress/l2_tx_feed/tests.rs:86-134`, `sequencer-core/src/history.rs:414-434`, `sequencer/src/storage/egress/canonical/tests.rs:309`
+
+- Claim: subscription_accepts_more_than_fifty_thousand_inputs_without_a_total_cap (l2_tx_feed/tests.rs:87-136) builds 50,001 rows and reads 3 events. The feed adds no cap of its own: prepare and run only call canonical_history_page (mod.rs:87, 198). The absence of a cap is already pinned by core history.rs:415-434 (0, 100_001, 0), and deep paging by canonical/tests.rs:309-335, which also uses 50,001 rows. Delete the feed test or shrink it to a few rows.
+- Fix: Delete the test, or shrink it to a few rows with page_size 1 if an end-to-end feed check is wanted.
+
+### E9. The egress contract is written out three times (README, openapi.yaml, protocol docs)
+
+`medium · confirmed · -250 lines · M · docs-only`  
+Where: `README.md:271-312`, `README.md:314-440`, `openapi.yaml:236-474`, `docs/protocol/application-history.md:138-177`, `docs/protocol/projection-replay.md:1-125`
+
+- Claim: The egress contract is duplicated across README.md:271-440, openapi.yaml:236-474 and the protocol docs. Verified examples: the order of refusal checks at README.md:290-293 and openapi.yaml:250-253; 'disconnect without a Close frame' at README.md:304-306, openapi.yaml:260-262 and application-history.md:173-177; the SDK prose at README.md:436-440 and application-history.md:160-164. application-history.md:11-12 and projection-replay.md:6-9 both name the README as owner, so changing the owner to openapi.yaml must update those links too.
+- Fix: Make openapi.yaml the owner of wire, limit and refusal detail. Cut the README API section to a route table (public vs internal) plus one paragraph per side with links, and keep only semantics in the protocol docs. Do this together with the E1-E3 freeze: replace the frozen subsections with a link and a 'frozen pending sync redesign' note rather than editing their prose.
+- Decision: Confirm that openapi.yaml, not the README, is the owner of the wire contract (the PR #50 review raised ownership).
+
+### E10. Stale and restating module comments in egress
+
+`nit · unverified-nit · -8 lines · S · docs-only`  
+Where: `sequencer/src/egress/mod.rs:4-6`, `sequencer/src/egress/api/subscribe.rs:4-6`, `sequencer/src/egress/api/health.rs:26-28`, `sequencer/src/http.rs:142-143`
+
+- Claim: egress/mod.rs says 'WS subscribe (today), future read-only endpoints', but /history, /historical-l1-inputs and the snapshot routes already exist. subscribe.rs:5-6 restates RAII ('permit is held for the lifetime of the session and released on disconnect via Drop'). health.rs:26-28 restates the struct's two fields.
+- Fix: Reduce egress/mod.rs to one line naming the internal surface. Delete the RAII sentence and the field restatement. Point the http.rs split comment to the register entry instead of 'the api split'.
+
+### ES1. WS feed module and test still claim to serve native catch-up
+
+`nit · skeptic-added · +0 lines · S · docs-only`  
+Where: `sequencer/src/egress/l2_tx_feed/mod.rs:4`, `sequencer/src/egress/l2_tx_feed/tests.rs:139`, `sequencer/src/egress/l2_tx_feed/tests.rs:185`, `sequencer/src/ingress/inclusion_lane/catch_up.rs:65`
+
+- Claim: The l2_tx_feed module doc says the feed is 'used by WS subscriptions and catch-up replay', and the lock test is named cancelled_catchup_prepare_... and asserts 'detached catch-up preparation must retain process ownership'. Catch-up does not use L2TxFeed: it calls canonical_history_page directly. Anyone freezing or deleting the feed under E3 would wrongly conclude that native restart depends on it.
+- Fix: In the E4 pure move, reword mod.rs:4 to 'DB-backed ordered-L2-tx feed for WS subscriptions'. Rename the test to cancelled_subscription_prepare_retains_process_lock... and fix its assert message.
+
+Keep (load-bearing):
+
+- Mandatory HistoryClaim (era, generation, next_input) on every WS subscribe (subscribe.rs:30-52; core history.rs:185-209). Do-not-simplify 'Don't retain a numeric resume offset without its history identity' (invariants.md:464-465, I18): recovery reuses suffix offsets.
+- Per-page claim revalidation inside one read transaction (l2_tx_feed/mod.rs:196-210, canonical.rs:47-60). This is the actual safety gate; the pre-upgrade prepare() only exists to return a typed 409 before the 101.
+- X-History-Error header duplicating the 409 body (subscribe.rs:61-69). WebSocket clients may stop reading after the failed upgrade's headers; the SDK reads the header first (sdk lib.rs:289-302), and a test pins this (lib.rs:409-423).
+- Gap, length and i64::MAX+1 guards in canonical_page_in (canonical.rs:82-134): 'impossible states fail loud', on a reader shared with native restart catch-up (catch_up.rs:65).
+- Generation cuts and the complete-lineage assert (storage/history.rs:98-148): the in-era standard-recovery mechanism; it survives the direction, and a missing cut must never authorize a partial minimum (I18).
+- base_executed_input_count / next_executed_input_count_in (storage/history.rs:85-96): the sequencer's own absolute offsets after a rebuild. This is N12's base C, needed by native replay regardless of the client design.
+- Process-lock retention by detached feed blocking work (l2_tx_feed/mod.rs:82, 121-141; test tests.rs:139-205): data-directory ownership must outlive cancelled requests.
+- Subscriber cap (64) checked before claim validation (state.rs:42-49, http.rs:145). Each subscriber pins a blocking thread polling every 20 ms; the cap bounds blocking-pool use and SQLite polling (about 3,200 small read transactions per second at the cap, acceptable for internal consumers).
+- HistoricalResponseBody tying the admission permit to the body's lifetime (egress/api/history.rs:116-176): bounds in-flight page memory to 8 pages. Keep until E1 removes the route; do not polish.
+- Health probes on the internal listener (health.rs:11-12): operators and the kubelet probe from inside the cluster.
+
+## F. L1 reader, batch submitter, provider
+
+Verdict: Area F covers the reader, the submitter and the shared provider code. The reader ingests safe InputBox events after a chain-id gate. It checks each batch two ways: index contiguity, and a getNumberOfInputs count pinned at the safe block. The submitter is a stateless tick. It re-derives the unresolved suffix from the safe-accepted frontier plus a Latest scan, raises the wallet-nonce watermark durably before broadcasting (I14), and re-estimates fees on every tick. The content-identity check and the divergence freeze (I9/I15) run in the same transaction as the reader's append. Production code is about 3,300 lines, roughly 23% of them comments. The core mechanisms are proportionate and well chosen. The "large files" are mostly misplaced tests: reader.rs is about 813 production lines plus about 810 lines of tests. l1_submission.rs is only 271 production lines; about 1,000 of its 1,240 test lines exercise check_danger and populate_safe_accepted_batches, which live in other modules. poster.rs is about 546 production lines. The biggest real problems are classification and observability under failure. Self-trust violations and impossible states are routed into the transient "provider/transport" bucket. Provider errors are stringified with no operation, nonce or stage. They are logged at error level on every poll tick and, through reqwest's Display, carry the full RPC URL. The rest is leftover cleanup: a redundant poster-level shutdown select left over from 288ed14, a test-only partition model that duplicates the production bisect, per-nonce pending-age bookkeeping where tracking only the head nonce would do, dead public storage helpers, and rationale prose repeated three or four times. Keep the double input-completeness witness, the write-before-broadcast watermark, the same-transaction divergence freeze, the single encode path shared by seal and submit, and the no-internal-retry stateless tick.
+
+
+### F1. Self-trust violations and impossible states are classified as transient provider errors
+
+`low · disputed · -15 lines · S · BC`  
+Where: `sequencer/src/l1/submitter/poster.rs:532-539`, `sequencer/src/l1/submitter/worker.rs:244-266`, `sequencer/src/l1/reader.rs:458-465`, `sequencer/src/l1/reader.rs:740-748`
+
+- Claim: Three things are true. (a) The impossible usize/overflow paths at reader.rs:458-465 and 740-748 are wrapped as InputReaderError::Provider. The codebase's own pattern for this is expect("...: contract-impossible") (storage/ingress.rs:254, storage/l1_inputs.rs:432). (b) worker.rs:245-265 re-validates the poster's answer and reports the mismatch as a retryable Provider error, which the self-trust section rules out ('no re-validation of a neighbor module's answer', threat-model README.md:34). (c) An undecodable own-key batch maps to Provider (poster.rs:538-539). The claim overstates the impact, though. Nothing here is 'retried silently': worker.rs:193 logs each occurrence at error level. The undecodable-landing stall also clears on its own once the landing passes safe, because the scan starts at safe_block+1 (worker.rs:215-218) and populate already treats undecodable copies as scheduler no-ops (safe_accepted_batches.rs:222-225). None of this has a reachable correctness effect. It is classification and labelling of impossible events.
+- Fix: First patch (refactor only): replace the impossible usize/overflow paths with expect() and a reason, and turn the worker's poster-count self-checks into debug_assert! or delete them. Second patch (behavior change): give the own-key undecodable batch its own variant carrying tx hash and InputAdded index. Decide whether it is terminal (the self-trust rule) or skipped in the fold to mirror the scheduler's no-op treatment. Do not label it a provider error either way.
+- Decision: For an undecodable batch from our own key: terminal exit (the self-trust rule) or skip it in the nonce fold (mirroring the scheduler's no-op)?
+- Independent trace: refuted. The code reads as the reviewer describes.
+
+### F2. Worker error logs lack operation, nonce and stage, fire at error level every tick, and mislabel SQLite faults
+
+`low · confirmed · +10 lines · S`  
+Where: `sequencer/src/l1/reader.rs:318-319`, `sequencer/src/l1/reader.rs:495`, `sequencer/src/l1/reader.rs:798`, `sequencer/src/l1/reader.rs:806`, `sequencer/src/l1/submitter/worker.rs:188-195`
+
+- Claim: As stated, with one sharper detail. BatchPosterError::Watermark is #[error(transparent)] (poster.rs:70-71), and WalletNonceWatermarkError::Storage/OpenStorage use #[source] with fixed Display text (watermark.rs:25-28). worker.rs:193 logs `error = %source`, so a SQLite BUSY on the watermark writer is logged as 'L1 provider error — will retry' with only 'watermark sink storage write failed' and no rusqlite cause. The divergence marker persists safe_input_index (safe_accepted_batches.rs:362-371), so the tx hash can be recovered with a join. Adding it to the log is a convenience, not a gap.
+- Fix: Prefix each Provider string with its operation and key fields (e.g. 'estimateGas nonce=N', 'eth_getBlock(safe)'). Use a small map_err helper per module, not a new error framework. In worker.rs, log Watermark failures under their own message. Add transaction_hash, plus our hash and the landed hash, to the divergence error log. Whether to downgrade the per-tick retry logs to warn after the first occurrence is the maintainer's call. Fix URL leakage through the register entry (see notes_triage), not here.
+- Decision: Keep error level on every retry tick, or log error once and then warn at a lower rate?
+
+### F3. l1_submission.rs is 1,510 lines because about 1,000 test lines belong to other modules
+
+`low · confirmed · +0 lines · S`  
+Where: `sequencer/src/storage/l1_submission.rs:509-940`, `sequencer/src/storage/l1_submission.rs:942-1510`, `sequencer/src/storage/recovery.rs:233`, `sequencer/src/storage/recovery.rs:643`, `sequencer/src/storage/safe_accepted_batches.rs:131`
+
+- Claim: Production code in l1_submission.rs ends at line 271, and tests start at 272. Roughly 850 test lines, not 1,000, belong elsewhere: check_danger tests at 525-940, and populate/divergence/seal-hash tests at 941-1315 and 1390-1510. pending_batches_skips_invalidated_and_respects_min_nonce (1316) and nonce_is_reused_after_torn_cascade (1347) test this module's own pending_batches and should stay. check_danger's tests live in a separate file (`mod tests;` at storage/recovery.rs:643). The local helpers default_test_protocol and unix_now_ms (509-523) must move with the tests.
+- Fix: Move the check_danger tests into storage/recovery's tests module, and the populate, divergence and seal-hash tests into safe_accepted_batches.rs tests. Pure move: no code changes and a separate patch.
+
+### F4. Poster-level shutdown select is a redundant leftover of 288ed14
+
+`low · confirmed · -40 lines · S`  
+Where: `sequencer/src/l1/submitter/poster.rs:68-69`, `sequencer/src/l1/submitter/poster.rs:81`, `sequencer/src/l1/submitter/poster.rs:160-161`, `sequencer/src/l1/submitter/poster.rs:372-381`, `sequencer/src/l1/submitter/poster.rs:442-447`
+
+- Claim: EthereumBatchPoster races every send against the same RuntimeScope that the submitter's run_forever already biased-selects on. The poster's BatchPosterError::Shutdown arm can never reach a caller in production.
+- Fix: Remove the poster's shutdown field, externalize_provider_call, the Shutdown variant and its classification arm, and the dedicated test. Cancellation stays with the worker's run_forever select. Do it as a refactor-only patch.
+- Decision: Confirm no planned non-worker caller (e.g. a future one-shot submit command) relies on the poster cancelling itself.
+
+### F5. The watchdog parity fixture drives a test-only copy of the bisect, not the production code
+
+`low · partially · -60 lines · S`  
+Where: `sequencer/src/l1/partition.rs:68-98`, `sequencer/src/l1/partition.rs:108-178`, `sequencer/src/l1/partition.rs:180-184`, `sequencer/src/l1/partition.rs:230-239`, `sequencer/src/l1/partition.rs:212-218`
+
+- Claim: Core confirmed. partition_vector_simulation_matches_watchdog (partition.rs:321-353) drives the cfg(test) recursive model (116-178), so the production worklist (68-98) is only claimed to match it in prose (64-67). A generic bisect driven by the fixture is the right fix, though the parity test then becomes async. Two parts of the proposal are weaker than stated. sort_logs_by_l1_order is the seam the log-sort parity test calls (partition.rs:359). Deleting it only moves a tautology, because neither version tests production's key closure (219-225). The better fix is to make that key closure the shared function. The reader's missing-block_number branch (reader.rs:684-688) is unreachable through the ordered fetch (partition.rs:213-218), but it is pinned by a unit test (reader.rs:1347). ingest_input_added is documented as a pure function driven by synthetic pairs (reader.rs:673-675). Converting it to expect means deleting that test. That is acceptable under self-trust, but it is not free.
+- Fix: Make the worklist generic over its query closure (async fn bisect(from, to, splittable, query)). Use it in production, and drive it in the parity test with a closure that replays the fixture. Delete simulate_partitioned_get_logs and the two one-line wrappers. Change the reader's duplicate check to expect("ordered fetch guarantees block_number").
+
+### F6. Per-nonce pending-age map where tracking only the head nonce would do
+
+`nit · partially · -35 lines · S · BC · docs-only`  
+Where: `sequencer/src/l1/submitter/poster.rs:117-144`, `sequencer/src/l1/submitter/poster.rs:150-155`, `sequencer/src/l1/submitter/poster.rs:181-189`, `sequencer/src/l1/submitter/poster.rs:201-234`, `sequencer/src/l1/submitter/poster.rs:465-473`
+
+- Claim: Tracking only the head nonce is not equivalent to the documented contract. docs/l1-fee-policy.md:46-50 promises a per-nonce clock from first attempt that 'Accepted re-broadcasts do not reset'. Under head-only tracking the clock resets whenever Latest advances, so a slowly draining suffix (each nonce mining just under 5 min) never warns, even though its tail batch has been unresolved for k×5 min. The per-nonce map is the minimal structure that keeps first-attempt times for upcoming nonces. The real defect is noise: during a stall every tracked nonce warns independently (poster.rs:203-218), giving k warnings per interval. Warning only for the lowest tracked entry, which holds the oldest clock, fixes that with almost no line change and no doc change.
+- Fix: Replace the map with Option<(head_nonce, since, last_warned)>: reset when Latest's nonce changes, warn after PENDING_WAIT_WARN_AFTER, and log the refusal info once per head. Update the fee-policy paragraph to say 'Latest nonce has not advanced for N minutes'. Patch only once the warn semantics are agreed.
+- Decision: Is the 'unresolved since first attempt, per nonce' clock worth keeping over 'head stuck for N minutes'?
+
+### F7. Dead public storage helpers, a test-only error variant and a stale module doc
+
+`low · confirmed · -25 lines · S`  
+Where: `sequencer/src/storage/l1_submission.rs:4-13`, `sequencer/src/storage/l1_submission.rs:54-56`, `sequencer/src/storage/l1_submission.rs:108-121`, `sequencer/src/storage/l1_submission.rs:124-129`, `sequencer/src/commands/setup/fill.rs:322`
+
+- Claim: Confirmed, with two corrections. frames_for_batch_in is production code (l1_submission.rs:243, via load_batch_frames_in); only the Storage::frames_for_batch wrapper (127-129) is test-only. The getter Storage::batch_tree_anchor (l1_submission.rs:59) is also test-only (fill.rs:207/288 in its test module, l1_inputs.rs:671-685); the e2e/harness batch_tree_anchor calls are the harness's own methods. WalletNonceWatermarkError::Other is constructed only at poster.rs:766 and watermark.rs:97, both tests. The test sink can return Storage(SQLITE_BUSY) instead.
+- Fix: Mark the three methods cfg(test), or delete them and have the tests call the _in helpers. Fix the module doc. Have the test sink inject a busy rusqlite error instead of keeping the Other variant.
+
+### F8. Cockroach-recovery seams in the reader and its storage: freeze, don't polish
+
+`low · partially · +0 lines · S`  
+Where: `sequencer/src/l1/reader.rs:138-141`, `sequencer/src/l1/reader.rs:225-231`, `sequencer/src/storage/l1_inputs.rs:69-152`, `sequencer/src/storage/l1_inputs.rs:176-183`, `sequencer/src/storage/l1_inputs.rs:266-268`
+
+- Claim: The freeze recommendation stands, but the inventory needs fixing. open_tip_nonce (l1_submission.rs:110-121) is test-only, per F7, so it is not a live recovery seam: delete it rather than freeze it. The missing-baseline branch in populate (safe_accepted_batches.rs:166-177) also serves plain setup, per its own comment ('Plain setup detects prior activity before installing genesis'), so it is not cockroach-only. The real seams are FrontierMode::DeferUntilAnchorSet and set_frontier_mode (reader.rs:138-141, 225-231; sole caller setup/mod.rs:262), first_batch_submitter_input_after_block (l1_inputs.rs:85; setup/mod.rs:705) and safe_inputs_in_block_range (l1_inputs.rs:120; setup/mod.rs:488/494). Together they come to about 100 production lines.
+- Fix: Freeze: no doc or abstraction polish on these items. Carry two constraints into the tool's design. First, it must reuse the reader's verified ingest rather than a fresh log scan (the warning at l1_inputs.rs:74-79 remains true). Second, the batch-tree anchor (I16) survives in any design, because a tool-produced sequencer state still roots at N'.
+
+### F9. Rationale repeated three or four times, design-history prose, and table cells over 150 words
+
+`low · partially · -120 lines · M · docs-only`  
+Where: `sequencer/src/l1/mod.rs:16-29`, `sequencer/src/l1/provider.rs:127-134`, `sequencer/src/l1/submitter/poster.rs:46-50`, `sequencer/src/l1/submitter/poster.rs:394-402`, `sequencer/src/l1/reader.rs:38-44`
+
+- Claim: The mid-life chain-failover rationale really is stated three times: provider.rs:127-134, poster.rs:46-50 and poster.rs:394-402, the last one tagged '(review)'. The design-history prose at l1/mod.rs:23-29, safe_accepted_batches.rs:122-130 and l1_inputs.rs:41-42 is as described. reader.rs:38-44 is not a repeat, though: it covers in-model operator URL repointing across restarts. The 'Uniswap row' is threat-model README.md:24 (about 208 words); line 25 is the 17-word batch-submitter-key row. The RPC row (:22) is about 175 words. The Uniswap row belongs to the fee-oracle area. The failover rationale itself names a scenario the threat model excludes (see FS1), so trimming it is a content decision, not just a wording one.
+- Fix: State each rationale once: chain-id window at create_verified_signer_provider; poster and reader link to it in one line. Delete the design-history sentences. In the threat model, cut each actor row to trust level plus a one-line capability, and move the completeness-witness and oracle-outage arguments into short subsections. Leave the F8 items untouched.
+
+### F10. SubmitterExit is a one-variant enum that every caller maps away
+
+`nit · unverified-nit · -10 lines · S`  
+Where: `sequencer/src/l1/submitter/worker.rs:69-78`, `sequencer/src/commands/run/workers.rs:144`, `sequencer/src/commands/run/workers.rs:353`, `sequencer/src/commands/run/workers.rs:619-621`
+
+- Claim: SubmitterExit::Shutdown is the only variant, and the supervisor immediately pattern-maps it to ().
+- Fix: Return Result<(), BatchSubmitterError> like the reader does.
+
+### FS1. Chain-id gating is asymmetric: the poster defends against mid-life failover, but the reader checks only once
+
+`low · skeptic-added · -6 lines · S · BC`  
+Where: `sequencer/src/l1/reader.rs:146`, `sequencer/src/l1/reader.rs:344-348`, `sequencer/src/l1/reader.rs:488-502`, `sequencer/src/l1/reader.rs:394-401`, `sequencer/src/l1/submitter/poster.rs:46-50`
+
+- Claim: The poster re-checks eth_chainId before every productive send, specifically to survive a load-balanced RPC that fails over to another chain mid-life. The reader is the component whose ingest writes durable state, yet it verifies the chain id only once per instance (the chain_id_verified flag). Its comment says the check runs 'before reading anything from it'. Either mid-life failover is in scope, in which case the reader is the weaker gate, or it is out of scope ('must be one consistent node'), in which case the poster's gate and its three rationale comments defend an excluded scenario without naming that assumption.
+- Fix: Decide the model first. If failover is in scope, drop the chain_id_verified flag and check every tick. That is stateless, about -6 lines and one extra eth_chainId per poll. If it is out of scope, reword poster.rs:46-50/394-402 and provider.rs:131-134 to name the assumption and a revisit trigger, and fix the overstated reader comment.
+- Decision: Is a mid-life RPC chain failover inside the supported trust model?
+
+### FS2. The watermark raise does a blocking SQLite open and durable write on the async submitter and flusher tasks
+
+`low · skeptic-added · +6 lines · S · BC`  
+Where: `sequencer/src/l1/submitter/poster.rs:426`, `sequencer/src/recovery/flusher.rs:263`, `sequencer/src/l1/watermark.rs:63-73`, `sequencer/src/storage/open.rs:171`, `sequencer/src/l1/submitter/worker.rs:274`
+
+- Claim: StorageWatermarkSink::raise_to opens a writer connection with a 5 s busy_timeout and commits a durable MAX upsert synchronously. It is called inline from async submit_batches and from the flusher. The submitter routes every other SQLite access through spawn_blocking_with_lock. Under writer contention with the lane, this ties up a tokio worker thread for up to 5 s, and the biased shutdown select cannot preempt it.
+- Fix: Run the sink call through spawn_blocking_with_lock, in the poster or by making the sink own the lock and the blocking hop, and await it before the first send. Write-before-broadcast ordering is preserved, and the MAX upsert is idempotent if a cancelled raise finishes in the background. Do this in the same patch that settles the register's SQLite-contention entry, so both paths get one policy.
+
+Keep (load-bearing):
+
+- Double input-completeness witness in the reader (reader.rs:375-405, 438-466): index contiguity proves the right prefix, and getNumberOfInputs pinned at the scanned safe block proves the prefix is complete. It is the only defense against truncated get_logs from a lagging endpoint. The count-first fast path is the same trust base and saves a long paginated crawl.
+- Log/payload cross-check in ingest_input_added (reader.rs:678-724): block number and index are both carried by the log and by the EvmAdvance payload, and must agree. It mirrors the watchdog's decode_and_validate_log.
+- Three chain-id gates (reader.rs:488-504 once per reader, poster.rs:403-413 per non-empty tick, provider.rs:135-154 for keyed one-shot writers): they protect different windows (ingest, long-lived signing, one-shot signing). Keep the code and trim the repeated prose (F9).
+- Write-before-broadcast watermark (watermark.rs:43-74, poster.rs:422-426, l1_submission.rs:85-97): I14. A single MAX upsert committed with synchronous=FULL is the whole zombie-prevention anchor for the flush.
+- Content-identity check and divergence marker written in the same transaction as the reader's append (safe_accepted_batches.rs:146-154, 225-245, 296-335): I9/I15. The early return on an existing marker is the frontier freeze. The per-invocation scan cursor (113-120) is deliberate so a recovery batch reusing a nonce is not skipped.
+- load_batch_frames_in as the single encode path shared by seal and submitter (l1_submission.rs:231-270): the seal-time hash must come from the same bytes the submitter broadcasts, or I15 raises false mismatches.
+- Stateless submitter tick that re-derives everything from the safe frontier plus a Latest scan, with no internal retry (worker.rs:207-269): on the Do-not-simplify list (docs/invariants.md:468-470). The orchestrator respawn is the retry mechanism.
+- is_pending_tx_conflict classification (poster.rs:329-350): lets the rest of the suffix go out past a held nonce. An unrecognised wording falls back to the old behavior, so it is safe.
+- pad_gas_estimate (eip1559.rs:20-25): an out-of-gas revert would burn a wallet-nonce slot with no InputAdded.
+- L1-order sort plus refusal of logs missing a block number, at one point (partition.rs:192-228): both the reader's contiguity witness and the submitter's nonce fold need canonical order.
+- Operator-configurable long-range error codes for the bisect (partition.rs:11-26): range-error messages are not stable across providers. The overload with rate-limit codes is documented and accepted.
+- App-deployment-block scan floor gated on the v3 InputBox version() witness (reader.rs:171-190, 601-649): turns a potentially enormous genesis crawl into a bounded one, and is sound only under the verified v3 semantics.
+- HTTPS enforcement with an explicit insecure opt-in, and SubmitterKey redaction (provider.rs:30-50, l1/mod.rs:46-71): cheap guards against operator foot-guns and key leaks.
+
+## G. Automatic recovery and cockroach recovery (setup --recovery)
+
+Verdict: This area does two separate jobs. The first is automatic startup recovery: the detector exits, the orchestrator respawns, startup inspects, syncs, picks one repair under a guarded transaction, inspects again, and runtime admission checks a final time. The second is cockroach rebuild via `setup --recovery`: load a checkpoint, flush, re-sync, fold, publish a baseline. Production code is about 2,600 lines. The large file sizes are mostly tests (flusher.rs is ~405 prod / ~530 test, recovery/mod.rs ~505/~560, fill.rs ~75/~540). The automatic-recovery core is proportionate to its real concurrency and durability complexity: one dispatch table, Immediate transactions that re-inspect before mutating, a flush observation kept only on the stack, and a typed retry/refuse split. I found no high-severity bug. The real defects are a two-call TOCTOU in the flusher's completion observation (a fail-loud backstop exists) and a leftover plain-setup `--checkpoint-block` that turns an early clean refusal into a later, absorbing CanonicalDivergence. The biggest structural problem is that cockroach recovery is woven into `setup` (~270 prod lines in setup/mod.rs, ~450 counting config, errors and tests). That is exactly what the planned shared tool replaces, so it should be frozen. The pieces that survive (Checkpoint load, the seed/replay split, `fold_replay`, `fill_recovery_state`) already form an almost pure seam. N1 is cheap (~45 lines) with a genesis selector. docs/recovery/README.md is accurate and tight, but code comments repeat themselves (the DangerStatus arms are described four times) and carry stale history.
+
+
+### G1. Freeze `setup --recovery` in-band orchestration (~450 lines incl. config/errors/tests)
+
+`medium · partially · -450 lines · L · config`  
+Where: `sequencer/src/commands/setup/mod.rs:405-673`, `sequencer/src/commands/setup/checkpoint_tests.rs:1-226`, `sequencer/src/commands/config.rs:378-453`, `sequencer/src/commands/error.rs:387-430`, `sequencer/src/recovery/mod.rs:79-86`
+
+- Claim: Freezing the in-band `setup --recovery` orchestration is right. The code that only cockroach recovery uses is `Checkpoint`/`load`/`source_fold_inputs`/`recover`/`rebuild_from_checkpoint`/`flush_wallet_nonce`/`to_fold_input` (sequencer/src/commands/setup/mod.rs:405-673), the recovery config and validation (config.rs:378-453), `SetupRecoveryError` (error.rs:387-430), the frontier toggle (setup/mod.rs:255-263), `CheckpointAheadOfStop` (recovery/mod.rs:79-86, raised only at setup/mod.rs:571), and `assert_resync_caught_up` (recovery/mod.rs:136, called only at setup/mod.rs:555). The docs scope is mis-stated, though. cockroach.md:140-160 'Application-specific reader state' (restore the client checkpoint, replay L1 through C, drain, then agree on K) is not removed by the direction. It is the manual form of the client half that the shared tool will automate, and G2 itself relies on it (cockroach.md:142-144), so keep it as that half's spec. docs/protocol/projection-replay.md is mostly the general egress bootstrap: /history, replay from genesis, subscribe at K (projection-replay.md:11-31), plus standard-recovery generation compatibility (:44-56). The new sync supersedes it, but it belongs to the egress area and is not cross-era cockroach machinery.
+- Fix: Freeze: fix only safety bugs. Do not polish its error classification (including the re-sync site of the open register entry), load ordering, receipt format, or SetupRecoveryError wording. About 150 of these lines move into the tool library (see G2); the rest is deleted at extraction, not now.
+- Decision: Confirm the freeze scope covers the projection-replay cross-era docs as well as the setup code.
+
+### G2. Extraction seam for the shared recovery tool: keyless, generic over Application, C supplied
+
+`medium · partially · -250 lines · L · BC · config`  
+Where: `sequencer/src/commands/setup/mod.rs:560-614`, `sequencer/src/commands/setup/mod.rs:405-499`, `sequencer-core/src/scheduler/fold.rs:4-20`, `sequencer-core/src/scheduler/fold.rs:62-75`, `sequencer/src/commands/setup/fill.rs:36-50`
+
+- Claim: The pure seam is real. `rebuild_from_checkpoint` only sources `safe_inputs`, folds, and fills (setup/mod.rs:560-614). `fold_replay` is side-effect free and already expects a future standalone tool (sequencer-core/src/scheduler/fold.rs:12-15). The checkpoint loads only after the full sync (setup/mod.rs:534 vs 264), and B<=C is checked only after the signed flush (569 vs 537). The C-sourcing claim is wrong. `flush-mempool` does not return C: the command returns `()` and only logs `safe_block` (commands/flush.rs:23, 78-83). It also cannot run in either cockroach scenario. On a wiped DB it needs a completed setup (lifecycle.rs:250-252). On the surviving diverged DB its preflight refuses on canonical divergence (commands/flush.rs:30 -> lifecycle.rs:141). A keyless tool therefore needs a setup-less flush mode: submitter address plus an optional watermark, emitting C in machine-readable form. Either that, or the tool embeds the flush. The rest of the design is a reasonable plan, but it is a future-tool design, not a refactor of today's code.
+- Fix: (1) Library: `recover::<A>(Checkpoint<A>, inputs in (A,C] ascending, C, submitter) -> {app S', N', K, clock}`. Move into it Checkpoint+load (405-465), the seed/replay split (467-499), the A<B<=C checks (449-457, 569-577) and to_fold_input (664-673). (2) The tool never signs. C comes from the existing `flush-mempool`, and the tool refuses unless its L1 view reaches C. Run all deterministic checks (load, B <= synced head) before any L1 work. (3) Sequencer output: `setup --baseline <bundle>` publishes (S', N', K, C) through `fill_recovery_state`/`complete_baseline_setup`. Genesis becomes the trivial baseline. Setup loses --recovery, key args, the DeferUntilAnchorSet toggle, `flush_wallet_nonce`, `recover`, and SetupRecoveryError. (4) Client contract: the client runs the same library with its own richer `A`, from its own checkpoint (boundaries may differ, cockroach.md:142-144), to the same C. Agreement means equal (K, last_executed_safe_block) per I19 and equal N'. The receipt (era, C, N', K) is what the future sync binds to. Not worth investing in now: streaming fold inputs (setup/mod.rs:487-497 collects into a Vec, though fold accepts iterators), checkpoint.toml/finalized_snapshot receipt polish, setup-recovery error classification.
+- Decision: Should C come from `flush-mempool` (keyless tool, recommended) or should the tool embed the flush? Should the library live in sequencer-core or a new crate? Should the tool write the sequencer DB directly or emit a bundle for `setup --baseline`?
+
+### G3. N1: genesis recovery needs a hand-made bundle; add a genesis checkpoint selector
+
+`medium · confirmed · +45 lines · S · BC · config`  
+Where: `sequencer/src/commands/config.rs:425-428`, `sequencer/src/commands/setup/mod.rs:428-464`, `sequencer/src/commands/setup/mod.rs:318-330`, `sequencer/src/egress/api/snapshot.rs:205-218`, `sequencer/src/commands/setup/mod.rs:839-909`
+
+- Claim: Today `--recovery` requires `--checkpoint-dump-dir` holding info.toml, checkpoint.toml, and app state. checkpoint.toml is produced only by egress `/finalized_snapshot`. Plain setup cannot be used to mint a genesis artifact on a chain with prior batches, because its gate refuses before the genesis app is built. The loader already accepts genesis (`is_genesis`, setup/mod.rs:449-452), and the binary already has the genesis constructor (setup/mod.rs:47-50, used at 329), but recovery never receives it.
+- Fix: Add `--checkpoint genesis` (or: --recovery with B=0 and no dump dir) that builds `Checkpoint{app: genesis_app()?, A:0, N:0, B:0}`, reusing the count-zero check from fill.rs:18-28. Then remove the `is_genesis` exception from `Checkpoint::load`, so supplied bundles must strictly satisfy A<B. Cost: ~45 lines plus one test. Runtime cost: a full replay from app deployment, with all inputs held in memory (setup/mod.rs:487-497). That is acceptable until history is large; revisit if setup's RSS binds. Trust caveat: the result is canonical only if this binary's scheduler and app match the canonical machine over the whole history (the same trust as any (B,C] replay, over a longer range).
+- Decision: Add it now to frozen setup (~45 lines, immediately useful), or only as the genesis case of the future tool.
+
+### G4. Plain `setup --checkpoint-block B>0` is a leftover knob that defers a clean refusal into absorbing divergence
+
+`low · disputed · -10 lines · S · BC · config`  
+Where: `sequencer/src/commands/config.rs:368-377`, `sequencer/src/commands/setup/mod.rs:233-246`, `sequencer/src/commands/setup/mod.rs:318-330`, `sequencer/src/commands/setup/mod.rs:704-705`, `sequencer/src/commands/setup/fill.rs:29-30`
+
+- Claim: Plain `setup --checkpoint-block B>0` is a dead, misleadingly documented knob (config.rs:368-375 'PR3 ...'), but the failure is not deferred to a later sync. Plain setup syncs with `FrontierMode::Populate` (only recovery defers, setup/mod.rs:261-263), with base 0 before completion (safe_accepted_batches.rs:166-177) and anchor 0. A previously accepted batch therefore fails content identity as Foreign (safe_accepted_batches.rs:301-309) and records the divergence marker during setup's own initial sync. The gate then passes because the batch is <= B, and `register_genesis_baseline` -> `complete_baseline_setup` refuses on that marker (lifecycle.rs:104-111). So setup still refuses before completion, with the same remedy (wipe + cockroach). It just shows a divergence refusal instead of `BatchPastCheckpoint` (exit 40 'setup needs recovery'). If the prior batches were all scheduler-rejected, genesis is correct. The impact is diagnostic only. A simpler fix than adding validation: delete `--checkpoint-block` entirely. In recovery it only cross-checks the receipt the operator copies it from (setup/mod.rs:436-441; cockroach.md:178 '--checkpoint-block <block-from-receipt>'), so B can come from checkpoint.toml. Keep the B-vs-deployment check (setup/mod.rs:239) for recovery.
+- Fix: Reject `checkpoint_block != 0` without --recovery in `SetupConfig::validate` (config.rs:434-443). Call the gate with 0, and drop the plain-path B-vs-deployment-block check. Under G2, the flag moves to the tool entirely.
+- Independent trace: refuted. The claim says plain setup with B>0 'defers a clean refusal into absorbing divergence' that 'a later sync records'.
+
+### G6. `TipAlreadyOpen` is documented as impossible yet handled as Retry
+
+`low · confirmed · -8 lines · S · BC`  
+Where: `sequencer/src/storage/recovery.rs:115-119`, `sequencer/src/storage/recovery.rs:267-269`, `sequencer/src/recovery/mod.rs:89-90`, `sequencer/src/recovery/mod.rs:497-499`
+
+- Claim: The variant doc says it is 'unreachable under the process lock, and retryable if it ever fires'. Retrying an impossible state goes against the 'impossible states fail loud' principle: the next boot re-inspects, finds Ready, and admits, hiding the only cause that can produce this state (a lock violation).
+- Fix: Classify it as refuse (or `assert!` inside the transaction, which rolls back on unwind), and delete `RecoveryRetryReason::TipAlreadyOpen`. This changes the exit code from 20 to 30 for a state that should never occur.
+
+### G7. DangerStatus arms restated four times; flush docs narrate each other's callers
+
+`low · confirmed · -60 lines · S · docs-only`  
+Where: `sequencer/src/storage/recovery.rs:37-54`, `sequencer/src/storage/recovery.rs:57-83`, `sequencer/src/storage/recovery.rs:173-232`, `sequencer/src/recovery/flusher.rs:124-134`, `sequencer/src/commands/setup/mod.rs:620-628`
+
+- Claim: The DangerStatus arms are described in the enum-level list (storage/recovery.rs:37-54), the per-variant docs (57-83), the numbered list (173-205), and the trust-hierarchy list (206-228). The enum-level list is also incomplete: it omits `CanonicalDivergence`. Caller narration appears at flusher.rs:128-134 and setup/mod.rs:625-628, and meta commentary at detector.rs:12-16. Keep one ordering paragraph that cites I4, because the arm order is on the Do-not-simplify list (docs/invariants.md:459-461).
+- Fix: Keep one-line variant docs plus one ordering paragraph citing I4. Delete the caller narration and meta commentary.
+
+### G8. Stale code docs: 'shared with the batch submitter', 'PR3', `flush_and_wait` as the entry point
+
+`low · confirmed · -10 lines · S · docs-only`  
+Where: `sequencer/src/storage/recovery.rs:10-12`, `sequencer/src/storage/recovery.rs:436`, `sequencer/src/commands/config.rs:372-375`, `sequencer/src/commands/error.rs:394-396`, `sequencer/src/recovery/flusher.rs:4-10`
+
+- Claim: Confirmed as stated, plus two more stale lines in the same vein. commands/flush.rs:9 says 'the same flush `setup --recovery` will run internally' in the future tense, although it already does (setup/mod.rs:653). The SetupRecoveryError doc (error.rs:388-390) says the post-flush re-sync uses the transient RecoveryError paths, but the re-sync's sync failure maps to `WorkerExit::InputReader` (setup/mod.rs:546-553). Only the caught-up check uses RecoveryError (555).
+- Fix: Correct the wording; mark the test-only visibility as such.
+
+### G9. Log levels contradict the documented semantics (flush timeout, detector exit, per-slot send errors)
+
+`nit · partially · -5 lines · S`  
+Where: `sequencer/src/recovery/flusher.rs:380-389`, `sequencer/src/recovery/flusher.rs:236-247`, `sequencer/src/recovery/detector.rs:152-157`, `sequencer/src/recovery/detector.rs:35-37`, `sequencer/src/recovery/flusher.rs:354`
+
+- Claim: Only the flusher timeout contradiction is clear. flusher.rs:381-389 logs error! with 'should not happen during normal L1 operation', while flusher.rs:236-239 calls the same timeout 'the flush's ordinary rhythm, not a fault'. That deserves debug/warn. The detector point is debatable. detector.rs:35-37 says 'not an error' about the exit classification (a distinct CommandError, exit 10), not about severity. A danger detection stops soft confirmations, and the statuses include `CanonicalDivergence`, so a blanket warn would under-report divergence. If anything, choose the level per status. The per-slot error! (flusher.rs:354) is redundant only for the first three nonces; the aggregate carries just three samples (95-115), so the per-slot lines are the only record of the rest.
+- Fix: Log the watch timeout at debug (keep the loop's single warn). Lower the detector to warn. Drop the per-slot error!, since the aggregate already carries three samples.
+
+### G10. Stringified transport errors can embed credential-bearing RPC URLs
+
+`low · confirmed · +10 lines · S`  
+Where: `sequencer/src/recovery/flusher.rs:283`, `sequencer/src/recovery/flusher.rs:324`, `sequencer/src/recovery/flusher.rs:353-354`, `sequencer/src/recovery/flusher.rs:402`, `sequencer/src/l1/provider.rs:146`
+
+- Claim: Confirmed. Fold it into the open register entry 'Startup logs the full RPC URL' as a scope extension; it is not a separate work item.
+- Fix: Extend that register entry's scope to transport error strings and redact once at the provider boundary (strip the URL), rather than fixing each site. Verify with a synthetic credential URL.
+
+### G11. Flush waits on its own tx hash instead of slot consumption
+
+`low · confirmed · -25 lines · S · BC`  
+Where: `sequencer/src/recovery/flusher.rs:367-395`, `sequencer/src/recovery/flusher.rs:117-122`, `sequencer/src/recovery/flusher.rs:265-270`, `sequencer/src/recovery/flusher.rs:62-66`
+
+- Claim: Accurate, but the race is narrower than implied. No-ops are sent only from `nonce_at(Latest)` upward (flusher.rs:254, 265), so an original tx already mined gets no competing no-op. The 10-block wait (derive_timeouts, 62-66) happens only when the original or a zombie is mined between that read and the broadcast, or outbids the 3x-headroom bumped no-op. Expect about -15 to -20 lines rather than -25.
+- Fix: Replace watch_txs with a bounded wait (same timeout, polling every safe_poll_interval) for `nonce_at(Latest) >= flush_end`. Delete map_watch_error, the hash vector, and the PendingTransactionConfig use. This adds no retry loop (the Do-not-simplify rule is respected): errors still propagate and the outer loop is unchanged. Gain: up to 10 blocks only in the race where the original lands, so it is justified as a simplification, not as a performance fix.
+
+### G12. Three guarded recovery mutations repeat the same transaction preamble
+
+`nit · partially · -20 lines · S`  
+Where: `sequencer/src/storage/recovery.rs:248-278`, `sequencer/src/storage/recovery.rs:282-306`, `sequencer/src/storage/recovery.rs:312-338`
+
+- Claim: The preamble is duplicated three times (storage/recovery.rs:253-260, 288-295, 318-325), but the proposed closure helper hides each method's commit point in safety-critical guarded mutations and nets only about -8 to -12 lines. A plainer helper, `begin_guarded(&mut self, protocol, now_ms) -> Result<(Transaction<'_>, RecoveryInspection), RecoveryMutationError>`, would open the Immediate tx, inspect, refuse divergence, and require the checkpoint. Each method would keep its own guard and an explicit `tx.commit()`.
+- Fix: Add a private `guarded(&mut self, protocol, now_ms, body: FnOnce(&Transaction, RecoveryInspection) -> Result<T, RecoveryMutationError>)` that commits on Ok, keeping each action-specific guard in its body. Pure refactor.
+
+### GS1. Cockroach flush throws away a surviving durable watermark
+
+`low · skeptic-added · +10 lines · S · BC · config`  
+Where: `sequencer/src/commands/setup/mod.rs:652`, `sequencer/src/commands/flush.rs:30`, `sequencer/src/storage/lifecycle.rs:141`, `sequencer/src/recovery/flusher.rs:160-172`, `docs/recovery/cockroach.md:246-250`
+
+- Claim: The flusher's only defense against zombie batch txs (dropped from the local pool but alive elsewhere) is the durable watermark anchor `safe >= watermark + 1`. `setup --recovery` reads the watermark from the freshly wiped DB, which is None on a first attempt. `flush-mempool` cannot be pointed at the surviving old data dir either: its preflight refuses on canonical divergence, which is the usual reason for a cockroach recovery. So even when the old DB is intact (every divergence-triggered rebuild), recovery falls back to the provider's pool view, and cockroach.md presents the watermark as unavailable ('The lost database cannot supply').
+- Fix: Do not change frozen setup. In the shared tool (G2), let the flush step take an optional read-only watermark from the old DB (`SELECT watermark FROM wallet_nonce_watermark`) and use the max of that and any fresh watermark. This is a stateless read with no new machinery. Invariant protected: every wallet slot the previous deployment may have broadcast is consumed at safe depth before C. Quantified: it matters only when a zombie exists at rebuild time, which is rare, but the existing fallback is a second full cockroach. Update cockroach.md:246 to say 'when the database is lost'.
+- Decision: Should the shared tool's flush accept the old data dir (or its watermark value) as an optional input?
+
+Refuted:
+
+- G5. Flusher reads the safe nonce and C in two separate Safe-tag calls. No reachable scenario under the supported trust model.
+
+Keep (load-bearing):
+
+- RuntimeAdmission witness plus the final admit_runtime re-inspection (recovery/mod.rs:110-116, 374-386): preparation can outlast the L1 view's freshness; only the final check authorizes launch.
+- Provider-failure fallback on the initial sync only, and none after the flush (recovery/mod.rs:267-276 vs 305): the cascade needs a view that has actually caught up to the flush observation.
+- Flush observation kept only on the stack, so a retry flushes again (recovery/mod.rs:302-304): a persisted witness could go stale across restarts.
+- Guarded Immediate transactions that re-inspect before mutating (storage/recovery.rs:248-338): clock-dependent facts can change between the decision and the mutation; StaleDecision is reachable.
+- check_danger arm order and the two find_* helpers (storage/recovery.rs:388-427): on the Do-not-simplify list (I4).
+- Unconditional post-flush cascade of the whole non-gold closed suffix (storage/recovery.rs:449-457): a convergence policy; keeping the suffix can re-enter the same danger cycle (pinned by recovery/mod.rs:843-894).
+- Generation advance inside cascade_and_reopen (storage/recovery.rs:492-494): I18 offset reuse needs history identity. Freeze it until the new client sync is designed, but do not remove it.
+- Watermark anchor `safe >= watermark+1` in the flush completion predicate (flusher.rs:203-208): I14, it covers zombie txs the local pool forgot.
+- No internal retry loop in the flusher (flusher.rs:298-303): Do-not-simplify; respawn is the retry.
+- RecoveryL1 trait (recovery/mod.rs:212-217): the one seam that lets procedure tests run real SQLite inspections and repairs.
+- Detector as its own worker holding a ProcessLock clone (detector.rs:73-80, 165-178): blocking checks keep data-directory exclusivity after shutdown races.
+- Checkpoint receipt agreement checks (setup/mod.rs:436-446) and fold.rs's always-on ordering assertions: cheap fail-loud guards on trusted inputs. They move to the tool rather than being deleted.
+- Exhaustive retry/refuse classifiers with polarity tests (recovery/mod.rs:388-504, 536-641): they pin exit-code semantics for the supervisor.
+
+## H. Commands, config, errors, runtime, storage foundation, logging (cross-cutting)
+
+Verdict: This area holds the operator surface: clap config for setup, run and flush-mempool, the exit-code taxonomy (10/20/30/40/1 plus SIGABRT 134), the run bracket and worker supervisor, the process lock and shutdown scope, the storage open/lifecycle foundation, and the baseline schema. Its size is mostly proportionate. About 4,200 Rust prod lines plus 660 SQL lines sit in scope. error.rs is about 727 prod and 600 test lines. config.rs is about 607 prod and 490 test lines. In both, the bulk is doc comments (31% and 26% of prod lines) and the verdict table test, not machinery. The exit-code projection is the essential part: one exhaustive CommandFailureVerdict feeds both the black box and the exit code, and it should stay. The biggest problems are diagnostic, not structural. (1) Root causes get lost: the error types mix two Display conventions, and every sink prints only Display. (2) io::Error values at data-dir and lock boundaries reach the operator with no path. (3) Expected exits (10/20) and per-poll retryable provider errors log at ERROR, which breaks ERROR-based alerting. The one real config hazard is N16: MAX_WAIT_BLOCKS is a binary constant that the deployment identity does not pin. Freeze the setup --recovery CLI and error surface, since the shared recovery tool supersedes it. The schema's triggers and CHECKs mostly earn their keep because they enforce registered invariants at the engine layer.
+
+
+### H1. Root causes vanish from exit, abort and black-box lines (two Display conventions, Display-only sinks)
+
+`medium · confirmed · +12 lines · S · BC`  
+Where: `sequencer/src/ingress/inclusion_lane/error.rs:17-44`, `sequencer/src/l1/watermark.rs:25-28`, `sequencer/src/egress/l2_tx_feed/error.rs:15-20`, `sequencer/src/egress/l2_tx_feed/error.rs:58`, `sequencer/src/harness.rs:129`
+
+- Claim: The claim holds. InclusionLaneError (error.rs:17-44), CatchUpError (error.rs:94-103), WalletNonceWatermarkError (watermark.rs:25-28) and SubscribeError/SubscriptionError (l2_tx_feed/error.rs:13-21, 57-67) use #[source] with a Display that omits the cause. Every sink prints only Display. Two details are missing. (a) WorkerExit (commands/error.rs:513-526) and WorkerStop::Source (error.rs:572-573) embed `{0}` without #[source], so source() stops at WorkerStop, and a chain-walker would also need those types changed. That makes embed-in-Display the consistent choice. (b) SubscribeError::OpenStorage also reaches abort_terminal through l2_tx_feed/mod.rs:92,105, which prints `preparing tx-feed subscription: cannot open subscription storage`. SubscribeError::Join embeds `{source}` while also marking it #[source] (l2_tx_feed/error.rs:23-27), so it would print twice under a walker.
+- Fix: Use one convention. The cheap option is to append `: {source}` to the ~10 format strings that omit it, which matches the convention CommandError and BootstrapError already use. Add one test that a nested lane error's Display contains its io-level root. Example: before `ERROR terminal runtime failure; aborting process error=inclusion lane: snapshot at batch close failed`; after `... error=inclusion lane: snapshot at batch close failed: <dump error>: No space left on device (os error 28)`. A chain-walking reporter is the alternative, but only if the embedded `{0}` is removed everywhere, otherwise causes print twice.
+- Decision: Choose embed-in-Display (small) or source()+chain-walker (repo-wide). Recommend embed-in-Display.
+
+### H2. Data-dir, lock and sweep io::Errors reach the operator with no path
+
+`low · partially · +25 lines · S · BC`  
+Where: `sequencer/src/commands/error.rs:51-52`, `sequencer/src/commands/error.rs:633`, `sequencer/src/runtime/process_lock.rs:66-72`, `sequencer/src/commands/run/mod.rs:51`, `sequencer/src/commands/flush.rs:24`
+
+- Claim: Confirmed in code: CommandError::Io (error.rs:51-52) and ProcessLockError::Io (process_lock.rs:40-41) are transparent. create_dir_all (run/mod.rs:51, flush.rs:24), the lock open (process_lock.rs:66-72), try_exists (commands/mod.rs:42) and read_dir (startup_hygiene.rs:85-86) therefore surface bare OS messages and exit 1. The diagnostic loss is smaller than claimed. These are the first filesystem actions of a single-data-dir command, and the operator supplied the path through --data-dir or the env, so the path can almost always be inferred. Carrying the path is a cheap papercut fix, not a medium defect.
+- Fix: Carry the path at these ~6 sites. Make ProcessLockError::Io a struct variant `{ path, source }`. Add a `DataDir { path, source }` CommandError variant for create_dir_all, try_exists and read_dir, classified Unclassified exactly like Io today. Example: before `ERROR sequencer exiting error=Permission denied (os error 13) exit_code=1`; after `ERROR sequencer exiting error=data-directory lock /var/lib/seq/sequencer.lock: Permission denied (os error 13) exit_code=1`. Add a row to the error.rs unclassified() table so the verdict stays pinned.
+
+### H3. Expected exits (10/20/40) and per-poll retryable provider errors log at ERROR
+
+`low · partially · +12 lines · S · BC`  
+Where: `sequencer/src/harness.rs:125-131`, `sequencer/src/l1/submitter/worker.rs:193`, `sequencer/src/l1/reader.rs:312-319`, `sequencer/src/runtime/shutdown.rs:17`
+
+- Claim: error! is used for every CommandError exit (harness.rs:129) and for each retried provider failure in the submitter (worker.rs:193, once per idle tick) and in the reader (reader.rs:312-319). The documented alerting contract, however, is the exit code (error.rs:61-73 projection header; docs/watchdog/operator-deployment.md), not log level, and the repo states no log-level policy. Exit 10 (danger detected) is an operationally significant event, not routine noise. The strongest part of the finding is the per-tick ERROR during an L1 outage, one line every 2-5 s. Downgrading retry logs to warn and adding a verdict field on the exit line is a reasonable low-priority cleanup.
+- Fix: Pick the level from the verdict: Terminal and Unclassified log at error; ExpectedRecovery, Retryable and SetupRecoveryRequired log at warn. Add a `verdict` field that names the supervisor action. Downgrade the per-tick retry logs to warn. Add `exit = "SIGABRT(134): terminal, do not restart"` to the abort line. Example: before `ERROR sequencer exiting error=worker exited: danger detector: danger detected (TipInDanger(41)) — stopping for startup recovery exit_code=10`; after `WARN sequencer exiting for supervised restart verdict=ExpectedRecovery exit_code=10 error=...`.
+
+### H4. MAX_WAIT_BLOCKS is a binary constant the deployment identity does not pin (N16)
+
+`low · disputed · +60 lines · M · BC · db-schema`  
+Where: `sequencer-core/src/lib.rs:21`, `sequencer/src/commands/config.rs:74-81`, `sequencer/src/storage/mod.rs:239-246`, `sequencer-core/src/scheduler/mod.rs:33-38`, `examples/canonical-app/src/bin/canonical-app-devnet.rs:11`
+
+- Claim: MAX_WAIT_BLOCKS (sequencer-core/src/lib.rs:21) is compiled into both the guest (scheduler/mod.rs:33-38) and the sequencer (config.rs:74-81), and DeploymentIdentity does not pin it (storage/mod.rs:239-246). The hazard is real but generic. AGENTS.md:74 makes 'the same source compiled into the on-chain machine' the model, and any build skew in sequencer-core scheduler rules (staleness formula, fee math, DOMAIN_NAME) diverges the same way. Pinning one constant covers one vector of many. The constant has not changed since it was introduced (git log -S: only 2bd2e62). The proposed `setup --max-wait-blocks` flag is worse than the status quo. It turns a single compile-time source of truth into an operator input that the sequencer cannot check against the guest's per-binary constant, which adds a new divergence path at setup. If build-skew detection is wanted, pin a compiled protocol fingerprint (MAX_WAIT_BLOCKS, DOMAIN_NAME, a protocol version) at setup and refuse a mismatch at run, with no operator knob.
+- Fix: Do not add a free runtime knob. Give it the same shape as the sequencer address: a per-deployment value. (1) Add a `SchedulerConfig::new(addr, max_wait_blocks)` constant per guest binary. (2) Add `setup --max-wait-blocks` (env CARTESI_SEQUENCER_MAX_WAIT_BLOCKS, default 1200), pin it in deployment_identity and include it in mismatch_fields. (3) In run, build ProtocolTiming after load_setup_identity from the pinned value, which moves run/mod.rs:57 below :64. Tests keep using the literal.
+- Decision: Schema and identity change (ask-first area). Confirm guest images take it per-binary like the sequencer address.
+- Independent trace: refuted. Every claim in the evidence holds: the constant is unpinned and the guest and the sequencer share it.
+
+### H5. Freeze the setup --recovery CLI, error and lifecycle surface; the shared recovery tool replaces it
+
+`medium · partially · +0 lines · S`  
+Where: `sequencer/src/commands/config.rs:286-331`, `sequencer/src/commands/config.rs:378-453`, `sequencer/src/commands/error.rs:388-434`, `sequencer/src/storage/lifecycle.rs:36`, `sequencer/src/storage/lifecycle.rs:112-119`
+
+- Claim: Freezing is right for the CLI and validation surface: OptionalKeyArgs (config.rs:286-331), the recovery fields and validate()/resolve_recovery_key (config.rs:378-453), and SetupRecoveryError. Those leave setup when the shared tool lands. The claim overreaches on the storage side. The tool must still produce the sequencer's startup DB, and that is exactly what LifecycleCommand::Rebuild plus complete_baseline_setup(recovery=true) do (initialize_for_command, open_recovery_tip_in_tx; lifecycle.rs:100-130). That layer probably moves behind the tool rather than being deleted, so 'resolves Overlapping admission policies by removal' is not assured. Plain setup's checkpoint_block detection scan and the exit-40 refusal also stay meaningful, because they point the operator at the tool.
+- Fix: Do not polish any of it: no KeyArgs/OptionalKeyArgs unification and no SetupRecoveryError cleanup. When the tool lands, delete it from setup. That also resolves the 'Overlapping admission policies' register entry (Rebuild arms) by removal. Size in this area is about 200 prod lines plus about 150 test lines.
+
+### H6. L1/data-dir args are copied across three configs with identical docs, despite the module's own shared-group rule
+
+`low · partially · -35 lines · S`  
+Where: `sequencer/src/commands/config.rs:15-16`, `sequencer/src/commands/config.rs:339-356`, `sequencer/src/commands/config.rs:462-481`, `sequencer/src/commands/config.rs:547-567`
+
+- Claim: Confirmed: eth_rpc_url and allow_insecure_rpc, with an identical 5-line doc, are repeated in SetupConfig (config.rs:339-351), RunConfig (:464-476) and FlushConfig (:549-555), against the module's own shared-group rule (config.rs:15-16). The line delta is overstated. The duplication is about 13 lines × 3 = 39. A flattened L1RpcArgs plus three flatten sites costs about 23, for a net of roughly -15 to -20, not -35. FlushConfig's separate seconds_per_block is intentional, because flush does not take the rest of TimingArgs.
+- Fix: Add `#[derive(Args)] struct L1RpcArgs { eth_rpc_url, allow_insecure_rpc }` and flatten it into all three configs. Leave data_dir in place, or move it into the same group. Flag names and env vars stay the same.
+
+### H7. Test-only code in production modules: set_alpha and complete_setup
+
+`low · partially · -40 lines · S`  
+Where: `sequencer/src/storage/admin.rs:15-34`, `sequencer/src/storage/migrations/0001_schema.sql:567`, `sequencer/src/storage/lifecycle.rs:145-171`
+
+- Claim: complete_setup is #[cfg(test)] (lifecycle.rs:150) and has only two test callers (:376, :438), so it can go. Only the divergence assertion (:375-378) should be repointed to complete_baseline_setup. The test at :436-440 checks complete_setup's own precondition, which is meaningless for complete_baseline_setup because that function creates the baseline itself, so delete that test rather than repointing it. set_alpha has no in-repo non-test caller, but it is a `pub fn` on Storage in `pub mod storage` (sequencer/src/lib.rs:30), so moving it into test_helpers is a public-rust-api change for downstream app crates, not a free move. Fixing the schema comment (0001_schema.sql:567) is uncontroversial. Net delta is about -30.
+- Fix: Move set_alpha into storage/test_helpers and drop admin.rs. Reword the schema comment to 'constant; tests override'. Delete complete_setup and point its two tests at complete_baseline_setup.
+
+### H8. run/flush create a mistyped data dir, then refuse with a message that names no path
+
+`low · confirmed · +5 lines · S · BC`  
+Where: `sequencer/src/commands/run/mod.rs:51-55`, `sequencer/src/commands/flush.rs:24-27`, `sequencer/src/commands/mod.rs:42-44`, `sequencer/src/commands/error.rs:343-344`, `sequencer/src/storage/open.rs:51-58`
+
+- Claim: run (run/mod.rs:51-55) and flush (flush.rs:24-27) create the data dir and sequencer.lock before preflight_lifecycle_command finds no DB (commands/mod.rs:42-43). They then exit 30 with SetupNotComplete, whose Display names no path (error.rs:343-344). The open.rs rule cited (open.rs:51-58) concerns DB files, so this is a spirit-level inconsistency, not a violation. The proposed existence check before the lock is a read ahead of the lock, which the run/mod.rs:52-54 comment says to avoid. It is benign, though: absence refuses, and presence proceeds to take the lock.
+- Fix: Only setup creates the data dir. In run and flush, a missing dir maps to SetupNotComplete before the lock is taken. Give SetupNotComplete a `data_dir` field shown in Display. Exit code stays 30.
+
+### H9. The terminal_faults black box records only causes that re-log anyway
+
+`low · partially · -150 lines · M · BC · db-schema`  
+Where: `sequencer/src/storage/migrations/0001_schema.sql:447-482`, `sequencer/src/storage/lifecycle.rs:70-76`, `sequencer/src/storage/lifecycle.rs:173-231`, `sequencer/src/commands/mod.rs:50-113`, `sequencer/src/commands/setup/mod.rs:380-402`
+
+- Claim: The black box captures only terminal verdicts returned through a command bracket (commands/mod.rs:57-79). In run, terminal worker faults abort instead (workers.rs:375, 458), so most recorded causes are startup-phase and are re-derived on the next boot. This is ADR mechanism 2, registered as policy in docs/invariants.md:32-43, and the ADR itself states the limitation (2026-08-authority-boundary-adr.md:88-91). The finding adds no new evidence beyond the ADR's accepted trade. The 'set looks empty' claim is also overstated. Config-derived terminal verdicts (ChainIdMismatch or FeeOracleMisconfig in setup, SignerMisconfig at workers.rs:653) are not re-derived once the operator changes the config. The box also has a live consumer, the boot echo (run/mod.rs:62). Leave it to the maintainer, and note HS1, a concrete defect in that consumer.
+- Fix: Either keep it as an accepted cost (it is ADR-recorded) or delete it and let the exit code plus logs carry the cause, which H1-H3 make reliable. Quantify first: count how many terminal verdicts are not re-derived on the next boot. Today that set looks empty.
+- Decision: ADR mechanism 2. Maintainer decides keep vs delete; do not change it silently.
+
+### H10. Startup event omits the timing knobs; orphan-sweep deletions are not audited
+
+`low · confirmed · +8 lines · S · BC`  
+Where: `sequencer/src/commands/run/mod.rs:138-151`, `sequencer/src/commands/run/startup_hygiene.rs:21-25`, `sequencer/src/commands/run/startup_hygiene.rs:98-99`
+
+- Claim: The startup event (run/mod.rs:138-151) omits max_batch_open_seconds, l1_read_stale_after_blocks, seconds_per_block and confirmation depth. The orphan sweep logs successful deletions only as a debug count (startup_hygiene.rs:20-24, 98-99). Per-path info logging matters most for the sweep, because of its known path-spelling hazard (startup_hygiene.rs:64-65: 'setup and run may spell the same directory differently'). The eth_rpc_url removal belongs to the open register entry, not to this finding.
+- Fix: Add those fields to the startup event and drop eth_rpc_url (see the register entry). Log each orphan deletion at info with its path: one line per destructive action.
+
+### H11. batch_submitter_idle_poll_interval_ms accepts 0 and turns the idle submitter into an RPC hot loop
+
+`low · confirmed · +1 lines · S · BC · config`  
+Where: `sequencer/src/commands/config.rs:485-491`, `sequencer/src/l1/submitter/worker.rs:198-202`, `sequencer/src/l1/submitter/worker.rs:219-222`
+
+- Claim: batch_submitter_idle_poll_interval_ms (config.rs:485-491) has no range parser, unlike poll_interval_ms (config.rs:112) and max_batch_open_seconds (:509). With 0, the idle and transient arm (submitter/worker.rs:198-201) sleeps for zero and re-runs load_frontier plus observed_submitted_batch_nonces RPCs back-to-back.
+- Fix: Add `value_parser = clap::value_parser!(u64).range(1..)`.
+
+### H12. Danger-exit terminality is defined twice (abort decision vs exit verdict)
+
+`nit · unverified-nit · -4 lines · S`  
+Where: `sequencer/src/commands/error.rs:201-225`, `sequencer/src/commands/error.rs:556-561`
+
+- Claim: WorkerExit::is_terminal hard-codes `CanonicalDivergence | Safe` for DangerDetected, and danger_failure_verdict separately maps the same statuses to Terminal. The abort decision (workers.rs:373) and the exit code could drift apart.
+- Fix: Write `WorkerExit::DangerDetected { status } => danger_failure_verdict(status).is_terminal()`.
+
+### H13. Comments restate code, repeat each other, or carry change history
+
+`low · partially · -120 lines · S · docs-only`  
+Where: `sequencer/src/commands/error.rs:74-90`, `sequencer/src/commands/error.rs:489-495`, `sequencer/src/commands/config.rs:368-377`, `sequencer/src/storage/migrations/0001_schema.sql:21-26`, `sequencer/src/storage/migrations/0001_schema.sql:117-120`
+
+- Claim: The comment-density figures are correct: 228 of 727 prod lines in error.rs, 159 of 607 in config.rs. The EXIT_SETUP_NEEDS_RECOVERY doc (error.rs:81-89) and the 6-line clippy rationale (error.rs:489-494) are trimmable. Two examples are mischaracterized. The config.rs:369-376 'PR3' sentence is history-flavored wording, but not stale, since it points at `setup --recovery` as the non-genesis path. The schema's 'a CHECK on it once wedged batch close' (0001_schema.sql:22-24) is the rationale for a deliberate absence, a do-not-add guard. Keep the reason and drop only the anecdote. Do the --recovery-adjacent text last or skip it, given the H5 freeze.
+- Fix: Trim to the invariant and the why: one line for the Box rationale, one line per exit constant, delete the PR3 sentence, and leave history to git. Do one docs-only pass after H1-H3 so the trimmed text describes the final behavior.
+
+### H14. Schema seed uses INSERT OR IGNORE against the fail-loud check policy
+
+`nit · unverified-nit · +0 lines · S · db-schema`  
+Where: `sequencer/src/storage/migrations/0001_schema.sql:601`, `docs/invariants.md:29-31`
+
+- Claim: The check policy forbids `INSERT OR IGNORE`. The batch_policy seed uses it inside a migration that rusqlite_migration runs exactly once, so OR IGNORE can only mask a duplicate-seed bug.
+- Fix: Use a plain INSERT.
+
+### HS1. Boot-time black-box echo warns forever about a fault the operator already fixed
+
+`low · skeptic-added · +6 lines · S · BC`  
+Where: `sequencer/src/commands/run/mod.rs:62`, `sequencer/src/commands/mod.rs:84-113`, `sequencer/src/storage/lifecycle.rs:196-229`, `sequencer/src/storage/migrations/0001_schema.sql:470-482`, `sequencer/src/commands/setup/mod.rs:359-376`
+
+- Claim: Every `run` boot logs a WARN for the newest terminal_faults row. The table is append-only and nothing marks a fault as resolved. A terminal setup failure on a fresh data dir (for example, a typo'd --chain-id) is therefore echoed as a WARN on every healthy `run` boot for the life of the database, even after a corrected setup retry completes.
+- Fix: Have the black box's one consumer say only what is still news. Skip, or log at debug, any fault whose recorded_at_ms predates setup_complete.completed_at_ms, because a later completed setup proves a setup-era fault was resolved. Include the fault's age in the remaining WARN. If H9 deletes the black box, this goes with it.
+- Decision: Tied to H9: fix only if the black box is kept.
+
+Keep (load-bearing):
+
+- CommandFailureVerdict as the single classification behind both the exit code and the black box (commands/error.rs:95-195): one exhaustive match, so a new error shape cannot get one class in the logs and another at the supervisor.
+- The exit-code table tests (commands/error.rs:806-1292): about 480 lines, but each row pins one supervisor-facing integer per failure shape. This is the wire contract for orchestrators, and the distinct-codes test makes code pins equal verdict pins.
+- Per-worker is_terminal_invariant beside each error enum plus the generic WorkerStop<E> (commands/error.rs:529-609): a new variant fails to compile in its own module instead of falling through a distant wildcard.
+- is_persistent_storage_error failing open toward operational (storage/convert.rs:121-175): a wrong 'terminal' pages for a self-healing condition, while a wrong 'operational' only restarts.
+- SYNCHRONOUS_PRAGMA = FULL and its comment (storage/open.rs:16-32): it protects acknowledged chunk commits, the write-before-broadcast watermark and setup completion against power loss. The comment names exactly what relaxing it would break.
+- Storage::open refusing a missing DB file (storage/open.rs:49-72): database absence means uninitialized, which prevents an ownerless schema on a mistyped path. H8 extends the same rule to the directory.
+- The kernel process lock as Arc<File> clones plus spawn_blocking_with_lock (runtime/process_lock.rs): exclusivity outlives cancelled async futures that detach blocking DB work, and a persisted row cannot provide that.
+- abort_terminal and the panicking ShutdownOnDrop abort (runtime/shutdown.rs:16-19; commands/run/workers.rs:102-111): a terminal runtime fault exits without draining over corrupt state.
+- refuse_divergence_on_clean_exit (commands/run/run/mod.rs:96-102 path: sequencer/src/commands/run/mod.rs:96-102): it closes the exit-0 hole where a clean drain outruns divergence re-detection.
+- The Workers exhaustive destructures and concurrent drain (commands/run/workers.rs:323-473), already upheld by the jury: they make a forgotten worker a compile error and keep a hung component from hiding a terminal exit.
+- Schema invariant triggers and typeof guards (0001_schema.sql:27-33, 110-190, 360-370, 394-445, 526-532, 653-660): they enforce I15 (divergence freeze), I16 (single anchored root), write-once stamps and history immutability at the engine layer. That is cheap, multi-writer-safe defense for a store where divergence equals theft.
+- Secret handling at the clap edge (commands/config.rs:249-254, 588-592; hide_env_values on key and RPC args): the key never reaches Display or a log line, even on read failure.
+- The TTY-gated ANSI init in examples/wallet-sequencer/src/main.rs:10-18: it keeps escape codes out of journald and file logs (the earlier CI-red cause).
+
+## I. Snapshots, dumps, checkpoint metadata
+
+Verdict: This area turns each batch close into an immutable app-state artifact. The order is: the file is made durable, then one SQLite transaction seals the batch and registers the artifact. Selection is derived from acceptance: restart uses the newest valid batch, the watchdog and recovery use the newest accepted batch. GC deletes rows before files, and a lease lets HTTP serve the watchdog's comparison file and the operator's recovery archive. The core is correct and fails loud where it should. Selection never falls back to an older snapshot, GC keeps every valid snapshot beyond the accepted frontier, the divergence check shares one transaction with selection and lease, and the archive never reports a truncated success. I found no correctness bug. The size is about 1,330 production lines across the five in-scope files, plus a 65-line release supervisor in http.rs. That is roughly 30-40% more than the essential complexity. The excess sits in three places: 1. **Leases:** a lease is a process-local reference count, but it is stored durably in SQLite. That needs egress writer connections, a release supervisor task, a persistent-failure reporter and a startup reset (about 120 lines). 2. **`info.toml`:** the on-disk file repeats what SQLite already knows, and the export receipt repeats it again. It costs one extra file and 2 extra fsyncs per batch close (about 70 lines). 3. **Snapshot-plus-subscribe bootstrap:** `/latest_snapshot` and the history-claim headers serve a client bootstrap that the future direction replaces. They should be frozen, not polished (about 140 production and 250 test lines). Per-batch snapshots (N23) should stay. The cost is one lane stall per batch, and batches are paced by L1 posting. The real risk is a large native state on a filesystem without reflinks, which is a deployment requirement and needs no new policy. Sparse snapshots would trade that cost for a liveness failure in startup, recovery and the watchdog. For N3, the sequencer needs nothing from machine-emulator PR #398: the SQLite row is a stronger publish point than an atomic rename, and the watchdog has already adopted `rename_stored` and `remove_stored`.
+
+
+### I1. On-disk info.toml duplicates SQLite and the export receipt; drop it and generate it inside archives
+
+`medium · confirmed · -70 lines · S · BC · docs-only`  
+Where: `sequencer/src/ingress/inclusion_lane/dump_info.rs:38-60`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:93-101`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:136-149`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:156-205`, `sequencer/src/ingress/inclusion_lane/snapshot.rs:51`
+
+- Claim: info.toml holds only `format_version` and `next_batch_nonce`. Every server path already takes the nonce from SQLite, and the recovery receipt is a strict superset of the file. The file adds an unpublished-directory temp+rename and 2 fsyncs to every batch close, and it versions only itself, not the app bytes.
+- Fix: 1. Make the dump dir just mkdir + `app.create_dump(dir/state)` + parent fsync. 2. In `write_archive`, generate `info.toml` from the SQLite nonce it already receives, the same way it generates `checkpoint.toml` (dump_info.rs:108-117). The archive bytes and the recovery loader stay unchanged. 3. Replace the startup parse with a stat of `state`, or drop it. 4. Leave merging info.toml into a single receipt to the shared recovery-tool design, which will own the export format. If the file is kept instead, at least drop the temp+rename and the directory fsync in `write_info`.
+- Decision: Should startup keep a cheap stat-based presence check of the rollback artifact, or rely on catch-up's terminal `from_dump` classification? Archive format stays unchanged either way.
+
+### I2. Download leases are stored durably in SQLite but are process-local; replace with an in-memory registry
+
+`medium · confirmed · -120 lines · M · db-schema`  
+Where: `sequencer/src/storage/snapshot_dumps.rs:46-97`, `sequencer/src/storage/snapshot_dumps.rs:114-131`, `sequencer/src/storage/snapshot_dumps.rs:182-244`, `sequencer/src/storage/snapshot_dumps.rs:431-451`, `sequencer/src/http.rs:160-206`
+
+- Claim: A lease only means something while this process serves a body, and startup zeroes every count. Even so, each download does 2 SQLite write transactions from egress. Release goes through an injected scheduler, a supervisor task with a JoinSet, and a persistent/transient error classifier that aborts the process. All of that exists to decrement a counter.
+- Fix: Share `DumpLeases(Arc<Mutex<HashMap<i64,u32>>>)` between egress and the lane's GC. - **Acquire:** lock, run the read-only selection transaction (divergence check included), increment, unlock. - **Release:** the guard's Drop locks and decrements. It is infallible and does no I/O. - **GC:** lock, select candidates inside its write transaction, skip leased ids, delete, unlock. - **Lock order:** registry before SQLite. Egress never takes the SQLite writer lock, so this cannot deadlock. - **Invariant protected:** a leased artifact's row and files are never deleted. - **Assumption:** only the serving `run` process collects. Revisit if a second process ever serves or collects dumps. This removes the column, the startup reset, the release supervisor and the reporter wiring, and egress becomes SQLite read-only.
+- Decision: Approve dropping `dumps.lease_count` and adopting the single-serving-process assumption.
+
+### I3. /latest_snapshot and the history-claim headers serve the snapshot-plus-subscribe bootstrap the new sync replaces: freeze
+
+`medium · confirmed · -140 lines · S · BC · http-api`  
+Where: `sequencer/src/egress/api/snapshot.rs:195-202`, `sequencer/src/egress/api/snapshot.rs:392-410`, `sequencer/src/egress/api/snapshot.rs:183-187`, `sequencer/src/egress/api/snapshot.rs:268-276`, `sequencer/src/storage/snapshot_dumps.rs:99-106`
+
+- Claim: `/latest_snapshot` and the `X-History-Era`, `X-Recovery-Generation` and `X-Executed-Input-Count` headers exist so a client can restore the app dump and subscribe with a history claim. The future direction drops that assumption: clients hold their own SQLite state and get startup state from the shared recovery tool.
+- Fix: Freeze until the new client sync lands, then delete: - the route - `acquire_latest_snapshot_lease` and `snapshot_next_nonce_in` - `LeasedDump.history_version` and the history headers on all snapshot routes - the SDK method and the openapi entries Keep `Storage::latest_snapshot()`, which catch-up uses (inclusion_lane/catch_up.rs:22-31). Don't polish in the meantime (e.g. the redundant `snapshot_next_nonce_in` re-query).
+- Decision: Confirm `/latest_snapshot` and the history headers are frozen until the replacement sync exists.
+
+### I4. ETag/If-None-Match 304 on /finalized_state has no consumer
+
+`low · confirmed · -10 lines · S · BC · http-api`  
+Where: `sequencer/src/egress/api/snapshot.rs:150-169`, `sequencer/src/egress/api/snapshot.rs:436-441`, `openapi.yaml:531-560`, `README.md:456`
+
+- Claim: The watchdog idle-polls `/finalized_state/inclusion_block` and compares `/digest`. It never sends `If-None-Match`, so the conditional-GET path and its contract surface are unused.
+- Fix: Remove the ETag header, `if_none_match` and the 304 branch, plus the matching openapi/README text and the integration test.
+- Decision: Drop the conditional-GET feature from the operator API?
+
+### I5. The per-batch snapshot stalls the lane without any timing recorded; no revisit trigger exists for large native state
+
+`low · partially · +5 lines · S`  
+Where: `sequencer/src/ingress/inclusion_lane/snapshot.rs:41-60`, `sequencer/src/ingress/inclusion_lane/mod.rs:152-167`, `sequencer/src/storage/snapshot_dumps.rs:133-160`
+
+- Claim: `create_dump` runs synchronously and untimed on the lane at every close (snapshot.rs:41-60; mod.rs:152-167). That part is true. But closes are not paced by L1 posting. They fire when the fee-policy byte target is reached (`batch_size_target` → `max_batch_user_op_bytes`, storage/mod.rs:354, 371-377; lane mod.rs:435) or after `max_batch_open_seconds` (config.rs:501-511). Under load, several closes can happen per L1 block, so the stall scales with throughput ÷ target size. The register already tracks this: 'representative deployment latency, including checkpoint creation' sits under Track 3 follow-ups (register.md:267-269). Add the elapsed-time field and hang the reflink requirement and revisit trigger on that item instead of adding a duplicate entry.
+- Fix: - Log `create_dump` elapsed time at batch close (one debug field). - Add a register 'Known optimizations' entry: the stall is per batch, mitigated by a reflink-capable filesystem (XFS reflink=1, btrfs, APFS) for large-state engines. - Revisit trigger: measured `create_dump` p99 above about 250 ms, or retained-dump disk over budget on deployment storage. This needs no new mechanism.
+- Decision: Accept 'reflink-capable filesystem for large-state native engines' as a deployment requirement.
+
+### I6. Snapshot stream failures after the 200 are never logged; error messages omit the conflicting values and the path
+
+`low · partially · +10 lines · S`  
+Where: `sequencer/src/egress/api/snapshot.rs:253-263`, `sequencer/src/egress/api/snapshot.rs:316-332`, `sequencer/src/egress/api/snapshot.rs:443-446`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:76-80`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:94-98`
+
+- Claim: Non-terminal mid-stream errors are not logged: the producer only forwards them through `done_tx` (snapshot.rs:253-263), and `ComparisonReader` returns them (snapshot.rs:327-330). tower-http 0.6.11's `TraceLayer::new_for_http` does not log body errors for HTTP classification, because `classify_eos` is None (tower-http trace/future.rs:74-88, body.rs:82-88). But a warn in the producer's non-terminal branch would fire on every client disconnect: once the body is dropped, the duplex writer fails with BrokenPipe (snapshot.rs:240-263). So skip broken-pipe/disconnect errors or log them at debug. The missing path (snapshot.rs:191, 443-446) and the missing values (dump_info.rs:76-80, 94-98) are accurate, although the nonce-mismatch error is InvalidData, so it is logged via `abort_terminal` with the prefix (snapshot.rs:254-258). It only lacks the 2 nonces.
+- Fix: - Log a warn with the prefix and error in the producer's non-terminal branch and in `ComparisonReader`'s error map. - Pass the path into `internal_error` for open failures. - Include the expected and found values in the 2 messages.
+
+### I7. Three AsyncRead wrappers where two suffice
+
+`low · partially · -20 lines · S`  
+Where: `sequencer/src/egress/api/snapshot.rs:281-287`, `sequencer/src/egress/api/snapshot.rs:297-302`, `sequencer/src/egress/api/snapshot.rs:412-432`
+
+- Claim: `GuardedReader` is pure delegation (snapshot.rs:417-432), and the `Arc` in `stream_body` is unneeded (snapshot.rs:300). For archives, though, the body-side guard is redundant, not just the `GuardedReader`. All source-file reads happen inside `write_archive` on the producer thread, which holds its own guard (snapshot.rs:244-252). After it returns, the remaining bytes sit only in the 64 KiB duplex buffer. Simpler shape: the producer owns the `LeaseGuard` by value, `ArchiveReader` carries no guard, `ComparisonReader` owns its `LeaseGuard`. Delete `GuardedReader` and both `Arc`s, and update lifecycle.md:129-131.
+- Fix: Add `_guard` fields to `ComparisonReader` (`LeaseGuard`) and `ArchiveReader` (`Arc<LeaseGuard>`), then delete `GuardedReader`. This composes with I2.
+
+### I8. Snapshot docs and comments restate code, narrate history, or contradict the code
+
+`low · partially · -40 lines · S · docs-only`  
+Where: `docs/snapshots/lifecycle.md:38`, `docs/snapshots/lifecycle.md:133-148`, `docs/snapshots/README.md:3-13`, `docs/snapshots/format.md:62-65`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:174-183`
+
+- Claim: These verbosity points hold: - lifecycle.md:38 says "Initially". - lifecycle.md:139-145 restates the inode sweep that the code comments already own (startup_hygiene.rs:66-69, 112-115). - format.md:62-65 narrates a test. - dump_info.rs:174-183 restates `deny_unknown_fields` and the version gate. - dump_info.rs:505-507 narrates "the old line parser". - snapshot.rs:428 explains Unpin soundness the compiler already enforces. The `make_dump_dir` 'contradiction' is overstated. 'Opaque' there means the code never parses the name (snapshot.rs:62-67), and the nonce is a human aid. Reword the comment, which must change anyway if I1 lands because it cites info.toml. Renaming dirs by batch_index is churn without benefit. Folding README.md into lifecycle.md is optional: README is the directory index, and its paragraph at lines 8-13 is not duplicated elsewhere.
+- Fix: - Cut the device/inode paragraph to one sentence that links to the code. - Replace "Initially" with "Every". - Fold README.md into lifecycle.md's opening. - Drop the narrated test and history comments. - Name dumps by `batch_index`, the real snapshot identity, plus nanos, or drop the "opaque" claim.
+
+### I9. The wallet nests its single file as state/state; the reference engine should write its file at the prefix
+
+`nit · partially · -8 lines · S · BC · http-api`  
+Where: `examples/app-core/src/application/wallet.rs:362-391`, `docs/snapshots/format.md:12-22`
+
+- Claim: The wallet does nest one file as `state/state` (wallet.rs:367-391; format.md:21-22), and the contract permits a file at the prefix (application/mod.rs:253-254; application-contract.md:217-218). The gain is 1 mkdir and 1 directory fsync per close, plus an exemplar. The contract text and the N3 recipe already give libdex that pattern. The change breaks existing wallet bundles, touches the genesis/`--state-file` wiring (tests/harness/src/sequencer.rs:1398, 1448), the C wallet engine that delegates to `WalletApp` (examples/c-wallet-engine/src/lib.rs:407), and the wallet test at wallet.rs:1058. Do it only if the toy wallet is meant to be the reference engine pattern.
+- Fix: Write the SSZ file at `prefix` and have `state_file_in_dump` return the prefix itself. Update format.md. Ship it as its own patch, because existing wallet recovery bundles carry the nested layout.
+- Decision: Change the toy wallet's dump layout? This breaks existing wallet recovery bundles.
+
+Keep (load-bearing):
+
+- File created and fsynced before the SQLite row, row deleted before the files, and the split between storage/snapshot_dumps.rs (SQLite only) and the filesystem halves. The module boundary is the crash-ordering guarantee (I13, do-not-simplify).
+- Exact-snapshot selection with no fallback to an older artifact (snapshot_dumps.rs:162-163, 349-356). A missing artifact is corruption and fails loud (I7).
+- GC keeps every valid snapshot beyond the accepted frontier (snapshot_dumps.rs:133-160). An intermediate batch can become the next required checkpoint (do-not-simplify).
+- The canonical-divergence check runs in the same transaction as selection and lease (snapshot_dumps.rs:371-375). A matched batch that precedes a divergent one in the same block must not be advertised.
+- Only genesis baselines are comparable (snapshot_dumps.rs:385-400). A rebuilt baseline may contain the fold's speculative drain.
+- Leases as a concept. Acceptance advancing mid-download lets GC delete the finalized artifact, and NotFound is classified terminal, so the lease prevents a benign race from aborting the process. Only the storage of the lease is over-built (I2).
+- `referenced_artifact_io_is_terminal` (dump_info.rs:27-36) and `comparison_io`. They separate a corrupt referenced artifact (terminal) from an operational I/O error (retry).
+- `ArchiveReader` turning a producer failure into a stream error (snapshot.rs:334-369). Without it a truncated archive would pass as a successful 200.
+- `catch_unwind` around the foreign `state_file_in_dump` callback (snapshot.rs:291-295). Request-task panics would otherwise be swallowed.
+- The receipt is generated at export, never stamped into the immutable dump (dump_info.rs:85-117). Artifacts stay immutable.
+- The device/inode identity in the orphan sweep (startup_hygiene.rs:72-115). It fixed a path-alias data-loss bug.
+- `diagnose_missing_dump`'s watchdog-layout hint (dump_info.rs:207-252). It is cheap and aimed at the most likely operator mistake under recovery pressure.
+- Unconditional per-batch snapshots (N23). They are paced by L1 posting, and sparse snapshots would turn a cost into a liveness failure.
+
+## J. Example apps, canonical app, binaries
+
+Verdict: This area holds the placeholder wallet (app-core), the two Rust wallet binaries, the canonical RISC-V guest shell, the C-seam host (c-app-sequencer), the reference C-ABI engine (c-wallet-engine, which wraps WalletApp in unsafe FFI and adds a genesis tool), and the guest test suite (canonical-test). It is mostly proportionate. The 1,080-line wallet.rs is about 400 lines of app and 680 of tests. The app part is fine for a placeholder. The tests are where the excess sits: some duplicate sequencer-core guard tests, some are trivia, and one keeps a "legacy" SSZ type alive just to test an unknown selector. The Rust wallet and the C engine share no business logic: the engine delegates every call to WalletApp, and a native-vs-bridge conformance test checks the two agree. Keep both. The biggest problems are about what an app author would copy: - Anvil test private keys and their parser live in the app crate and are part of its public API (J1). - App state uses HashMap, so canonical ordering depends on remembering to sort in the encoder (J5). - There are two different genesis models. Rust picks a config per binary; C uses a genesis tool plus a `--state-file` flag that actually names a directory (J2, J3). - Tracing setup is copied three times, and the harness doc example calls an `init_tracing()` that does not exist (J4). The genesis plumbing should be frozen, not polished: the planned shared recovery/startup tool replaces it. Things to keep: the engine-delegates-to-WalletApp shape, the fsync'd create_dump, the typed error on incoherent snapshot progress, the golden snapshot vector shared with Lua, and the guest-side fee-arithmetic test.
+
+
+### J1. Anvil test-key list and its validating parser live in the app crate's public API
+
+`medium · partially · -120 lines · S`  
+Where: `examples/app-core/src/application/anvil_accounts.rs:1-87`, `examples/app-core/anvil_accounts.txt:1-100`, `examples/app-core/src/application/mod.rs:9`, `tests/harness/src/rollups.rs:380`, `tests/harness/src/rollups.rs:449`
+
+- Claim: app-core publicly re-exports `default_private_keys` (examples/app-core/src/application/mod.rs:9). Its only callers are tests/harness (rollups.rs:380, :449, :495; sequencer.rs:1368; wallet.rs:46) and tests/benchmarks (workload.rs:69, :187, :311, :369). parse_accounts validates the address column and then discards it (anvil_accounts.rs:49-51), and 32 test lines (88-119) cover a parser of a fixed, checked-in file. The keys can move to tests/harness: benchmarks already depends on rollups-harness (tests/benchmarks/Cargo.toml:13). The mnemonic option is not free, though. The harness enables only alloy's `signer-local` feature (tests/harness/Cargo.toml:14), so it would need `signer-mnemonic` added. The cheapest move is to keep the .txt file under tests/harness and take column 2 with a three-line split. Also update the doc pointer at wallet.rs:83-84.
+- Fix: Move the keys to tests/harness as a `const DEFAULT_PRIVATE_KEYS: &[&str]`, or derive them from Anvil's well-known mnemonic with alloy's mnemonic builder, which the harness already depends on. Delete the parser and its tests, and drop the re-export from app-core.
+
+### J2. Two genesis models (per-binary preset vs genesis tool + --state-file): freeze, the shared startup-state tool replaces both
+
+`low · partially · -150 lines · M · BC · config`  
+Where: `examples/wallet-sequencer/src/main.rs:1-24`, `examples/wallet-sequencer/src/bin/wallet-sequencer-devnet.rs:1-24`, `examples/c-wallet-engine/src/bin/c-wallet-genesis.rs:1-38`, `examples/c-wallet-engine/tests/genesis_cli.rs:1-17`, `examples/c-wallet-engine/src/lib.rs:420-427`
+
+- Claim: There are three per-network genesis selections. The two wallet-sequencer binaries differ only at line 23 (`default()` vs `devnet()`). The guest has its own pair, canonical-app-devnet.rs and canonical-app-sepolia.rs. The C path uses c-wallet-genesis (21-29) plus --state-file (c-app-sequencer lib.rs:50-58). Freezing them is right: do not add a --preset flag. The deletion plan overreaches, though. The future tool consumes a *supplied* checkpoint, and something app-specific still has to produce the genesis checkpoint. c-wallet-genesis.rs:4-5 and c-wallet-engine lib.rs:422-427 state that the seam has no create path, so every app ships a genesis tool. The conformance fixture also uses write_genesis (conformance.rs:21). So c-wallet-genesis and write_genesis survive any version of the direction. At most, the Rust devnet binary and the run_main/run_command genesis-closure plumbing (about 30-40 lines) would go, and only if setup becomes dump-only. The guest pair cannot go, because the machine image bakes its config in at build time.
+- Fix: Freeze. Do not add a `--preset` flag to wallet-sequencer or polish the genesis tool. When the shared tool lands, make setup consume a tool-produced startup dump for both Rust and C apps. That deletes wallet-sequencer-devnet, c-wallet-genesis plus its CLI test, and the genesis closure plumbing.
+- Decision: Should genesis become just 'a checkpoint produced by the shared tool' (one startup-state input for setup), and should that tool bind the app's deployment preset to the chain id setup pins?
+
+### J3. `--state-file` / CARTESI_SEQUENCER_STATE_FILE names a dump prefix (a directory), not the state file
+
+`low · confirmed · +0 lines · S · config`  
+Where: `bindings/c-app-sequencer/src/lib.rs:27-30`, `bindings/c-app-sequencer/src/lib.rs:57`, `tests/harness/src/sequencer.rs:1398`, `tests/harness/src/sequencer.rs:1448`, `bindings/c-app-engine/README.md:43-44`
+
+- Claim: `--state-file` / CARTESI_SEQUENCER_STATE_FILE (c-app-sequencer lib.rs:27-30) is passed to `EngineApp::from_dump` (lib.rs:57), so it names a dump prefix, while `state_file_in_dump` means the canonical file inside a dump (sequencer-core application/mod.rs:252-256; wallet.rs:389-391). The harness ends up with <tmp>/state/state (sequencer.rs:1398, 1448), and the README repeats the usage (bindings/c-app-engine/README.md:43-44). Because the genesis tool survives the future direction (see J2), the rename does not need to wait for that tool.
+- Fix: Rename to `--genesis-dump` / CARTESI_SEQUENCER_GENESIS_DUMP in the same patch that lands J2's tool. Do not rename it on its own before then.
+- Decision: Rename now, or fold into the J2 startup-tool change?
+
+### J4. Tracing init copied into every app binary; harness doc example calls a nonexistent init_tracing()
+
+`low · partially · -22 lines · S · public-rust-api`  
+Where: `examples/wallet-sequencer/src/main.rs:10-19`, `examples/wallet-sequencer/src/bin/wallet-sequencer-devnet.rs:10-19`, `bindings/c-app-sequencer/src/lib.rs:43-48`, `sequencer/src/harness.rs:7-18`
+
+- Claim: The ANSI-on-TTY tracing block appears three times: wallet-sequencer main.rs:14-19, the devnet bin at 14-19, and c-app-sequencer lib.rs:43-48. The comment appears twice. The harness.rs:12-17 example calls an `init_tracing()` that exists nowhere; git grep finds only the doc line, and the block is `ignore`d, so it never compiles. The proposal is more costly than stated. The sequencer library has no tracing-subscriber dependency (only examples/wallet-sequencer/Cargo.toml:17 and bindings/c-app-sequencer/Cargo.toml:21 have one), so exporting init_tracing from the library adds a dependency and a process-global subscriber policy. Calling it inside run_command would double-initialize for c-app-sequencer, which already calls `.init()`, and `.init()` panics when a global subscriber is already set. Smallest fix: make the doc example show the real block, and, if wanted, add `harness::init_tracing` only under run_main's binary-facing path. Net about -10 lines, not -22.
+- Fix: Export `sequencer::harness::init_tracing()`, or call it inside run_main/run_command after parsing (as c-app-sequencer already orders it). The Rust app's main then shrinks to one line, and the doc example becomes true.
+
+### J5. Deterministic app state uses HashMap; canonical order depends on remembering to sort in the encoder
+
+`low · partially · -45 lines · S`  
+Where: `examples/app-core/src/application/wallet.rs:57-63`, `examples/app-core/src/wallet_snapshot.rs:46-63`, `examples/app-core/src/wallet_snapshot.rs:83-102`, `examples/app-core/src/application/wallet.rs:996-1036`
+
+- Claim: WalletApp keeps HashMaps (wallet.rs:60-61), and canonical bytes depend on the sorts at wallet_snapshot.rs:54 and :63. A BTreeMap swap preserves the bytes: Address is FixedBytes<[u8;20]>, whose derived Ord is the same byte-lexicographic order as the current sort key. It also removes the sorts and both duplicate checks. Three corrections. (1) The golden vector (wallet_snapshot.rs:139-143) encodes the EMPTY wallet, so it does not guard ordering; byte equality has to be argued, or pinned with a non-empty vector. (2) The scrambled-order test (wallet.rs:996-1036) is vacuous today. It dumps the same unmutated HashMap twice, and an unmutated HashMap iterates in the same order both times, so the test would pass with the sort removed. That strengthens the case for deleting it. (3) Requiring strictly increasing addresses in decode tightens what decode accepts: unique but unsorted entries would be rejected. No encoder writes such bytes, but it is still an acceptance change for corrupt inputs. The 'RandomState seeds from randomness in the guest' point does not matter, because no unsorted iteration reaches output.
+- Fix: Switch to BTreeMap<Address, _>. Address's Ord is byte-lexicographic, which matches the current sort key, so the snapshot bytes do not change (the golden vector at wallet_snapshot.rs:139-143 guards this). Drop the sorts. In decode, require strictly increasing addresses, which replaces both duplicate checks and makes decode∘encode a bijection. Delete the scrambled-order test.
+
+### J6. wallet.rs test module duplicates sequencer-core guard tests and carries trivia, while the register's business-failure gap stays open
+
+`medium · confirmed · -170 lines · S`  
+Where: `examples/app-core/src/application/wallet.rs:420-479`, `examples/app-core/src/application/wallet.rs:541-549`, `examples/app-core/src/application/wallet.rs:551-609`, `examples/app-core/src/application/wallet.rs:812-823`, `examples/app-core/src/application/wallet.rs:856-881`
+
+- Claim: sequencer-core already pins the max-fee and exhausted-nonce guards generically (sequencer-core/src/application/mod.rs:512-523, 526-547), so wallet.rs:420-479 duplicates them. The Legacy* SSZ types (551-609) exist only to test an unknown union selector; Method has two variants (method.rs:11-13), and conformance.rs:94 already runs `vec![0xff]`. A one-line unknown-selector payload in an existing wallet test keeps the balance-unchanged assertion that conformance (which only compares native with bridge) lacks. The trivia tests are 541-549, 812-823 and 1057-1065. 856-881 nearly duplicates 826-854. No test overdraws after the fee: conformance's mixed history is fully funded (conformance.rs:53-94). Removing ~174 lines and adding a ~25-line business-failure test nets about -150, not -170.
+- Fix: Delete the listed tests. Replace the legacy block with a one-line malformed-method case. Add one test that pins an insufficient transfer and an insufficient withdrawal: fee, nonce and progress advance, and there are no outputs and no other balance change.
+
+### J8. WalletConfig doc says the fee recipient defaults to Address::ZERO; Default is Sepolia's sequencer address
+
+`low · confirmed · -1 lines · S · docs-only`  
+Where: `examples/app-core/src/application/wallet.rs:29-30`, `examples/app-core/src/application/wallet.rs:34-39`, `examples/app-core/src/application/wallet.rs:51-55`, `examples/app-core/src/application/wallet.rs:856-881`
+
+- Claim: wallet.rs:29 says the fee recipient 'Defaults to Address::ZERO (burned)'. But Default is sepolia() (51-55), whose sequencer_address is SEPOLIA_SEQUENCER_ADDRESS (38, 73-74). The test 'fee_sent_to_zero_address_when_default' (856-881) sets ZERO explicitly. See JS1 for the root cause.
+- Fix: Change the doc to 'Address credited with fee revenue.' Delete or rename the test (covered under J6).
+
+### J9. Engine status mapping drops PermissionDenied, so the host's PermissionDenied-terminal arm can never fire for C apps
+
+`low · confirmed · -1 lines · S · BC`  
+Where: `examples/c-wallet-engine/src/lib.rs:51-70`, `bindings/c-app-engine/src/lib.rs:78-84`, `sequencer/src/commands/error.rs:159-173`, `sequencer/src/ingress/inclusion_lane/dump_info.rs:27-35`
+
+- Claim: On AppBootstrap, the host classifies Io(PermissionDenied) as terminal (sequencer/src/commands/error.rs:159-172). Over the C seam, the reference engine maps it to IO_ERROR (c-wallet-engine lib.rs:52-63), and the shim turns that into ErrorKind::Other (c-app-engine lib.rs:78-79), which is classified Unclassified (error.rs:186), giving exit 1. The arm is also reachable natively beyond genesis reads: write_baseline_dump maps any create_dump AppError into AppBootstrap (setup/fill.rs:70-72), so an unwritable dumps dir exits 30 natively and 1 over C. error.rs:163 also contradicts the rationale for referenced artifacts (dump_info.rs:24-34), which keeps permission failures operational because they 'may clear'. Dropping PermissionDenied from error.rs:163 makes both paths and both policies consistent.
+- Fix: Frequency is low (operator misconfiguration only) and the fallback is safe (a retried failure that keeps failing), so add no new status. Drop PermissionDenied from error.rs:163 so native and C agree it is operational, or document the asymmetry in the header. Point the engine's mapping comment at referenced_artifact_io_is_terminal.
+- Decision: Should PermissionDenied on the genesis dump be terminal (exit 30) or operational (exit 1)?
+
+### J10. Dead public surface and a handled-impossible branch in the example crates
+
+`nit · unverified-nit · -25 lines · S · public-rust-api`  
+Where: `examples/app-core/src/application/mod.rs:14-16`, `examples/app-core/src/wallet_snapshot.rs:22-43`, `examples/app-core/src/application/wallet.rs:159-161`, `examples/app-core/src/application/wallet.rs:204-213`, `examples/c-wallet-engine/src/lib.rs:408-417`
+
+- Claim: The re-export aliases `encode_wallet_snapshot`/`decode_wallet_snapshot` have no users. The Snapshot* structs are `pub` but used only inside their module. The inherent `last_executed_safe_block` shadows the trait's default method. The interior-NUL branch in `state_file_in_dump` cannot be reached, because the prefix came from a CStr and `join("state")` adds no NUL. AGENTS.md says impossible states fail loud rather than being handled.
+- Fix: Delete the aliases and the inherent method, make the Snapshot* structs private, inline decode_portal_erc20_deposit, and replace the NUL branch with `.expect("prefix came from a CStr")`.
+
+### J11. ERC-20 deposit encoding and EIP-712 user-op signing hand-rolled in many test files
+
+`low · confirmed · -70 lines · S`  
+Where: `examples/app-core/src/application/wallet.rs:611-617`, `examples/canonical-test/src/main.rs:430-436`, `examples/c-wallet-engine/tests/conformance.rs:32-42`, `examples/canonical-test/src/main.rs:334-368`, `sdk/guest/rollups-types/src/lib.rs:220-236`
+
+- Claim: rollups-types has decode only (sdk/guest/rollups-types/src/lib.rs:220-235). The three deposit encoders are at wallet.rs:611-617, canonical-test main.rs:430-436 and conformance.rs:32-42. Nine parity-search signing loops exist, all in test code (canonical-test:352, sequencer-core scheduler/mod.rs:657, api.rs:520/:567 inside its tests module at :271, e2e_sequencer.rs:74/124/166/1595, harness wallet.rs:335). A cross-crate shared helper needs a feature-gated home. The simpler route is to switch each site to k256 `sign_prehash_recoverable` (or alloy's signer) in place, with no new shared module. Most sites are outside area J.
+- Fix: Add `Erc20Deposit::encode` next to decode, which also gives decode a round-trip test. Add one shared test helper `sign_user_op(key, op, domain)` that uses k256 `sign_prehash_recoverable` to get the parity directly. Migrate the in-area copies first.
+
+### J12. canonical-app justfile duplicates every devnet/sepolia recipe and shares their intermediate outputs
+
+`low · partially · -30 lines · S`  
+Where: `examples/canonical-app/justfile:17-23`, `examples/canonical-app/justfile:41-51`, `examples/canonical-app/justfile:55-71`, `examples/canonical-app/justfile:82-104`
+
+- Claim: The build-dapp-*, build-rootfs-* and build-machine-image* recipe pairs (justfile:41-51, 55-71, 82-104) differ only in network name, so parameterizing them saves about 25 lines. Sharing the intermediates (dapp, rootfs tar/ext2, lines 17-20) causes no stale mix: every image recipe re-runs its own dapp and rootfs dependencies in order (82→55→41, 94→64→47). Per-net intermediates are therefore not needed. The recipe names are referenced by the root justfile (68-71, 89-93), .github/workflows/release.yml:148-151 and the watchdog docs, so keep them as aliases.
+- Fix: Parameterise with `net := devnet|sepolia` (for example `build-machine-image net="devnet"`), use per-net intermediate paths, and keep the two image output names.
+
+### J13. Error messages without context, Debug formatting, and a user-triggerable warn repeated on every re-execution
+
+`nit · partially · +0 lines · S`  
+Where: `examples/app-core/src/application/wallet.rs:266-269`, `examples/c-wallet-engine/src/lib.rs:218-220`, `examples/c-wallet-engine/src/lib.rs:66`, `examples/c-wallet-engine/src/bin/c-wallet-genesis.rs:33`, `examples/app-core/src/application/wallet.rs:327-334`
+
+- Claim: These are minor message cleanups. wallet.rs:267-268 is an impossible-state error (the fee was validated first; conformance.rs:236 calls it an invariant fault), so adding context there is fine. engine lib.rs:218-219 is documented as unreachable (lib.rs:211-213). `{other:?}` at engine lib.rs:66 and `{err:?}` at c-wallet-genesis.rs:33 could use AppError's Display (sequencer-core application/mod.rs:13-20). Do NOT downgrade the unsupported-token warn at wallet.rs:328. Such a deposit moves the tokens to the app contract and credits nobody, so it records user funds stuck with no refund path. Repetition is bounded by attacker L1 gas per deposit, plus replays after a restart or rebuild.
+- Fix: Add sender, fee and balance to the Internal reason, name the reason in the engine message, use `{err}`, and downgrade the unsupported-token log to debug, or info at most.
+
+### J14. Comments that restate the trait contract or carry cross-module lore already enforced elsewhere
+
+`nit · unverified-nit · -15 lines · S · docs-only`  
+Where: `examples/app-core/src/application/wallet.rs:373-378`, `examples/app-core/src/application/wallet.rs:75-84`, `examples/app-core/src/application/wallet.rs:241-242`, `examples/c-wallet-engine/src/lib.rs:229-232`
+
+- Claim: Several comments restate the trait's durability doc, carry sync obligations the harness already asserts, or are hard to parse.
+- Fix: Replace each with a one-line pointer: 'durability: see Application::create_dump', and 'anvil #9, distinct from the deployer (setup's nonce gate); harness asserts sync'. Delete 241-242 and reword 229-232 as 'refuse while outputs are queued: overwriting would drop them'.
+
+### JS1. `Default` on WalletConfig/WalletApp silently selects Sepolia; the release binary and the genesis tool pick a network implicitly
+
+`low · skeptic-added · -8 lines · S · public-rust-api`  
+Where: `examples/app-core/src/application/wallet.rs:51-55`, `examples/app-core/src/application/wallet.rs:216-220`, `examples/wallet-sequencer/src/main.rs:23`, `examples/c-wallet-engine/src/bin/c-wallet-genesis.rs:24`, `examples/app-core/src/application/wallet.rs:29`
+
+- Claim: A deployment-specific config implements Default as `sepolia()`. As a result, the release wallet-sequencer's network (main.rs:23) and c-wallet-genesis's no-argument fallback (c-wallet-genesis.rs:24) are chosen implicitly, and the field doc wrongly says the default fee recipient is ZERO (J8). An operator or app author has to read the Default impl to learn which network a binary serves. A sequencer/guest config mismatch shows up as canonical divergence (operator-deployment.md:315 pairs the release binary with the Sepolia image).
+- Fix: Delete both Default impls. Call `WalletConfig::sepolia()` explicitly in main.rs:23 and in tests, and make c-wallet-genesis require the preset argument. The golden vector bytes do not change, because the vector is sepolia().
+- Decision: Should c-wallet-genesis require the preset (a CLI change) or keep Sepolia as an explicit, documented fallback?
+
+Refuted:
+
+- J7. Dump-contract tests are hand-written per app; no reusable check for an app author's Application impl. The duplication evidence is inaccurate, the -60 estimate ignores the helper's own size, and this conflicts with 'quantify before machinery' and Track 6 ownership.
+
+Keep (load-bearing):
+
+- c-wallet-engine delegates every entry point to WalletApp (examples/c-wallet-engine/src/lib.rs:139, 188, 276, 300, 391) rather than reimplementing the rules. That gives zero business-logic duplication between the Rust and C wallets, and the native-vs-bridge conformance suite (conformance.rs:44-161) is the seam's only end-to-end proof.
+- WalletApp::create_dump's create_dir (not create_dir_all) plus fsync of the file, the prefix and its parent (wallet.rs:367-385). This is the I13 obligation stated at sequencer-core/src/application/mod.rs:234-241; shorten the comment but keep the code.
+- from_snapshot_parts returns a typed AppError on incoherent progress instead of panicking (wallet.rs:97-118). Dump bytes are untrusted input.
+- The golden empty-snapshot vector test (wallet_snapshot.rs:139-143) is shared with the Lua watchdog (watchdog/tests/e2e.lua:163). It also guards J5's byte-identity.
+- `use c_wallet_engine as _;` in c-wallet-sequencer main.rs:9-11 is a load-bearing link import, as its comment says.
+- c-app-sequencer build.rs uses a cfg rather than a cargo feature (build.rs:6-13), so `--all-features` cannot produce a binary with no engine to link.
+- The engine's execute() refuses to run while outputs are still queued (c-wallet-engine lib.rs:240-243). Otherwise chain-bound outputs would be silently dropped.
+- The canonical-test fee-arithmetic test (canonical-test main.rs:224-302) is the only guest-side test with a nonzero fee, and it pins guest gas == host fee_to_linear from both sides.
+- The scheduler shell's inspect path reports and keeps serving instead of panicking (canonical-app scheduler/mod.rs:59-73). Inspect is a public read-only endpoint.
+- DEVNET_SEQUENCER_ADDRESS being Anvil account 9, distinct from the deployer (wallet.rs:85-86). A past drift between account 0 and account 9 caused CI reds; keep the fact even after J14 shortens the comment.
+
+## K. Tests, harness, benchmarks
+
+Verdict: Area K holds three test layers. Crate-internal unit and integration tests (sibling test files about 7.3k lines, src/integration_tests about 4.7k lines, plus inline modules) sit in front of three process-level crates under tests/: harness about 3.7k, e2e about 5.2k with 49 libtest-mimic scenarios, and benchmarks about 4.1k. Coverage depth fits a security-critical sequencer. The size does not: fixtures are copied rather than shared. There are 10 hand-written Application stubs, two identical TempDb helpers in three differently named helper modules, four bespoke in-process server bootstraps, two batch-tree invariant checkers, and around 140 repeated open/append/timing boilerplate blocks in recovery_tests.rs alone. Together that is roughly 1.3k removable lines with no loss of discrimination. Correctness problems in the tests themselves: - 43 integration tests silently pass when the listener cannot bind. - The 429 test relies on a 50 ms sleep and can hang instead of failing. - Two e2e scenarios sleep a fixed 7 s instead of polling. - e2e hand-copies sequencer defaults, citing a file that does not exist. The benchmark crate is heavier than the questions it answers. Its target-verdict code can only ever print NOT_EVALUATED. compare_latest re-parses CSV and re-implements the capacity summary the library already computes. The sweep bin has two copy-pasted branches. Roughly 3.5k test lines protect cross-rebuild client continuity and cockroach rebuild. The new direction (a shared recovery tool that produces both startup states) replaces that machinery, so freeze those tests rather than polish them. Worth keeping: the outage matrix (TcpProxy and faketime), the post-scenario schema check against the real binary's DB, the schema-trigger tests, the boundary tests for each recovery entry point, the C-host scenario variants, and kill_on_drop teardown.
+
+
+### K1. 43 in-crate integration tests silently pass when the test listener cannot bind
+
+`medium · confirmed · -170 lines · S`  
+Where: `sequencer/src/integration_tests/e2e_sequencer.rs:1183-1192`, `sequencer/src/integration_tests/e2e_sequencer.rs:1290-1296`, `sequencer/src/integration_tests/ws_broadcaster.rs:394-403`, `sequencer/src/integration_tests/snapshot_endpoints.rs:47-55`, `sequencer/src/integration_tests/e2e_sequencer.rs:207-209`
+
+- Claim: Confirmed as stated. Four helpers map bind PermissionDenied to eprintln + None: e2e_sequencer.rs:1184-1192 and :1290-1296, ws_broadcaster.rs:394-403, snapshot_endpoints.rs:49-55. There are 43 `else { return; }` sites under src/integration_tests. The risk is specific to this repo: agents run `cargo test` inside sandboxes that can deny bind, so a green suite there can hide 43 tests that never ran. Fix: fail on bind error. If sandboxes must stay supported, require an explicit env opt-in for the skip; do not keep the silent pass. Realistic delta is about -150.
+- Fix: Panic on any bind error (or `expect`), make the helpers return the runtime directly, delete the let-else at all 43 sites. If a sandbox genuinely cannot bind, gate the module with #[ignore] and an explicit env flag instead of a silent pass.
+- Independent trace: confirmed. The code matches the claim exactly. Only PermissionDenied takes the silent path;
+
+### K2. Three fixture modules under three names, duplicated TempDb, four bespoke in-process server bootstraps
+
+`medium · partially · -250 lines · M`  
+Where: `sequencer/src/integration_tests/common.rs:8-23`, `sequencer/src/storage/test_helpers.rs:28-43`, `sequencer/src/commands/test_support.rs:1-89`, `sequencer/src/integration_tests/e2e_sequencer.rs:1179-1282`, `sequencer/src/integration_tests/e2e_sequencer.rs:1284-1337`
+
+- Claim: Real duplication: - TestDb/temp_db is byte-identical in integration_tests/common.rs:8-23 and storage/test_helpers.rs:28-43. The integration tests are in-crate (lib.rs:33-35) and could import crate::storage::test_helpers (storage/mod.rs:48 is pub(crate)), so common.rs can be deleted. - wait_until is duplicated at inclusion_lane/tests.rs:1000 and setup/fill.rs:593. Overstated: only start_full_server_with_max_body does genesis-dump registration and ensure_open_tip (e2e_sequencer.rs:1201-1225). The other three bootstraps share only bind, L2TxFeed::new and start_on_listener with SnapshotState, about 25 lines each. They differ on purpose: a parked queue (:1299-1336), ws_max_subscribers (ws_broadcaster.rs:418-424), and a dummy state layout (ws_broadcaster.rs:382-384). A single TestServer builder saves less than claimed: realistic total is about -100 to -130, not -250.
+- Fix: One #[cfg(test)] crate::test_support module (submodules if needed) holding temp_db, wait_until, pin_test_deployment_identity, the stub app (K3) and a single TestServer builder (with_lane / parked_queue(cap) / max_body). Delete common.rs.
+
+### K3. Ten hand-written Application stubs repeat the same dump/from_dump/state_file plumbing
+
+`medium · partially · -350 lines · M`  
+Where: `sequencer/src/ingress/inclusion_lane/tests.rs:55-128`, `sequencer/src/ingress/inclusion_lane/tests.rs:130-186`, `sequencer/src/ingress/inclusion_lane/tests.rs:201-356`, `sequencer/src/ingress/inclusion_lane/tests.rs:1770`, `sequencer/src/commands/test_support.rs:22-74`
+
+- Claim: Confirmed: - There are 10 test `impl Application`. One, dump_info.rs:271 PrefixDumpApp, is missing from the locations. - TestApp.nonces is write-only (tests.rs:57, 91-93). - The SweepTestApp const hack is at test_support.rs:27-31. - SharedCountingApp, UserOpCounterApp and CountedSweepTestApp are the same progress-persisting stub. fill.rs:137-151 even re-implements decode_progress inline. The proposed single StubApp with instance knobs does not fit the trait. from_dump is static, and the lane reloads through it, so instance knobs survive only on directly constructed instances (tests.rs:533, :1978). - TestApp, InternalUserOpApp, SweepTestApp and StartupProbeApp reset to default on reload (tests.rs:113-115, workers.rs:722-726). - The counting stubs decode the persisted progress. - ReplayForbiddenApp and PrefixDumpApp (const-generic layout) must stay bespoke. Making every stub persist progress would change reload semantics for the reset-style stubs. Realistic shape: one persisting counter stub, one reset stub with knobs, plus the two bespoke ones. That is about -200, not -350.
+- Fix: One StubApp in test_support. It persists progress via encode/decode_progress and has opt-in knobs (reject_after, fail_dump, fail_validation, fail_apply, record: Option<Vec<ReplayEvent>>). Keep a bespoke impl only where the static from_dump must behave differently (ReplayForbiddenApp). Drop the write-only nonce map.
+
+### K4. recovery_tests.rs: ~140 repeated open/append/timing blocks, plus 680 lines of schema tests in the wrong file
+
+`medium · confirmed · -500 lines · M`  
+Where: `sequencer/src/storage/recovery_tests.rs:26-56`, `sequencer/src/storage/recovery_tests.rs:1913-1938`, `sequencer/src/storage/recovery_tests.rs:2136-2818`, `sequencer/src/storage/recovery.rs:642-643`
+
+- Claim: Confirmed, with corrected counts: - `Storage::open(db.path.as_str())` appears 68 times. - `&default_protocol_timing()` appears 57 times, not 65. - `StoredSafeInput {` appears 38 times. schema_invariants spans recovery_tests.rs:2136-2818 (682 lines). recovery.rs:641-643 is the only #[path] module in sequencer/src. The schema module's own comment (recovery_tests.rs:2141-2148) says it lives there only to share fixtures. Those fixtures are already in test_helpers, so moving it is a pure relocation. Realistic delta is about -350 to -450. The appends vary in sender, payload and count, so not all of them collapse to one line.
+- Fix: Extend the fixture trait in test_helpers with land(block, &[(sender, payload)]) and advance_safe_head(block), using SENDER_A and the default timing. Add a fixture fn that returns an opened Storage. Move schema_invariants next to the migration code (storage/tests.rs or open.rs tests). Keep every scenario.
+
+### K5. About 3.5k test lines guard cross-rebuild client continuity and the in-process cockroach rebuild: freeze them
+
+`medium · partially · +0 lines · S`  
+Where: `sequencer/src/integration_tests/historical_bootstrap.rs:1-561`, `sequencer/src/integration_tests/historical_bootstrap/recovery_compatibility.rs:1-403`, `sequencer/src/storage/history/generation_tests.rs:1-170`, `tests/e2e/src/cold_replica.rs:1-366`, `sequencer/src/commands/setup/checkpoint_tests.rs:1-226`
+
+- Claim: The superseded set is much smaller than 3.5k lines. Recovery generations and cuts are advanced by the automatic stale-batch cascade (recovery.rs:487-493, cascade_and_reopen), not only by cockroach rebuild. These tests therefore guard client continuity across routine automatic recovery, which the recovery tool does not replace: - generation_tests.rs (170) - canonical/tests.rs (429) - cold_replica.rs (366). Its "process-boundary recovery" is advance_wall_and_mine past MAX_WAIT plus respawn (cold_replica.rs:184-190), not a rebuild. - recovery_compatibility.rs ('survives missed recoveries') At most they are frozen pending the later sync redesign, not slated for deletion when the tool lands. The snapshot download tests are not superseded. /finalized_state, /inclusion_block and /digest are consumed by the watchdog (watchdog/sequencer.lua:48-64). The LeaseReadError scaffolding (snapshot_endpoints.rs:276-355) backs the /finalized_state lease tests (:357-638). checkpoint_tests.rs pins rebuild_from_checkpoint refusal safety. That logic moves into the tool rather than dying, so freeze it and migrate it. Genuinely superseded by the tool: the cross-rebuild client path, i.e. historical_bootstrap.rs (561, 'crosses the rebuilt baseline', LifecycleCommand::Rebuild at :270) and the era/raw-history egress tests in historical/tests.rs (497). Total is about 1.1k lines.
+- Fix: Freeze: do not apply K2-K4 consolidation here beyond mechanical path fixes. Delete or move these tests together with the machinery when the recovery tool lands. Its tests should become checkpoint-to-(sequencer DB, client DB) golden tests. The snapshot lease-read retry scaffolding (LeaseReadError, :276-345) goes with it.
+- Decision: Confirm snapshot download (snapshot_endpoints.rs) is in the superseded set, not kept for the watchdog or operator tooling.
+
+### K6. Benchmark target-verdict code can only ever say NOT_EVALUATED; the spec lists harnesses that do not exist
+
+`medium · confirmed · -280 lines · S`  
+Where: `tests/benchmarks/src/evaluation.rs:13-214`, `tests/benchmarks/src/bin/round_trip_latency.rs:72,199-206`, `tests/benchmarks/src/bin/sweep.rs:93,391`, `tests/benchmarks/BENCHMARK_SPEC.md:83-139`, `tests/benchmarks/README.md:63`
+
+- Claim: Confirmed. NetworkProfile::same_host_baseline() is the only constructor used (round_trip_latency.rs:72, sweep.rs:93). CanonicalNetworkAware is never built, so every verdict is NOT_EVALUATED (evaluation.rs:39, 171-187). Section 7 of the spec maps metrics to `ack_latency` and `unit_hot_path`, but src/bin holds only compare_latest, report, round_trip_latency and sweep. When deleting, keep a one-line network-profile string in the report, because spec section 6.5 requires it.
+- Fix: Delete evaluation.rs, the --evaluate flags and the verdict JSON field. Shrink the spec to the two p99 targets and the sample-size rule, and fix section 7. Re-add a verdict only when a network shaper exists.
+
+### K7. Benchmark tooling duplicates itself: CSV re-parsing, a re-implemented capacity summary, copy-pasted sweep branches, a redundant bin
+
+`medium · partially · -700 lines · M`  
+Where: `tests/benchmarks/src/bin/compare_latest.rs:35-57,283-390,431-534`, `tests/benchmarks/src/sweep.rs:110-145`, `tests/benchmarks/src/bin/sweep.rs:236-330`, `tests/benchmarks/src/bin/sweep.rs:340-450`, `tests/benchmarks/src/bin/round_trip_latency.rs:1-238`
+
+- Claim: Confirmed: - compute_sweep_summary (compare_latest.rs:509-533) re-implements compute_capacity_summary (sweep.rs:110-145) field for field, over hand-parsed CSV rows (compare_latest.rs:431-500, 351-390). - The sweep bin writes JSON in both branches (:353, :481). - report.rs already loads that JSON (report.rs:26-36, 258-297). - The ack and round-trip branches in bin/sweep.rs share their structure. Not verified: that round_trip_latency is exactly `sweep --round-trip` at one concurrency. It owns the --evaluate soft-confirm path (round_trip_latency.rs:199-206), which disappears with K6, and possibly other flags. Realistic delta is about -400 to -500, not -700.
+- Fix: Make JSON the only machine-read artifact (CSV becomes print-only or goes away). Use one row type with optional round-trip columns, one sweep code path that takes a Mode, and drop round_trip_latency (just keeps the recipe name). compare_latest then loads two JSONs and diffs the library summaries. Goal: about 4.1k down to about 3.3k lines. Do this before K8 so the new metrics land once.
+- Decision: Whether the ack-only sweep (no WS clients) must stay a separate mode for capacity runs. Recommended: keep it as a flag, not a separate code path.
+
+### K8. N17: add DB size and post-load batch drain time to the benchmark report
+
+`low · partially · +120 lines · S`  
+Where: `tests/benchmarks/src/runtime.rs:107-217`, `tests/benchmarks/src/bin/round_trip_latency.rs:172-193`, `tests/harness/src/sequencer.rs:571-591`, `tests/harness/src/sequencer.rs:700-731`, `tests/harness/src/sequencer.rs:876`
+
+- Claim: The gap is real. MemoryReport (runtime.rs:107-116) is the only resource report, and the harness has the building blocks: data_dir (:876), count_safe_accepted_batches (:571-591) and mine_live_l1_blocks (:938-940). StorageReport (DB plus WAL bytes) is cheap and well defined. drain_secs is less meaningful than claimed. In self-contained mode it is shaped by: - harness-driven mining at 1 s per block (rollups.rs:95-102) - the Anvil safe-head lag (--slots-in-an-epoch, rollups.rs:206) - the submitter idle poll of 5 s by default (test_cases.rs:3074-3076) So it measures poll cadence times batch count, not submitter throughput. Report it as an environment-shaped profiling number, or ship only StorageReport first. This is a missing metric, not a defect, so severity is low.
+- Fix: (a) StorageReport { db_bytes, wal_bytes, bytes_per_1k_accepted } from a stat of data_dir/sequencer.db and -wal when the run ends, recorded next to MemoryReport (self-contained only). (b) When the last load worker returns, record t0 and the highest sealed-batch nonce (add a MAX(nonce) accessor beside count_safe_accepted_batches). Then loop mine_live_l1_blocks(1) and poll MAX(nonce) in safe_accepted_batches until it reaches that nonce, with a deadline. Report drain_secs and batches_drained. Exclude the open tip so the metric measures submitter throughput, not max_batch_open. About 120 lines, no machinery.
+- Decision: Whether 'after all workers stop' means the load generators stop (recommended; measures the submitter backlog) or the sequencer's own workers shut down (that would measure flush-mempool instead).
+
+### K9. Timing-based tests: the 50 ms race in the 429 test can hang; fixed 7 s submitter sleeps in e2e
+
+`low · confirmed · -10 lines · S`  
+Where: `sequencer/src/integration_tests/e2e_sequencer.rs:464-472`, `sequencer/src/integration_tests/e2e_sequencer.rs:1301,1331-1337`, `sequencer/src/integration_tests/e2e_sequencer.rs:1546-1567`, `tests/e2e/src/test_cases.rs:3077,3120`, `tests/e2e/src/test_cases.rs:3909,3944`
+
+- Claim: Confirmed. /tx does try_send and then awaits a oneshot (ingress/api.rs:257-268). With the receiver parked (e2e_sequencer.rs:1336) and no timeout in post_raw_json (:1546-1567), the 429 test hangs if the main request wins the single slot. Both e2e scenarios sleep a fixed 7 s (test_cases.rs:3077/3120, 3909/3944). Better fix for the 429 case: add a deterministic unit test in ingress/api.rs with a pre-filled channel(1), modelled on closed_lane_is_service_unavailable (api.rs:289), and drop the racy integration test.
+- Fix: Fill the parked queue directly (keep a tx clone and try_send a dummy PendingUserOp) and drop the sleep and the spawned first request. In e2e, poll Anvil's pending tx count (txpool) with a deadline instead of the 7 s sleep, and hoist the shared constant.
+
+### K10. Two hand-written batch-tree invariant checkers that disagree on the anchor
+
+`low · confirmed · -90 lines · S`  
+Where: `sequencer/src/storage/recovery_tests.rs:2835-2924`, `tests/harness/src/sequencer.rs:752-858`, `tests/e2e/src/main.rs:45-49`, `sequencer/src/storage/migrations/0001_schema.sql:110`
+
+- Claim: Confirmed. The crate copy asserts that a NULL parent has nonce 0 (recovery_tests.rs:2853-2856). The harness copy is anchor-aware (harness sequencer.rs:760-767) and also checks the single valid root. Both run the same LEFT JOIN query.
+- Fix: Keep the harness check: it is the only check against the real binary's DB after each scenario. Drop the crate copy and have tree_invariants_hold_across_mixed_workload rely on the trigger tests, or move one anchor-aware checker into test_support and call it from both.
+
+### K11. e2e hand-copies sequencer defaults and cites a file that does not exist
+
+`low · confirmed · +0 lines · S`  
+Where: `tests/e2e/src/test_cases.rs:72-80`, `sequencer/src/commands/config.rs:51-52`
+
+- Claim: Confirmed. test_cases.rs:72-80 cites runtime/config.rs, which does not exist (sequencer/src/runtime holds only mod.rs, process_lock.rs and shutdown.rs). The real default is commands/config.rs:49-53 (default_value = "300"). ManagedSequencerConfig would need a new field or env passthrough so the harness can set these values explicitly.
+- Fix: Have the harness spawn config set CARTESI_SEQUENCER_PREEMPTIVE_MARGIN_BLOCKS and SECONDS_PER_BLOCK explicitly from these constants, so the test owns the values instead of copying them. Drop the sync comment.
+
+### K12. e2e scenario configuration is keyed by name strings
+
+`nit · confirmed · +0 lines · S`  
+Where: `tests/e2e/src/main.rs:19-34`
+
+- Claim: Confirmed: main.rs:19-33 selects the binary by the c_host_ prefix, disables faketime for three literal names, and sets the fee oracle for one name. This is a style issue, and it is low-risk because names are rarely renamed.
+- Fix: Have test_cases() return (name, run, configure: fn(&mut ManagedSequencerConfig)) so each scenario declares its own config next to its body.
+
+### K13. Harness errors leave out the context needed to diagnose flakes; skip logs hide vacuous passes
+
+`nit · partially · +5 lines · S`  
+Where: `tests/harness/src/ws.rs:31-34`, `tests/harness/src/util.rs:57-60`, `tests/harness/src/sequencer.rs:1616-1621`, `sequencer/src/integration_tests/snapshot_endpoints.rs:52`
+
+- Claim: Real but small: - The WS timeout error 'wait for websocket frame' (ws.rs:31-34) omits the 10 s timeout and the expectation. - 'sequencer exited before readiness' (util.rs:57-60) omits the log path. The link to the register entry is overstated. The recorded failure was a 'Connection reset', which already reaches the error text via `receive websocket frame: {err}` (ws.rs:35). The register asks for server-side logs, which CI now uploads (register.md:147-158).
+- Fix: Include the timeout and the expectation in the WS error (expect_user_op_from can pass the sender), and append log_path() to readiness and exit errors. The skip logs go away with K1.
+
+### K14. Test comments that restate code, describe their callers, or have gone stale
+
+`nit · unverified-nit · -30 lines · S`  
+Where: `tests/harness/src/sequencer.rs:565-570`, `sequencer/src/integration_tests/e2e_sequencer.rs:1306-1311`, `sequencer/src/ingress/inclusion_lane/tests.rs:107-111,416-418`, `sequencer/src/ingress/inclusion_lane/tests.rs:206-211`, `tests/harness/src/sequencer.rs:745-752`
+
+- Claim: count_safe_accepted_batches' doc describes the one test that calls it. The 'Sentinel submitter: pass an address no fixture seeds' comment sits on an L2TxFeedConfig literal that no longer has an address field. The comments around drop(app) and from_dump restate the code. SharedCountingApp claims it 'counts direct-input executions' but only persists progress. assert_schema_invariants is documented as panicking while it returns HarnessResult (mixed error channels).
+- Fix: Delete or trim them in the K2/K3 sweep. Per AGENTS.md, keep only comments that state a non-obvious why.
+
+### K15. `extern crate self as sequencer` lets in-crate tests spell the same path two ways
+
+`nit · unverified-nit · -2 lines · S`  
+Where: `sequencer/src/lib.rs:32-35`, `sequencer/src/integration_tests/e2e_sequencer.rs:7,16-22`
+
+- Claim: Left over from moving the tests into src (bc8ffe8). Integration files mix `crate::storage::...` and `sequencer::storage::...`; there are 35 `sequencer::` sites across five files.
+- Fix: Rewrite sequencer:: to crate:: in integration_tests and drop the alias. A mechanical change.
+
+### KS1. Harness repeats the read-only DB open block in ten accessors
+
+`low · skeptic-added · -50 lines · S`  
+Where: `tests/harness/src/sequencer.rs:387`, `tests/harness/src/sequencer.rs:446`, `tests/harness/src/sequencer.rs:468`, `tests/harness/src/sequencer.rs:553`, `tests/harness/src/sequencer.rs:572`
+
+- Claim: Each harness DB accessor repeats the same 6-line block: join("sequencer.db"), open_with_flags(READ_ONLY) and the same map_err. The DB filename is spelled out 11 times.
+- Fix: Add one private `fn open_db_read_only(&self) -> HarnessResult<rusqlite::Connection>` and call it from every accessor. This also gives a single home for the DB filename that K8's StorageReport needs.
+
+### KS2. Stale 'Sentinel submitter' comments describe an argument L2TxFeed::new no longer takes
+
+`nit · skeptic-added · -5 lines · S`  
+Where: `sequencer/src/integration_tests/e2e_sequencer.rs:1253-1254`, `sequencer/src/integration_tests/e2e_sequencer.rs:1309-1310`, `sequencer/src/integration_tests/snapshot_endpoints.rs:60`
+
+- Claim: These comments say the fixture passes a sentinel submitter address. L2TxFeed::new takes only (db_path, shutdown, config) (egress/l2_tx_feed/mod.rs:71), and the L2TxFeedConfig literals the comments sit in have no such field. The real sentinel is NO_OWN_BATCHES, pinned through the deployment identity in l2_tx_feed/tests.rs:322-339.
+- Fix: Delete the three stale comments.
+
+Keep (load-bearing):
+
+- src/integration_tests inside the crate (integration_tests/mod.rs:1-2): keeps the raw worker-launch APIs crate-private; moving them to tests/ would force public surface.
+- tests/harness TcpProxy (harness/src/proxy.rs, about 440 lines) together with faketime: the only way to drive the provider-outage / both-down / hiccup scenario matrix.
+- Harness assert_schema_invariants run after every scenario (e2e/src/main.rs:45-49): the only structural check against the real binary's DB. Keep this anchor-aware copy (see K10).
+- The schema_* trigger tests (recovery_tests.rs:2152-2801): the schema is the enforcement layer for the batch-tree invariants. Move them (N4), do not cut them.
+- Boundary pairs that look redundant but cover different entry points: recover_aging_tip (recovery_tests.rs:985-1022) vs recover_post_flush (:1913-1966).
+- The reject-flood frontier-starvation test (inclusion_lane/tests.rs:505-585): its sleep-based stub is the only pin on bounded turns versus divergence detection.
+- The c_host_ scenario variants (e2e main.rs:20, test_cases.rs:160-171): they run the same scenarios through the C ABI bridge.
+- Zone-math derived constants and compile-time asserts in test_cases.rs:57-100: they tie the outage scenarios to MAX_WAIT_BLOCKS (fix the copied defaults per K11, keep the derivation).
+- Serial e2e runner (main.rs:12, test_threads=1): scenarios share Anvil, faketime and the process lock.
+- kill_on_drop on spawned children (harness/sequencer.rs:1397,1565): a panicking assertion still tears down Anvil and the sequencer.
+- MemorySampler and the accepted-tx-to-WS-event sanity assertion (BENCHMARK_SPEC section 3.5): the benchmark's real correctness guard and memory profile.
+
+## L. Build, CI, supply chain, cross-compilation
+
+Verdict: Build/CI/supply-chain is about 2,250 lines: 21 manifests, two workflows, three composite actions, three justfiles, six scripts, two Dockerfiles and one build.rs. Its essential complexity is real. A host workspace that links the emulator (testsi), a RISC-V guest cross-build whose template hash is consensus-relevant, a C-engine seam and a Lua/Docker watchdog all need pinned, hash-verified inputs. The core is sound and should be kept. Every downloaded artifact is SHA-pinned. The cross image is pinned by digest. CI runs with --locked. default-members keeps a plain `cargo build` free of the CM/libclang requirement. Clippy already covers all 21 members, guest crates included, through libcmt's host mock. The biggest problems sit around that core, not in it. (1) The release path's supply-chain posture is weaker than CI's: third-party actions are on mutable tags with workflow-wide write permissions, cross/just are unpinned, and a dispatch builds the dispatched branch while labelling it with an arbitrary tag. (2) CI runs every PR push twice with no concurrency cancel, and builds the devnet guest image in two jobs. (3) The pin plumbing (verify/load scripts, a Rust version pinned in three places) is about 150 lines that mostly compare the pins file with itself, while the real drift points go unchecked: Foundry version ×3, contracts version ×2, guest-tools version. (4) The lockfile looks heavier than the build: 537 entries, ark-ff×4, three syn majors. Most of that comes from weak `dep?/feat` optional entries that never compile. The compiled duplicates the manifests actually cause are four (reqwest, tokio-tungstenite, thiserror, toml), plus one unused direct dep. Measure with `cargo build --timings` / `cargo tree -d -e normal,build` before any wider dependency surgery.
+
+
+### L1. Release path: mutable action tags, workflow-wide write token, unpinned cross/just, caches in release
+
+`medium · confirmed · +15 lines · S`  
+Where: `.github/workflows/release.yml:23-25`, `.github/workflows/release.yml:65-71`, `.github/workflows/release.yml:191-229`, `.github/workflows/release.yml:270`, `.github/actions/setup-guest-toolchain/action.yml:89-118`
+
+- Claim: Confirmed as stated. One refinement: DOCKERHUB_TOKEN reaches only build-watchdog-image (release.yml:180-208). The broader exposure is the workflow-wide GITHUB_TOKEN with contents:write and packages:write (release.yml:23-25). Every tag-referenced action in every job can use that token, including taiki-e/install-action@v2 (:69), Swatinem/rust-cache@v2 (:66) and dtolnay/rust-toolchain@stable (:60).
+- Fix: Pin every non-GitHub-owned action to a commit SHA with a `# vX.Y` comment. Move `permissions` to the job level: contents:write only on `publish`, packages:write only on `build-watchdog-image`, and `contents: read` at the top of both workflows. Pin tool versions (`tool: cross@<ver>,just@<ver>`) and record them in toolchain-pins.env. Drop rust-cache/gha cache from release.yml, since a release build should not restore a cache written by other refs. Add .github/dependabot.yml for `github-actions` so the SHA pins stay current.
+- Decision: Whether release builds may keep caches (speed) or must build cold (provenance).
+
+### L2. workflow_dispatch release builds the dispatched branch but labels/tags it with inputs.tag
+
+`medium · confirmed · +6 lines · S · BC`  
+Where: `.github/workflows/release.yml:11-21`, `.github/workflows/release.yml:41-42`, `.github/workflows/release.yml:127-128`, `.github/workflows/release.yml:174-175`, `.github/workflows/release.yml:269-273`
+
+- Claim: Confirmed. It matters more than the reviewer says: generate-release-manifest.sh:85-91 writes an explicit `alignment.rule`, 'All artifacts sharing release_tag were built from git_commit'. A dispatch from main naming a new tag breaks that rule, because softprops creates the tag at the default-branch HEAD while git_commit is GITHUB_SHA. A dispatch naming an existing tag is also wrong: it uploads assets built from the dispatched branch into that tag's release.
+- Fix: Pass `ref: ${{ inputs.tag || github.ref }}` to every checkout in release.yml, and fail early if `inputs.tag` does not resolve to an existing tag. Alternatively, drop the free-form `tag` input and let dispatch only re-run an existing tag.
+- Decision: Should dispatch be allowed to create a new tag at all, or only rebuild an existing one?
+- Independent trace: confirmed. Code reading confirms the claim. There are four checkouts and none passes `ref:`.
+
+### L3. CI runs every PR push twice and never cancels superseded runs
+
+`low · partially · +5 lines · S`  
+Where: `.github/workflows/ci.yml:3-5`, `.github/workflows/ci.yml:102-105`, `.github/workflows/ci.yml:131-134`, `.github/workflows/ci.yml:182-186`
+
+- Claim: The double run and the missing concurrency group are real: ci.yml:3-5 has no filters and the file has no `concurrency:` key. Two parts are overstated. First, watchdog-docker's `needs: rust` (ci.yml:185) is not 'for no reason'. It is the same fail-fast gate canonical-guest (:104) and rollups-e2e (:133) use, trading latency for wasted minutes on red pushes. Second, `push: branches: [main]` also stops CI on v* tag pushes (today the unfiltered push trigger runs it). release.yml has no CI gate, so a tag commit that never reached main or a PR would then ship with no CI run at all. Treat this as a cost and latency cleanup, not a defect.
+- Fix: Use `push: branches: [main]` plus `pull_request:`, and add `concurrency: { group: ${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: true }`. Drop `needs: rust` from watchdog-docker. This roughly halves runner minutes per PR iteration, and the safety net is unchanged because the PR run covers the same tree.
+- Decision: The double run has incidentally surfaced flakes (register:150-152). Confirm that losing that is acceptable; a nightly re-run is the explicit alternative.
+
+### L4. Four compiled duplicate stacks are caused by our own version picks, plus one unused direct dep
+
+`low · partially · -2 lines · S · public-rust-api`  
+Where: `Cargo.toml:62`, `Cargo.toml:71`, `sdk/guest/testsi/Cargo.toml:23`, `sequencer/Cargo.toml:19`, `sequencer/Cargo.toml:28`
+
+- Claim: The four duplicate stacks exist as described, but none of reqwest 0.12, tokio-tungstenite 0.28 or thiserror 1 is in the shipped wallet-sequencer graph. sequencer pulls reqwest and tokio-tungstenite only as dev-dependencies (sequencer/Cargo.toml:45-46). The other users are the SDK, harness and benchmarks, and thiserror 1 comes only from testsi (sdk/guest/testsi/Cargo.toml:23). That makes this test and CI build time only. alloy-network-primitives is confirmed unused: sequencer/Cargo.toml:28, with zero `alloy_network_primitives` uses in any .rs file. The tokio-tungstenite part is superseded-by-direction. axum's `ws` feature (sequencer/Cargo.toml:14) serves only `/ws/subscribe` (egress/api/mod.rs:36), and the SDK's tungstenite is that endpoint's client (sdk/rust-client/src/lib.rs:25). Both are the subscribe path the new sync replaces, so freeze them rather than dedupe. Keep the reqwest, thiserror, toml and unused-dep parts. The reqwest bump changes the SDK's public API (`pub response: reqwest::Response`, sdk/rust-client/src/lib.rs:33), so coordinate it with the open register entry 'Support HTTPS and WSS in the Rust SDK', which needs a TLS feature choice anyway.
+- Fix: Bump `reqwest = { version = "0.13", default-features = false }` and `tokio-tungstenite = "0.29"` in [workspace.dependencies]. Set testsi to `thiserror = { workspace = true }`. Delete `alloy-network-primitives` from sequencer/Cargo.toml:28. Optionally replace `alloy-transport` with `alloy::transports::layers::RetryBackoffLayer` and bump toml to the current major. Check the result with `cargo tree -d -e normal,build --workspace`.
+- Decision: sequencer-rust-client is an SDK. If its public API exposes tungstenite/reqwest types, the bump is a semver-visible change. The toml bump changes how checkpoint info.toml is rendered (dump_info.rs:109,159); confirm no digest covers those bytes before bumping.
+
+### L5. Pin plumbing (~150 lines) mostly checks the pins file against itself and misses the real drift points
+
+`medium · partially · -90 lines · S`  
+Where: `scripts/verify-toolchain-pins.sh:43-74`, `scripts/load-toolchain-pins.sh:1-49`, `rust-toolchain.toml:2`, `toolchain-pins.env:5`, `toolchain-pins.env:21-22`
+
+- Claim: The core is confirmed. verify-toolchain-pins.sh:47-55 re-reads toolchain-pins.env and compares it with values sourced from the same file. Its only justfile check (:57) greps for `pins := "../../toolchain-pins.env"`, and that variable is dead: examples/canonical-app/justfile:3 defines it, but lines 4-6 hard-code the path. The real drift points go unchecked. Foundry 1.5.1 appears at ci.yml:57, action.yml:30 and justfile:16. The contracts version appears at Cargo.toml:49 and justfile:15, plus a third copy the reviewer missed: tests/harness/src/paths.rs:6-7 hard-codes both 3.0.0-alpha.10 and anvil-1.5.1. Guest-tools 0.18.0 appears at canonical Dockerfile:7 and watchdog/test-guest/Dockerfile:8, and must match libcmt-sys. Two corrections to the proposal. RUST_TOOLCHAIN cannot simply be deleted, because generate-release-manifest.sh:79 reads os.environ["RUST_TOOLCHAIN"] into RELEASE.json; the script must parse rust-toolchain.toml instead. The cited toolchain-pins.env:21-22 is the lua-cURL comment and is irrelevant. A realistic net delta is about -60 to -70 lines.
+- Fix: Make rust-toolchain.toml the only Rust pin: delete RUST_TOOLCHAIN, the `rust-toolchain` action input and the dtolnay steps, and use `rustup toolchain install` (adding `targets` where needed). Add FOUNDRY_VERSION, ROLLUPS_CONTRACTS_VERSION and MACHINE_GUEST_TOOLS_VERSION to toolchain-pins.env, and have ci.yml, the justfile and the Dockerfile ARG consume them. Replace verify lines 43-74 with three real cross-file greps (Cargo.toml `=${ROLLUPS_CONTRACTS_VERSION}`, justfile dump name, libcmt-sys description/README). Inline the loader as `grep -E '^[A-Z_]+=' toolchain-pins.env >> "$GITHUB_ENV"`.
+
+### L6. Consensus guest build lacks --locked, uses an unpinned cross binary, and does not remap paths
+
+`low · partially · +2 lines · S`  
+Where: `examples/canonical-app/justfile:43`, `examples/canonical-app/justfile:49`, `examples/canonical-app/Cross.toml:3`, `.github/actions/setup-guest-toolchain/action.yml:115-118`, `.github/workflows/release.yml:147-151`
+
+- Claim: The facts are right. The cross builds have no --locked (canonical justfile:43,49), and neither does `cargo run -p canonical-test` (:107). The cross binary is unpinned (action.yml:115-118). There is no .cargo/config.toml or RUSTFLAGS remap anywhere. The impact is smaller than claimed. In CI, canonical-guest and rollups-e2e `needs: rust`, and rust builds with --locked (ci.yml:60), so a stale lock fails first. A release tag on a commit that already passed CI cannot re-resolve. The checkout-path concern is probably moot: cargo passes workspace-relative paths for workspace members, and no path dependencies sit outside the workspace. Adding --locked is still a free one-line fix. Leave the remap concern pending the reviewer's two-path experiment.
+- Fix: Add `--locked` to both cross builds (and to `cargo run -p canonical-test`). Pin the cross version (covered by L1). Try a cheap experiment first: run `just canonical print-build-hashes` from two different checkout paths. Add `RUSTFLAGS=--remap-path-prefix=$PWD=/src` only if the hashes differ.
+- Decision: Whether independent rebuilds of the template hash from any checkout path are a goal. The remap part is low-confidence until the two-path experiment runs.
+
+### L7. The devnet guest image is built twice per CI run (canonical-guest and rollups-e2e jobs)
+
+`low · confirmed · -25 lines · S`  
+Where: `.github/workflows/ci.yml:102-129`, `.github/workflows/ci.yml:131-171`, `examples/canonical-app/justfile:82`, `examples/canonical-app/justfile:106-107`, `justfile:62-71`
+
+- Claim: Confirmed. canonical-guest runs test-guest, which depends on build-machine-image (canonical justfile:106,82). rollups-e2e builds the same devnet image through ensure-machine-image (root justfile:62,67-68), each job after a full setup-guest-toolchain. The e2e path runs lua-deps three times (ci.yml:163, justfile:63, justfile:84) and `apt-get update` a second time (ci.yml:157 after action.yml:46). The ~-25 delta is plausible because it mostly removes ci.yml:102-129.
+- Fix: Fold the canonical-guest job into rollups-e2e by running `just canonical-test-guest` first. That builds the image once, and ensure-machine-image then reuses it. Drop the redundant lua-deps invocation and the second `apt-get update` (ci.yml:155-163). The trade-off is one less parallel job and roughly 10 minutes more wall-clock on the e2e path.
+- Decision: Choose between parallel wall-clock and the runner minutes saved by building the guest image once.
+
+### L8. canonical-app justfile copy-pastes devnet and sepolia recipes three times
+
+`low · confirmed · -35 lines · S · config`  
+Where: `examples/canonical-app/justfile:39-104`, `justfile:89-93`, `.github/workflows/release.yml:147-151`
+
+- Claim: Confirmed. The pairs at examples/canonical-app/justfile:41-51, 55-71 and 82-104 differ only in the bin name or the --store path. dapp_binary, rootfs_tar and rootfs_ext2 (:17-20) are shared across chains. Today this is hygiene, not a bug: each machine-image recipe rebuilds its own rootfs before storing it, so the sequential builds in release.yml:147-151 and justfile:62 come out correct. A realistic net is about -20 to -25 lines once the aliases are added back.
+- Fix: Use one `build-machine-image chain="devnet"` recipe with per-chain intermediates under out/<chain>/. Keep the existing output dir names and thin aliases so the harness, watchdog and release consumers do not change.
+
+### L9. Release builds wallet-sequencer through cross even for the native x86_64 target and installs unused apt packages
+
+`low · confirmed · -10 lines · S · BC`  
+Where: `.github/workflows/release.yml:28-76`, `.github/workflows/release.yml:47-57`
+
+- Claim: Confirmed. release.yml:76 builds both matrix targets with cross. There is no root Cross.toml, so the default tag-based images are used. lua5.4, liblua5.4-dev, libslirp-dev and libssl-dev are installed (:47-57), but Cargo.lock has no openssl, native-tls or hyper-tls. Cross's older-glibc images are a deliberate portability benefit, which the needs_decision already captures.
+- Fix: Either build natively on `ubuntu-24.04` and `ubuntu-24.04-arm` runners, which drops cross and docker from this job, or pin cross and add a root Cross.toml with image digests. Drop the unused apt packages either way.
+- Decision: Cross images give an old-glibc, portable binary, while native 24.04 runners raise the glibc floor to 2.39. Pick the supported glibc floor, or move to a static musl target.
+
+### L10. Lint gaps: the production bash launcher and scripts are not shellchecked, one Lua fixture is unlinted, there is no workspace lint table, and `just ci` has drifted from CI
+
+`low · confirmed · +12 lines · S`  
+Where: `.github/workflows/ci.yml:65-69`, `watchdog/sequencer-watchdog:1-5`, `scripts/watchdog-lua-deps.sh:84`, `scripts/verify-toolchain-pins.sh:13`, `Cargo.toml:1-73`
+
+- Claim: Confirmed, with one count corrected: there are 8 `allow` attributes, not 6. The two missed are libcmt-sys/src/lib.rs:1-3 (three bindgen allows) and sequencer/src/commands/test_support.rs:29; all remain justified. Nothing runs shellcheck, even though five `shellcheck disable` directives exist (scripts/*.sh) and watchdog/sequencer-watchdog is 67 lines. luacheck at ci.yml:69 misses watchdog/tests/fixtures/input_added_evm_advance.lua. No manifest has a `[lints]` table. `just ci` (justfile:120-124) omits clippy, luacheck, the Lua tests and the C smoke.
+- Fix: Add a CI step `shellcheck scripts/*.sh watchdog/sequencer-watchdog` and lint `tests/**/*.lua`. Add `[workspace.lints.clippy] undocumented_unsafe_blocks = "warn"`, opted in first by bindings/c-app-engine (the seam reader). Either delete `just ci` or make CI invoke it so there is one list.
+- Decision: Whether to require SAFETY comments on the FFI seam crates (adds about 40 short comments).
+
+### L11. No advisory or source gate on the crate graph
+
+`low · confirmed · +35 lines · S`  
+Where: `Cargo.toml:41-73`, `sdk/guest/testsi/Cargo.toml:19`, `.github/workflows/ci.yml:8-81`
+
+- Claim: Confirmed. There is no deny.toml or audit.toml, and no advisory or source step in ci.yml. The only git source is the dave rev (sdk/guest/testsi/Cargo.toml:19). A non-blocking job plus a schedule is proportionate.
+- Fix: Add a small deny.toml covering `advisories` and `sources` (allow-git = the dave repo only), with `bans` left at warn. Run `cargo deny check advisories sources` as a separate CI job that does not block PRs, plus a weekly schedule. The invariant it protects is that no known-vulnerable crate ships in the sequencer or watchdog release.
+- Decision: Blocking or advisory-only on PRs.
+
+### L12. sequencer-core build.rs generates 15 constants; a checked-in table plus a recompute test is simpler and visible in review
+
+`low · confirmed · -50 lines · S`  
+Where: `sequencer-core/build.rs:1-119`, `sequencer-core/Cargo.toml:25-26`, `sequencer-core/src/fee.rs:20-24`
+
+- Claim: Confirmed. build.rs:66-118 generates TABLE and MAX_EXPONENT into OUT_DIR, fee.rs:21-23 include!s them, and ruint is the only build-dependency (sequencer-core/Cargo.toml:25-26). A checked-in literal plus a recompute test gives the same guarantee. It also serves fee.rs:15-16 ('Independent implementations must reproduce the conversion bit-for-bit') better, because the values become reviewable. The fee.rs doc references to build.rs (:14,:44) must be updated with it.
+- Fix: Check in the generated `TABLE`/`MAX_EXPONENT` as a literal const in fee.rs. Move the repeated-squaring algorithm into a #[test] that recomputes the table with alloy U256 and asserts equality. That gives the same guarantee, enforced in CI, and the table becomes reviewable.
+- Decision: Whether the maintainer prefers derived-at-build constants on principle over a test-pinned literal.
+
+### L13. No profile tuning: full debuginfo for roughly 500 deps on every dev/test build and in the CI cache
+
+`low · confirmed · +4 lines · S`  
+Where: `Cargo.toml:1-73`
+
+- Claim: Confirmed: no manifest has a `[profile.*]` section. Add one caution: restrict the change to `[profile.dev]`. The guest is built with `cross build --release` (canonical justfile:43,49), so any `[profile.release]` edit changes the template hash and is consensus-relevant.
+- Fix: Add `[profile.dev] debug = "line-tables-only"` (backtraces keep file:line) and optionally `[profile.dev.package."*"] debug = false`. Measure before and after with `cargo build --timings` and `du -sh target`.
+- Decision: Accept losing full variable-level debuginfo in dependencies.
+
+### L14. Manifest hygiene: wrong inherited readme path, unhoisted shared deps, guest crates outside workspace.package
+
+`nit · unverified-nit · +0 lines · S`  
+Where: `Cargo.toml:34`, `sequencer/Cargo.toml:13`, `sequencer/Cargo.toml:19-20`, `tests/harness/Cargo.toml`, `tests/e2e/Cargo.toml`
+
+- Claim: Inherited `readme = "../README.md"` resolves relative to the workspace root, so it points outside the repo. Shared deps are declared per member: tar 0.4 ×3, toml 0.8 ×2, libtest-mimic 0.6/0.6.1, and the `sequencer-core` path in 8 manifests. rollups-types uses `alloy-* = "1"` instead of the workspace entries. The five guest crates hard-code version, edition 2021 and license instead of inheriting. Only the guest crates set publish=false.
+- Fix: Set `readme = "README.md"` and `publish = false` in [workspace.package]. Hoist tar, toml, libtest-mimic and the internal path crates into [workspace.dependencies]. Point rollups-types at workspace alloy. Migrate the guest crates to edition 2024 and `*.workspace = true` in a separate refactor patch (bindgen output may need `unsafe extern`).
+
+### L15. Comments that restate code or describe things that do not exist (representative)
+
+`nit · unverified-nit · -12 lines · S · docs-only`  
+Where: `sequencer/Cargo.toml:50-52`, `sequencer-core/build.rs:24-25`, `sequencer-core/build.rs:73`, `sequencer-core/build.rs:82`, `sequencer-core/build.rs:84-86`
+
+- Claim: Examples: (1) sequencer/Cargo.toml:50-52 spends three lines explaining what [dev-dependencies] means; "# TcpProxy for provider-disconnect tests" would do. (2) build.rs repeats 'exact integer, no floating point' three times (:11, :86, :100) and narrates steps (`// Build the table by repeated squaring.`, `// Generate Rust source.`). (3) toolchain-pins.env:21-22 documents a pin that does not exist, duplicating watchdog-lua-deps.sh:6-9.
+- Fix: Trim to the non-obvious: keep the alloy 2.x/1.x constraint note (Cargo.toml:51-53) and the Cross.toml digest rationale; cut the rest. This is moot for build.rs if L12 lands.
+
+### L16. Checksum-failure messages hide the actual hash (representative)
+
+`nit · unverified-nit · +2 lines · S`  
+Where: `justfile:77`, `examples/canonical-app/justfile:28`, `examples/canonical-app/justfile:36`
+
+- Claim: When a pinned download is replaced upstream, the operator sees 'SHA256 mismatch ... delete it and re-run' on stdout, with shasum's FAILED line discarded by `>/dev/null`. There is no expected-vs-actual pair to tell a corrupted download from a re-published asset. The kernel check (canonical justfile:28) likewise discards shasum's stdout and prints nothing that names the pinned release.
+- Fix: On failure, print `expected=<pin> actual=$(shasum -a 256 file)` and the URL to stderr.
+
+### LS1. The guest kernel, a consensus-relevant input, is not hash-pinned in-tree; its checksum is downloaded next to it
+
+`medium · skeptic-added · -3 lines · S · BC · config`  
+Where: `examples/canonical-app/justfile:13-16`, `examples/canonical-app/justfile:25-37`, `toolchain-pins.env:17-19`, `watchdog/test-guest/justfile:41`, `justfile:21-24`
+
+- Claim: download-deps fetches both the kernel and its .sha512 from the same machine-linux-image release (justfile:31-32) and checks one against the other. That catches corruption in transit, but not a replaced release asset. Every other download is pinned in-tree: the CM and xgenext2fs .debs (toolchain-pins.env:8-15), guest-tools (canonical Dockerfile:8) and the anvil dump (root justfile:24, whose comment states the 'replaced/corrupted release asset' TOFU model). The kernel goes into the machine image's RAM (canonical justfile:87), so it determines the template hash. The area verdict's 'every downloaded artifact is SHA-pinned' is therefore false for the one input that matters most.
+- Fix: Add CARTESI_LINUX_KERNEL_SHA512 (or SHA256) to toolchain-pins.env next to CARTESI_LINUX_KERNEL_FILENAME. Verify the downloaded kernel against the pin in download-deps and in watchdog/test-guest, and drop the second wget and the sed rewrite. This protects the invariant that the template hash is a function of in-tree pins and source only, under the same TOFU model the repo already uses.
+
+### LS2. Tag-push releases are never marked prerelease, so every alpha is published as a full release
+
+`low · skeptic-added · +0 lines · S · BC`  
+Where: `.github/workflows/release.yml:273`, `.github/workflows/release.yml:17-21`
+
+- Claim: `prerelease: ${{ github.event_name == 'workflow_dispatch' && inputs.prerelease }}` is false on the normal path, a v* tag push. Every tag so far is v0.1.0-alpha.1..10 (git tag -l), so each tag push publishes a non-prerelease, which GitHub's default make_latest then marks as Latest. Only manual dispatches honour the prerelease flag.
+- Fix: `prerelease: ${{ github.event_name == 'workflow_dispatch' && inputs.prerelease || github.event_name == 'push' && contains(github.ref_name, '-') }}`, which marks SemVer pre-release tags automatically.
+- Decision: Whether alpha tags should be marked prerelease (likely yes).
+
+Refuted:
+
+- L17. Snapshot-egress-only deps: freeze, don't polish. The reviewer tied sha2 and tokio-util to download-then-subscribe without reading which routes use them.
+
+Keep (load-bearing):
+
+- toolchain-pins.env plus SHA verification of every downloaded input: the CM .deb (install-cartesi-machine/action.yml:38-39), xgenext2fs (setup-guest-toolchain/action.yml:77-79), kernel sha512 (canonical justfile:27-37), guest tools sha512 (canonical Dockerfile:8-13) and the TOFU anvil dump hash (justfile:21-24). These are what make the canonical image and the e2e chain state trustworthy.
+- examples/canonical-app/Cross.toml:3 pins the guest cross image by digest; the consensus binary's toolchain must be bit-stable.
+- SOURCE_DATE_EPOCH, `xgenext2fs -f` (zeroed timestamps), `--assert-version` and `--assert-rolling-template --final-hash` in the canonical justfile (:43, :62, :84-92). These make the template hash reproducible and catch a wrong emulator early.
+- `--locked` on every CI and release cargo call (ci.yml:60,66,78; release.yml:76) prevents silent dependency drift in tested and shipped artifacts.
+- default-members = [sequencer, wallet-sequencer] (Cargo.toml:25) keeps plain `cargo build` free of the CM/libclang/libslirp requirement that canonical-test and testsi impose.
+- scripts/ci-c-application-smoke.sh builds an out-of-workspace consumer against the C seam, which catches workspace-only assumptions in c-app-sequencer that in-workspace tests cannot.
+- scripts/ci-watchdog-docker-smoke.sh exercises the real production entrypoint, the flock contention and the uninitialized-state path inside the shipped image, not just that the image builds.
+- c-app-engine generates its FFI bindings with bindgen from the header at build time (bindings/c-app-engine/Cargo.toml build-deps comment): the header is the ABI source of truth, and checking in generated bindings would let them drift.
+- libcmt-sys builds a host mock (sdk/guest/README.md), which is why clippy and tests cover guest crates on the host with no RISC-V lint job.
+- Workspace alloy feature lists are member-specific and `node-bindings` is dev-only (sequencer/Cargo.toml:41-43). This keeps the Anvil-spawning surface out of production builds.
+- E2E failure-log upload (ci.yml:173-180) is the instrumentation the open flake register entry depends on.
+- Release SHA256SUMS + release-manifest.json (release.yml:251-267) give operators one artifact that ties the sequencer, the watchdog image and the canonical images to one commit and one set of pins.
+
+## M. Watchdog (Lua) and guest SDK provenance
+
+Verdict: The watchdog is a one-shot Lua CLI of about 2,240 production lines plus a 67-line bash wrapper. It replays InputBox inputs on the canonical Cartesi Machine in-process, proves the L1 view complete (contiguous indices plus getNumberOfInputs pinned at B), compares a flat SHA-256 against the sequencer's accepted checkpoint, latches a divergence before collecting evidence, and offers `replay` for recovery. The size fits the essential complexity. No module passes 320 lines, each concept has one home, there is no daemon and no in-tick retry, there are only three failure classes, and the README's "Why it is built this way" names the invariant behind each hardening mechanism. The v2 rewrite (c0bebe8 and later) overtook both backlog notes: AI3 is fixed, and AI2 is down to a small residual in idempotent init. The real problems are small and local: (1) the credential-bearing RPC URL leaks into stderr, last_tick.json and `status` output (http.lua:73), the same shape as an open register entry; (2) config.json mixes deployment identity with endpoint and provider tuning that operators rotate; (3) init's no-config branch deletes an agreed head instead of failing loud; (4) module headers restate the README. Nothing here is superseded by the recovery and client-sync direction. `replay` is the canonical-side input the future shared recovery tool will consume, so keep it, and do not grow application-specific export inside the watchdog. sdk/guest is clearly vendored: libcmt is pinned by tag, commit and tarball sha256 and has update steps, and the Rust crates are an acknowledged in-tree fork. The one gap is that the guest-tools/libcmt version pairing is held only by prose in two files.
+
+
+### M1. L1 RPC URL (often carrying an API key) is embedded in failure messages that reach stderr, last_tick.json and `status`
+
+`medium · confirmed · +0 lines · S · BC`  
+Where: `watchdog/http.lua:73`, `watchdog/jsonrpc.lua:36-37`, `watchdog/l1.lua:81-84`, `watchdog/main.lua:271-274`, `watchdog/main.lua:176-182`
+
+- Claim: On any transport failure (DNS, refused connection, timeout), http.lua:73 formats the full request URL into the error. For the L1 RPC that is the provider URL, and Infura or Alchemy style URLs carry the API key in the path. jsonrpc.lua:36-37 passes the error through unchanged, and l1.lua:83 and l1.lua:205 wrap it as a transient error. main.lua:272-274 then logs it to stderr, main.lua:176-182 persists it in last_tick.json, and main.lua:146 prints it from `status`. This contradicts docs/watchdog/README.md:143-144 ('The L1 RPC endpoint is never persisted'). status.prom is not affected, because metrics.render emits no message (metrics.lua:44-73). The libcurl error text itself names at most the host. HTTP-status failures (jsonrpc.lua:45-48) do not include the URL.
+- Fix: Drop the URL from http.lua's message and keep only the method. Callers already add context ('L1 RPC:', 'sequencer <route>:'). If a host is wanted, log scheme://host only. Fix it in the same patch as the Rust register entry.
+
+### M2. config.json persists rotatable endpoint/provider tuning (sequencer_url, long_block_range_error_codes) next to deployment identity
+
+`low · partially · -12 lines · S · BC · config`  
+Where: `watchdog/config.lua:4-7`, `watchdog/config.lua:99`, `watchdog/config.lua:107`, `watchdog/config.lua:123`, `watchdog/config.lua:129`
+
+- Claim: Two facts hold. init requires CARTESI_WATCHDOG_SEQUENCER_URL (config.lua:99) although bootstrap.run never uses a sequencer (bootstrap.lua:20-62, main.lua:125). The range-error codes are frozen at init (config.lua:107, :129, :148-161), so switching to a provider with a different code means wiping the state directory and re-initializing, per README.md:162-163. But 'two sources of truth' overstates it. The URL is a documented persisted default with a tick-time override (README.md:150, config.lua:154), and the module header says so (config.lua:4-7). The failure mode is also loud and bounded: a missing code only makes wide getLogs ranges fail as transient (l1.lua:196-205), while small ranges keep working, and the default list covers the common providers. Proposed delta is closer to -5 than -12, because the tick needs a required-URL check in its place.
+- Fix: Read both from the env at run time (codes keep their default) and stop persisting them. config.load ignores the old fields, so no version bump is needed. config.json then holds pure identity: version, chain_id, app_address, input_box_address, state_source, bootstrap_block. The AI2 element validation goes away with the field.
+- Decision: Should the sequencer URL become a required tick-time env var (like the RPC URL), and should provider error codes be tunable without re-init?
+
+### M3. Idempotent init checks only identity, not the schema of an existing config.json (AI2 residual)
+
+`nit · partially · +2 lines · S · BC`  
+Where: `watchdog/bootstrap.lua:23-35`, `watchdog/config.lua:133-163`
+
+- Claim: The idempotent init branch compares only chain_id, app_address and state_source (bootstrap.lua:23-35, config.lua:134-138) and never runs config.load. The gap is reachable only through a config.json that was hand-edited but is still valid JSON. A torn or corrupt file already fails at bootstrap.lua:23, because read_json raises an operator error (store.lua:119-121). Every value init writes is validated before it is written (config.lua:94-130). A v1 directory gets 'initialized for another deployment ... wipe it to re-initialize' (bootstrap.lua:28-29) rather than the version message (config.lua:145), but both prescribe the same remedy (wipe and re-init). Calling config.load in that branch is still a harmless one-line tightening.
+- Fix: In the idempotent branch, call `config.load(store.dir, existing, {})` before comparing identity (one line). Init then fails with the same diagnosis tick would give.
+
+### M4. init silently deletes an agreed head when config.json alone is missing, which is an impossible state that should fail loud
+
+`low · confirmed · +6 lines · S · BC`  
+Where: `watchdog/bootstrap.lua:38-40`, `watchdog/bootstrap.lua:54-57`, `watchdog/main.lua:112-118`, `docs/recovery/cockroach.md:85-97`
+
+- Claim: With no config.json, bootstrap.lua:38-40 deletes checkpoints/ wholesale on the assumption that any checkpoint came from an interrupted init. It does so before validating anything: the removal at line 40 runs before the chain-id, InputBox, source and trust checks at lines 43-52. An interrupted init can leave only one checkpoint, at its bootstrap block (lines 54-57 publish before config.json is written), and an agreed head always has block > bootstrap_block (tick.lua:72, :106). So a missing config.json beside an agreed head is an impossible state that gets 'handled' by deletion. The code's own diagnostics lead into it. A missing config.json yields 'not initialized; run init' (main.lua:115; operator-deployment.md:395 attributes that message only to an empty directory). operator-deployment.md:250-253 endorses running init before every tick. operator-deployment.md:177 says config.json 'needs no backup', which contradicts cockroach.md:85. Init then exits 0 and silently forces a full replay from the bootstrap snapshot. A CM_SNAPSHOT_DIR pointing inside checkpoints/ is deleted before it is loaded. Safety holds (the re-bootstrap is from a trusted snapshot), and backups kept outside the state directory survive (operator-deployment.md:183-184), so the severity stays low. Better proposal: move the removal after validation; remove only a single checkpoint whose block equals cfg.bootstrap_block; raise an operator error ('checkpoints without config.json; restore config.json or wipe checkpoints/') otherwise, including when bootstrap_dir lies under checkpoints/; and fix the operator-deployment.md:177 wording.
+- Fix: In the no-config branch, remove only a checkpoint whose block equals cfg.bootstrap_block. Raise an operator error if any other checkpoint exists. Invariant: an agreed head is deleted only by a newer agreement.
+
+### M5. Error messages missing context or unbounded: rmdir without a path, full HTTP error bodies
+
+`low · confirmed · +2 lines · S · BC`  
+Where: `watchdog/store.lua:66`, `watchdog/tick.lua:108-113`, `watchdog/sequencer.lua:24-26`, `watchdog/jsonrpc.lua:48`
+
+- Claim: remove_tree's `assert(lfs.rmdir(path))` (store.lua:66) raises only strerror. The vendored lfs remove_dir calls pushresult with a NULL info (luafilesystem/src/lfs.c:617-621, 221-229), so a failed prune (tick.lua:109-113) logs 'internal failure: Directory not empty' with no path. os.remove on line 68 does name the file. Separately, require_ok puts the whole non-2xx GET body into the error (sequencer.lua:25). jsonrpc truncates to 200 bytes (jsonrpc.lua:48), and http:download already caps its error body at 512 bytes (http.lua:113-116). So only the inclusion_block and digest GETs are unbounded.
+- Fix: Raise `cannot remove <path>: <err>` in remove_tree, and truncate the sequencer body to the same 200 bytes as jsonrpc.
+
+### M6. Module headers and the test-guest README restate docs/watchdog/README.md and the e2e oracle
+
+`low · partially · -80 lines · S · docs-only`  
+Where: `watchdog/store.lua:4-21`, `watchdog/tick.lua:4-21`, `watchdog/incident.lua:4-14`, `watchdog/incident.lua:104-116`, `watchdog/sequencer-watchdog:16-28`
+
+- Claim: The module headers in store.lua:4-21, tick.lua:4-21 and incident.lua:4-14 do restate README sections (README.md:24-48, 165-193, 195-224), and one copy has already drifted. store.lua:18-21 says config.json is 'written once by init, which is re-run after a crash', but a torn config.json makes init itself fail (bootstrap.lua:23, store.lua:119-121), and README.md:184-186 and operator-deployment.md:394 say to wipe first. The wrapper's `case`-vs-`[[` aside (sequencer-watchdog:27-28) is self-evident. Two parts of the proposal are wrong. (1) incident.lua:104-116 is collect()'s parameter contract (the shape of `evidence`), not a README copy, so keep it. (2) The test-guest recipe (test-guest/README.md:60-89) cannot be replaced by e2e.lua. e2e's oracle compares final root hashes only (e2e.lua:84-137), not CLI exit codes 1/7/101 or the inspect-after-exception behavior documented at lines 99-117. The outcome table (lines 93-98) is keyed by the recipe's run names. Also keep the wrapper sentence on why the paths are appended, since it guards against a real regression. A realistic delta is about -40 lines, not -80.
+- Fix: Cut each module header to one line plus the one non-obvious invariant and a README anchor. Cut the wrapper comment to one line. In test-guest/README keep the outcome table and the emulator quirks (lines 99-117) and replace the bash recipe with a pointer to e2e.lua.
+
+### M7. `status` fails entirely on a torn last_tick.json or config.json, right after the host crash when operators most need it
+
+`nit · partially · +4 lines · S · BC`  
+Where: `watchdog/main.lua:130-148`, `watchdog/store.lua:113-124`, `watchdog/incident.lua:32-45`
+
+- Claim: `status` reads config.json and last_tick.json without pcall (main.lua:133, :146), so invalid JSON fails the whole command (store.lua:119-121), while the incident reads degrade gracefully (incident.lua:32-35, 41-44). The window is small. A torn last_tick.json lasts at most one tick period, because tick never reads that file and record() rewrites it on every run (main.lua:176-182). A torn config.json also fails tick and init, and the documented remedy is to wipe the state directory (README.md:184-186). During the window, the latch stays visible through the tick's exit 2 and cartesi_watchdog_divergence_info in status.prom (metrics.lua:60-64). Wrapping the two reads is fine, but this is robustness, not 'tests'.
+- Fix: Wrap both reads in `status` the way incident.evidence does, reporting `{unreadable = true}` for that field so the rest of the summary still prints.
+
+### M8. Provenance gaps: json.lua has no pinned commit, and the guest-tools/libcmt pairing is held by prose in two files
+
+`low · partially · +8 lines · S`  
+Where: `watchdog/third_party/json.lua:2-4`, `watchdog/third_party/lua-curl/UPSTREAM`, `watchdog/third_party/luafilesystem/UPSTREAM`, `sdk/guest/README.md:19-28`, `examples/canonical-app/Dockerfile:5-8`
+
+- Claim: json.lua names only '@ 0.1.2 (commit on master)' plus a local change (third_party/json.lua:3-5), while lua-curl and lfs have UPSTREAM files with a commit or tag (and lfs also a sha256). The guest-tools pin is wider than 'prose in two files'. The version and its sha512 are duplicated in two Dockerfiles (examples/canonical-app/Dockerfile:7-8 and watchdog/test-guest/Dockerfile:8-9), and the libcmt version is repeated in sdk/guest/README.md:17-28, libcmt-sys/Cargo.toml:6 and libcmt-sys/build.rs:5. toolchain-pins.env has no guest-tools entry. scripts/verify-toolchain-pins.sh already checks drift for the other pins (CM version, linux image, kernel), so the proportionate fix reuses it. Add MACHINE_GUEST_TOOLS_VERSION and its sha512 to toolchain-pins.env, then add a few lines to the existing script that require both Dockerfile ARGs to match it (or pass them as --build-arg). This is not new machinery.
+- Fix: Add watchdog/third_party/json.UPSTREAM with the upstream commit and a one-line description of the %d change. Move MACHINE_EMULATOR_TOOLS_VERSION (and its sha512) into toolchain-pins.env next to CARTESI_MACHINE_VERSION so one file states the pairing. No verification machinery: updates are rare.
+
+### M9. Dead and duplicated small helpers
+
+`nit · unverified-nit · -20 lines · S`  
+Where: `watchdog/abi.lua:92-97`, `watchdog/machine.lua:196-201`, `watchdog/abi.lua:64-68`, `watchdog/json.lua:6-12`, `watchdog/tick.lua:34-37`
+
+- Claim: abi.decode_bytes has no caller. machine.sha256 re-implements abi.hex_from_bytes. The json facade's new() returns a shared module. tick.run re-checks the latch that main already checked (main's check exists because config may be unreadable). The timestamp format is written twice in main. tick injects machine.publish into the evidence data table as a capability.
+- Fix: Delete decode_bytes. Reuse a single hex helper. Make watchdog/json.lua `return require("watchdog.third_party.json")` (or require it directly). Keep exactly one latch check, the one in main.lua with tests going through main or asserting a precondition. Pass `machine` to incident.collect instead of storing publish in evidence. Reuse now().
+
+### M10. Two small places that do not fail loud on malformed L1 data
+
+`nit · unverified-nit · +3 lines · S · BC`  
+Where: `watchdog/jsonrpc.lua:14-19`, `watchdog/jsonrpc.lua:87`, `watchdog/l1.lua:35-40`, `watchdog/abi.lua:106-111`
+
+- Claim: hex_to_integer uses tonumber(s, 16), which in Lua 5.4 silently wraps for more than 16 hex digits and goes negative at or above 2^63. A malformed safe-head or log position can therefore become a plausible number. decode_evm_advance guesses whether a selector is present from length parity instead of checking for EvmAdvance 0x415bf363.
+- Fix: Reject more than 16 hex digits or a negative result in hex_to_integer. Require the EvmAdvance selector and raise otherwise.
+
+### M11. Image-side Lua search-path redundancy
+
+`nit · unverified-nit · -2 lines · S`  
+Where: `watchdog/Dockerfile:80-81`, `watchdog/Dockerfile:97-101`, `watchdog/main.lua:13-19`, `watchdog/sequencer-watchdog:22-52`
+
+- Claim: The image copies share/lua/5.4 into both /usr/local/share and /usr/share. It sets CARTESI_WATCHDOG_LUA_DEPS and LUA_CPATH to the same /opt/watchdog/lib, which main.lua then prepends again. The wrapper's path composition serves the documented local-build (host .deb) deployment and is load-bearing. The image duplicates are not.
+- Fix: Drop the second COPY (the wrapper already appends /usr/share/lua/5.4) and drop CARTESI_WATCHDOG_LUA_DEPS from the image ENV, or drop /opt/watchdog/lib from LUA_CPATH. Keep the wrapper logic. docker-smoke guards the change.
+
+### MS1. `clear` creates a missing state directory, so a mistyped path during an incident reports 'no divergence is latched'
+
+`low · skeptic-added · +2 lines · S · BC`  
+Where: `watchdog/sequencer-watchdog:55-57`, `watchdog/main.lua:96-110`, `watchdog/main.lua:150-153`, `watchdog/incident.lua:187-191`
+
+- Claim: The wrapper runs `mkdir -p` on the state directory for `clear` as well as init and tick, and commands.clear calls open_store(state_dir, true). So a mistyped CARTESI_WATCHDOG_STATE_DIR on `clear` creates an empty directory plus run.lock, and the command fails with 'no divergence is latched'. During an incident this reads as 'already cleared' while the real watchdog keeps exiting 2. It also contradicts main.lua:96-97, which says only commands that write may create the directory so that a mistyped path fails. `clear` only ever acts on an existing incident/ and has nothing to create.
+- Fix: Open the store without create in commands.clear, and limit the wrapper's mkdir to init and tick. For clear, fail when the directory is missing before taking the lock. Roughly a 3-line change.
+
+Keep (load-bearing):
+
+- Latch-before-evidence ordering (main.lua:203-286, incident.lua:92-102, tick.lua:45-55): exit 2, the watchdog_event line and status.prom must not wait on multi-GiB evidence collection or be lost to a full disk.
+- The `incident/` directory as the latch, with an unreadable record still latching as unreadable_marker (incident.lua:28-37): JSON is not fsynced, so the directory and not the file carries the latch.
+- L1 completeness proof (l1.lua:164-233): contiguous indices plus getNumberOfInputs pinned at B turn silent log truncation by a provider into a failed tick instead of a false comparison; the split rule is shared with Rust through the partition vector.
+- Deriving the InputBox from Application.getInputBox() at init (l1.lua:92-123): a configured address could name another release's InputBox, whose empty history would look complete.
+- Clone-per-input executor with the revert-root assertion (machine.lua:203-248): mirrors the reference CLI's --revert-mode=stored and is tested against the CLI oracle (e2e.lua:89-140).
+- Target block fixed from /digest before replay (tick.lua:67-74): a long replay never chases a moving target.
+- The bootstrap special case in behind() (tick.lua:57-65): tells a never-agreed head from a real regression.
+- Head-by-checkpoint-name with sync_stored+rename publish and no pointer file (store.lua:149-176, machine.lua:110-115): a crash leaves either the old head or the new one.
+- check_source plus the trusted_start template-hash check at init (bootstrap.lua:51-52, canonical.lua:18-26): this is what closed AI3.
+- Three-class errors module (errors.lua): 44 lines, and it maps cleanly to exit 1 with the class named in logs and last_tick.json.
+- `replay` (replay.lua): the canonical-side producer of a checkpoint at a chosen block that cockroach recovery uses today and the future shared recovery tool will consume. Keep it, but keep application-specific export out of it.
+- The wrapper's flock and Lua path composition (sequencer-watchdog:29-65): the lock serializes writing commands, and the path logic serves the documented host-.deb local-build deployment.
+- Vendored native modules compiled from in-tree sources with UPSTREAM files (third_party/lua-curl, luafilesystem): no build-time download.
+- The test guest plus CLI-oracle e2e (watchdog/test-guest, tests/e2e.lua): the only proof that the in-process executor matches the reference host semantics.
+
+## N. Docs corpus and comment verbosity
+
+Verdict: The docs corpus is about 7,350 lines and 50.8k words (README 569, AGENTS.md 464, docs/** 6,314). Production Rust has 4,958 comment lines against 27,396 code lines. The essential content is real: the duality map, the invariant register, scheduler semantics, recovery and its TLA+ models, the watchdog runbook. But the corpus is about 1.5-2x the size that content needs. Three habits cause most of it. First, the same fact is restated in many places: the fee derivation appears in 7 places, the danger-arm order in 4, the count semantics in 5, and the scheduler-mirror co-location note in 3. Second, essays sit where a sentence should: a 60-line rustdoc on check_danger, threat-model table cells over 400 characters, and 37 of 80 module headers breaking the existing 1-4 line rule. Third, finished material stays in the tree: two dated records whose retirement condition is met, and a 546-line TLA+ model of a rejected design. About 700 lines document the egress sync, cross-generation checkpoints and projection replay, which the planned shared rebuild tool replaces; those should be frozen, not polished. The existing rules on review codenames and history narration mostly hold (no codenames found, about 6 narration phrases), so the drift is about repetition and length rather than tone. AGENTS.md costs about 4.9k words in every session and could be about half that size by keeping the duality map, the fail-loud and complexity principles, Always/Ask/Never, the commands and the Reading Routes, and linking out for everything else. On logs, the sampled error and warn calls carry structured context; the one known secret leak (the RPC URL in the startup log) is already an open register entry.
+
+
+### N1. Freeze the egress-sync / cross-generation / projection-replay docs (~700 lines)
+
+`medium · partially · -650 lines · M · docs-only`  
+Where: `docs/protocol/projection-replay.md:1-125`, `docs/plans/2026-07-track3-feed-replay-design.md:1-120`, `docs/review/2026-09-16-track3-validation.md:1-150`, `docs/protocol/application-history.md:70-103`, `docs/protocol/application-history.md:120-178`
+
+- Claim: The cited docs (~700 lines) do describe the shared-state client sync that the direction replaces: projection-replay.md:1-9 (readers rebuild projections from historical L1 inputs), cockroach.md:140-161 (an indexer replays through the new era's C and rebinds its claim), README.md:271-440 (WS claim plus /history and /historical-l1-inputs), and the Track 3 plan. The freeze posture is right. Two parts of the deletion plan are wrong. (a) docs/review/2026-09-16-track3-validation.md also holds the POST /tx ACK latency regression evidence that the ADR's performance posture relies on (2026-08-authority-boundary-adr.md:186-193). The /tx path is not superseded, so move those ACK numbers to a benchmark record before deleting the file. (b) application-history.md:70-103 (checkpoint compatibility after standard recovery) is replaced by the future sync design, not by the cockroach rebuild tool, because automatic recovery still bumps the generation. The freeze note should also fix coordination-tracks.md campaign item 1 ('Merge the implemented egress API... Bart can then integrate'), which is stale now.
+- Fix: Do not edit these docs for verbosity now. In one small docs patch, replace Track 3's table row and section in coordination-tracks.md with 3-4 lines recording the new direction and naming these docs as frozen. Leave the contract docs untouched, since AGENTS forbids amendment banners in current contracts. When the shared rebuild tool lands, delete projection-replay.md, the Track 3 plan and the 2026-09-16 record, cut application-history.md to its coordinates table (about 60 lines), and rewrite README.md:271-440 against the new sync. That sequencing saves about 650 lines without double work.
+- Decision: Confirm that Track 3 is formally closed and that the 2026-09-16 latency numbers are no longer needed as the ADR's 'performance posture' regression evidence (docs/plans/2026-08-authority-boundary-adr.md:186-193).
+
+### N2. AGENTS.md baseline (464 lines, 4,874 words) restates its owners; a lean baseline is ~230 lines
+
+`medium · partially · -220 lines · M · docs-only`  
+Where: `AGENTS.md:145-180`, `AGENTS.md:182-209`, `AGENTS.md:211-233`, `AGENTS.md:235-255`, `AGENTS.md:286-320`
+
+- Claim: AGENTS.md (464 lines, 4,874 words) restates owners in several places. The Application Trait Contract says 'the essentials follow' after naming its owner (AGENTS.md:237), and the module map overlaps README Project Layout. A leaner baseline is reasonable. The proposal would lose facts and links, though. 'Use a dedicated submitter address' and the devnet account-9 fact (AGENTS.md:312-315) exist nowhere else, so they need a new home such as README Running or cockroach.md before Command Configuration is cut. docs/review/register.md:192 (the open OpenAPI-drift entry) links AGENTS.md#http-endpoints for the openapi change-together rule, so turning HTTP Endpoints into a Reading Routes row breaks that anchor and the rule. AGENTS.md:337-340 also endorses an 'intentional baseline' on purpose, so how much to keep is the maintainer's call, not a rule violation.
+- Fix: Keep these: Mission plus Requirements (10 lines); Design Principles compressed (12); the duality map with its three implementations and two mechanical facts (25); staleness rule plus the two recovery paths in 8 lines with links; Threat Model brief (8); the fail-loud and comment rules (8); Documentation Practice (12); Shell and Commands (15); Always/Ask/Never (25); Definition of Done (6); Reading Routes (22); a 6-term glossary (chunk, frame, batch, Tip, safe_block, inclusion lane); Type Boundaries (6). Cut the Application Trait Contract to 3 lines plus a link, and Domain Truths to the deposit/rejection/nonce one-liners. Keep the module map here and delete README's copy (see N11). Command Configuration and HTTP Endpoints become a Reading Routes row each. This saves about 2.4k words per session.
+- Decision: Is the module map baseline material (keep it in AGENTS) or reachable via README and module headers (cut it)? Recommend AGENTS, since agents need it first.
+
+### N3. Fee derivation / oracle policy is stated in 7 places; batch.rs carries a 33-line fee essay
+
+`low · partially · -45 lines · S · docs-only`  
+Where: `sequencer-core/src/batch.rs:7-39`, `README.md:501`, `AGENTS.md:190`, `AGENTS.md:218`, `docs/threat-model/README.md:24`
+
+- Claim: The real duplicate is the 33-line header at sequencer-core/src/batch.rs:7-39. It restates, nearly line for line, the schema comment block at 0001_schema.sql:540-562: the formula, log base, oracle conversion and tenfold slack. The schema also repeats the tenfold slack at :578. README.md:501 and AGENTS.md:218 add clause-level repeats. fee.rs:226 is not a restatement: it tells SUGGESTED_MAX_FEE_SLACK apart from log_slack, a non-obvious note worth keeping. AGENTS.md:190 is already a one-line glossary entry with an owner link. Realistic saving is about 30 lines, which makes this low, not medium. Track 5 (coordination-tracks.md:16) notes that log-space fees may become defunct, which argues for trimming to a pointer rather than polishing.
+- Fix: Pick two owners: the schema comment beside batch_policy_derived owns the formula, and the threat-model oracle row owns source trust and outage policy. Example rewrite of the batch.rs header: `// Batch sizing and frame fees are log-space DA charges; the formula and\n// its knobs live with batch_policy_derived in 0001_schema.sql.` Cut README.md:501 to one line plus a link, and drop the log_slack clause from AGENTS.md:218.
+
+### N4. check_danger rustdoc is 60 lines, states the arm order twice, and duplicates the recovery README
+
+`medium · confirmed · -52 lines · S`  
+Where: `sequencer/src/storage/recovery.rs:173-232`, `docs/recovery/README.md:130-149`, `docs/invariants.md:152-158`, `docs/invariants.md:459-461`
+
+- Claim: The arm order is documented in the rustdoc as a numbered list (1-6), then as a 'Returns the first variant' chain, then as a five-bullet 'trust hierarchy'. Clock faults are explained twice inside the same comment. The recovery README already owns the order, names check_danger_in, and gives the rationale; I4 and Do-not-simplify repeat it again.
+- Fix: Rewrite to: `/// Classify danger in one read transaction. Arms fire in order: divergence,\n/// stale view, closed batch, Tip, clock fault, estimate. The order is the\n/// dispatch policy (I4; docs/recovery/README.md "When safe-head progress stops").\n/// now_ms is injected so storage tests need no clock mocking.`
+
+### N5. Module-header rule (1-4 lines) is broken by 37 of 80 headers, 24 of them over 10 lines (606 lines total)
+
+`medium · confirmed · -250 lines · M`  
+Where: `AGENTS.md:328`, `sequencer/src/storage/mod.rs:4-29`, `sequencer/src/commands/run/workers.rs:4-26`, `sequencer/src/storage/lifecycle.rs:4-25`, `sequencer/src/l1/submitter/worker.rs:4-25`
+
+- Claim: Counts reproduced exactly: 80 files with //! headers, 37 over 4 lines, 24 over 10, 606 lines in total. One correction makes the case stronger. storage/mod.rs:6-25 does not list 'all 13 sibling modules': the crate declares 15 (storage/mod.rs:31-45), and the header leaves out `open` and `safe_accepted_batches`. The enumerated list has already drifted. Apart from workers.rs, the convert.rs header (24 lines) also states a real governing posture: contract-bound conversions fail loud, clock and query bounds saturate. Compress it, don't drop it.
+- Fix: Run one pass over the 24 headers longer than 10 lines and cut each to its purpose and governing constraint, about 4 lines. Keep the non-obvious build-enforcement note in workers.rs:20-26, which justifies the explicit shape and is cut-resistant; compress it to 3 lines. For storage/mod.rs, keep 'one file per writer role; schema and valid_* views in migrations/0001_schema.sql' and delete the file list. Do this as its own docs-only patch.
+
+### N6. Scheduler-mirror co-location note appears 3 times; 'orthogonal parameter' trivia twice
+
+`low · confirmed · -32 lines · S`  
+Where: `sequencer/src/storage/safe_accepted_batches.rs:91-130`, `sequencer-core/src/protocol.rs:344-347`, `sequencer-core/src/protocol.rs:399-422`, `docs/invariants.md:110-114`
+
+- Claim: Three places explain why populate_safe_accepted_batches keeps an inline nonce advance instead of advance_expected_batch_nonce, and one of them narrates a past refactor. Two places explain why batch_submitter is a parameter rather than a field, which is not a contract.
+- Fix: Cut the populate_safe_accepted_batches doc to about 8 lines: `/// Mirror scheduler acceptance over new submitter inputs into safe_accepted_batches;\n/// a foreign or byte-different acceptance records canonical_divergence instead (I9, I15).\n/// The only persistent cursor is the latest accepted row: recovery can reuse a nonce\n/// after rejected rows, so those are rescanned until a later acceptance. The expected\n/// advance stays inline because it interleaves with the divergence check (I1).` Delete protocol.rs:344-347 and :420-422; I1 owns the co-location.
+
+### N7. 21-line rustdoc on a #[cfg(test)] helper
+
+`low · partially · -19 lines · S`  
+Where: `sequencer/src/storage/ingress.rs:116-138`
+
+- Claim: ensure_open_tip (ingress.rs:116-136, #[cfg(test)] at :137) carries a 21-line rustdoc and should shrink. One sentence must move rather than be deleted. The genesis Tip's leading safe inputs are 'sequenced but not executed', and the lane's catch-up replay executes them, so there is no cold-start drain (:124-126). That fact exists only on this test helper. The production mechanism's doc, open_fresh_tip_in_tx at ingress.rs:468-479, says only 'draining all currently-undrained safe inputs into its first frame', which reads as if they were executed. Move the sentence there. Net saving is about 16 lines.
+- Fix: Rewrite to: `/// Test-only: open the genesis Tip on a fresh DB (no-op if a Tip exists).\n/// Production uses ensure_open_tip_for_recovery, which rechecks startup facts.`
+
+### N8. Retire the 2026-09-18 and 2026-09-19 review records: their retirement condition is met
+
+`low · confirmed · -158 lines · S · docs-only`  
+Where: `docs/review/2026-09-18-stack-review-validation.md:8`, `docs/review/2026-09-19-review-followup-validation.md:9`, `docs/review/register.md:145-146`
+
+- Claim: Both records say 'Retire this record after (stack) landing when no ongoing review decision uses it'. The stack has landed on main, and the only incoming link is register.md:146, which merely points at flake reproduction context.
+- Fix: Delete both files (158 lines). In register.md:145-146 replace the link with 'Reproduced 2026-09-18 under a parallel run; isolated and serial runs passed.'
+
+### N9. docs/recovery/history keeps a 460-line TLA+ model of a rejected design, run by check-all
+
+`low · partially · -520 lines · S · docs-only`  
+Where: `docs/recovery/history/README.md:1-77`, `docs/recovery/history/optimistic.tla`, `docs/recovery/history/optimistic.cfg`, `docs/recovery/justfile:12-16`, `docs/recovery/README.md:249-254`
+
+- Claim: The facts are right: optimistic.tla is 460 lines plus a 77-line README, the justfile's check-all includes the roughly 3-minute check-optimistic (docs/recovery/justfile:12-16), and only recovery/README.md:252 links the history. The justification is wrong in two ways. docs/review/README.md:33 governs review notes, not recovery design docs. And the model is not just a 'rejected design': history/README.md:17-19 records a clean 194M-state check of the optimistic alternative after the Silver-only fix, and :62-70 states the downtime tradeoff that would reopen it. That makes it a revisit-trigger asset in the sense of the 'preserve the reason for a deliberate tradeoff together with the assumptions that would change the decision' rule (docs/review/README.md:41-42). The cheaper option that needs no decision is to drop check-optimistic from check-all (one line) and keep the directory. Deleting it stays the maintainer's call.
+- Fix: Inline the roughly 25-line counterexample under 'Why the closed-suffix policy is safe' in docs/recovery/README.md. Delete docs/recovery/history/ and the check-optimistic recipe. Record the removal commit in that paragraph so the model can be recovered with git show.
+- Decision: Does the maintainer want to keep the bounded optimistic model as runnable evidence? The memory notes a recovery TLA+ design-doc location, so it may be valued.
+
+### N10. README environment-variable list is incomplete versus config.rs and contains history narration
+
+`low · confirmed · -4 lines · S · docs-only`  
+Where: `README.md:143-146`, `README.md:166`, `README.md:542`, `AGENTS.md:317-320`, `sequencer/src/commands/config.rs:89-101`
+
+- Claim: README's required/optional variable lists omit the fee-oracle source variables that setup pins, MAX_BATCH_OPEN_SECONDS, FEE_ORACLE_POLL_INTERVAL_MS, and the CHECKPOINT_*/RECOVERY rebuild variables. AGENTS.md:317-320 already says config.rs owns these names. README.md:166 is 'previously/now' narration, and README.md:542 ends in a dangling colon.
+- Fix: Keep the two required-variable lines and the example. Replace the optional list with 'All options, defaults and validation: `<binary> setup --help` / `run --help` (config.rs).' Delete line 166 and fix line 542.
+
+### N11. README duplicates AGENTS (module layout, reading list, test prerequisites); snapshots/README is an index-only page
+
+`low · partially · -55 lines · S · docs-only`  
+Where: `README.md:503-534`, `README.md:540-550`, `README.md:552-565`, `AGENTS.md:152-180`, `AGENTS.md:375-379`
+
+- Claim: README Project Layout (README.md:503-520) overlaps AGENTS Workspace and module layout (AGENTS.md:152-180), and the two have already drifted: README omits canonical-app, canonical-test and sdk. Further Reading (README.md:552-565) overlaps Reading Routes. Two corrections. docs/snapshots/README.md:8-11, the three-boundary paragraph ('Counts and clocks alone do not establish acceptance'), is not repeated in lifecycle.md; a grep finds it only in snapshots/README.md. Fold it, don't drop it. And there is one inbound link (README.md:560), not 3-4.
+- Fix: README keeps a 5-line workspace overview plus 'see AGENTS.md#architecture-map'. Replace Further Reading with a link to AGENTS Reading Routes. Fold docs/snapshots/README.md's two useful sentences into lifecycle.md's intro and delete it, updating 3-4 links.
+
+### N12. Threat-model actor table hides essays in table cells (9 cells, 7.6k characters)
+
+`low · partially · +0 lines · S · docs-only`  
+Where: `docs/threat-model/README.md:18-30`
+
+- Claim: Only 4 of the 9 lines over 400 characters are actor-table cells: lines 22, 23, 24 and 28, about 4.2k characters, with the Uniswap row at 1,475. The other five (lines 43, 81, 85, 113, 115) are one-line prose paragraphs or bullets in Self-trust, In-scope, Out-of-scope and L1 block-time coupling. They are long but are not table essays. The proposal to split the oracle, RPC and InputBox policy out of the cells still stands.
+- Fix: Limit each cell to one sentence (trust level plus capability). Move the oracle, RPC and InputBox policies into short '### Fee oracle' / '### RPC endpoint' subsections under 'Actors and trust', keeping the existing anchor target so links keep working. Line count is roughly neutral; words drop about 30%.
+
+### N13. Fail-loud policy and divergence-check bounds restated across AGENTS, invariants, README; register layout drift
+
+`low · confirmed · -45 lines · S · docs-only`  
+Where: `AGENTS.md:331`, `docs/invariants.md:14-68`, `docs/invariants.md:32-59`, `docs/invariants.md:309-367`, `docs/invariants.md:452-473`
+
+- Claim: AGENTS.md:331 restates the invariants.md check policy in a 10-line bullet. The policy section itself carries three admission/maintenance/selection bullets (28 lines) that restate the authority-boundary ADR, which they cite as owner. README.md:50-61 restates I9/I15's bounds. I15 (59 lines) has grown four sub-essays: runtime reaction, race bound, watchdog boundary, baseline-aware frontier. The Do-not-simplify list sits between I18 and I19 instead of after the register.
+- Fix: Cut AGENTS.md:331 to 'Impossible states fail loud; never handle or absorb them. Decision test: docs/invariants.md.' Reduce invariants.md:32-59 to one line linking the ADR. Cut README.md:50-61 to 3 lines plus a link. Move Do-not-simplify below I20. Leave I15's substance alone (it is load-bearing) but turn its sub-bullets into terse 'holds/enforced/breaks' fragments.
+
+### N14. Style-rule tweak to stop the drift: 'one fact, one home' plus size caps
+
+`low · confirmed · +2 lines · S · docs-only`  
+Where: `AGENTS.md:328-331`, `AGENTS.md:333-360`, `docs/review/register.md:62-63`, `docs/plans/2026-07-track3-feed-replay-design.md:63-64`
+
+- Claim: The current rules forbid codenames and narration, and those hold. What drifts is repetition, length and defensive disclaimers. There are 30 'not a proof / does not establish / is not implied' phrases in living docs and the register, such as 'This guard cannot guarantee timely L1 inclusion.' and 'This is reference evidence, not private-engine conformance or a deployment benchmark.' Nothing in the rules caps rustdoc length or forbids restating an owner's lists.
+- Fix: Replace AGENTS.md:328-329 with four rules. (1) One fact, one home: elsewhere, name it in a clause and link; never restate its conditions, orderings or lists. (2) Module header at most 4 lines and rustdoc contract at most about 6; longer reasoning goes to the owning doc or invariant, linked. (3) State a non-guarantee once, at its owner, only where a reader would otherwise assume the guarantee. (4) Table cells hold one sentence. Optionally add a warn-only CI awk check for //! headers over 6 lines and /// runs over 20 lines, about 10 lines of script. It protects only doc hygiene, so add it only if the drift recurs after the cleanup.
+- Decision: Adopt the caps as review norms only, or also add the warn-only CI check?
+
+### NS1. flush_and_wait rustdoc (35 lines) duplicates the recovery README's flush section
+
+`low · skeptic-added · -28 lines · S`  
+Where: `sequencer/src/recovery/flusher.rs:157-191`, `docs/recovery/README.md:155-174`
+
+- Claim: The flush_and_wait rustdoc is the third-longest in production code. It restates the completion predicate, the no-op nonce range, the zombie-coverage rationale and the safe-block return contract. docs/recovery/README.md 'Flush the covered wallet slots' already owns all four, with the I14 link.
+- Fix: Cut to about 6 lines: `/// Consume every covered wallet slot at safe depth with 0-ETH self-transfers;\n/// returns once Pending <= Safe && Safe >= watermark + 1 (the watermark conjunct\n/// covers zombies the local node forgot; I14). Returns the safe block of that\n/// observation: the caller must not cascade before its re-synced view reaches it.\n/// Procedure and rationale: docs/recovery/README.md "Flush the covered wallet slots".` Leave the loop and the watch-timeout outer retry unchanged; the Do-not-simplify rule on flusher retry loops concerns code, not this comment.
+
+Keep (load-bearing):
+
+- AGENTS.md:65-86 duality map (three implementations that must agree, drain attribution, empty-batch rule): the single most important baseline fact for avoiding scheduler/sequencer divergence.
+- AGENTS.md:444-464 Reading Routes table: cheap routing that is what allows the rest of the baseline to shrink.
+- AGENTS.md:402-427 Always/Ask First/Never: compact, and encodes the ask-first contract areas.
+- docs/invariants.md register format (holds / enforced by / depended on by / breaks) and the Do-not-simplify list: the guard against locally sound refactors; move the list but keep its content.
+- docs/invariants.md I15 substance (docs/invariants.md:309-367): race bound and watchdog boundary are load-bearing; compress the wording, not the facts.
+- docs/protocol/scheduler-semantics.md algorithm steps and the count-transition table (:152-174): the canonical owner of acceptance semantics.
+- docs/recovery/README.md 'Why the closed-suffix policy is safe' and the two current TLA+ models (preemptive.tla, admission.tla): the safety argument for flush-before-cascade.
+- docs/recovery/cockroach.md checkpoint eligibility, flush and stopping-block sections: safety preconditions that survive the planned shared rebuild tool.
+- docs/watchdog/incident-runbook.md and operator-deployment.md: operational procedures; the maintainer wants incident procedures in a runbook with tooling and drills.
+- docs/review/README.md lifecycle plus register.md: the process works; it just needs applying (N8).
+- docs/review/2026-09-25-sender-index-commit-cost.md: retained measurement with live consumers at register.md:207 and :236.
+- sequencer/src/recovery/flusher.rs:157-191 flush_and_wait doc: explains the durable watermark anchor of the loop condition, which is non-obvious and safety-critical.
+- sequencer/src/commands/run/workers.rs:20-26: explains that the explicit per-worker shape is compiler-enforced, the reason the components-vec redesign was refuted; trim it, keep the point.
+- sequencer-core/src/protocol.rs:353-362 'Deliberately omitted structural rejects': deliberate absence recorded once at its seam, as the doc policy asks.
diff --git a/docs/review/2026-10-13-whole-repo-review.md b/docs/review/2026-10-13-whole-repo-review.md
new file mode 100644
index 00000000..31dd5795
--- /dev/null
+++ b/docs/review/2026-10-13-whole-repo-review.md
@@ -0,0 +1,468 @@
+# Whole-repo review, 2026-10-13
+
+Read-only review of `1a9615d` (= `origin/main`) through five lenses:
+over-engineering, abstractions, correctness, simplification, and taste. The
+maintainer's backlog notes were triaged against the code, and the three consumer
+surfaces were judged from the consumer's seat: the `Application` trait and C ABI,
+the scheduler spec, and the egress API.
+
+Method: 14 area reviewers, one adversarial skeptic per area, independent traces
+for medium- and high-severity correctness claims, a future-direction mapper,
+and a synthesizer. No builds or tests were run. Of 182 findings, 69 were
+confirmed, 68 partially confirmed, 5 refuted and 4 disputed. The orchestrator
+re-checked K1, BS1, CS1, L2, LS1, N6, N9, N10, N13, N14 and FEE1 in the code.
+Every finding id resolves in the [findings appendix](2026-10-13-whole-repo-findings.md).
+
+Retire both files when the waves below land or are re-planned. Open items move
+to the [register](register.md).
+
+## Verdict
+
+- **Consensus core is sound.** No high-severity bug turned up in gate order,
+  nonce handling, the drain, the fold or the divergence freeze.
+- **Risks sit at boundaries, not in algorithms.**
+  - The guest's compiled sequencer address is never checked against the pinned submitter (BS1).
+  - Signature acceptance is defined by alloy, not by the spec (B1).
+  - The fee floor overcharges at sub-gwei gas (CS1).
+  - 43 tests pass without running (K1).
+  - A release dispatch can mislabel artifacts (L2), and the guest kernel's hash is not pinned in-tree (LS1).
+- **Over-engineering is local, not structural.**
+  - Durable leases implement a process-local refcount (I2).
+  - Fee inverses in the consensus crate have only test callers (C3).
+  - Benchmark verdict code can never evaluate (K6).
+  - The poster has a redundant shutdown select (F4).
+  - The hostile-L1, durability and concurrency machinery is proportionate.
+- **Large files are mostly tests.** Copied fixtures (K2–K4, about 1k lines) and
+  duplicated benchmark tooling (K6/K7, about 0.8k) are the main harvest outside
+  superseded code.
+- **Diagnostics are the weakest lens.**
+  - Root causes drop out of exit and abort lines (H1).
+  - The RPC URL leaks on both the Rust and Lua sides (register, M1, G10).
+  - Retryable conditions log at ERROR on every tick (H3, F2).
+- **Docs run 1.5–2× their content.** Facts repeat in 3–7 places, 37 of 80
+  module headers break the 1–4 line rule, and AGENTS.md costs about 4.9k words
+  per session.
+- **The future direction supersedes about 7k lines:** projection replay, the
+  WS/replica bootstrap and `setup --recovery`. Freeze them; most polish findings
+  there are traps.
+
+## Plan of attack
+
+Progress: W1, W2, W3a, W3b and W4 have landed on `claude/repo-code-review-103cc5`.
+Each was followed by a devnet and watchdog e2e run and an adversarial review
+whose surviving findings were folded into their commits. W3a left the guest
+binary byte-identical. W3b, W4 and the Cartesi Machine v0.22.0 bump moved the
+template hash, with behavior pinned by consensus vectors; the hashes are in the
+[guest image record](2026-10-14-guest-image-refresh.md). The input-reader review's commits (compared against the sling
+reader, branch `claude/input-reader-review-fda7ad`) are folded in on top, adapted
+to this branch:
+
+| Their commit | Here |
+|---|---|
+| `2bfac83` | `fix(l1): split a failed eth_getLogs range on any error` |
+| `15f7d0a` | `fix(l1): resend rate limits briefly and never resend log caps` |
+| (new) | `test(l1): pin log order and refusal on both sides` |
+| `83b9166`, plus `4532b33`'s redirect refusal | `fix(l1): keep the RPC URL out of errors and logs, keep the cause` |
+| `1d3bf98` | dropped: `http.origin` leaked text after an `@` in a path or query, and the watchdog already names no URL |
+| `19b667c` | `fix(setup): pin the deployment block only once it is safe` |
+| `ad80cab` | `fix(l1): cross-check the input payload's chain and app; sharper reader errors` |
+| `e626e96` | `docs: record the reader's L1 assumptions and bounded-ingestion design` |
+| `e959fc0` | `feat(storage): make safe_inputs append-only` |
+| `4532b33` | `feat(l1): separate read and submit RPC providers; pin HTTP/1.1` |
+
+A log missing its block, transaction or log index is refused on both sides, and
+the shared log-sort vector pins it for an absent or null field. A malformed
+position is split like a transport failure and reported as `Provider` in Rust,
+but refused as transient in Lua; both retry.
+
+Rules for every wave: behavior changes and refactors ship as separate patches,
+frozen code (see [Freeze list](#freeze-list)) gets bug fixes only, and
+wire/schema/ABI changes and guest behavior changes wait for the contract wave. A
+guest-image move that preserves behavior may land earlier when the consensus
+vectors pass unchanged (W3b).
+
+### Step 0: decisions (settled 2026-10-13)
+
+1. **Bart: done.** His client treats cockroach recoveries as absent, and it can
+   keep doing so once the tool exists. The [Track 3 plan](../plans/2026-07-track3-feed-replay-design.md#follow-up-sequence)
+   and the [tracks board](../plans/2026-07-coordination-tracks.md) still describe
+   him integrating scheduler replay; correct that text in W1.
+2. **Fees stay in log space.** The batch-level fee is deferred together with
+   batch-scoped replay protection, which would enable it.
+   - The oracle-side numerics become sequencer-local work: C2, then CS1, in W2.
+     CS1 relaxes a schema CHECK; approved.
+   - Track 5 (the fee table) is unblocked but consensus-relevant, so it moves to
+     W5 with Bart, taking L12 (`build.rs` → checked-in table) with it.
+   - The NUM note's batch-fee half stays deferred, recorded in
+     [batch-scoped replay protection](../plans/2026-10-batch-scoped-replay-protection.md).
+3. **N8 typed signing: deferred.** Out of the current scope.
+4. **Recovery-tool shape: a later dedicated session.** The direction mapper's
+   sketch is under [Consumer surfaces](#consumer-surfaces).
+   - Bart's client ignores cockroach recoveries, so a v1 can be the extraction
+     of `setup --recovery` into a keyless tool that emits only the sequencer
+     bundle; the client output can wait.
+   - Whether checkpoints carry scheduler state stays coupled to the fridge bound.
+
+### W1: correctness and safety (about 18 small patches, no decisions)
+
+| Item | Change |
+|---|---|
+| K1 | Integration helpers panic on bind failure instead of silently passing 43 tests. |
+| K9 | Make the 429 test deterministic; poll the txpool instead of sleeping 7 s. |
+| L2 | Release checks out `inputs.tag` and fails if the tag is missing. |
+| LS1 | Pin the guest kernel SHA in `toolchain-pins.env`. |
+| LS2 | Mark `-` tags as prerelease. |
+| DS1 | Treat `ChannelClosed` during requested shutdown as graceful (exit 0, not 1). |
+| G6 | `TipAlreadyOpen` refuses instead of retrying an impossible state. |
+| H11 | Idle poll interval rejects 0 (`range(1..)`). |
+| H8 | `run`/`flush` refuse a missing data dir before creating it, naming the path. |
+| B3 | `fold_replay` asserts every replay and seed input is at or below C. |
+| A6 | C adapter maps lifecycle-only statuses from execute/validate/drain to `Internal`. |
+| M4 | Watchdog `init` refuses, instead of deleting, an agreed head beside a missing config. |
+| MS1 | Watchdog `clear` never creates the state dir. |
+| M3 | Idempotent watchdog `init` validates the existing config schema. |
+| E3(5) | SDK `subscribe()` gets the same timeout as its siblings. |
+| Docs | AS1 (AGENTS.md:216 rejection list), BS1 (spec sentence and deployment checklist), GS1 wording, `lifecycle.rs:237` comment, Track 3 and tracks-board text updated to match step 0. |
+| Register | Close N9, N10, N11, N12, N13, N20, FEE1, AI1, AI3 and the stale testsi entry; fold FEE2 into fee-observation visibility; widen the RPC-URL entry to the reader, poster, flusher, oracle and watchdog. |
+| N9 | Drop the `docs/recovery/history` model from `check-all`; it stays as a dev analysis tool. |
+
+Exit: the suite fails on bind error, the release pins the kernel and checks out
+the tag, and the register reflects the closures.
+
+### W2: operator surface (about 8 patches, behavior only)
+
+- **Logging, one PR.** Embed `{source}` in Display (H1, D1, E6); put paths in
+  I/O errors (H2); log retries at WARN and verdicts at ERROR (H3, F2); add timing
+  knobs to the startup event (H10); log post-200 stream failures (I6, M5, C8).
+- **RPC URL redaction.** One choke point at the provider boundary (register, M1,
+  G10).
+- **Listener split.** Separate public and internal listeners (N24, register),
+  with D8 folded in.
+- **Fee oracle numerics.** One f64 log expression replaces the integer price
+  pipeline (C2). Then the signed exponent, so sub-unit gas prices stop flooring
+  at 1 unit/gas (CS1, schema CHECK change). Keep the cheap NUM comment.
+- **Smaller items.**
+  - SDK HTTPS for ingress only, plus the reqwest/thiserror/toml version alignment (L4).
+  - Validate batch-open together with the danger timing (register).
+  - Fix setup's exit classification for plain-setup sites (register).
+  - Have `flush` wait on slot consumption (G11).
+  - Record per-batch snapshot timing (I5).
+- Exit: a synthetic credential URL never reaches logs or status, every abort line
+  names its root cause, and the routes are split.
+
+### W3: harvest (pure refactors, roughly −2.5k lines)
+
+- **W3a tests and benchmarks, first.**
+  - Adopt one test-placement convention (N4) with one `test_support` module (K2), one stub app (K3), and recovery_tests fixtures plus the schema tests relocated (K4).
+  - Drop the benchmark verdict code (K6), then dedupe the tooling (K7), then add DB size and drain time (K8, N17).
+  - Smaller items: K10–K12, J6 with the wallet business-failure test from the register, J11, F3, F5.
+- **W3b production.**
+  - sequencer-core: B6 (private ProtocolTiming fields), B7, B8, C3 (dead fee inverses), C5.
+  - sequencer: D2 (test fixtures out of `storage/ingress.rs`), D4, F4, F7, F10, H6, H7, H12, I7, E4 (pure move).
+  - Examples: J1, J5, J10.
+  - Build: L1, L3 step 1, L5, L6, L7, L10 (shellcheck, luacheck, `just ci`
+    removed), L11, L13, L14 (the readme path; the tar and libtest-mimic
+    hoists). L12 moved to Track 5 in W5.
+  - Scheduler-code refactors (B6–B8) compile into the guest. Run the canonical
+    guest tests and the duality test for each, and expect the template hash to
+    move.
+  - Renames: rename the submitter's wallet `nonce` to `wallet_nonce` (N14); test literals for MAX_WAIT_BLOCKS (N16).
+  - From the input-reader integration: `test-sequencer` runs at the default
+    thread count (N18); a 3xx at setup's chain-id check is a configuration
+    error (exit 30).
+  - Added during W3b: the F1 and J9 decisions, the process-lock test flake's
+    cause (a child spawned by a concurrent test briefly holds a copy of the
+    lock's descriptor), consensus vectors, the remaining test-only `pub`
+    storage items behind `cfg(test)`, a Rust 1.99, dependency and nixpkgs
+    refresh, and a reproducible guest build: cross added `rust-src` only on a
+    later run, so the template hash depended on build-cache history.
+  - Also added: action pins checked offline in CI and audited upstream before
+    each release, the release published with the `gh` CLI so no third-party
+    code holds `contents: write`, the Node 20 actions bumped, and the runner
+    image pinned to `ubuntu-24.04`.
+- Exit: no `#[path]` test modules, one `test_support`, a benchmark crate of
+  about 3.3k lines, and no `pub` test-only items in production modules. Test
+  fixtures live in `test_support` or `storage::test_helpers`; `#[cfg(test)]
+  pub(crate)` seams on private state and test constructors or doubles beside
+  their type (the worker test spawners, the poster's test hooks and mock,
+  `ProcessLock::test` and `acquire_released`, `SafeInputRange::empty_at`,
+  `DumpInfo::at_baseline`) stay where they are.
+
+### W4: docs lean pass (docs only, about −1k doc and −350 comment lines)
+
+- **Order.**
+  1. Adopt the style rule first (N14: one fact, one home, plus size caps).
+  2. Shrink AGENTS.md to about 230 lines (N2), keeping the account-9 and #http-endpoints anchors.
+  3. Trim the 24 longest module headers (N5).
+  4. Retire the 09-18 and 09-19 records (N8).
+  5. Move the threat-model essays out of table cells (N12).
+  6. Then the rest of N3–N13, B5, B10, F9, G7, G8, H13, I8, M6.
+- **Porter spec (B11).** About 130 lines: SSZ layout, domain, `UserOp` type
+  and constants. Describe the signature acceptance set (B1) as currently
+  implemented and mark it pending; making it normative binds Bart's port (5c).
+- Independent docs patches can land beside any wave; the bulk waits for W3 so
+  the text describes final code.
+- **Landed** (about −1.2k net lines: −450 docs, −725 comments, −40 code):
+  - The style rule heads AGENTS.md's Documentation Practice, as norms with no
+    CI check. AGENTS.md is 347 lines and 3.6k words (from 478 and 5.1k): the
+    230-line target would have deleted rules homed only there.
+  - The porter spec replaces scheduler-semantics.md (309 → 216 lines), with
+    the pending rules listed in the register; I1, I3 and I15 tightened.
+  - Threat-model essays moved into subsections; the 09-18 and 09-19 records
+    retired; the egress freeze recorded in the coordination plan.
+  - Module headers within the 1–4-line cap across the sequencer, guest crates
+    and watchdog, except `fold.rs` (W6) and `sequencer-core/build.rs` (W5).
+  - `advance_expected_batch_nonce` moved from `sequencer-core` into the
+    submitter: a resume heuristic, not a scheduler mirror (B5).
+  - README's Running example uses account 9 and a fixed fee, and its variable
+    list matches `config.rs`.
+  - Skipped as already fixed: N7, N9 (W1 kept the model as a dev tool), most of
+    G7/G8/H13/I8. N1's deletions wait for the recovery tool. The ~22 remaining
+    non-guarantee phrases follow the new rule when their owner is next edited.
+
+### W5: contract wave (needs a sync with Bart before any change)
+
+The sub-batches double as the agenda for that sync; each ships separately.
+
+- **5a seam v1 (C ABI).** A1, A2, A7, A3 header trim, Track 6 (emit callback,
+  path suffix, ABI version getter, linker policy), and L10's
+  `undocumented_unsafe_blocks` lint with its SAFETY-comment decision for the
+  FFI crates. N8 is deferred.
+- **5b batch-format bump (wire).** `[u8; 65]` signature (N7), the full SSZ
+  overhead fix (register), A8. Drain sealed batches first and land before the
+  first production deploy; an undecodable batch from the submitter key is
+  terminal since W3b (F1), so the drain is load-bearing.
+- **5c guest-image batch (consensus, with the C++ port).**
+  - C1 fee rule; B1 acceptance set (document as-is, or narrow); B9 empty batches.
+  - Track 5 fee table, with L12, which Bart's port consumes byte-for-byte.
+  - The fridge bound, serializable `SchedulerState` with a "scheduler" inspect
+    query, and B13 guest reports.
+  - The BS1 setup cross-check and conformance vectors, extending
+    `tests/fixtures/consensus_vectors_v1.json` (W3b) as a new versioned file.
+  - J5's strict-order snapshot decode, which changes what the guest accepts.
+
+### W6: recovery tool lands (direction; roughly −5k net)
+
+- **Tool.** New `recovery` crate: move `fold.rs` as a pure move first, then add
+  an outputs observer and `resume_from`.
+- **Import.** `setup --import` keeps the B≤C check, `DeferUntilAnchorSet` and
+  the rebuilt-anchor test. Delete `setup --recovery` (G1, H5).
+- **Supporting moves.** Move `dump_info.rs` into the bundle crate and drop
+  on-disk `info.toml` (I1), since the tool owns the export format; GS1
+  old-watermark input; genesis case (N1, G3).
+- **Deletions.** Projection replay (E1) and its docs and tests.
+- **One baseline-migration rewrite.** Tool-minted era, drop the cut ledger,
+  in-memory leases (I2), H14. CS1 lands earlier, in W2, by editing the
+  baseline migration in place, which the migration policy allows today.
+- **After the new sync is designed.** Retire the WS wire format,
+  `/latest_snapshot` and history headers (I3), the `/history` reshape (E2),
+  identity types (A4) and `cold_replica`. Keep in-era generation signalling in
+  some form.
+
+## Decisions
+
+Step 0 settled the four that blocked planning. The rest, by the wave they gate:
+
+| Wave | Decision | Recommendation |
+|---|---|---|
+| W1 | Release posture (L1): SHA-pinned actions, job-level tokens, no caches in release | Adopt; dispatch rebuilds existing tags only |
+| W2 | Retry log level (H3, F2) | Verdict-driven: retries WARN, terminal ERROR |
+| W2 | Keep the `terminal_faults` black box (H9) | Keep; fix its forever-warn (HS1) |
+| W3b | Own-key undecodable batch (F1, disputed) | Decided: terminal under self-trust (`UndecodableOwnBatch`; `run` aborts with SIGABRT 134, like any terminal runtime fault), after a refactor patch |
+| W3b | C-engine PermissionDenied (J9) | Decided: operational (exit 1), so native and C engines agree |
+| W3b | Guest-image move outside the contract wave (U0) | Decided: allowed for behavior-preserving commits behind the consensus vectors, as one contiguous batch |
+| W3b | Operator-visible renames and exit codes (U3, U4) | Decided: `wallet_nonce` log keys in their own commit; a 3xx at setup's chain-id check exits 30 |
+| W3b | CI supply chain (U5, U6) | Decided: every action pinned by SHA; cargo-deny blocks on sources, reports advisories without blocking, no schedule. Dependabot declined: it moves a pin without verifying the new code, so its PRs are either rubber-stamped, undoing the pin, or reviewed as carefully as a manual bump. Pins are bumped deliberately before each release instead; the procedure and this reason live in `scripts/verify-action-pins.sh`. Revisit if pins go stale unnoticed again, the set of actions grows, or someone can own a weekly review |
+| W4 | Contract owner: README or `openapi.yaml` (E9) | Moot for the frozen egress half; decide with the new sync |
+| W1 | `docs/recovery/history` TLA+ (N9) | Decided: drop it from `check-all`; it stays as a dev analysis tool |
+| W3 | CI double run (L3) | Decided: step 1, CI on pull requests plus pushes to `main` and `v*` tags, superseded PR runs cancelled. Nightly runs declined; revisit when one-off PR failures stop being a signal or someone owns a red nightly |
+| W4 | Chain-id failover (FS1) | Decided: out of scope per "one consistent node"; revisit when a fallback RPC tier lands. The poster's per-send recheck stays, since a swapped chain would raise the durable watermark |
+| W5 | Signature acceptance set (B1) | Documented as pending in the porter spec (W4); narrow to v∈{27,28} and low-s in the port's image. The vector table is pinned (W3b): both paths accept the high-s twin and any v ≥ 35 |
+| W5 | Out-of-range frame fee (C1) | Structural `FeeAboveMax` rejection |
+| W5 | Zero-frame batches (B9) | Reject only if the port forces a new image anyway |
+| W5 | `scheduler_accepts` mirrors gate d (B2, disputed) | Keep the omission; the trace found no reachable case |
+| W5 | Batch "nonce" naming (N14) | Not "index": it collides with `batches.batch_index`. If renamed at all, "sequence number", inside 5b |
+| — | MAX_WAIT_BLOCKS (N16, H4) | Status quo; a setup flag adds unverifiable drift. Revisit only if a deployment needs a different window |
+| — | Flashbots or fanout (N22) | Decline Flashbots; defer fanout; record the reason and a revisit trigger |
+| W6 | In-memory leases (I2) | Registry, with a "single serving process" assumption; drop `lease_count` in the rewrite |
+| W6 | Fee-observation stamp (register) | Keep the per-poll write (it costs under 0.1%) unless the column goes |
+
+## Backlog triage
+
+| Note | Status | Evidence | Next |
+|---|---|---|---|
+| N1 genesis recovery ergonomics | open | `--recovery` needs a hand-made bundle; the loader already accepts genesis (setup/mod.rs:449-452) | Genesis case in the tool (W6) |
+| N2 dump-dir metadata | partially | `next_batch_nonce` is stored 3× (SQLite, `info.toml`, `checkpoint.toml`) | Drop on-disk `info.toml` (I1, W2); one receipt in the tool (W6) |
+| N3 snapshot API, mmap/CoW, machine-emulator#398 | partially | The watchdog already uses `rename_stored`/`remove_stored` (machine.lua:114, 233-241); the sequencer's publish point is the SQLite row | Adopt nothing; give Bart a reflink recipe (W4) |
+| N4 test layout | done | Seven placement styles; one `#[path]` module (recovery.rs:642) | Rule in AGENTS.md, moves landed (W3a) |
+| N5 clippy exclusions | stale premise | CI clippy runs `--workspace --all-targets --all-features` over all 20 members (ci.yml:66) | Close; lint the shell scripts instead (L10) |
+| N6 exponentiation/log | partially | TickMath is already f64 (7cfb474); the scheduler table is Track 5 | Log space stays: oracle math in W2 (C2); table in W5 with Bart |
+| N7 `[u8; 65]` signature | open | `Vec<u8>` (batch.rs:62-68); the DB already enforces 65 | 5b, with the SSZ overhead fix |
+| N8 parametric `UserOp` | deferred | EIP-712 has no sum types; `data` signs as hex | Out of scope (step 0); if revived, typed signing via an app hook over opaque transport |
+| N9 safe_block ≤ inclusion_block | fixed | Gate d precedes staleness (scheduler/mod.rs:295-317) | Close |
+| N10 time-only frame rotation | fixed | Rotation is safe-block distance only (inclusion_lane/mod.rs:246-250) | Close |
+| N11 generation on cascade | fixed | Generation advance plus 409 on reconnect (subscribe.rs:58-70) | Close; in-band notice belongs to the new sync |
+| N12 paginated replay and offset C | fixed | Pager, per-page revalidation, base K (canonical.rs:47-71) | Close; the historical half is frozen (E1) |
+| N13 nested `.DS_Store` | fixed | The unanchored `.gitignore:11` pattern matches nested paths | Close |
+| N14 nonce → index | done | Collides with `batches.batch_index` | The submitter's account nonce is `wallet_nonce` (W3b); the batch nonce stays (see Decisions) |
+| N16 MAX_WAIT_BLOCKS configurable | done | Single constant (lib.rs:21); never changed | Status quo; tests take it from `sequencer_core` (W3b) |
+| N17 benchmark DB size and drain time | done | Only a memory report exists | Reported per sweep step (W3a) |
+| N18 cross-compilation and compile times | done | Guest image built twice in CI; 4 duplicate dependency stacks; no profile tuning | One CI run per push (L3), the guest image built once (L7), line-tables-only debuginfo (L13, `target/debug` −22%), parallel `test-sequencer`, one tungstenite stack (W3b) |
+| N19 logs under error | done | ANSI and key redaction done; causes now ride in Display, and `error_chain` renders dependency errors' causes; levels follow the verdict | W2 and the input-reader integration |
+| N20 hot-path clones | stale premise | No per-op clone that matters; fsync and checkpoints dominate | Close |
+| N21 supply chain | done | Deps already hoisted; one unused dep; duplicates; no advisory gate | L4 (W2); cargo-deny (L11), hoists (L14), and held majors with their revisit triggers at their manifest lines (W3b) |
+| N22 Flashbots/fanout | decide | The poster reads from the same node; fanout only helps a >4 h propagation failure | Decline; record the reason (W4) |
+| N23 conditional snapshots | decide | Exact per-batch snapshots are load-bearing (snapshot_dumps.rs:325-330) | Keep per-batch; add timing (I5) |
+| N24 split servers | open | One merged router (http.rs:331-347) | W2 |
+| N25 verbose docs | done | Rules exist; length and repetition drift | One fact, one home and size caps adopted, about −1.2k lines (W4) |
+| AI1 BUSY/LOCKED classifier test | fixed | Classifier tests exist at every layer | Close |
+| AI2 watchdog config validation | partially | Residual needs a hand-edited `config.json` | M3 (W1) |
+| AI3 watchdog snapshot validity | fixed | `check_source` plus `trusted_start` (bootstrap.lua:51-52) | Close |
+| FEE1 TokenHandle latch | fixed | TokenHandle removed (9a3046f) | Close |
+| FEE2 oracle writes per poll | stale premise | Max-age no longer exists; cost under 0.1% | Fold into fee-observation visibility |
+| NUM numeric stack | partially | Price math is f64; the scheduler consumes only the published fee | Comment and C2/CS1 in W2, C3 in W3; the batch-fee half is deferred with batch-scoped replay protection |
+
+Register entries the review re-checked: the SSZ overhead entry is still open (5b).
+The testsi cycle-target entry is fixed (1283765; delete it). The RPC-URL entry is
+wider than recorded (W2). The listener entry is N24 (W2). The HTTPS/WSS entry
+splits: HTTPS for ingress now, WSS dropped. Admission overlap and the setup
+misclassification belong in the setup reshape (W6), apart from the plain-setup
+sites (W2).
+
+## Consumer surfaces
+
+**`Application` trait and C ABI.** The trait is sound for execution: progress is
+engine-owned and checked at the shared boundary, and the integer enums refuse
+unknown values. The friction is at the seam:
+
+- Host-only rejection codes appear in the app's vocabulary (A1).
+- Engines must fsync a directory the host owns (A2).
+- The stateful drain and path callback, and the missing ABI version, are open Track 6 items.
+- The contract is written four times (A3).
+
+Ship one seam-v1 change agreed with Bart. Let the recovery tool, not each engine,
+own baseline nonces and pending-direct eligibility; that drops the
+nonce-enumeration ABI and the per-engine exporter burden.
+
+**Scheduler spec.** The algorithm prose is clear and the fold is pure. A C++ port
+still lacks:
+
+- the SSZ layout, the domain and the `UserOp` type;
+- the signature acceptance set (B1);
+- the sequencer-address provenance rule (BS1);
+- the out-of-range fee rule (C1);
+- language-neutral conformance vectors.
+
+Scheduler state (app, queued directs, next nonce) is private, so recovery
+re-seeds (A,B] instead of resuming. Direction: a porter spec plus trace vectors
+now, and a serializable `SchedulerState` designed together with the fridge bound
+in one guest-image change.
+
+**Egress API.** The premise (client = replica of sequencer state) is wrong for
+full-database clients:
+
+- Snapshot-plus-subscribe loses the client's projection.
+- Cross-era recovery makes every client embed the scheduler.
+- Messages carry inputs without outputs or outcomes.
+
+What survives: the ingress routes, `/finalized_state`, `/digest` and
+`/inclusion_block` (the watchdog's only dependency), `/finalized_snapshot`, leases,
+the canonical page reader with `HistoryClaim` (native restart uses it), the
+listener split, and in-era generation signalling.
+
+The recovery-tool sketch (from the direction mapper):
+
+- **Inputs:** deployment identity, a checkpoint (genesis or scheduler state at B),
+  the stop block C from `flush`, and an input source over (B,C].
+- **Outputs:** written file-first, with `receipt.toml` last as the commit point
+  (tool-minted era, B, C, N', K, digest). One output is a sequencer bundle for
+  `setup --import`. The other is a versioned client trace of (B,C] with outcomes
+  and app outputs.
+- **Client rule:** a client imports at an era boundary and never subscribes
+  across one.
+
+## Correctness findings
+
+| Id | Sev / status | Where | Scenario | Fix |
+|---|---|---|---|---|
+| BS1 | medium, single-source, grep-checked | wallet.rs:73,85; setup/mod.rs:580,591 | The guest's compiled `sequencer_address` differs from the pinned submitter, so every batch becomes a direct input. The frontier and fold still report acceptance; only the watchdog notices | Spec sentence and checklist (W1); setup cross-check via inspect (5c) |
+| B1 | medium, partially | scheduler/mod.rs:350-358; storage/ingress.rs:723 | A high-s signature is admitted, stored verbatim and accepted by the Rust guest. A spec-following low-s port skips it and diverges | Normative wire/signature section plus vectors (W4); decide narrowing (5c) |
+| CS1 | medium, single-source, code-checked | math.rs:33-40; fee.rs:136-138; schema:573 | USDC fee token, ETH at $2,500, gas under 0.4 gwei: floored at 1 unit/gas, so 4× overcharge at 0.1 gwei | Signed exponent plus relaxed CHECK (W2) |
+| K1 | medium, confirmed, traced | integration_tests/* (4 helpers) | A sandbox denies bind, 43 tests return early, and the suite shows green | Panic on bind error (W1) |
+| L2 | medium, confirmed, traced | release.yml:42-272 | A dispatch from `main` naming a tag publishes main's build under that tag | Check out `inputs.tag` (W1) |
+| LS1 | medium, single-source, code-checked | canonical-app/justfile:25-37 | The kernel is verified against a checksum from the same release, so a replaced asset changes the template hash unnoticed | Pin the SHA in-tree (W1) |
+| M1 | medium, confirmed | watchdog/http.lua:73; main.lua:146,176-182 | A transport failure writes the RPC URL, with its API key, to stderr, `last_tick.json` and `status` | Redact (W2) |
+| C1 | low, confirmed, traced | fee.rs:68-71; scheduler/mod.rs:229-262 | A frame fee above MAX_EXPONENT plus a max_fee=65535 op makes the guest panic deterministically; needs an encoder bug or a stolen key | Structural rejection (5c) |
+| A6 | low, confirmed | c-app-engine/src/lib.rs:70-85 | An engine bug returns NOT_FOUND from execute, which becomes non-terminal I/O and a restart loop | W1 |
+| G6 | low, confirmed | storage/recovery.rs:115-119 | An impossible lock-violation state is retried and hidden | W1 |
+| DS1 | low, single-source | inclusion_lane/mod.rs:143-150,439-443 | SIGTERM races the frontier check, and a clean shutdown exits 1 | W1 |
+| GS1 | low, single-source | setup/mod.rs:652; flush.rs:30 | The cockroach flush reads the watermark from the wiped DB, so zombie coverage falls back to the pool view | Docs now; the tool takes the old watermark (W6) |
+| B3, H8, H11, M4, MS1, K9, AS1, J9, FS1, FS2, LS2 | low | see appendix | Fail-loud gaps, misconfiguration traps, flaky timing | W1–W2 |
+| B2, F1, G4, H4 | disputed | see appendix | A skeptic confirmed each, but an independent trace refuted it | See Decisions |
+
+## Freeze list
+
+Bug fixes only until W6 or the new sync design:
+
+| Item | Size | Fate |
+|---|---|---|
+| Projection replay: `/historical-l1-inputs`, SDK history, `historical_bootstrap`, `projection-replay.md`, README/OpenAPI sections (E1) | ~1.6k core, ~3.5k with docs and tests | Delete in W6 |
+| WS wire format and SDK snapshot→subscribe bootstrap (E3) | ~1.4k | New sync; the page reader and `HistoryClaim` survive |
+| `/history` baseline and `accepted_checkpoint` (E2), `/latest_snapshot` and history headers (I3) | ~0.5k | Reshape or delete with the new sync |
+| Era/generation identity types (A4), cut ledger and compatibility query | ~0.6k | New sync decides; in-era generation survives |
+| `setup --recovery` orchestration, config and errors (G1, H5) | ~0.45k (~1.6k subsystem) | About 150 lines move to the tool; the rest is deleted |
+| `fold.rs`; cockroach reader seams (F8); genesis plumbing (J2) | ~0.4k | Move or partially delete in W6 |
+| `batch_policy` log-additive design (C6) | ~0.25k | Frozen pending the fee decision |
+
+Not superseded, despite first impressions: the snapshot lease supervisor (D7),
+`/finalized_state` and `/digest` with sha2 (L17), `generation_tests.rs`, and the
+engine path callback.
+
+## Not doing
+
+Each item was refuted or declined. Re-propose only with new evidence.
+
+- Prior juries: a JoinSet supervisor, collapsing PreparedRuntime, flattening
+  RecoveryError, merging BootstrapError variants, a TerminalityOf trait, moving
+  phase→progress into drive_recovery, a bool `/tx` gate, AppWithProgress, a
+  components-vec Workers, UniswapConfig::pinned, retain-over-expect, and internal
+  retry loops.
+- This review:
+  - Dropping the lane's drain cursor (D3): it is an independent I6 witness.
+  - The flusher's two-call TOCTOU (G5): unreachable under the trust model.
+  - A reusable dump-contract kit (J7): Track 6 owns it.
+  - Renaming nonce to "index" (N14).
+  - A `--max-wait-blocks` flag (N16).
+  - Flashbots (N22) and sparse snapshots (N23).
+  - Hot-path clone work (N20).
+  - The max-age/2 write rule (FEE2).
+  - Nonce-enumeration ABI exports: the tool owns baseline nonces.
+  - A closure-based guarded helper (G12): prefer `begin_guarded`.
+  - A two-connection contention test (AI1): it would test SQLite.
+- The input-reader review (sling comparison): contiguity-only chunk commits,
+  warn-then-error transport logging, a reader bound at `i64::MAX`, HTTP/2 or
+  keepalive, per-profile timeouts, 60 s or 20 s timeouts, a hash-pinned safe
+  head, a poster count witness, `getInputHash` as a content witness, and tests
+  pinning read/submit routing. A separate submit (private relay) URL is
+  deferred: `create_keyed_providers` is the seam.
+- W3b:
+  - Migrating the vendored guest crates (libcmt-sys, trolley, testsi) to edition
+    2024: they compile into the guest and are a documented vendored fork.
+  - Declaring every internal crate once in `[workspace.dependencies]` (L14b),
+    and `publish = false` in `[workspace.package]` (L14): each member would
+    opt in for nothing, since nothing here is published.
+  - Pointing rollups-types at the workspace alloy entries: a guest SDK crate
+    needs neither `serde` nor `k256`, and inheritance cannot remove features.
+  - Dependency majors: tower-http 0.7, bindgen 0.73 and tokio-tungstenite 0.30,
+    with reasons and revisit triggers at their manifest lines; k256 0.14 and
+    sha2 0.11 wait for alloy and RustCrypto.
+- W4: a CI check for the documentation size caps (norms first; revisit if
+  drift returns), and bounding archive downloads per connection (the
+  endpoints are operator-only, and resource exhaustion is out of scope).
+- Keep, despite looking heavy:
+  - Exit-verdict projection, SYNCHRONOUS FULL, and schema triggers and typeof guards.
+  - Per-batch exact snapshots, GC beyond the frontier, and the I1 duality test.
+  - The reader's double completeness witness, the watermark-before-broadcast rule, and the stateless submitter.
+  - The full keep lists are per area in the appendix. Splitting every failed
+    log range supersedes the reader keep item on configurable range-error
+    codes, and M2 narrows to the watchdog's persisted sequencer URL.
diff --git a/docs/review/2026-10-14-guest-image-refresh.md b/docs/review/2026-10-14-guest-image-refresh.md
new file mode 100644
index 00000000..bfae761f
--- /dev/null
+++ b/docs/review/2026-10-14-guest-image-refresh.md
@@ -0,0 +1,87 @@
+# Guest image refresh, 2026-10-14
+
+**Consumer:** the release notes of the next canonical guest image, and the next
+change that moves the template hash, which compares against these values.
+**Retire** this record once that change records its own hashes.
+
+W3b and W4 of the [whole-repo review](2026-10-13-whole-repo-review.md) moved
+the template hash with no intended behavior change: a Rust toolchain and
+dependency refresh, guest-crate refactors, and W4's comment edits. Two later
+changes ship in the same image: the Sepolia build's dedicated sequencer
+address, and Cartesi Machine v0.22.0 with its paired kernel. What moves the
+hash, and how a behavior-preserving move is checked, is in
+[`docs/cartesi-machine.md`](../cartesi-machine.md#versions-are-all-or-nothing).
+
+## Method
+
+- Hashes: `just canonical-print-build-hashes` (devnet) and
+  `just canonical-build-machine-image-sepolia` plus `cartesi-machine --load=…
+  --initial-hash` (Sepolia), cross 0.2.5, guest tools 0.18.0. Every row up to
+  the W4 one uses cartesi-machine 0.21.0 and kernel `6.5.13-ctsi-2`; the last
+  row uses 0.22.0 and `6.18.56-ctsi-1`, two cold builds agreeing. Every value
+  below is from a cold build (no `target/` for the guest or its host side),
+  with `rust-src` in the cross toolchain (see `docs/cartesi-machine.md`). Two
+  cold builds of the W3b final commit (`756a8ac`) agreed, and so did builds
+  from three checkout paths.
+- Behavior: [`tests/fixtures/consensus_vectors_v1.json`](../../tests/fixtures/consensus_vectors_v1.json),
+  pinned at `6000e3a` before anything moved and byte-identical at the final
+  commit. The workspace tests check it natively at every commit, and
+  `just canonical-test-guest` (15 cases, 5 golden) checks it in the built image
+  after each dependency step and after the refactors. A
+  stdlib-only Python reimplementation (Keccak, EIP-712, ABI encoding, fee table,
+  secp256k1 recovery) reproduced 47 of the pinned values when they were pinned.
+- Dev shell: nixpkgs moved from `104240a` (2026-08-03) to `8edc0c7`
+  (2026-10-08) first; both images were bit-identical before and after, and the
+  devnet and watchdog e2e suites passed on the new shell.
+
+## Results
+
+Devnet initial hash and cycles to the first yield:
+
+| Step | Commit | Initial hash | Cycles |
+|---|---|---|---|
+| Baseline, Rust 1.95.0 | `6000e3a` | `0x489e84ce7aaf451f36ebea813b3c1d9b12137ee4b78c91d6f73a1fdac372a180` | 51284983 |
+| Rust 1.99.0 | `6009104` | `0x6c323c329e712445d911be8972c92c78808dd4943cbbef9765e4c3370ef00ffb` | 51252817 |
+| alloy-core 1.7.3 | `02d8fa9` | `0x94b6a4779094aaea1f5c7adce8b3b8a2fda94bead6ed2802c6312c069be7e9d6` | 51252675 |
+| 11 guest-compiled crates | `fb37bc9` | `0xc1fc8f03cfdb69adb1b9c382fddc27ecad383fcf725e3b1a2d986ef1689f5b1f` | 51248352 |
+| Guest refactors (B6–J5) | `8d03166` | `0xa006cd4d34685b2804737bcef48e3b398999c30081106a5745216b08fdad223b` | 51222421 |
+| 6 updates in the guest's build graph | `711f312` | `0xa4c01357665937d80f006c9c3726c49d0a80fe7aea2d3b8bf2199ea7333d388d` | 51222416 |
+| W4 guest comments and the nonce-scan move | `7dc3fb5` | `0xa0c7296d256b401f4103097a3b0b29105b19215f10dde048f400bb3a820277c9` | 51222416 |
+| Cartesi Machine 0.22.0 and kernel 6.18 | `11607ff` | `0xcd299178e6e860db692e20267edecf220313393ce23c0103a34b8456f5fb0ae8` | 53967473 |
+
+The commits before `6009104` (libtest-mimic, tokio-tungstenite, async-trait)
+and the remaining compatible updates after `711f312` left every artifact
+byte-identical. Among the guest refactors, every commit that touched guest
+source moved the dapp binary, including those whose changed code the guest never
+calls (B6, C3b, J1); the test-only J5 commit and the manifest commit did not.
+`711f312` updates only crates that run on the host inside proc macros and
+bindgen, yet moves the binary. W4's guest commits change only comments, apart
+from moving `advance_expected_batch_nonce` out of `sequencer-core` into the
+submitter; the cycle count is unchanged, but comment edits shift the line
+numbers rustc embeds in panic locations, so the image moves. cpufeatures, which
+only keccak uses and only on aarch64 hosts, went with the host-only updates: the
+x86_64 cross build never compiles it.
+
+`aa0fc0f` changes only the Sepolia build's compiled sequencer address, so the
+devnet dapp and rootfs stay as W4 left them; it was not measured on its own.
+`11607ff` changes no guest byte: the devnet dapp and rootfs equal W4's, and the
+template moves through the emulator (new machine identifiers and uarch) and
+the kernel alone. The v0.22 commits after it change the watchdog, testsi and
+docs, none of which reaches the image.
+
+| Image | Baseline (`6000e3a`) | Final (`11607ff`) |
+|---|---|---|
+| devnet dapp sha256 | `9415789ca67687000081ef4038cd6ac7b1508c0f9c2d42db81ee9281c492bee8` | `5b896252a4f327d195acd333c4b75ca61485402823e9e6213c10f3f23a11d201` |
+| Sepolia dapp sha256 | `ca9fd50eda3773c628ef7d5d47eeba532d1b97c22f7e4f7b0a4f01d986482bd7` | `63d15d391ae42dd63d8e6c3e37c78f814fbae74c3459d6371a8a855d4d2edfd1` |
+| Sepolia initial hash | `0xc6fd1515ba68c7256b16e17ced3bd48f9d5ede5c8079c14729f2ef5275f11457` | `0xeaf87115bd3bb9d2a902f07ea63a198626d3c16d943cd9df3dfaffbcac320c7f` |
+
+`f0d1ccf` is the last commit that reproduces the baseline image.
+
+## Limits
+
+The vectors are samples: equivalence beyond them rests on `canonical-test` and
+the devnet e2e suite, which runs the Rust and C hosts and the duality test.
+Guest report text is not pinned: it is not consensus and may change with the
+toolchain. Cycle counts are not consensus either. A warm `target/` built partly
+before `rust-src` arrived mixes both kinds of embedded paths and gives a hash
+no cold build reproduces; measure hashes cold.
diff --git a/docs/review/register.md b/docs/review/register.md
index 9d83bc5f..a806c3c6 100644
--- a/docs/review/register.md
+++ b/docs/review/register.md
@@ -52,16 +52,6 @@ an earlier checkpoint or genesis. The [scheduler contract](../protocol/scheduler
 and [application contract](../protocol/application-contract.md) own the boundaries
 the implementation must update together.
 
-### Validate batch-open and danger timing together
-
-[`RunConfig`](../../sequencer/src/commands/config.rs) accepts any positive
-`max_batch_open_seconds`, while `protocol_timing()` validates only the separate
-timing fields. Incompatible settings can repeatedly recover a low-volume open
-batch before its seal deadline. Next: validate their relationship at the runtime
-configuration boundary, with checked units and an explicit submission margin;
-test refusal and a valid low-volume closure. This guard cannot guarantee timely
-L1 inclusion.
-
 ### Batch-size accounting omits SSZ overhead
 
 The lane estimates each operation as `71 + max_method_payload_bytes()`.
@@ -78,72 +68,17 @@ Next: compare the intended bound with serialized batches across payload/frame
 counts, then correct the estimate and check the separately configured
 `batch_policy.log_user_op_bytes` used for fee accounting.
 
-### Support HTTPS and WSS in the Rust SDK
-
-The [client constructor](../../sdk/rust-client/src/lib.rs) rejects every HTTPS
-endpoint, leaving its HTTPS-to-WSS URL branch unreachable. Next: support both
-HTTP/HTTPS and their WS/WSS counterparts, verify the dependency TLS features,
-and exercise certificate-verified requests and subscriptions. Preserve local
-HTTP use; URL acceptance alone is not evidence that TLS works.
-
-### Separate public ingress and internal egress listeners
-
-[`http.rs`](../../sequencer/src/http.rs) serves both routers on one listener.
-Publishing that listener wholesale also exposes unauthenticated internal state
-and snapshot routes. Next: finish the planned per-side bind configuration and
-verify that every public route in the [API contract](../../README.md#api) (today
-`POST /tx`, `GET /fee`, `GET /nonce`, and `GET /domain`) is on the public
-listener and no internal route is. Keep network access controls as the
-deployment boundary; no new authentication subsystem is implied.
-
-### Fix the pinned test framework's cycle target
-
-The pinned `testsi::run_machine_increment` passes constant `1 << 28` to an
-absolute-cycle-target API. Long runs can stop advancing and report a timeout
-caused by the driver. Evidence: [the pinned source](https://github.com/GCdePaula/cartesi-tools-rs/blob/ed14b98ecfe9796dc3ca7c9b96bfdbf0ef9baf22/host/testsi/src/machine.rs#L159)
-and the [workspace dependency](../../Cargo.toml). Next: fix the target progression
-in that tooling, update the pin, and verify guest progress past the old target
-before relying on long-run capacity measurements. This is an upstream tooling
-task needed by sequencer validation.
-
-## Confirmed discrepancies
-
-### Setup misclassifies some deterministic L1 configuration failures
-
-Setup wraps reader bootstrap failures as live-worker failures, yielding exit 1;
-normal-run startup classifies deterministic reader bootstrap failures as
-terminal, exit 30. Malformed RPC URLs exercise this distinction. Discovery
-failures such as a wrong InputBox also occur in setup, but run does not repeat
-that discovery. The impact is a misleading operator hint in a one-shot command.
-
-Evidence: [`setup`](../../sequencer/src/commands/setup/mod.rs),
-[`InputReaderError::is_terminal_invariant`](../../sequencer/src/l1/reader.rs),
-and `classify_input_reader` in [startup recovery](../../sequencer/src/recovery/mod.rs).
-Next: classify failures by the setup phase and pin the external exit code;
-preserve genuinely transient provider failures.
-
-### Startup logs the full RPC URL
-
-The `sequencer startup` event includes `eth_rpc_url` verbatim. Operator URLs can
-carry credentials in userinfo, paths, or query parameters; private-key
-redaction does not cover this field.
-
-Evidence: [`commands/run/mod.rs`](../../sequencer/src/commands/run/mod.rs).
-Next: omit the field or define a safe endpoint representation, and check
-diagnostic/help paths with a synthetic credential-bearing URL. No credential
-exposure in an actual deployment was established by this review.
-
 ## Bounded investigations and cleanup
 
-- **Intermittent process-lock test failure.** The macOS workspace suite can
-  report `Locked` at the final reacquisition in
-  `dropped_runtime_scope_keeps_lock_until_detached_worker_stops` in
-  [`workers.rs`](../../sequencer/src/commands/run/workers.rs); an isolated rerun
-  passes. The worker drops its scope before signalling completion, so a simple
-  worker-completion race does not explain the failure. Identify any remaining
-  descriptor/process ownership before changing the assertion or lock behavior.
-  Reproduced during the 2026-09-18 stack closeout; isolated and full serial
-  runs passed. See the [current validation record](2026-09-18-stack-review-validation.md).
+- **Confirmation watches outlive an RPC outage** (checked 2026-10-13). alloy's
+  watch timeout reaps only transactions it has not yet seen
+  (`alloy-provider` `heart.rs`), so if the endpoint dies after a batch
+  transaction was seen, the poster's watch waits out the outage instead of
+  failing. The heartbeat logs each failed poll at ERROR, and shutdown still
+  cancels the wait. Under the fail-stop model this costs nothing, since nothing
+  useful can happen meanwhile. Revisit on a partial failure where block polling
+  stalls while the endpoint otherwise serves; the fix is an outer timeout around
+  the watch. Evidence: [`submitter/poster.rs`](../../sequencer/src/l1/submitter/poster.rs).
 - **Intermittent C-host recovery WebSocket reset.** At `dc4dd78` on
   2026-09-19, `c_host_recovery_after_stale_batches_test` failed an expected
   message receive with `Connection reset without closing handshake` in the
@@ -156,29 +91,37 @@ exposure in an actual deployment was established by this review.
   timeouts, teardown, or retry behavior. Evidence: the
   [recovery scenario](../../tests/e2e/src/test_cases.rs) and
   [WS receive helper](../../tests/harness/src/ws.rs).
-- **Transient SQLite contention stops the submitter.** Read handles use a
-  50 ms busy timeout; a storage/open failure escapes the submitter loop.
-  BUSY/LOCKED are nonterminal but project to unclassified exit 1, causing
-  respawn/recovery under a restarting supervisor. Frequency and benefit of
-  local retry are unmeasured. Check contention before choosing a bounded
+- **Transient SQLite contention stops the submitter and the input reader**
+  (input-reader half checked 2026-10-13 at `1a9615d`).
+  Submitter read handles use a 50 ms busy timeout; the input reader opens
+  writer handles (5 s busy timeout) for its cursor read and its append. In
+  both, a storage/open failure escapes the worker loop. BUSY/LOCKED are
+  nonterminal but project to unclassified exit 1, causing respawn/recovery
+  under a restarting supervisor. Frequency and benefit of local retry are
+  unmeasured. Check contention for both workers before choosing a bounded
   retry or timeout change; preserve other errors. Evidence:
   [`storage/open.rs`](../../sequencer/src/storage/open.rs),
   [`submitter/worker.rs`](../../sequencer/src/l1/submitter/worker.rs),
+  [`l1/reader.rs`](../../sequencer/src/l1/reader.rs),
   [`commands/error.rs`](../../sequencer/src/commands/error.rs).
 - **Overlapping admission policies.** The generic
   [`lifecycle` preflight](../../sequencer/src/storage/lifecycle.rs) contains
-  setup/rebuild branches, but production calls it only for run/flush.
-  [`setup`](../../sequencer/src/commands/setup/mod.rs) has its own admission
-  path with an intentionally tested already-complete no-op. Consolidate or
-  narrow the unused branches when next changing admission; there is no
+  setup/rebuild branches, but production calls it only for run/flush; setup
+  and rebuild reach the shared completion rule only inside
+  `complete_baseline_setup`. [`setup`](../../sequencer/src/commands/setup/mod.rs)
+  has its own admission path with an intentionally tested already-complete
+  no-op. Consolidate when the shared recovery tool reshapes setup; there is no
   demonstrated conflicting live route.
 - **Fee-observation visibility.**
   [`log_gas_price_updated_at_ms`](../../sequencer/src/storage/fee_oracle.rs)
   is persisted, with no production reader. Decide whether operator SQL
   inspection suffices or a real consumer needs exposure before adding an
   endpoint or removing the stamp. The accepted
-  [oracle outage policy](../threat-model/README.md#actors-and-trust) is an
-  economic tradeoff, independent of whether a health field exposes age.
+  [oracle outage policy](../threat-model/README.md#fee-oracle) is an
+  economic tradeoff, independent of whether a health field exposes age. The
+  oracle rewrites the stamp on every successful poll, unchanged price included,
+  so a stale stamp means failing polls. That is one FULL-sync commit per
+  successful poll, an estimated (unmeasured) cost under 0.1% of writer time.
 - **Recovery across external effects.** Model/storage tests do not replace
   process-level zombie re-injection or a restart between flush completion and
   cascade commit. Before adding harness machinery, identify the missing
@@ -240,6 +183,48 @@ at `6b2a233`.
   size and unmeasured. Evidence:
   [`ingress/api.rs`](../../sequencer/src/ingress/api.rs),
   [`storage/queries.rs`](../../sequencer/src/storage/queries.rs).
+- **Per-batch snapshots run on the lane.** Every batch close writes its
+  snapshot before the sealing commit, so admission waits for
+  `Application::create_dump` and the sequencer's fsyncs. Closes fire on the fee
+  policy's byte target or the batch-open deadline, not on L1 posting, so under
+  load several land per L1 block and the stall grows with throughput over target
+  size. Exact per-batch snapshots stay: restart, acceptance comparison, and
+  recovery select the exact batch's snapshot
+  ([lifecycle](../snapshots/lifecycle.md#creation-and-restart)). For a
+  large-state native engine, the mitigation is a `create_dump` that clones files
+  on a copy-on-write filesystem (XFS with `reflink=1`, btrfs, APFS); see the
+  [clone costs](../cartesi-machine.md). Unmeasured beyond the batch-close
+  event's `snapshot_ms`. Revisit, per the
+  [capacity assumption](../protocol/application-contract.md#5-operational-capacity-for-l1-reconciliation),
+  when its p99 on deployment storage exceeds about 250 ms or retained snapshots
+  exceed the deployment's disk budget. Evidence:
+  [`inclusion_lane/snapshot.rs`](../../sequencer/src/ingress/inclusion_lane/snapshot.rs)
+  (added 2026-10-13 at `462e4d1`).
+- **Bounded ingestion for syncs without a lane** (checked 2026-10-13 at
+  `1a9615d`). A reader tick fetches `[cursor, safe]` whole, holds every event in
+  memory (decoded event plus raw log, roughly twice the input bytes;
+  unmeasured) and commits once; one failed single-block `get_logs` restarts the
+  span. In `run` the span stays under `l1_read_stale_after_blocks`. Setup,
+  startup syncs after downtime and `setup --recovery` have no bound: a fresh
+  database scans every input since the app's deployment, our batches included
+  (the InputBox caps an encoded input at 64 KiB). Current histories are
+  megabytes, and rerunning on a larger host is the fallback. The known
+  mechanism commits per block window without archive state. When the received
+  indices are contiguous from the stored count and the last one sits at block
+  `b`, the stored and received inputs in blocks before `b` are complete,
+  because InputBox indices follow L1 order. Commit those at head `b - 1`, with
+  that block's header timestamp and without refreshing `synced_at_ms` (I12),
+  and hold the inputs at `b` for the next window; an empty window commits
+  nothing; the window that reaches the sampled safe head keeps today's count
+  check; reject logs outside the requested window; a later failure still
+  returns an error. A window end is never committed on contiguity alone: the
+  lane would stamp frames past a dropped tail input. The recovery fold still
+  loads every input after its checkpoint. Act when `safe_inputs` payload bytes
+  approach a quarter of the recovery host's memory, when a recovery sync fails
+  on a transient mid-crawl, or when the reader becomes a crate shared with
+  another node. Evidence: [`l1/reader.rs`](../../sequencer/src/l1/reader.rs),
+  [`l1/partition.rs`](../../sequencer/src/l1/partition.rs),
+  [`storage/l1_inputs.rs`](../../sequencer/src/storage/l1_inputs.rs).
 
 ## Verification gaps
 
@@ -253,8 +238,8 @@ at the smallest useful boundary when working on that behavior.
 | Canonical divergence | Storage freeze and startup refusal are covered separately. Compose accepted divergent input, runtime stop, and refusal after respawn in a process test; frontier must remain frozen. See [I15](../invariants.md#i15-divergence-marker-present--acceptance-frontier-frozen). |
 | Rebuilt anchor | Anchor unit mechanics and rebuild round-trip are covered. Exercise a later full-tear cascade after a nonzero-anchor rebuild and verify submission resumes at that anchor. See [I16](../invariants.md#i16-the-batch-tree-has-exactly-one-valid-parentless-root-carrying-the-deployments-anchor-nonce). |
 | Same-block directs | `multi_deposit_reconciliation_test` accumulates directs in separate blocks. Queue portal sends, mine once, assert equal receipt blocks, and verify canonical/WS order and attribution in the [E2E scenarios](../../tests/e2e/src/test_cases.rs). |
-| Wallet business failure | Mixed replay is covered. Pin insufficient transfer/withdrawal amounts after successful fee validation: fee/nonce/progress advance, the transfer/withdrawal has no further effect, and replay agrees. See the [wallet implementation](../../examples/app-core/src/application/wallet.rs) and [Application contract](../protocol/application-contract.md#2-replay-safety--rejection-inclusion-and-failure). |
 | Boot failure exits | Exit 20 now has a process assertion; exits 40/1 still need exact assertions in applicable setup/failure scenarios, so the supervisor receives the intended recovery/retry hint. Start in the [E2E scenarios](../../tests/e2e/src/test_cases.rs) and [exit contract](../../sequencer/src/commands/error.rs). |
+| SDK HTTPS | A test pins that `https://` endpoints open with a TLS ClientHello. Certificate rejection is untested; it relies on reqwest's rustls platform verifier, with no override in the SDK. Add a rejection test if the SDK gains custom roots. See the [client](../../sdk/rust-client/src/lib.rs). |
 | Uniswap-mode boot | Source-boundary tests pin setup validation, lazy runtime refresh, and transient quote retention. Existing sequencer E2Es use fixed mode. Decide whether a mock-pool boot scenario warrants its harness cost when changing oracle integration. |
 
 Warm restore already has state/cursor agreement tests and snapshot downloads
@@ -262,6 +247,34 @@ have lease/GC coverage. If restart cost becomes a requirement, add an assertion
 that distinguishes restoring a dump from a correct but expensive genesis
 replay; no new snapshot lifecycle is implied.
 
+## Canonical rules open for the C++ port
+
+The [scheduler spec](../protocol/scheduler-semantics.md) marks these rules
+**pending**. Each changes the canonical machine image or its wire format, so
+they are agreed with the port's author. The wire-format bump ships first, on
+its own, after draining sealed batches and before the first production deploy;
+the rest ship in the port's image. Checked 2026-10-14 at `32bf8de`;
+evidence: the spec's links and
+[`consensus_vectors_v1.json`](../../tests/fixtures/consensus_vectors_v1.json).
+
+- **Signature acceptance set.** The guest and `POST /tx` accept every `v ≥ 35`
+  and the high-`s` twin, as alloy does. Proposed: `v ∈ {27, 28}` and low `s`
+  only.
+- **Out-of-range frame fee.** A `fee_price` above `MAX_EXPONENT` halts the
+  machine once an op reaches the wallet's fee conversion. Proposed: reject such
+  a batch structurally.
+- **Empty batches** are valid at any age and consume a nonce, though the
+  sequencer never sends one. Reject them only if the port forces a new image
+  anyway.
+- **Wire format.** A fixed 65-byte signature field, with the
+  [SSZ overhead](#batch-size-accounting-omits-ssz-overhead) fix; drain sealed
+  batches before the switch.
+- **Riding the port's image:** the
+  [fee table](../plans/2026-07-coordination-tracks.md#track-5--fee-exponentiation-lut),
+  the [fridge bound](#bound-the-canonical-direct-input-fridge), and a setup check
+  of the guest's compiled `sequencer_address`. With them come versioned gate
+  and signature vectors, adding the unpinned `s ≥ n` and `v` from 29 to 34.
+
 ## Integration work owned elsewhere
 
 - [Track 3 follow-ups](../plans/2026-07-track3-feed-replay-design.md):
diff --git a/docs/snapshots/README.md b/docs/snapshots/README.md
deleted file mode 100644
index 63eb0de5..00000000
--- a/docs/snapshots/README.md
+++ /dev/null
@@ -1,28 +0,0 @@
-# Snapshots
-
-Application snapshots are immutable, durable copies of application state at a
-known execution boundary. They let the inclusion lane resume with load and
-replay. A snapshot may contain optimistic state; L1 acceptance determines which
-artifact can back a canonical comparison or recovery export.
-
-Keep three boundaries separate: the engine embeds its executed-input count and
-safe-block clock; SQLite associates an artifact with a local batch or era
-baseline; safe L1 acceptance selects a comparison checkpoint. Counts and clocks
-alone do not establish acceptance. The
-[history guide](../protocol/application-history.md) explains these coordinates
-and snapshot-plus-replay bootstrap.
-
-- [Application contract](../protocol/application-contract.md#6-checkpoint-lifecycle)
-  — engine dump methods, durability, immutable artifacts, independent restore,
-  and the canonical comparison file.
-- [Wallet format](format.md) — the wallet's layout, deterministic SSZ encoding,
-  and decode rules.
-- [Lifecycle](lifecycle.md) — creation at batch close, restart selection,
-  acceptance-derived comparison checkpoints, recovery exports, retention,
-  download leases, and crash safety. Acceptance is a separate durable fact;
-  artifacts are never promoted or rewritten.
-
-For automatic startup repair, see [automatic recovery](../recovery/README.md).
-For rebuilding after database loss or a sequencer bug, see
-[cockroach recovery](../recovery/cockroach.md). The root
-[README](../../README.md) owns endpoint shapes.
diff --git a/docs/snapshots/format.md b/docs/snapshots/format.md
index 68f409f4..ddc4779b 100644
--- a/docs/snapshots/format.md
+++ b/docs/snapshots/format.md
@@ -53,16 +53,15 @@ metadata come from the sequencer; see [application history](../protocol/applicat
 
 ### Determinism
 
-`WalletApp` stores balances and nonces in `HashMap`s, so iteration order
-is nondeterministic. Before encoding:
+`WalletApp` keeps balances and nonces in `BTreeMap`s keyed by `Address`,
+ordered by the 20 address bytes compared lexicographically, so the encoder
+emits:
 
-- `balances` entries are sorted ascending by `address`
-- `nonces` entries are sorted ascending by `address`
+- `balances` entries in ascending `address` byte order
+- `nonces` entries in ascending `address` byte order
 
 This guarantees byte-identical snapshot files for byte-identical logical
-state, regardless of insertion order. Tests assert this property by
-calling `create_dump` twice on the same `WalletApp` and comparing the
-resulting state files for byte equality.
+state, regardless of insertion order.
 
 ### Decode Rules
 
@@ -74,8 +73,8 @@ The decoder rejects:
 - Zero `executed_input_count` with a nonzero `last_executed_safe_block`.
 
 Duplicate checks prevent an entry from silently overwriting another during
-restore. The decoder accepts unique entries in any order; encoding the restored
-state sorts them. Deterministic emitted bytes do not imply that the decoder
+restore. The decoder accepts unique entries in any order; re-encoding the
+restored state emits them in address order. Deterministic emitted bytes do not imply that the decoder
 accepts only that ordering.
 
 ## Versioning
diff --git a/docs/snapshots/lifecycle.md b/docs/snapshots/lifecycle.md
index 903c3cec..37119dab 100644
--- a/docs/snapshots/lifecycle.md
+++ b/docs/snapshots/lifecycle.md
@@ -4,6 +4,12 @@ Snapshots preserve application state at a declared execution boundary. Their
 contents and boundary are immutable. L1 acceptance is a separate durable fact:
 there is no promotion operation and no mutable finalized pointer.
 
+Keep three boundaries separate: the engine embeds its executed-input count and
+safe-block clock; SQLite associates an artifact with a local batch or era
+baseline; safe L1 acceptance selects a comparison checkpoint. Counts and clocks
+alone do not establish acceptance. The [history guide](../protocol/application-history.md)
+explains these coordinates.
+
 ## Artifact and boundary
 
 Every artifact is a sequencer-owned directory:
@@ -35,10 +41,13 @@ an application count, and replacement branches, which can reuse a nonce.
 
 ## Creation and restart
 
-Initially every batch close creates a snapshot. The lane makes the artifact
+Every batch close creates a snapshot. The lane makes the artifact
 and metadata durable **before** one transaction seals the batch and registers
 its snapshot. A failed database commit leaves an orphan directory; startup
 sweeps it. A committed close therefore has its required snapshot.
+Creation runs on the lane, so user ops queued behind a close wait for it. Each
+close logs the creation time as `snapshot_ms`, at DEBUG, or at WARN once it
+reaches half the `POST /tx` acknowledgement budget.
 
 Setup similarly makes the baseline artifact durable before publishing the
 complete era baseline, recovery root when applicable, and setup-completion
@@ -108,8 +117,7 @@ archive. Supply that extracted directory to `setup --recovery`, with the
 checkpoint block recorded in its receipt. The loader checks the receipt against
 the immutable dump metadata and configured block. Copying a bare local
 `dumps/<id>/` directory is insufficient: it is a restore artifact and has no
-acceptance receipt. Export creates the receipt without modifying local files;
-startup no longer stamps or repairs acceptance metadata in `info.toml`.
+acceptance receipt. Export creates the receipt without modifying local files.
 
 ## Retention, leases, and crash safety
 
@@ -136,13 +144,12 @@ of all checkpoint resources. Filesystem deletion failure leaves a harmless
 orphan for the startup sweep. The reverse ordering would leave a durable row pointing at missing
 state and is forbidden. Startup clears leases left by the dead process,
 checks the rollback checkpoint's `info.toml` and format version, collects obsolete
-rows, and sweeps orphan directories before workers start. On supported Linux and
-macOS hosts, the sweep reads every retained artifact's filesystem object identity
-(device and inode) before deleting any orphans. Comparing those identities
-preserves alternate spellings, symlinks, and mount aliases of the same artifact.
-Retained identity lookup failures stop the sweep before deletion: missing
-references or structural I/O errors are terminal; operational I/O errors retain
-their normal classification. Application restoration runs afterward in the launched inclusion
-lane, before processing new user ops; the metadata check does not validate the
-application bytes. Missing or corrupt referenced artifacts also fail loud when
-read or restored.
+rows, and sweeps orphan directories before workers start. The sweep matches
+artifacts by filesystem identity (device and inode), not by path, because setup
+and run can spell the same directory differently; it resolves every retained
+artifact before deleting anything and stops if one cannot be resolved
+([`startup_hygiene.rs`](../../sequencer/src/commands/run/startup_hygiene.rs)).
+Application restoration runs afterward in the launched inclusion lane, before
+processing new user ops; the metadata check does not validate the application
+bytes. Missing or corrupt referenced artifacts also fail loud when read or
+restored.
diff --git a/docs/threat-model/README.md b/docs/threat-model/README.md
index 1641ee5f..2cd9aa53 100644
--- a/docs/threat-model/README.md
+++ b/docs/threat-model/README.md
@@ -17,17 +17,92 @@ What we are protecting:
 
 | Actor | Trust | Capabilities |
 |-------|-------|--------------|
-| InputBox contract | Trusted | Authenticates `msg_sender` on `addInput`. Must be rollups-contracts **v3+**: the reader anchors its scan at the application's deployment block, sound only because the v3 InputBox reverts `addInput` for not-yet-deployed apps. Bootstrap witnesses this via `version()` and refuses pre-v3 boxes. Use correctly; do not model forgery. |
-| Our Ethereum node | Trusted, fail-stop | Inside our infra. May become unreachable; will never lie. |
-| RPC endpoint (`CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`) | Trusted, fail-stop — **must be one consistent node** | The code supports exactly **one** endpoint, shared by reader, submitter, poster, flusher, and fee oracle; no fallback tier exists yet. Behind a load-balanced fleet, lagging replicas can silently truncate `get_logs` ranges and desynchronize the flush/re-sync views. The reader fails loud on an incomplete InputAdded set: a per-app index contiguity check (right prefix) plus a `getNumberOfInputs` count witness pinned at the scanned safe block (complete prefix), so a dropped/clamped/truncated-tail input is detected before the safe head advances rather than silently skipped, and recovery refuses if the re-sync lags the flush view. (The count witness is fetched before the scan; when it matches the stored input count the reader advances the safe head without a `get_logs` crawl — same trust base, since a fail-stop node's pinned-block count cannot understate without lying.) The residual fleet exposure is a node that lies *consistently* about both its logs and its input count — outside the fail-stop model. A semi-trusted fallback tier (Infura/Alchemy) is future work. |
-| Operator env / CLI flags | Trusted, **mistakes foot-gun-guarded** | Setup configuration is authoritative — including the reviewed Uniswap V3 WETH/fee-token pool the fee oracle quotes. The complete source is pinned in deployment identity; run cannot replace it. The operator is trusted, not infallible: the supported operator-mistake class is *accidental concurrent or stale use of one data directory* — two processes on one dir (kernel process lock), a mistyped `--data-dir` (open refuses paths with no database). Deliberate operator subversion, copied-directory coordination, and distributed fencing remain out of scope (the lock is a cheap local foot-gun guard, not distributed fencing — [ADR mechanism 1](../plans/2026-08-authority-boundary-adr.md#1-runtimescope-structured-process-ownership)); mechanisms defending this class are judged against this boundary rather than re-litigated per review. |
-| Uniswap V3 pool (fee oracle) | Semi-trusted L1 state | Spot manipulation of a deep pool is mitigated by a 30-minute TWAP plus 10× slack in `batch_policy.log_slack`. Residual risks: TWAP lag during real moves and thin/wrong pool misconfiguration. Multi-hop pricing is out of scope. Setup writes the first Uniswap quote under the same hard L1 requirement as the rest of setup; a failed quote leaves setup incomplete. `run` does not gate recovery or admission on another quote: it starts from the persisted `batch_policy.log_gas_price`, constructs the source from setup-validated identity without RPC, and launches a refresher that logs/retries transient quote failures indefinitely while retaining that price. `log_gas_price_updated_at_ms` records successful observation for telemetry; it is not an expiry gate. A shared-endpoint outage or stale view is already caught by safe-head progress, while a pool/`observe`-specific failure with a healthy input reader is accepted as an unbounded economic residual: stale-low pricing can subsidize DA/weaken the fee spam barrier and stale-high pricing can reject users, but neither changes canonical execution because the frame's persisted fee is immutable and enforced by both sides. The 10× slack is a margin, not a proof against arbitrary market movement. Deterministic setup-time source misconfiguration (`WrongTokenPair`, `MissingPoolCode`, chain-id mismatch), fatal arithmetic, and persistent storage faults remain terminal. |
-| Batch-submitter private key | Private | Held in operator infra. Not reachable by the network. |
-| Sequencer's own code | Trusted during normal operation | Tests/review prevent bugs; runtime invariant checks fail loud. Bugs require diagnosis and correction, followed by an operator rebuild if local state cannot be trusted. See "self-trust" below. |
-| **L1 mempool and block builders** | **Fully adversarial** | May reorder, delay, drop, or selectively include submitted transactions. Private mempools mean "dropped" is indistinguishable from "delayed indefinitely." |
-| HTTP clients at `POST /tx`, `GET /fee`, `GET /nonce`, and `GET /domain` | Untrusted | Arbitrary public callers. May submit malformed, malicious, or replay payloads. The `GET` routes are intentional public reads: the open-frame fee, the signing domain, and any sender's soft-confirmed nonce. The nonce is a live per-address count of included ops, published before their batches reach L1 (up to `max_batch_open`, 2 h by default); only the egress feed carries it otherwise. It reveals activity timing, not op contents, and moves only after the op is sequenced, so a watcher cannot front-run the op it counts. |
-| WebSocket subscribers at `/ws/subscribe` | Internal, but untrusted for data-exposure | Intended for internal indexers. Treat as public for what is exposed. |
-| Direct-input senders on L1 | Untrusted | Arbitrary L1 accounts calling InputBox. May submit any calldata. |
+| InputBox contract | Trusted | Authenticates `msg_sender` on `addInput`; must be rollups-contracts v3+ ([InputBox version](#inputbox-version)). |
+| Our Ethereum node | Trusted, fail-stop | Inside our infra; may become unreachable but never lies. |
+| RPC endpoint (`CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT`) | Trusted, fail-stop — **must be one consistent node** | One endpoint serves every L1 client, with no fallback tier ([RPC endpoint](#rpc-endpoint)). |
+| Operator env / CLI flags | Trusted, **mistakes foot-gun-guarded** | Setup configuration, including the reviewed fee-oracle pool, is authoritative ([Operator mistakes](#operator-mistakes)). |
+| Uniswap V3 pool (fee oracle) | Semi-trusted L1 state | Prices L1 gas in the fee token; a stale or skewed price is an accepted economic risk ([Fee oracle](#fee-oracle)). |
+| Batch-submitter private key | Private | Held in operator infra, out of the network's reach. |
+| Sequencer's own code | Trusted during normal operation | Tests and review prevent bugs; runtime invariant checks fail loud ([Self-trust](#self-trust)). |
+| **L1 mempool and block builders** | **Fully adversarial** | May reorder, delay, drop, or selectively include submitted transactions; with private mempools, "dropped" is indistinguishable from "delayed indefinitely". |
+| HTTP clients at `POST /tx`, `GET /fee`, `GET /nonce`, and `GET /domain` | Untrusted | Arbitrary public callers that may submit malformed, malicious, or replay payloads; the `GET` routes are [public reads](#public-reads). |
+| WebSocket subscribers at `/ws/subscribe` | Internal, but untrusted for data-exposure | Intended for internal indexers; treat as public for what is exposed. |
+| Direct-input senders on L1 | Untrusted | Arbitrary L1 accounts calling InputBox with any calldata. |
+
+### InputBox version
+
+The reader's scan starts at the application's deployment block. That is sound
+only because a v3 InputBox reverts `addInput` for an application that does not
+exist yet; bootstrap checks `version()` and refuses an older box. Setup pins
+the block only once it is at or below a safe head sampled before the read, so
+no reorg can move the floor. Do not model InputBox forgery.
+
+### RPC endpoint
+
+The code supports exactly one endpoint, shared by the reader, submitter,
+poster, flusher, and fee oracle. Behind a load-balanced fleet, lagging replicas
+can silently truncate `get_logs` ranges and desynchronize the flush and re-sync
+views; recovery refuses if the re-sync lags the flush view.
+
+The reader fails loud on an incomplete `InputAdded` set
+([I6](../invariants.md#i6-the-frame-clock-accounts-for-a-complete-l1-interval)):
+index contiguity proves the right prefix, and the InputBox count pinned at the
+scanned safe block proves it complete. When that count equals the stored count,
+the reader advances without a `get_logs` crawl; a fail-stop node's pinned-block
+count cannot understate without lying.
+
+Each ingested input's `EvmAdvance` chain id and application must match the
+pinned identity; the endpoint's chain id is checked once per reader process.
+Two residuals are accepted: a mid-life chain swap behind the same URL that
+advances the head only through the count-equality skip, and a node that lies
+consistently about both its logs and its input count, outside the fail-stop
+model. A semi-trusted fallback tier (Infura/Alchemy) is future work;
+[L1 chain semantics](#l1-chain-semantics) says what to pin before adopting one.
+
+### Operator mistakes
+
+The operator is trusted, not infallible. The complete fee-oracle source is
+pinned in deployment identity, and `run` cannot replace it. The supported
+mistake class is accidental concurrent or stale use of one data directory: two
+processes on one directory (a kernel process lock) or a mistyped `--data-dir`
+(open refuses a path with no database). Deliberate subversion,
+copied-directory coordination, and distributed fencing are out of scope; the
+lock is a local foot-gun guard
+([ADR mechanism 1](../plans/2026-08-authority-boundary-adr.md#1-runtimescope-structured-process-ownership)).
+Judge mechanisms for this class against this boundary.
+
+### Fee oracle
+
+A TWAP (30 minutes by default, pinned at setup) and the tenfold margin in
+`batch_policy.log_slack` ([formula](../../sequencer/src/storage/migrations/0001_schema.sql))
+mitigate spot manipulation of a deep pool. The margin does not bound arbitrary
+market movement. Residual risks are TWAP lag during real moves and a thin or
+wrong pool; multi-hop pricing is out of scope.
+
+Setup writes the first quote under the same hard L1 requirement as the rest of
+setup. `run` gates neither recovery nor admission on another quote: it starts
+from the persisted `log_gas_price`, builds the source from the pinned identity
+without RPC, and refreshes in the background, retrying transient failures
+indefinitely and keeping the last price. `log_gas_price_updated_at_ms` is
+telemetry, not an expiry gate.
+
+A shared-endpoint outage or stale view is already caught by safe-head progress.
+A pool-specific failure with a healthy reader is an accepted, unbounded economic
+risk: a stale-low price subsidizes DA and weakens the spam barrier, and a
+stale-high price rejects users. Neither changes canonical execution, because
+the frame's persisted fee is immutable and enforced by both sides. Setup-time
+source misconfiguration (`WrongTokenPair`, `MissingPoolCode`, chain-id
+mismatch), a TWAP tick outside the Uniswap range, and persistent storage faults
+are terminal; a price above the representable range saturates at `MAX_EXPONENT`.
+
+### Public reads
+
+The `GET` routes are intentional public reads: the open-frame fee, the signing
+domain, and any sender's soft-confirmed nonce. The nonce counts a sender's
+included ops before their batches reach L1 (up to `max_batch_open`, 2 h by
+default); otherwise only the egress feed carries it. It reveals activity
+timing, not op contents, and moves only after the op is sequenced, so a watcher
+cannot front-run the op it counts.
 
 ### Self-trust
 
@@ -40,7 +115,7 @@ application checkpoint and L1. The checkpoint must be trusted independently of
 the faulty local state. Historical inputs, including malformed batches, receive
 the canonical scheduler's normal treatment during replay.
 
-This is **not** a prohibition on checking. Internal invariants are enforced loudly wherever a check is near-free — the type system, SQL constraints and triggers, boundary assertions — because failing loud preserves safety, while a silently-tolerated bug that externalizes (a signed batch, an ack, a feed event) is state divergence: as severe as theft and undefendable at runtime. Loud failure is not automatically self-healing: transient faults may clear on restart, but persistent invalid state is terminal and may require inspection or cockroach recovery. The rule, in short: **assert real invariants, fail loud, never absorb silently, never handle gracefully.** The decision test and the register of cross-module invariants live in [`docs/invariants.md`](../invariants.md).
+This is **not** a prohibition on checking: internal invariants are asserted loudly wherever a check is near-free (types, SQL constraints and triggers, boundary assertions). The [check policy](../invariants.md#the-check-policy-fail-loud) owns the rule, its reasons, and the decision test.
 
 Inputs from untrusted actors are validated rigorously, as ever.
 
@@ -78,7 +153,7 @@ blocking production diagnostics would require revisiting that assumption
   rollbackable soft confirmations, the watchdog's digest comparison, and the I15
   divergence freeze.
 - **Adversarial mempool:** reorder, delay, drop, selective inclusion by builders
-- **Zombie transactions:** a submitted batch may sit in a private mempool indefinitely and land long after we believed it was gone. Two load-bearing defenses: the recovery flusher consumes every wallet-nonce slot this deployment ever used (anchored by the persisted watermark, I14) so zombies cannot claim them; and the content-identity check (I9/I15) compares every *simulated-accepted* landing strictly after baseline block `C` against the valid closed batch we sealed at that nonce. The complete prefix through `C` is opaque and is never reinterpreted using the recovered nonce. A foreign or byte-different landing records divergence when it becomes safe and is ingested, freezes the accepted frontier, and requires cockroach recovery. This is trust-boundary validation of external input (the mempool replaying our own stale transactions at times we don't control), not defense-in-depth against self-bugs or a general canonical-state oracle. In cockroach recovery the watermark does not survive the wipe, so that flush is best-effort by construction; the content-identity check is what keeps the residual zombie detected-and-frozen rather than silent (see [the flush boundary](../recovery/cockroach.md#flush-and-stopping-block)).
+- **Zombie transactions:** a submitted batch may sit in a private mempool indefinitely and land long after we believed it was gone. Two load-bearing defenses: the recovery flusher consumes every wallet-nonce slot this deployment ever used (anchored by the persisted watermark, I14) so zombies cannot claim them; and the content-identity check (I9/I15) compares every *simulated-accepted* landing strictly after baseline block `C` against the valid closed batch we sealed at that nonce. The complete prefix through `C` is opaque and is never reinterpreted using the recovered nonce. A foreign or byte-different landing records divergence when it becomes safe and is ingested, freezes the accepted frontier, and requires cockroach recovery. This is trust-boundary validation of external input (the mempool replaying our own stale transactions at times we don't control), not defense-in-depth against self-bugs or a general canonical-state oracle. Cockroach recovery does not read the previous database's watermark, so that flush relies on the provider's pool view; the content-identity check is what keeps the residual zombie detected-and-frozen rather than silent (see [the flush boundary](../recovery/cockroach.md#flush-and-stopping-block)).
 - L1 reorgs up to safe depth
 - Malicious `POST /tx` callers: malformed signatures, spoofed sender, replay across chains or apps, nonce manipulation
 - Malicious direct-input senders: arbitrary payload, any intent; sender authenticity is guaranteed by InputBox
@@ -100,27 +175,36 @@ These are preconditions the sequencer takes as given. They are neither "trust" n
 
 ### L1 block-time coupling
 
-The wall-clock fallback in [`sequencer/src/storage/recovery.rs`](../../sequencer/src/storage/recovery.rs) estimates missed blocks as:
-
-```
-estimated_missed_blocks = (now - last_safe_progress_ms) / CARTESI_SEQUENCER_SECONDS_PER_BLOCK
-```
+The wall-clock fallback estimates missed blocks as the time since the last safe-head advance divided by `CARTESI_SEQUENCER_SECONDS_PER_BLOCK` ([automatic recovery](../recovery/README.md#when-safe-head-progress-stops)).
 
 This assumes a **known, bounded-variance relationship** between elapsed wall-clock time and mined L1 block count. The assumption has three parts:
 
 1. **Known average block time** — `CARTESI_SEQUENCER_SECONDS_PER_BLOCK` (default 12s, Ethereum mainnet) accurately reflects the target chain's block cadence.
 2. **Bounded variance** — over the danger-threshold window (~4h on mainnet), the delta between `elapsed_seconds / avg_block_time` and actual mined blocks is small. On Ethereum mainnet this holds: slot proposers occasionally skip, but >99% of slots produce a block.
-3. **Wall clock is accurate enough for elapsed-time estimation.** A discrete jump of a full block-time or more against either persisted safety baseline is detected and makes the L1 view unusable until the clock or a new safe-head observation catches up; sub-block skew is tolerated as quantization noise, and the fault is evaluated only after the observed-safe danger checks. Gradual or systematic drift remains an external assumption.
+3. **Wall clock is accurate enough for elapsed-time estimation.** A clock that falls a full block-time or more behind a persisted safety baseline is detected and refuses operation; sub-block skew is tolerated. Gradual or systematic drift remains an external assumption.
 
-**Where it matters.** The missed-block estimate is a fallback for a safe head that stops advancing, whether the RPC is unreachable or still answers with a stalled view. Clock usability is also checked whenever persisted safety baselines are aged: observed block numbers remain authoritative and their danger verdicts run first, but a clock a full block-time or more out of step with either baseline still makes that view unusable for estimation and for worker admission.
+**Where it matters.** The missed-block estimate is a fallback for a safe head that stops advancing, whether the RPC is unreachable or still answers with a stalled view.
 
 **Violation modes.**
 - **Chain with unstable block time.** A chain where average block time drifts substantially (e.g., PoW networks under major hashrate swings) would make the estimate less reliable. Mitigation: `CARTESI_SEQUENCER_SECONDS_PER_BLOCK` should be tuned conservatively (overestimate block time → underestimate missed blocks → more cautious recovery triggers).
 - **Operator misconfigures `CARTESI_SEQUENCER_SECONDS_PER_BLOCK`.** Typo or copy-paste error pointing at the wrong chain's cadence. Operator-trust scope.
-- **Significant host clock drift.** A sequencer host whose clock lags or leads the real-world by minutes per day could slowly desynchronize its danger estimates from reality. A detectable backward crossing of a persisted baseline refuses operation; gradual drift may not.
+- **Significant host clock drift.** A sequencer host whose clock lags or leads the real-world by minutes per day could slowly desynchronize its danger estimates from reality.
 
 **Corollary for test design.** To deterministically exercise the wall-clock fallback, tests must maintain this coupling: when advancing the L1 block count, they should also advance (or simulate) the corresponding wall-clock interval. Our e2e harness does the reverse — it rewinds `l1_safe_head.synced_at_ms` to an older timestamp, which is semantically equivalent to advancing the wall clock.
 
+### L1 chain semantics
+
+The input reader, the frame clock, and the canonical scheduler use L1 block numbers and the `safe` tag as Ethereum defines them:
+
+1. **Safe blocks are permanent.** The reader ingests through the sampled safe head and never rereads below it, and frames commit to that head. The sequencer reads `safe`, not `finalized`, for deposit latency: on Ethereum, finalized trails safe by about one more epoch (6.4 minutes), a large share of the [deposit-availability target](../../AGENTS.md#invariants).
+2. **EVM `block.number` is the RPC block number.** The application's deployment block, which floors the scan, and each input's `EvmAdvance.blockNumber`, by which the scheduler drains and ages it, are EVM values. The reader uses them as log and safe-head coordinates, and frames carry RPC block numbers.
+
+**Violation modes.**
+- **A safe block is replaced**: an Ethereum justified checkpoint that never finalizes, or an L2 whose safe head rests on unfinalized parent-chain data (the OP Stack). Frames and soft confirmations already account for inputs L1 no longer has. The reader then stalls on an index or count mismatch, unless the replacement keeps the input count, in which case nothing detects it. The reader pins no block hash: it logs a warning only when a provider's safe head is numerically behind the persisted one.
+- **Arbitrum and Orbit chains** return the parent chain's number from `block.number`. The scan floor lands far below the deployment, and the first ingested input fails the reader's block cross-check on every retry, after setup completes and, at the latest, once our first batch lands, with soft confirmations already issued.
+
+**Revisit** before targeting any chain other than Ethereum L1 or its testnets. For an Arbitrum-family chain, first add a setup check that `block.number` at the sampled safe block equals that block's number. Before adopting a load-balanced or fallback endpoint tier, also pin the reader's count read to the sampled block's hash, so a backend that clamps a future block number errors instead of answering for another block.
+
 ## How to apply this doc in code review
 
 For each code path under review:
@@ -137,4 +221,4 @@ For each code path under review:
 ## Related documents
 
 - [`../recovery/README.md`](../recovery/README.md) — recovery design, TLA+ formal verification
-- [`../../AGENTS.md`](../../AGENTS.md) — architecture, coding conventions, hot-path invariants
+- [`../../AGENTS.md`](../../AGENTS.md) — architecture map, conventions, and working rules
diff --git a/docs/watchdog/README.md b/docs/watchdog/README.md
index aa92aea9..800b47e4 100644
--- a/docs/watchdog/README.md
+++ b/docs/watchdog/README.md
@@ -50,8 +50,8 @@ retry: a failed tick's retry is the next scheduled one.
 ### Canonical execution
 
 The watchdog drives the machine in-process through the `cartesi` Lua module,
-with the reference rollup host semantics the `cartesi-machine` CLI and Dave
-implement ([details](../cartesi-machine.md#rollup-host-semantics)). It clones
+with the rollup host semantics of Dave's sling node and the CLI's epoch driver
+([grounding and pins](../cartesi-machine.md#rollup-host-semantics)). It clones
 the head into a working directory and runs the machine in place on it; before
 each input it clones the working directory as a snapshot:
 
@@ -71,16 +71,21 @@ watchdog and the reference CLI and require equal root hashes.
 A provider that silently drops logs must fail the tick, not produce a false
 comparison. The reader requires InputBox indices to run contiguously from the
 head's input count, and checks the count it reached against
-`InputBox.getNumberOfInputs(app)` pinned at block B. Every input's payload must
-name the configured application and chain. Long log ranges are split on the
-provider error codes that mean "range too large", exactly like the Rust reader
-(shared vector: `tests/fixtures/l1_partition_vector.json`).
+`InputBox.getNumberOfInputs(app)` pinned at block B (a scan that stops at a
+canonical fixed point latches instead, without this check). Every input's
+payload must name the configured application and chain. A log query that fails
+over more than one block is split in half and retried, and one that fails on a
+single block fails the tick, exactly like the Rust reader. Logs sort by (block,
+tx index, log index), and a log missing any of them fails the tick, as in the
+Rust reader. The shared vector `tests/fixtures/l1_partition_vector.json` pins
+both rules on both sides.
 
 **Scan floor.** The Rust reader starts at the application's deployment block,
-which is sound only because it also witnesses that the InputBox rejects inputs
-for undeployed applications. The watchdog starts at its bootstrap block and
-proves completeness from the InputBox count instead; do not copy the
-deployment-block floor without the witness.
+which is sound because setup pins that block only once it is safe and the
+reader's first scan proves, from index 0 and the InputBox count, that no input
+precedes it. The watchdog starts at its bootstrap block and proves completeness
+from the InputBox count instead; do not copy the deployment-block floor without
+that witness.
 
 The reader holds one provider response at a time: each successful log range
 is decoded and fed to the machine before the next is fetched.
@@ -116,17 +121,25 @@ schedulers must also prevent overlapping ticks (systemd, or Kubernetes
 `concurrencyPolicy: Forbid`).
 
 `init` checks the bootstrap machine: it must wait for an input and yield the
-configured state source, and it must be a trusted start, which `replay`
-requires of its `--from` machine too. Its block must be safe on the RPC; its
-input count comes from `getNumberOfInputs` at that block, which needs an RPC
-with state there (an archive node for old blocks); and when no input precedes
-the block, the machine must be the application's template (its root hash
-equals the on-chain `getTemplateHash()`).
+configured state source, the tick must be able to run it in place (its files
+writable, see [filesystem](operator-deployment.md#filesystem)), and it must be
+a trusted start, which `replay` requires of its `--from` machine too. Its
+block must be safe on the RPC; its input count comes from `getNumberOfInputs`
+at that block, which needs an RPC with state there (an archive node for old
+blocks); and when no input precedes the block, the machine must be the
+application's template (its root hash equals the on-chain
+`getTemplateHash()`).
 
 Exit 1 covers three failure classes, which the log line and `last_tick.json`
 name: `transient` (the L1 RPC or the sequencer's HTTP API; the next tick may
 succeed), `operator` (configuration, the state directory, an image), and
-`internal` (anything else, including filesystem failures such as a full disk).
+`internal` (anything else, including a filesystem write that reports a full
+disk). A full disk while the working machine runs in place is different: the
+emulator's write through a shared mapping faults, and the kernel kills the
+process by SIGBUS (on Linux signal 7: exit 135 in a shell, `status=7/BUS` under
+systemd) before it writes `last_tick.json` or `status.prom`, so only the
+stale-heartbeat alert sees it; `replay` can die the same way, and the watchdog
+keeps no free-space floor ([why](#why-it-is-built-this-way)).
 Exit 2 means a divergence: found by this tick, or latched earlier. It stays
 latched until `clear`. A tick that finds a divergence exits 2 even when it
 cannot create `incident/` (a full state directory); it logs the divergence as
@@ -138,22 +151,21 @@ again if it persists.
 
 `init` reads the environment and writes `config.json`, which later commands
 read: the chain id, the application, the InputBox it derives from the
-application, the state source, the bootstrap block, the sequencer URL, and the
-range-error codes. The bootstrap block matters after `init` too: it tells a
-never-agreed head from an agreed one (see [the tick](#the-tick)). The L1 RPC
-endpoint is never persisted.
+application, the state source, the bootstrap block, and the sequencer URL. The
+bootstrap block matters after `init` too: it tells a never-agreed head from an
+agreed one (see [the tick](#the-tick)). The L1 RPC endpoint is never persisted,
+and failure messages name no request URL.
 
 | Variable | Read by | Meaning |
 |---|---|---|
 | `CARTESI_WATCHDOG_STATE_DIR` | all | Absolute path of the state directory |
 | `CARTESI_WATCHDOG_BLOCKCHAIN_HTTP_ENDPOINT` | init, tick, replay | L1 JSON-RPC endpoint; never persisted, so it can rotate |
-| `CARTESI_WATCHDOG_SEQUENCER_URL` | init (persisted); tick (optional override) | Sequencer operator API base URL |
+| `CARTESI_WATCHDOG_SEQUENCER_URL` | init (persisted); tick (optional override) | Base URL of the sequencer's internal listener |
 | `CARTESI_WATCHDOG_BLOCKCHAIN_ID` | init (optional) | Expected chain id; defaults to the RPC's `eth_chainId` |
 | `CARTESI_WATCHDOG_APP_ADDRESS` | init | Application address; init derives the InputBox from its `getInputBox()`, as the sequencer does |
 | `CARTESI_WATCHDOG_STATE_SOURCE` | init | `inspect`, or `range:<label>` with a label matching `[a-z][a-z0-9-]*` |
 | `CARTESI_WATCHDOG_CM_SNAPSHOT_DIR` | init | Absolute path of the trusted bootstrap machine |
 | `CARTESI_WATCHDOG_CM_SNAPSHOT_SAFE_BLOCK` | init | L1 block the bootstrap machine has consumed all inputs through |
-| `CARTESI_WATCHDOG_LONG_BLOCK_RANGE_ERROR_CODES` | init (optional) | Comma-separated provider codes that split log ranges; default `-32005,-32012,-32600,-32602,-32616` |
 | `CARTESI_WATCHDOG_METRICS_FILE` | tick (optional) | Absolute path to write `status.prom` to instead of the state directory |
 | `CARTESI_WATCHDOG_LUA_ROOT`, `CARTESI_WATCHDOG_LUA_BIN` | wrapper | Lua sources and interpreter (defaults suit the release image) |
 | `CARTESI_WATCHDOG_LUA_DEPS` | all | Directory of the native modules (`lcurl.so`, `lfs.so`) |
@@ -284,11 +296,53 @@ Successful `init` or an idle tick is not evidence of a comparison.
   compared on that range. A library with application-supplied extraction hooks
   waits for an application these two sources cannot serve.
 - **In-process execution, the CLI as oracle.** The optimizations (reflink
-  clones, in-place mapping) live in the emulator, and v0.21 enforces the
-  dangerous part of the host semantics itself (no input after a reject without
-  a revert). Running the CLI per tick would add process management and a full
-  machine store per tick for semantics we get anyway, so the watchdog mirrors
-  the CLI's `--revert-mode=stored` loop and tests against the CLI.
+  clones, in-place mapping) live in the emulator. The emulator ignores an input
+  it cannot take instead of refusing it
+  ([host semantics](../cartesi-machine.md#rollup-host-semantics)), so the
+  watchdog advances only a machine at an `RX_ACCEPTED` yield and asserts that
+  each input was taken. Running the CLI per tick would add process management
+  and a full machine store per tick, so the watchdog runs the CLI's per-input
+  loop with no hash builder, using its stored-mode snapshot and revert without
+  its two per-input fsyncs: `work/` is scratch, reset every tick, and only a
+  published head is made durable, as sling syncs only a batch's final
+  boundary. It tests against the CLI, and against the step's rule where the
+  CLI aborts or departs from it.
+- **Grounded on sling, with deliberate differences.** Where the watchdog
+  departs from Dave's sling node
+  ([grounding and pins](../cartesi-machine.md#rollup-host-semantics)), it does
+  so on purpose:
+  - *L1 head.* Sling ingests at `finalized`. The watchdog reads at `safe`,
+    because the sequencer serves only its latest safe accepted checkpoint
+    ([acceptance](../snapshots/lifecycle.md#acceptance-and-comparison)), so it
+    shares the sequencer's assumption that safe blocks are permanent
+    ([L1 chain semantics](../threat-model/README.md#l1-chain-semantics)).
+  - *Head trust.* Sling asserts every stored boundary against its database
+    row, because it adopts content-addressed directories by name. The
+    watchdog keeps one head, published by its own sync and no-replace rename
+    and never opened for writing, and checks no root when it opens it: v0.22
+    has no supported check of data pages against the stored hash tree (its
+    `verify_hash_tree` serves the emulator's internal tests), so a recorded
+    root would catch only a swapped directory or a torn hash tree. A damaged head
+    surfaces as a latched divergence, which the runbook's replay attributes to
+    the watchdog.
+  - *An advance the machine does not take.* The references carry on from it
+    as an unchanged accept, where the watchdog fails loud (above); the
+    InputBox cap keeps every chain input deliverable.
+  - *After a fixed point.* The watchdog stops reading inputs and latches
+    `canonical_machine_dead`, where sling keeps recording later inputs
+    against the frozen state: the same state.
+  - *Start.* A non-genesis bootstrap is trusted, not anchored on chain
+    ([a trusted checkpoint](operator-deployment.md#initialize)).
+  - *Free space.* Sling refuses to start a batch without a clock (an open
+    epoch's, or a settled epoch's replay) below 1 GiB free, leaving the space
+    to work with a deadline. The watchdog has no deadline and keeps no floor:
+    a full disk only fails or kills ticks ([failure classes](#commands)),
+    while a floor would need `df` (LuaFileSystem has no `statvfs`) and is a
+    margin, not a bound, as sling says of its own.
+  - *Inspect.* Sling has no inspect path. The `inspect` source follows the
+    CLI's `--cmio-inspect-state`.
+  - *An epoch past 2^24 inputs.* The watchdog, like the sequencer, executes
+    the tail the chain never feeds.
 - **Flat SHA-256 digests.** The comparison is an equality check between two
   parties we operate, for states expected to reach several GiB. SHA-256 is the
   cheapest on the sequencer and couples to nothing. A machine Merkle root
@@ -332,9 +386,9 @@ LuaFileSystem (`lfs.so`). The `cartesi` module ships with the emulator.
 
 | Command | What it exercises |
 |---|---|
-| `just test-watchdog` | Unit tests: every module against fakes, including the shared partition vector and metrics golden files |
+| `just test-watchdog` | Unit tests: every module against fakes, including the shared partition and log-sort vectors and metrics golden files |
 | `just watchdog lint` | `luacheck` |
-| `just test-watchdog-e2e` | The real emulator with the test guest: executor against the CLI oracle (accept, reject, exception, halt), both state sources, full ticks, `replay`, and the wallet image's golden genesis state. Builds the test guest image on first use; needs the sepolia canonical image |
+| `just test-watchdog-e2e` | The real emulator with the test guest: executor against the CLI oracle (accept, reject, exception, halt), the bare-metal seam machines of Dave's sling node (budget seams, delivery tripwire, oversized and preset yields, a preset halt with an accept pending), both state sources, full ticks, `replay`, and the wallet image's golden genesis state. Builds the test guest image on first use; needs the sepolia canonical image |
 | `just test-rollups-e2e` | Devnet scenarios: the watchdog genesis compare and `watchdog_divergence_drill_test` on the Rust host, and the non-genesis compare through both hosts |
 | `just watchdog docker-smoke` | The release image: native modules, commands, and the lock |
 | `just doctor` | Toolchain: Lua, emulator, native modules, and the devnet image's state query |
diff --git a/docs/watchdog/getting-started.md b/docs/watchdog/getting-started.md
index cbbea1c4..493d8426 100644
--- a/docs/watchdog/getting-started.md
+++ b/docs/watchdog/getting-started.md
@@ -38,8 +38,11 @@ sources into `.deps/lua`.
 image (`watchdog/test-guest/out/test-machine-image`), which it builds on first
 use; the [test guest README](../../watchdog/test-guest/README.md) explains the
 guest and how to rebuild it. `just test-watchdog-compare-harness` and
-`just test-rollups-e2e` build missing canonical images themselves but reuse
-existing ones, so rebuild an image after changing the wallet or its guest. The
+`just test-rollups-e2e` build missing canonical images themselves. Every recipe
+reuses an image that exists, so remove `examples/canonical-app/out` or
+`watchdog/test-guest/out` after changing the wallet, its guest, or a Cartesi
+Machine or kernel pin in `toolchain-pins.env`: an image stored by another
+emulator version fails to load with `expected "archive_version" 8 (got 7)`. The
 README's [Tests](README.md#tests) table says what each recipe exercises.
 
 ## Path A: the automated harness
@@ -120,5 +123,5 @@ does not describe the new one: remove `$CARTESI_WATCHDOG_STATE_DIR` and run
 | `CM inspect bytes mismatch (len <N> vs expected <M>)` | The devnet image is older than the wallet code; rebuild it with `just canonical-build-machine-image` |
 | `watchdog state is already locked: <dir>/run.lock` | Another `init`, `tick`, or `clear` is running |
 | `flock is required (util-linux)` | Use the devshell, or install util-linux |
-| `sequencer /finalized_state/inclusion_block: GET <url> failed: …` | The devnet stack stopped, or the exports come from an earlier run |
+| `sequencer /finalized_state/inclusion_block: GET failed: …` | The devnet stack stopped, or the exports come from an earlier run |
 | `divergence inclusion_block_regressed latched at block 0` | The state directory comes from an earlier devnet run; remove it and run `init` again |
diff --git a/docs/watchdog/incident-runbook.md b/docs/watchdog/incident-runbook.md
index 599ee151..3d814abd 100644
--- a/docs/watchdog/incident-runbook.md
+++ b/docs/watchdog/incident-runbook.md
@@ -100,7 +100,10 @@ Use the application's template machine with `--from-block 0` (`replay` checks
 it against the on-chain template hash), or an archived checkpoint whose block
 you trust. `replay` needs an RPC with state at `A` (an archive node for old
 blocks), absolute paths, and an `--out` that does not exist; it never writes
-the state directory.
+the state directory. Run it with a watchdog release on the deployment's
+Cartesi Machine version: templates, checkpoints and `incident/canonical` load
+only in the version that stored them
+([upgrades](operator-deployment.md#upgrades)).
 
 | `replay`'s `sha256` equals | Conclusion |
 |---|---|
diff --git a/docs/watchdog/operator-deployment.md b/docs/watchdog/operator-deployment.md
index 53b1c116..156b6728 100644
--- a/docs/watchdog/operator-deployment.md
+++ b/docs/watchdog/operator-deployment.md
@@ -22,12 +22,11 @@ the sequencer's operator routes.
 | `GET /finalized_state/digest` | When the sequencer's accepted block has advanced |
 | `GET /finalized_state` | After a mismatch, to keep the sequencer's bytes as evidence |
 
-The sequencer serves these routes on the same listener as its public API,
-without authentication. The
+The sequencer serves these routes on its internal listener
+(`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`), without authentication. The
 [API reference](../../README.md#operator-snapshot-endpoints-internal-only)
-owns them and why they must stay private: expose only the public routes at the
-public ingress, and give the watchdog host an internal path to the operator
-routes. The sequencer hashes the comparison file on each digest request and
+owns them and why they must stay private: publish only the public listener,
+and give the watchdog host a path to the internal one. The sequencer hashes the comparison file on each digest request and
 the watchdog waits up to 300 seconds for the answer, so a proxy in between
 needs a read timeout at least that long for multi-GiB states.
 
@@ -49,9 +48,8 @@ InputBox, `eth_getCode`, and `eth_call` at past blocks: `init` reads the
 InputBox count at the bootstrap block, and every comparison reads it at the
 comparison block ([L1 completeness](README.md#l1-completeness)). Use an archive
 node when the bootstrap block, or a block you `replay` from, is older than the
-state your provider keeps. Long log ranges are split when the provider answers
-with one of the codes `-32005,-32012,-32600,-32602,-32616`; if yours uses
-another, set `CARTESI_WATCHDOG_LONG_BLOCK_RANGE_ERROR_CODES` at `init`.
+state your provider keeps. A log query that fails over more than one block is
+split in half and retried; one that fails on a single block fails the tick.
 
 ## Runtime
 
@@ -122,10 +120,9 @@ as `canonical-machine-image-<chain>-vX.tar.gz` (checked against the release's
 
 The build prints the image's root hash. It needs the kernel
 (`just canonical download-deps`), `cross`, Docker buildx able to build
-`linux/riscv64`, `xgenext2fs`, and the pinned `cartesi-machine`. A stored
-machine loads only in the Cartesi Machine version that stored it
-([versions are all-or-nothing](../cartesi-machine.md#versions-are-all-or-nothing)),
-so the image and the watchdog must use the same version.
+`linux/riscv64`, `xgenext2fs`, and the pinned `cartesi-machine`. The image
+and the watchdog must use the same Cartesi Machine release
+([why](../cartesi-machine.md#versions-are-all-or-nothing)).
 
 ## State source
 
@@ -155,12 +152,24 @@ a copy-on-write filesystem a clone costs metadata; elsewhere it is a full
 sparse copy of the machine, which makes multi-GiB states slow
 ([Cartesi Machine storage](../cartesi-machine.md#storage-sharing-and-snapshots)).
 Keep the bootstrap machine on the same filesystem, so the clone `init` makes
-of it is cheap as well.
+of it is cheap as well. Leave its file permissions as `cartesi-machine
+--store` and the release tarball set them: every file writable by its owner
+except those of host read-only ranges, such as the PMAs
+(`0000000000010000-1000.bin`), which the emulator maps read-only. The working
+machine runs in place, and the emulator refuses to map a file without write
+permission for writing
+([storage](../cartesi-machine.md#storage-sharing-and-snapshots)), so `init`
+opens a clone of the bootstrap machine as the tick will and refuses an image
+whose files lack it.
 
 ### Checkpoint disk usage and backups
 
 Disk usage is roughly one machine for the head, plus a working clone and a
-per-input snapshot while a tick runs (nearly free on copy-on-write), plus
+per-input snapshot while a tick runs (on copy-on-write a clone costs metadata,
+but the pages a catch-up writes, and the hash-tree pages they update, take
+real blocks, up to a full machine for the working clone: about 40 MB per 100
+inputs in the
+[measured run](../cartesi-machine.md#storage-sharing-and-snapshots)), plus
 incident evidence: the canonical machine at the divergence and two copies of
 the comparison bytes. Cleared incidents stay under `incidents/` until you
 remove them. With a `range` source, the watchdog also reads the whole range
@@ -172,12 +181,13 @@ Back up, from the state directory:
 - the newest `checkpoints/<block>-<count>/`, the head: the stored machine at
   L1 block `<block>`, after `<count>` InputBox inputs, which the sequencer
   agreed with (or the trusted bootstrap, before the first agreement);
-- `incident/` while a divergence is latched, and `incidents/`.
+- `incident/` while a divergence is latched, and `incidents/`;
+- `config.json`: `init` refuses a directory whose agreed head has lost it.
 
-`init` writes `config.json`, so it needs no backup. Checkpoints are published
-atomically, so the newest one is complete once a tick has finished. Run the
-backup after the tick in the same scheduled job: the next tick removes the
-previous head as soon as it publishes a new one. Names are zero-padded, so the
+Checkpoints are published atomically, so the newest one is complete once a
+tick has finished. Run the backup after the tick in the same scheduled job: the
+next tick removes the previous head as soon as it publishes a new one. Names
+are zero-padded, so the
 last one in sorted order is the newest. Stored machines are sparse files; copy
 them with a sparse-aware tool (`cp --sparse=always`, `rsync --sparse`,
 `tar --sparse`). Keep copies outside `checkpoints/`, which must hold nothing
@@ -203,7 +213,7 @@ table says where its value comes from.
 |---|---|---|
 | Chain id | The L1 network: `11155111` for Sepolia, `1` for mainnet. Pin it: `init` refuses an RPC that serves another chain | `CARTESI_WATCHDOG_BLOCKCHAIN_ID` |
 | Application | The deployment; the sequencer's `CARTESI_SEQUENCER_APP_ADDRESS` | `CARTESI_WATCHDOG_APP_ADDRESS` |
-| Sequencer URL | The internal address of the sequencer's listener ([network access](#network-access)) | `CARTESI_WATCHDOG_SEQUENCER_URL` |
+| Sequencer URL | The sequencer's internal listener ([network access](#network-access)) | `CARTESI_WATCHDOG_SEQUENCER_URL` |
 | L1 RPC | Your provider ([network access](#network-access)); read at run time, never persisted | `CARTESI_WATCHDOG_BLOCKCHAIN_HTTP_ENDPOINT` |
 | State source | The application ([state source](#state-source)) | `CARTESI_WATCHDOG_STATE_SOURCE` |
 | Bootstrap machine and block | [Initialize](#initialize) | `CARTESI_WATCHDOG_CM_SNAPSHOT_DIR`, `CARTESI_WATCHDOG_CM_SNAPSHOT_SAFE_BLOCK` |
@@ -226,7 +236,7 @@ Choose the bootstrap:
 
   ```bash
   cast call "$CARTESI_WATCHDOG_APP_ADDRESS" 'getDeploymentBlockNumber()(uint256)' \
-      --rpc-url "$CARTESI_WATCHDOG_BLOCKCHAIN_HTTP_ENDPOINT"
+      --block safe --rpc-url "$CARTESI_WATCHDOG_BLOCKCHAIN_HTTP_ENDPOINT"
   ```
 
   No input precedes that block, so `init` checks the image against the
@@ -239,7 +249,11 @@ Choose the bootstrap:
   `CARTESI_WATCHDOG_CM_SNAPSHOT_SAFE_BLOCK=X`. `init` checks that the machine
   waits for an input and yields the state source. It cannot check that its
   state is right: a wrong bootstrap surfaces as a `state_mismatch` at the next
-  comparison, the runbook's "watchdog wrong" case. The
+  comparison, the runbook's "watchdog wrong" case. A Dave node seeds
+  mid-history only from the consensus's last settled machine root
+  (`getLastFinalizedMachineMerkleRoot`); the watchdog reads no consensus
+  contract, so nothing anchors such a checkpoint, and a wrong one costs a false
+  `state_mismatch` that `replay` from the template resolves. The
   [detection boundary](README.md#detection-boundary) states what `init` and
   idle ticks do not prove.
 
@@ -283,7 +297,9 @@ console output.
 
 - **Divergence (`failed`).** Follow the [incident runbook](incident-runbook.md).
 - **Stale heartbeat.** No tick has finished recently: the scheduler stopped, a
-  tick hangs or is still replaying a long range, or every run exits at the lock
+  tick hangs or is still replaying a long range, a tick died by a signal (such
+  as SIGBUS on a full state-directory filesystem; see
+  [failure classes](README.md#commands)), or every run exits at the lock
   because another process holds it, such as a latching tick still collecting
   evidence (its divergence alert fires first).
 - **Sustained warning.** `sequencer-watchdog status` shows the last tick's
@@ -303,15 +319,23 @@ A deployed application is pinned to the Cartesi Machine version its template
 was built with ([why](../cartesi-machine.md#versions-are-all-or-nothing)), and
 so is its watchdog: run a watchdog release whose `cartesi_machine_version`
 (printed with `CARTESI_WATCHDOG_PRINT_RELEASE_INFO=1`) matches the version the
-application's template was built with. A release on another version cannot
-load the state directory's machines and cannot reproduce the template.
+application's template was built with. A release on another minor version
+cannot load the state directory's machines; within a minor, only the release
+you run holds the watchdog to the template's version (ours pin it exactly).
+Keep a release on each Cartesi Machine version that a deployment still
+runs, or whose checkpoints and incident evidence you may need to `replay`.
+
+A new Cartesi Machine version means a new application deployment, and its
+watchdog starts from a new, empty state directory that `init` fills from that
+release's canonical image. Keep the old deployment's state directory intact
+beside the old release; do not wipe it while its evidence may be needed.
 
 ## Sepolia
 
 | Item | Value |
 |---|---|
 | Chain id | `11155111` |
-| InputBox | `0xEbE9f4Dfc04ae10bBeE663859c3dc5A23f94eA3C`: rollups-contracts v3.0.0-alpha.10, the version the root `justfile` pins, deploys it at the same address on every chain, the devnet included |
+| InputBox | `0xEbE9f4Dfc04ae10bBeE663859c3dc5A23f94eA3C`: rollups-contracts v3.0.0-alpha.10, the version `toolchain-pins.env` pins, deploys it at the same address on every chain, the devnet included |
 | Canonical image | `canonical-machine-image-sepolia-vX.tar.gz`, or `just canonical-build-machine-image-sepolia`. Its guest runs `WalletConfig::sepolia()`, the configuration of the release `wallet-sequencer` binary |
 | State source | `inspect` |
 | Application | Per deployment |
@@ -355,6 +379,10 @@ re-detects fail-loud when the faulty state is next read, so the supervisor's
 handling of 30 and SIGABRT (stop and page, do not auto-restart) is what bounds
 a crash loop.
 
+The final `sequencer exiting` line logs at ERROR for exits 30 and 1, and at
+WARN for 10, 20 and 40, with `verdict` and `supervisor_action` fields; the
+SIGABRT line says so. Alert on the exit status, not the log level.
+
 - **Supervisor recipes.** systemd can act on the code directly:
   `RestartPreventExitStatus=30 ABRT` (SIGABRT/134 is terminal-class too).
   Kubernetes Deployments restart regardless of exit code, and there is no
@@ -362,13 +390,18 @@ a crash loop.
   re-detection windows, serving traffic in between. There, the crash-loop
   bound is your alerting, not the restart policy: page immediately on
   `lastState.terminated.exitCode == 30` (and on signal exits / 134).
+- **A fresh deployment needs a setup retry budget.** `setup` exits 20 until
+  the L1 safe head reaches the application's deployment block, about one to
+  two epochs on Ethereum (6.4–12.8 min); give a setup Job or unit a longer
+  retry budget (a Kubernetes Job's default backoffLimit 6 allows about
+  10.5 min).
 - **After an unclean death (OOM, node reboot, SIGKILL) no action is
   needed**: the next start re-derives everything from facts. For
   postmortems, the `terminal_faults` table records the cause of every
   command that returned through its bracket with a terminal verdict
   (best-effort, append-only, traveling with the data directory —
-  `SELECT * FROM terminal_faults ORDER BY fault_id DESC`; the next `run`
-  also logs the latest row once at startup). Any death that did not return
+  `SELECT * FROM terminal_faults ORDER BY fault_id DESC`; each `run` boot
+  logs the latest row at WARN unless a later completed setup resolved it). Any death that did not return
   through the bracket — SIGKILL, OOM, a node reboot, a terminal runtime abort,
   a controller panic — leaves only the process logs.
 - **Untrustworthy local state requires manual recovery.** The reader's
@@ -382,19 +415,24 @@ a crash loop.
 
 ## Troubleshooting (live deployments)
 
-The wrapper prints the lock message itself; the watchdog prints the others
-after the command and failure class, as in
+The wrapper prints the lock and `flock` messages, and the missing-directory
+message for `clear`, itself; the watchdog prints the others after the command
+and failure class, as in
 `watchdog: tick: transient failure: <message>`.
 
 | Message | Cause |
 |---|---|
 | `watchdog state is already locked: <dir>/run.lock` | Another `init`, `tick`, or `clear` holds the state directory, so the scheduler overlaps runs |
 | `flock is required (util-linux)` | Install util-linux; the wrapper needs `flock` for its lock |
-| `state directory <dir> does not exist` | `status` or `replay` with a wrong `CARTESI_WATCHDOG_STATE_DIR` |
+| `state directory <dir> does not exist` | `status`, `replay`, or `clear` with a wrong `CARTESI_WATCHDOG_STATE_DIR` |
+| `<dir> has checkpoint <path> but no config.json; restore config.json or wipe the directory` | `config.json` was lost beside an agreed head; restore it from backup, or wipe and re-run `init` |
 | `<dir>/config.json is not valid JSON` | A crash tore `config.json` right after `init`; wipe the state directory and re-run `init` |
 | `<dir> is not initialized; run init` | `tick` or `replay` on an empty state directory: a missing volume or a changed `CARTESI_WATCHDOG_STATE_DIR` |
 | `<dir>/config.json is not a version 2 watchdog config; wipe the state directory and re-run init` | See [upgrades](#upgrades) |
-| `cannot load stored machine <dir>: …` | A machine stored by another Cartesi Machine version; see [upgrades](#upgrades) |
+| `cannot load stored machine <dir>: expected "archive_version" 8 (got 7)`, or the `expected …` text alone with class `internal` (from a clone in `tick` or `replay`) | A machine stored by a Cartesi Machine release of another minor version; see [upgrades](#upgrades) |
+| `the tick cannot run <dir> in place: cannot load stored machine …/work/probe: unable to open backing file '<f>': Permission denied …` from `init` (as root: `backing file '<f>' is read-only and cannot be shared for writing`) | The bootstrap machine's files lack write permission; run `chmod -R u+w <dir>`, or on a read-only filesystem copy it, make the copy writable, and point `CARTESI_WATCHDOG_CM_SNAPSHOT_DIR` at it; then re-run `init` (see [filesystem](#filesystem)) |
+| `cannot load stored machine …/work/working: …` with the same causes, from `tick` | The head checkpoint's files lack write permission (lost after `init`, or kept from a bootstrap machine an older release initialized); run `chmod -R u+w` on the head checkpoint, or wipe the state directory and re-run `init` |
+| `cannot load stored machine <dir>: …` with another message | The emulator's message names the file or field it could not load |
 | `<dir> was initialized for another deployment or state source; wipe it to re-initialize` | The `init` environment names another chain, application, or state source than the directory holds |
 | `no input precedes block <N>, so the machine at <dir> must be the application's template, but its root hash differs from the on-chain template hash` | The image is not this application's template: another chain's image, another build, or another application |
 | `L1 RPC: eth_call: …` during `init` | The RPC has no state at the bootstrap block; use an archive node |
@@ -402,6 +440,6 @@ after the command and failure class, as in
 | `sequencer /finalized_state/digest: HTTP 404` while `inclusion_block` answers | A proxy does not forward the digest route, or the sequencer comes from another release |
 | `sequencer /finalized_state/inclusion_block: HTTP 503`, with `canonical divergence prevents accepted checkpoint selection` | The sequencer's own divergence marker is set: a sequencer incident for [cockroach recovery](../recovery/cockroach.md#incident-playbook) |
 | `L1 RPC safe head <N> is behind target block <B>` | The RPC lags the sequencer's L1 view; the next tick retries |
-| `InputBox counts <N> inputs at block <B> but the scan reached index <M>`, or `InputBox index <N> where <M> was expected: the L1 view is incomplete` | The provider returned incomplete logs; switch providers if it persists |
+| `InputBox counts <N> inputs at block <B> but the scan reached index <M>`, or `InputBox index <N> where <M> was expected: the L1 view is incomplete` | The provider returned incomplete logs, so switch providers; if it persists across them, a safe block below the head may have been replaced ([L1 chain semantics](../threat-model/README.md#l1-chain-semantics)), so confirm with `replay` from a trusted machine at a finalized block, then wipe the state directory and `init` from one |
 | `the L1 RPC does not serve chain <N>` | The RPC endpoint belongs to another chain |
 | `no flash drive or NVRAM carries the label "<label>"` | The state source does not match the image |
diff --git a/examples/app-core/Cargo.toml b/examples/app-core/Cargo.toml
index 130eac77..3b641dc3 100644
--- a/examples/app-core/Cargo.toml
+++ b/examples/app-core/Cargo.toml
@@ -17,3 +17,7 @@ ssz = { workspace = true }
 ssz_derive = { workspace = true }
 tracing = { workspace = true }
 rollups-types = { workspace = true }
+
+[dev-dependencies]
+rollups-types = { workspace = true, features = ["test-support"] }
+serde_json = { workspace = true }
diff --git a/examples/app-core/src/application/anvil_accounts.rs b/examples/app-core/src/application/anvil_accounts.rs
deleted file mode 100644
index fae92f61..00000000
--- a/examples/app-core/src/application/anvil_accounts.rs
+++ /dev/null
@@ -1,119 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-use std::sync::OnceLock;
-
-const ANVIL_ACCOUNTS_RAW: &str =
-    include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/anvil_accounts.txt"));
-
-#[derive(Debug)]
-struct ParsedAnvilAccounts {
-    private_keys: Vec<String>,
-}
-
-static PARSED_ANVIL_ACCOUNTS: OnceLock<ParsedAnvilAccounts> = OnceLock::new();
-
-pub fn default_private_keys() -> &'static [String] {
-    parsed_anvil_accounts().private_keys.as_slice()
-}
-
-fn parsed_anvil_accounts() -> &'static ParsedAnvilAccounts {
-    PARSED_ANVIL_ACCOUNTS.get_or_init(|| {
-        parse_accounts(ANVIL_ACCOUNTS_RAW)
-            .unwrap_or_else(|reason| panic!("invalid anvil_accounts.txt: {reason}"))
-    })
-}
-
-fn parse_accounts(raw: &str) -> Result<ParsedAnvilAccounts, String> {
-    let mut private_keys = Vec::new();
-
-    for (line_no, line) in raw.lines().enumerate() {
-        let trimmed = line.trim();
-        if trimmed.is_empty() {
-            continue;
-        }
-
-        let mut parts = trimmed.split_whitespace();
-        let address = parts
-            .next()
-            .ok_or_else(|| format!("line {}: missing address", line_no + 1))?;
-        let private_key = parts
-            .next()
-            .ok_or_else(|| format!("line {}: missing private key", line_no + 1))?;
-        if parts.next().is_some() {
-            return Err(format!(
-                "line {}: expected exactly two tokens: <address> <private_key>",
-                line_no + 1
-            ));
-        }
-        validate_hex_token(address, 42, "address", line_no + 1)?;
-        validate_hex_token(private_key, 66, "private key", line_no + 1)?;
-        private_keys.push(private_key.to_string());
-    }
-
-    if private_keys.is_empty() {
-        return Err("file does not contain any account records".to_string());
-    }
-
-    Ok(ParsedAnvilAccounts { private_keys })
-}
-
-fn validate_hex_token(
-    token: &str,
-    expected_len: usize,
-    field_name: &str,
-    line_no: usize,
-) -> Result<(), String> {
-    if token.len() != expected_len {
-        return Err(format!(
-            "line {}: invalid {} length: expected {}, got {}",
-            line_no,
-            field_name,
-            expected_len,
-            token.len()
-        ));
-    }
-    if !token.starts_with("0x") {
-        return Err(format!(
-            "line {}: {} must start with 0x",
-            line_no, field_name
-        ));
-    }
-    if !token.as_bytes().iter().skip(2).all(u8::is_ascii_hexdigit) {
-        return Err(format!("line {}: {} must be hex", line_no, field_name));
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::parse_accounts;
-
-    #[test]
-    fn parse_accounts_accepts_valid_lines() {
-        let raw = "\
-0x1111111111111111111111111111111111111111 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-0x2222222222222222222222222222222222222222 0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
-";
-        let parsed = parse_accounts(raw).expect("valid accounts");
-        assert_eq!(parsed.private_keys.len(), 2);
-    }
-
-    #[test]
-    fn parse_accounts_rejects_wrong_token_count() {
-        let raw = "0x1111111111111111111111111111111111111111";
-        let err = parse_accounts(raw).expect_err("missing key must fail");
-        assert!(err.contains("expected exactly two tokens") || err.contains("missing private key"));
-    }
-
-    #[test]
-    fn parse_accounts_rejects_wrong_lengths_and_non_hex() {
-        let wrong_len = "0x111111111111111111111111111111111111111 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-        let err = parse_accounts(wrong_len).expect_err("wrong address len must fail");
-        assert!(err.contains("invalid address length"));
-
-        let non_hex = "0x1111111111111111111111111111111111111111 0xzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz";
-        let err = parse_accounts(non_hex).expect_err("non-hex key must fail");
-        assert!(err.contains("private key must be hex"));
-    }
-}
diff --git a/examples/app-core/src/application/mod.rs b/examples/app-core/src/application/mod.rs
index 56a54947..53f56e93 100644
--- a/examples/app-core/src/application/mod.rs
+++ b/examples/app-core/src/application/mod.rs
@@ -1,16 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-mod anvil_accounts;
 mod method;
 mod notice;
 mod wallet;
 
-pub use anvil_accounts::default_private_keys;
 pub use method::{MAX_METHOD_PAYLOAD_BYTES, Method, Transfer, Withdrawal};
 pub use notice::{DepositNotice, TransferNotice};
 pub use wallet::{DEVNET_SEQUENCER_ADDRESS, SEPOLIA_SEQUENCER_ADDRESS, WalletApp, WalletConfig};
-
-pub use crate::wallet_snapshot::{
-    decode as decode_wallet_snapshot, encode as encode_wallet_snapshot,
-};
diff --git a/examples/app-core/src/application/wallet.rs b/examples/app-core/src/application/wallet.rs
index 31387377..cb7a79a2 100644
--- a/examples/app-core/src/application/wallet.rs
+++ b/examples/app-core/src/application/wallet.rs
@@ -1,7 +1,7 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 use std::io::Write;
 use std::path::{Path, PathBuf};
 
@@ -26,7 +26,7 @@ use sequencer_core::user_op::UserOp;
 pub struct WalletConfig {
     pub erc20_portal_address: Address,
     pub supported_erc20_token: Address,
-    /// Address that receives fee revenue. Defaults to `Address::ZERO` (burned).
+    /// Address credited with fee revenue.
     pub sequencer_address: Address,
 }
 
@@ -57,8 +57,10 @@ impl Default for WalletConfig {
 #[derive(Debug, Clone)]
 pub struct WalletApp {
     config: WalletConfig,
-    balances: HashMap<Address, U256>,
-    nonces: HashMap<Address, u32>,
+    // BTreeMap: iteration is ascending address bytes, the snapshot's
+    // canonical entry order.
+    balances: BTreeMap<Address, U256>,
+    nonces: BTreeMap<Address, u32>,
     execution_progress: ApplicationProgress,
 }
 
@@ -71,15 +73,15 @@ pub const SEPOLIA_USDC_ADDRESS: Address = address!("0x1c7D4B196Cb0C7B01d743Fbc61
 pub const DEVNET_MOCK_USDC_ADDRESS: Address =
     address!("0x95d0c8A7d11342299807A2Fc19ac44C2321cCc68");
 pub const SEPOLIA_SEQUENCER_ADDRESS: Address =
-    address!("0x16d5FF3Fdd14e2a86FBA77cbcE6B3Cd9C32b8Ff3");
+    address!("0x79b88d2f598d8D001832D69f5201332A3f1e14c8");
 /// Devnet batch-submitter / sequencer address — anvil account **9**,
 /// deliberately distinct from the deployer/funder (anvil account 0).
 ///
 /// A dedicated submitter is a load-bearing assumption of `setup`'s detection
-/// gate: step 1 refuses when the submitter's wallet nonce is
-/// unsettled (`pending > safe`). The deployer has a non-zero nonce from
-/// contract creations whose tail isn't safe at setup time, so reusing it as
-/// the submitter false-positives. Account 9 starts at nonce 0. Kept in sync
+/// gate: step 1 refuses when the submitter's wallet nonce is unsettled
+/// (`pending > safe`), so the submitter must not share a key with the
+/// deployer or with an e2e wallet whose transactions may be in flight.
+/// Account 9 starts at nonce 0. Kept in sync
 /// with the harness submitter key (`tests/harness` uses `default_private_keys`
 /// index 9) and `canonical-test`'s batch sender.
 pub const DEVNET_SEQUENCER_ADDRESS: Address =
@@ -88,8 +90,8 @@ impl WalletApp {
     pub fn new(config: WalletConfig) -> Self {
         Self {
             config,
-            balances: HashMap::new(),
-            nonces: HashMap::new(),
+            balances: BTreeMap::new(),
+            nonces: BTreeMap::new(),
             execution_progress: ApplicationProgress::default(),
         }
     }
@@ -101,8 +103,8 @@ impl WalletApp {
     /// not a panic escaping `from_dump`'s `Result`.
     pub(crate) fn from_snapshot_parts(
         config: WalletConfig,
-        balances: HashMap<Address, U256>,
-        nonces: HashMap<Address, u32>,
+        balances: BTreeMap<Address, U256>,
+        nonces: BTreeMap<Address, u32>,
         executed_input_count: u64,
         last_executed_safe_block: u64,
     ) -> Result<Self, AppError> {
@@ -138,12 +140,12 @@ impl WalletApp {
     }
 
     #[cfg(test)]
-    pub(crate) fn balances_mut(&mut self) -> &mut HashMap<Address, U256> {
+    pub(crate) fn balances_mut(&mut self) -> &mut BTreeMap<Address, U256> {
         &mut self.balances
     }
 
     #[cfg(test)]
-    pub(crate) fn nonces_mut(&mut self) -> &mut HashMap<Address, u32> {
+    pub(crate) fn nonces_mut(&mut self) -> &mut BTreeMap<Address, u32> {
         &mut self.nonces
     }
 
@@ -156,10 +158,6 @@ impl WalletApp {
         .expect("coherent progress");
     }
 
-    pub fn last_executed_safe_block(&self) -> u64 {
-        self.execution_progress.last_executed_safe_block()
-    }
-
     fn balance_of(&self, addr: &Address) -> U256 {
         *self.balances.get(addr).unwrap_or(&U256::ZERO)
     }
@@ -200,17 +198,6 @@ impl WalletApp {
             .expect("wallet nonce overflow: no canonical successor");
         self.nonces.insert(addr, next);
     }
-
-    fn decode_portal_erc20_deposit(
-        portal_address: Address,
-        input: &sequencer_core::l2_tx::DirectInput,
-    ) -> Result<Option<Erc20Deposit>, rollups_types::Erc20DepositDecodeError> {
-        if input.sender != portal_address {
-            return Ok(None);
-        }
-
-        Erc20Deposit::decode(&input.payload).map(Some)
-    }
 }
 
 impl Default for WalletApp {
@@ -312,7 +299,10 @@ impl Application for WalletApp {
         input: &sequencer_core::l2_tx::DirectInput,
     ) -> Result<AppOutputs, AppError> {
         let mut outputs = Vec::new();
-        match Self::decode_portal_erc20_deposit(self.config.erc20_portal_address, input) {
+        let deposit = (input.sender == self.config.erc20_portal_address)
+            .then(|| Erc20Deposit::decode(&input.payload))
+            .transpose();
+        match deposit {
             Ok(Some(deposit)) => {
                 if deposit.token == self.config.supported_erc20_token {
                     self.credit(deposit.sender, deposit.value);
@@ -403,79 +393,56 @@ mod tests {
     use std::time::{SystemTime, UNIX_EPOCH};
 
     use alloy_primitives::{Address, U256, address};
-    use rollups_types::ERC20_DEPOSIT_PREFIX_BYTES;
-    use rollups_types::Erc20Transfer;
     use rollups_types::alloy_sol_types::SolCall;
-    use ssz_derive::{Decode, Encode};
+    use rollups_types::{Erc20Deposit, Erc20Transfer};
 
     use super::{ApplicationProgress, ExecutedInputCount, WalletApp, WalletConfig};
     use crate::application::{DepositNotice, Transfer, TransferNotice, Withdrawal};
     use sequencer_core::application::{
         AppError, AppOutput, Application, CanonicalState, InvalidReason, ValidationOutcome,
     };
-    use sequencer_core::application::{execute_direct_input, execute_valid_user_op};
+    use sequencer_core::application::{
+        ExecutionOutcome, execute_direct_input, execute_valid_user_op, validate_and_execute_user_op,
+    };
     use sequencer_core::l2_tx::{DirectInput, ValidUserOp};
     use sequencer_core::user_op::UserOp;
 
     #[test]
-    fn validate_rejects_when_max_fee_below_current_fee() {
-        use sequencer_core::application::{ExecutionOutcome, validate_and_execute_user_op};
-
-        let mut app = WalletApp::new(WalletConfig::default());
-        let sender = Address::from_slice(&[0x11; 20]);
-        app.balances.insert(sender, U256::from(10_u64));
-
-        let user_op = UserOp {
-            nonce: 0,
-            max_fee: 1,
-            data: Vec::<u8>::new().into(),
+    fn sepolia_dedicated_submitter_is_the_batch_sender_and_fee_recipient() {
+        use sequencer_core::batch::Batch;
+        use sequencer_core::scheduler::{
+            ProcessOutcome, Scheduler, SchedulerConfig, SchedulerInput,
         };
+        use ssz::Encode;
 
-        // The max_fee < current_fee check lives in the free function
-        // validate_and_execute_user_op, not in validate_user_op directly.
-        let result = validate_and_execute_user_op(&mut app, sender, &user_op, 2, 0)
-            .expect("should return Ok(Invalid), not Err");
-        assert_eq!(
-            result,
-            ExecutionOutcome::Invalid(InvalidReason::InvalidMaxFee {
-                max_fee: 1,
-                base_fee: 2
-            })
-        );
-    }
+        let submitter = address!("0x79b88d2f598d8D001832D69f5201332A3f1e14c8");
+        let previous_submitter = address!("0x16d5FF3Fdd14e2a86FBA77cbcE6B3Cd9C32b8Ff3");
+        let config = WalletConfig::sepolia();
+        assert_eq!(config.sequencer_address, submitter);
+        assert_eq!(WalletConfig::default().sequencer_address, submitter);
 
-    #[test]
-    fn an_exhausted_nonce_is_rejected_instead_of_overflowing() {
-        use sequencer_core::application::{ExecutionOutcome, validate_and_execute_user_op};
-
-        let mut app = WalletApp::new(WalletConfig::default());
-        let sender = Address::from_slice(&[0x11; 20]);
-        app.balances.insert(sender, U256::from(10_u64));
-        app.nonces.insert(sender, u32::MAX);
-        let user_op = UserOp {
-            nonce: u32::MAX,
-            max_fee: 0,
-            data: Vec::<u8>::new().into(),
+        let mut scheduler = Scheduler::new(
+            WalletApp::new(config),
+            SchedulerConfig::new(super::SEPOLIA_SEQUENCER_ADDRESS),
+        );
+        let input = |sender| SchedulerInput {
+            sender,
+            inclusion_block: 10,
+            domain: sequencer_core::build_input_domain(11155111, Address::ZERO),
+            payload: Batch {
+                nonce: 0,
+                frames: Vec::new(),
+            }
+            .as_ssz_bytes(),
         };
 
-        let result = validate_and_execute_user_op(&mut app, sender, &user_op, 0, 0)
-            .expect("an exhausted nonce is a rejection, not a fault");
-        assert_eq!(
-            result,
-            ExecutionOutcome::Invalid(InvalidReason::NonceExhausted)
-        );
-        assert_eq!(app.current_user_nonce(sender), u32::MAX);
+        let previous = scheduler.process_input(input(previous_submitter)).unwrap();
+        assert_eq!(previous.outcome, ProcessOutcome::DirectEnqueued);
+        assert_eq!(scheduler.next_expected_batch_nonce(), 0);
 
-        app.nonces.insert(sender, 5);
-        let result = validate_and_execute_user_op(&mut app, sender, &user_op, 0, 0).unwrap();
-        assert_eq!(
-            result,
-            ExecutionOutcome::Invalid(InvalidReason::InvalidNonce {
-                expected: 5,
-                got: u32::MAX
-            }),
-            "a sender that is not exhausted gets the expected nonce"
-        );
+        let current = scheduler.process_input(input(submitter)).unwrap();
+        assert_eq!(current.outcome, ProcessOutcome::BatchExecuted);
+        assert_eq!(scheduler.next_expected_batch_nonce(), 1);
     }
 
     #[test]
@@ -538,82 +505,14 @@ mod tests {
         assert!(outputs.is_empty());
     }
 
-    #[test]
-    fn wallet_starts_with_zero_balances() {
-        let app = WalletApp::new(WalletConfig::default());
-        let sender = address!("0x1111111111111111111111111111111111111111");
-        let recipient = address!("0x2222222222222222222222222222222222222222");
-
-        assert_eq!(app.current_user_balance(sender), U256::ZERO);
-        assert_eq!(app.current_user_balance(recipient), U256::ZERO);
-    }
-
-    #[derive(PartialEq, Debug, Encode, Decode, Clone)]
-    struct LegacyDeposit {
-        amount: U256,
-        to: Address,
-    }
-
-    #[derive(PartialEq, Debug, Encode, Decode, Clone)]
-    struct LegacyWithdrawal {
-        amount: U256,
-    }
-
-    #[derive(PartialEq, Debug, Encode, Decode, Clone)]
-    struct LegacyTransfer {
-        amount: U256,
-        to: Address,
-    }
-
-    #[derive(PartialEq, Debug, Encode, Decode, Clone)]
-    #[ssz(enum_behaviour = "union")]
-    enum LegacyMethod {
-        Withdrawal(LegacyWithdrawal),
-        Transfer(LegacyTransfer),
-        Deposit(LegacyDeposit),
-    }
-
-    #[test]
-    fn legacy_deposit_payload_is_included_as_no_op() {
-        let mut app = WalletApp::new(WalletConfig::default());
-        let sender = address!("0x1111111111111111111111111111111111111111");
-        let recipient = Address::from_slice(&[0x77; 20]);
-        app.balances.insert(sender, U256::from(500_u64));
-        let before_sender_nonce = app.current_user_nonce(sender);
-        let before_sender_balance = app.current_user_balance(sender);
-        let before_recipient = app.current_user_balance(recipient);
-
-        let legacy = LegacyMethod::Deposit(LegacyDeposit {
-            amount: U256::from(123_u64),
-            to: recipient,
-        });
-        // fee exponent 0 → fee_to_linear(0) = 1 (minimum fee)
-        let valid = ValidUserOp {
-            sender,
-            fee: 0,
-            data: ssz::Encode::as_ssz_bytes(&legacy),
-        };
-
-        let outputs = execute_valid_user_op(&mut app, &valid, 0)
-            .expect("execute valid user op")
-            .outputs;
-
-        assert_eq!(app.current_user_nonce(sender), before_sender_nonce + 1);
-        // Gas cost of 1 unit (fee_to_linear(0) = 1) is deducted
-        assert_eq!(
-            app.current_user_balance(sender),
-            before_sender_balance - U256::from(1u64)
-        );
-        assert_eq!(app.current_user_balance(recipient), before_recipient);
-        assert!(outputs.is_empty());
-    }
-
     fn encode_erc20_deposit_payload(token: Address, sender: Address, value: U256) -> Vec<u8> {
-        let mut payload = Vec::with_capacity(ERC20_DEPOSIT_PREFIX_BYTES);
-        payload.extend_from_slice(token.as_slice());
-        payload.extend_from_slice(sender.as_slice());
-        payload.extend_from_slice(value.to_be_bytes::<32>().as_slice());
-        payload
+        Erc20Deposit {
+            token,
+            sender,
+            value,
+            exec_layer_data: Vec::new(),
+        }
+        .encode()
     }
 
     #[test]
@@ -810,15 +709,69 @@ mod tests {
     }
 
     #[test]
-    fn devnet_config_uses_deterministic_mock_usdc_address() {
-        let config = WalletConfig::devnet();
-        assert_eq!(
-            config.erc20_portal_address,
-            super::SEPOLIA_ERC20_PORTAL_ADDRESS
-        );
+    fn business_failures_after_fee_validation_charge_fee_and_consume_nonce() {
+        let sequencer = address!("0x9999999999999999999999999999999999999999");
+        let mut app = WalletApp::new(WalletConfig {
+            sequencer_address: sequencer,
+            ..WalletConfig::default()
+        });
+        let sender = address!("0x1111111111111111111111111111111111111111");
+        let recipient = address!("0x2222222222222222222222222222222222222222");
+        let funded = U256::from(100_u64);
+        app.balances.insert(sender, funded);
+        let fee: u16 = 10;
+        let fee_cost = sequencer_core::fee::fee_to_linear(fee);
+        let too_much = U256::from(1_000_u64);
+        // Selector 2 was the retired `Deposit { amount, to }` method, laid out
+        // like `Transfer`; an op shaped like it must not mint to `to`.
+        let mut retired_deposit = vec![2];
+        retired_deposit.extend(ssz::Encode::as_ssz_bytes(&Transfer {
+            amount: too_much,
+            to: recipient,
+        }));
+        let mut replay = app.clone();
+
+        for (i, data) in [
+            ssz::Encode::as_ssz_bytes(&super::Method::Transfer(Transfer {
+                amount: too_much,
+                to: recipient,
+            })),
+            ssz::Encode::as_ssz_bytes(&super::Method::Withdrawal(Withdrawal { amount: too_much })),
+            retired_deposit,
+        ]
+        .into_iter()
+        .enumerate()
+        {
+            let nonce = u32::try_from(i).unwrap();
+            let safe_block = 10 + u64::from(nonce);
+            let user_op = UserOp {
+                nonce,
+                max_fee: fee,
+                data: data.clone().into(),
+            };
+            let ExecutionOutcome::Included(live) =
+                validate_and_execute_user_op(&mut app, sender, &user_op, fee, safe_block).unwrap()
+            else {
+                panic!("a fee-funded op is included even when its method fails");
+            };
+            // Restart catch-up replays the persisted op without validation.
+            let replayed =
+                execute_valid_user_op(&mut replay, &ValidUserOp { sender, fee, data }, safe_block)
+                    .unwrap();
+            assert_eq!(replayed, live);
+
+            assert!(live.outputs.is_empty());
+            let charged = fee_cost * U256::from(nonce + 1);
+            assert_eq!(app.current_user_nonce(sender), nonce + 1);
+            assert_eq!(app.current_user_balance(sender), funded - charged);
+            assert_eq!(app.current_user_balance(sequencer), charged);
+            assert_eq!(app.current_user_balance(recipient), U256::ZERO);
+            assert_eq!(app.executed_input_count().get(), u64::from(nonce) + 1);
+            assert_eq!(app.last_executed_safe_block(), safe_block);
+        }
         assert_eq!(
-            config.supported_erc20_token,
-            super::DEVNET_MOCK_USDC_ADDRESS
+            replay.canonical_snapshot_bytes().unwrap(),
+            app.canonical_snapshot_bytes().unwrap()
         );
     }
 
@@ -853,33 +806,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn fee_sent_to_zero_address_when_default() {
-        let config = WalletConfig {
-            sequencer_address: Address::ZERO,
-            ..WalletConfig::default()
-        };
-        let mut app = WalletApp::new(config);
-        let sender = address!("0x1111111111111111111111111111111111111111");
-        app.balances.insert(sender, U256::from(10_000_u64));
-
-        let fee_exponent: u16 = 100;
-        let gas_cost = sequencer_core::fee::fee_to_linear(fee_exponent);
-        let valid = ValidUserOp {
-            sender,
-            fee: fee_exponent,
-            data: Vec::new(),
-        };
-        execute_valid_user_op(&mut app, &valid, 0).expect("execute op");
-
-        assert_eq!(
-            app.current_user_balance(sender),
-            U256::from(10_000_u64) - gas_cost
-        );
-        // Fee goes to address zero — effectively burned.
-        assert_eq!(app.current_user_balance(Address::ZERO), gas_cost);
-    }
-
     #[test]
     fn create_dump_then_from_dump_round_trips_full_state() {
         let mut app = WalletApp::new(WalletConfig {
@@ -898,6 +824,7 @@ mod tests {
 
         let prefix = temp_dump_prefix();
         app.create_dump(&prefix).expect("create dump");
+        assert!(WalletApp::state_file_in_dump(&prefix).starts_with(&prefix));
 
         let restored = WalletApp::from_dump(&prefix).expect("load dump");
 
@@ -993,48 +920,6 @@ mod tests {
         assert_eq!(app.last_executed_safe_block(), 150);
     }
 
-    #[test]
-    fn create_dump_produces_deterministic_bytes() {
-        // Insert in scrambled order so the HashMap's non-deterministic
-        // iteration order is exercised. The encoder must sort to make
-        // the resulting bytes stable; without sorting, two `create_dump`
-        // calls on the same logical state could produce different files.
-        let mut app = WalletApp::new(WalletConfig::default());
-        app.balances.insert(
-            address!("0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
-            U256::from(1_u64),
-        );
-        app.balances.insert(
-            address!("0x1111111111111111111111111111111111111111"),
-            U256::from(2_u64),
-        );
-        app.balances.insert(
-            address!("0x5555555555555555555555555555555555555555"),
-            U256::from(3_u64),
-        );
-        app.nonces
-            .insert(address!("0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), 7);
-        app.nonces
-            .insert(address!("0x1111111111111111111111111111111111111111"), 8);
-        app.set_executed_input_count(99);
-
-        let prefix_a = temp_dump_prefix();
-        let prefix_b = temp_dump_prefix();
-        app.create_dump(&prefix_a).expect("first dump");
-        app.create_dump(&prefix_b).expect("second dump");
-
-        let bytes_a = std::fs::read(WalletApp::state_file_in_dump(&prefix_a)).expect("read a");
-        let bytes_b = std::fs::read(WalletApp::state_file_in_dump(&prefix_b)).expect("read b");
-
-        std::fs::remove_dir_all(&prefix_a).expect("cleanup a");
-        std::fs::remove_dir_all(&prefix_b).expect("cleanup b");
-
-        assert_eq!(
-            bytes_a, bytes_b,
-            "create_dump must produce byte-identical files for identical logical state"
-        );
-    }
-
     #[test]
     fn from_dump_rejects_malformed_bytes() {
         let prefix = temp_dump_prefix();
@@ -1054,16 +939,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn state_file_in_dump_lives_inside_prefix() {
-        let prefix = PathBuf::from("/tmp/example-prefix");
-        let state = WalletApp::state_file_in_dump(&prefix);
-        assert!(
-            state.starts_with(&prefix),
-            "state file path {state:?} must live under prefix {prefix:?}"
-        );
-    }
-
     fn temp_dump_prefix() -> PathBuf {
         // Combine pid + nanos + a process-local counter so concurrent tests
         // never collide on the same prefix path, even within a single nanosecond.
@@ -1077,4 +952,61 @@ mod tests {
         path.push(format!("wallet-dump-{}-{nanos}-{n}", std::process::id()));
         path
     }
+
+    const CONSENSUS_VECTORS: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../tests/fixtures/consensus_vectors_v1.json"
+    ));
+
+    /// The guest emits these payloads as notices and voucher calldata, so their
+    /// bytes, selector included, are consensus. Pinned once and never
+    /// regenerated: a mismatch is a finding.
+    #[test]
+    fn output_encodings_match_the_pinned_bytes() {
+        let vectors: serde_json::Value =
+            serde_json::from_str(CONSENSUS_VECTORS).expect("parse consensus_vectors_v1.json");
+        let pinned = &vectors["wallet_outputs"];
+        let text = |value: &serde_json::Value| value.as_str().expect("pinned string").to_owned();
+        let address = |key: &str| {
+            text(&pinned[key])
+                .parse::<Address>()
+                .expect("pinned address")
+        };
+        let bytes = |value: &serde_json::Value| {
+            alloy_primitives::hex::decode(text(value)).expect("pinned hex bytes")
+        };
+        let (token, sender, recipient) =
+            (address("token"), address("sender"), address("recipient"));
+
+        let cases = pinned["cases"].as_array().expect("pinned cases");
+        assert_eq!(cases.len(), 3);
+        for case in cases {
+            let amount: U256 = text(&case["amount"]).parse().expect("pinned amount");
+            assert_eq!(
+                DepositNotice {
+                    token,
+                    sender,
+                    amount
+                }
+                .abi_encode(),
+                bytes(&case["deposit_notice"]),
+                "DepositNotice, amount {amount:#x}"
+            );
+            assert_eq!(
+                TransferNotice {
+                    sender,
+                    recipient,
+                    amount
+                }
+                .abi_encode(),
+                bytes(&case["transfer_notice"]),
+                "TransferNotice, amount {amount:#x}"
+            );
+            assert_eq!(
+                Erc20Transfer { recipient, amount }.abi_encode(),
+                bytes(&case["erc20_transfer"]),
+                "Erc20Transfer, amount {amount:#x}"
+            );
+        }
+    }
 }
diff --git a/examples/app-core/src/wallet_snapshot.rs b/examples/app-core/src/wallet_snapshot.rs
index e2a4dc22..c0ffff5e 100644
--- a/examples/app-core/src/wallet_snapshot.rs
+++ b/examples/app-core/src/wallet_snapshot.rs
@@ -1,16 +1,12 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Canonical SSZ snapshot encoding for the toy wallet app.
-//!
-//! [`encode`] and [`decode`] are the single source of truth used by
-//! [`WalletApp::create_dump`](crate::application::wallet::WalletApp::create_dump),
-//! CM `inspect_state`, and the watchdog's digest comparison.
-//!
-//! Golden bytes: `tests/fixtures/wallet_snapshot_empty.hex` (shared with
-//! Rust and Lua parity tests).
+//! Canonical SSZ encoding of the toy wallet's state (layout owned by
+//! `docs/snapshots/format.md`). [`encode`] and [`decode`] are the only codec:
+//! `WalletApp::create_dump`, CM `inspect_state` and the watchdog digest use them.
+//! Golden bytes: `tests/fixtures/wallet_snapshot_empty.hex`, shared with Lua tests.
 
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 
 use alloy_primitives::{Address, U256};
 use ssz::{Decode, Encode};
@@ -20,19 +16,19 @@ use crate::application::{WalletApp, WalletConfig};
 use sequencer_core::application::{AppError, Application};
 
 #[derive(Debug, Clone, PartialEq, Eq, SszEncode, SszDecode)]
-pub struct SnapshotBalance {
+struct SnapshotBalance {
     pub address: [u8; 20],
     pub balance_be: [u8; 32],
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, SszEncode, SszDecode)]
-pub struct SnapshotNonce {
+struct SnapshotNonce {
     pub address: [u8; 20],
     pub nonce: u32,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, SszEncode, SszDecode)]
-pub struct WalletSnapshot {
+struct WalletSnapshot {
     pub erc20_portal_address: [u8; 20],
     pub supported_erc20_token: [u8; 20],
     pub sequencer_address: [u8; 20],
@@ -42,25 +38,24 @@ pub struct WalletSnapshot {
     pub last_executed_safe_block: u64,
 }
 
-/// Deterministic SSZ bytes for `app`'s logical state (sorted map entries).
+/// Deterministic SSZ bytes for `app`'s logical state; entries come out in
+/// ascending address order (`BTreeMap` iteration order).
 pub fn encode(app: &WalletApp) -> Vec<u8> {
-    let mut balances: Vec<_> = app
+    let balances: Vec<_> = app
         .balances_iter()
         .map(|(address, balance)| SnapshotBalance {
             address: address.into_array(),
             balance_be: balance.to_be_bytes(),
         })
         .collect();
-    balances.sort_unstable_by_key(|entry| entry.address);
 
-    let mut nonces: Vec<_> = app
+    let nonces: Vec<_> = app
         .nonces_iter()
         .map(|(address, nonce)| SnapshotNonce {
             address: address.into_array(),
             nonce: *nonce,
         })
         .collect();
-    nonces.sort_unstable_by_key(|entry| entry.address);
 
     WalletSnapshot {
         erc20_portal_address: app.config().erc20_portal_address.into_array(),
@@ -80,7 +75,7 @@ pub fn decode(bytes: &[u8]) -> Result<WalletApp, AppError> {
         reason: format!("snapshot decode failed: {e:?}"),
     })?;
 
-    let mut balances = HashMap::with_capacity(decoded.balances.len());
+    let mut balances = BTreeMap::new();
     for entry in decoded.balances {
         let address = Address::from(entry.address);
         let balance = U256::from_be_bytes(entry.balance_be);
@@ -91,7 +86,7 @@ pub fn decode(bytes: &[u8]) -> Result<WalletApp, AppError> {
         }
     }
 
-    let mut nonces = HashMap::with_capacity(decoded.nonces.len());
+    let mut nonces = BTreeMap::new();
     for entry in decoded.nonces {
         let address = Address::from(entry.address);
         if nonces.insert(address, entry.nonce).is_some() {
@@ -157,4 +152,50 @@ mod tests {
         let restored = decode(&bytes).expect("decode snapshot");
         assert_eq!(encode(&restored), bytes);
     }
+
+    #[test]
+    fn encode_emits_entries_in_ascending_address_order() {
+        // These rank differently under byte order, little-endian chunks and
+        // reversed bytes, so only byte-lexicographic order passes.
+        let first_byte = address!("0x0100000000000000000000000000000000000000");
+        let second_byte = address!("0x0002000000000000000000000000000000000000");
+        let last_byte = address!("0x00000000000000000000000000000000000000ff");
+        let tail_chunk = address!("0x0000000000000000000000000000000000000100");
+        let config = WalletConfig::sepolia();
+        let mut app = WalletApp::new(config);
+        for (address, balance) in [
+            (first_byte, 1_u64),
+            (last_byte, 2),
+            (second_byte, 3),
+            (tail_chunk, 4),
+        ] {
+            app.balances_mut().insert(address, U256::from(balance));
+        }
+        app.nonces_mut().insert(first_byte, 7);
+        app.nonces_mut().insert(last_byte, 8);
+
+        let balance = |address: Address, value: u64| SnapshotBalance {
+            address: address.into_array(),
+            balance_be: U256::from(value).to_be_bytes(),
+        };
+        let nonce = |address: Address, nonce: u32| SnapshotNonce {
+            address: address.into_array(),
+            nonce,
+        };
+        let expected = WalletSnapshot {
+            erc20_portal_address: config.erc20_portal_address.into_array(),
+            supported_erc20_token: config.supported_erc20_token.into_array(),
+            sequencer_address: config.sequencer_address.into_array(),
+            balances: vec![
+                balance(last_byte, 2),
+                balance(tail_chunk, 4),
+                balance(second_byte, 3),
+                balance(first_byte, 1),
+            ],
+            nonces: vec![nonce(last_byte, 8), nonce(first_byte, 7)],
+            executed_input_count: 0,
+            last_executed_safe_block: 0,
+        };
+        assert_eq!(encode(&app), expected.as_ssz_bytes());
+    }
 }
diff --git a/examples/c-wallet-engine/Cargo.toml b/examples/c-wallet-engine/Cargo.toml
index 82cfdd9c..554fa628 100644
--- a/examples/c-wallet-engine/Cargo.toml
+++ b/examples/c-wallet-engine/Cargo.toml
@@ -28,3 +28,4 @@ alloy-primitives = { workspace = true }
 [dev-dependencies]
 tempfile = { workspace = true }
 ssz = { workspace = true }
+rollups-types = { workspace = true, features = ["test-support"] }
diff --git a/examples/c-wallet-engine/src/lib.rs b/examples/c-wallet-engine/src/lib.rs
index 1ab6d592..80b51e75 100644
--- a/examples/c-wallet-engine/src/lib.rs
+++ b/examples/c-wallet-engine/src/lib.rs
@@ -48,19 +48,12 @@ fn set_error(message: impl AsRef<str>) {
     });
 }
 
-/// Preserve missing/corrupt artifact classification across the ABI; diagnostics are not parsed.
+/// Validation and execution: NOT_FOUND and INVALID_DUMP are lifecycle-only statuses.
 fn report(error: &AppError, what: &str) -> sys::ApplicationEngineStatus {
     match error {
         AppError::Io(err) => {
             set_error(format!("{what} failed: {err}"));
-            match err.kind() {
-                std::io::ErrorKind::NotFound => sys::APPLICATION_ENGINE_STATUS_NOT_FOUND,
-                std::io::ErrorKind::InvalidData
-                | std::io::ErrorKind::UnexpectedEof
-                | std::io::ErrorKind::NotADirectory
-                | std::io::ErrorKind::IsADirectory => sys::APPLICATION_ENGINE_STATUS_INVALID_DUMP,
-                _ => sys::APPLICATION_ENGINE_STATUS_IO_ERROR,
-            }
+            sys::APPLICATION_ENGINE_STATUS_IO_ERROR
         }
         other => {
             set_error(format!("{what} failed: {other:?}"));
@@ -69,6 +62,26 @@ fn report(error: &AppError, what: &str) -> sys::ApplicationEngineStatus {
     }
 }
 
+/// Dump loading and creation: preserve the missing/corrupt classification across the ABI. These
+/// are the kinds `referenced_artifact_io_is_terminal` and the host's AppBootstrap arm treat as
+/// terminal; other I/O, PermissionDenied included, stays IO_ERROR, which the host classifies
+/// operational. Diagnostics are not parsed.
+fn report_lifecycle(error: &AppError, what: &str) -> sys::ApplicationEngineStatus {
+    let AppError::Io(err) = error else {
+        return report(error, what);
+    };
+    let status = match err.kind() {
+        std::io::ErrorKind::NotFound => sys::APPLICATION_ENGINE_STATUS_NOT_FOUND,
+        std::io::ErrorKind::InvalidData
+        | std::io::ErrorKind::UnexpectedEof
+        | std::io::ErrorKind::NotADirectory
+        | std::io::ErrorKind::IsADirectory => sys::APPLICATION_ENGINE_STATUS_INVALID_DUMP,
+        _ => return report(error, what),
+    };
+    set_error(format!("{what} failed: {err}"));
+    status
+}
+
 /// Borrow a path the way the C API carries it, raw bytes rather than text.
 ///
 /// A Unix path is bytes. Decoding it as UTF-8 would answer for a different path than the caller
@@ -151,7 +164,7 @@ pub unsafe extern "C" fn application_engine_from_dump(
             set_error(format!("from_dump failed: {reason}"));
             sys::APPLICATION_ENGINE_STATUS_INVALID_DUMP
         }
-        Err(err) => report(&err, "from_dump"),
+        Err(err) => report_lifecycle(&err, "from_dump"),
     }
 }
 
@@ -390,7 +403,7 @@ pub unsafe extern "C" fn application_engine_create_dump(
     let prefix = unsafe { path_from(prefix) };
     match engine.app.create_dump(&prefix) {
         Ok(()) => sys::APPLICATION_ENGINE_STATUS_OK,
-        Err(err) => report(&err, "create_dump"),
+        Err(err) => report_lifecycle(&err, "create_dump"),
     }
 }
 
@@ -405,16 +418,13 @@ pub unsafe extern "C" fn application_engine_state_file_in_dump(
     // Pure over the prefix: it touches no filesystem and needs no engine. Where the state file
     // sits follows from the shape this app gives a dump, a directory with `state` inside it.
     let state_file = WalletApp::state_file_in_dump(&prefix);
-    match CString::new(state_file.as_os_str().as_encoded_bytes()) {
-        Ok(path) => STATE_FILE.with(|slot| {
-            *slot.borrow_mut() = path;
-            slot.borrow().as_ptr()
-        }),
-        Err(_) => {
-            set_error("the dump prefix contains an interior NUL");
-            std::ptr::null()
-        }
-    }
+    // The prefix came from a CStr and `join("state")` adds no NUL.
+    let path =
+        CString::new(state_file.as_os_str().as_encoded_bytes()).expect("prefix came from a CStr");
+    STATE_FILE.with(|slot| {
+        *slot.borrow_mut() = path;
+        slot.borrow().as_ptr()
+    })
 }
 
 /* -- genesis, the one entry point that is not part of the seam -- */
diff --git a/examples/c-wallet-engine/tests/conformance.rs b/examples/c-wallet-engine/tests/conformance.rs
index 2be1d7cd..33216bea 100644
--- a/examples/c-wallet-engine/tests/conformance.rs
+++ b/examples/c-wallet-engine/tests/conformance.rs
@@ -5,6 +5,7 @@ use alloy_primitives::{Address, U256};
 use app_core::application::{Method, Transfer, WalletApp, WalletConfig, Withdrawal};
 use c_app_engine::{Application, EngineApp};
 use c_wallet_engine as _;
+use rollups_types::Erc20Deposit;
 use sequencer_core::application::{
     AppError, AppOutput, CanonicalState, ExecutionOutcome, execute_direct_input,
     execute_valid_user_op, validate_and_execute_user_op,
@@ -30,14 +31,16 @@ fn state_bytes(app: &mut EngineApp, path: &Path) -> Vec<u8> {
 }
 
 fn deposit(config: WalletConfig, recipient: Address, amount: u64, block: u64) -> DirectInput {
-    let mut payload = Vec::new();
-    payload.extend_from_slice(config.supported_erc20_token.as_slice());
-    payload.extend_from_slice(recipient.as_slice());
-    payload.extend_from_slice(&U256::from(amount).to_be_bytes::<32>());
     DirectInput {
         sender: config.erc20_portal_address,
         block_number: block,
-        payload,
+        payload: Erc20Deposit {
+            token: config.supported_erc20_token,
+            sender: recipient,
+            value: U256::from(amount),
+            exec_layer_data: Vec::new(),
+        }
+        .encode(),
     }
 }
 
diff --git a/examples/canonical-app/justfile b/examples/canonical-app/justfile
index 9aceb468..bb6ecef5 100644
--- a/examples/canonical-app/justfile
+++ b/examples/canonical-app/justfile
@@ -1,19 +1,19 @@
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
-pins := "../../toolchain-pins.env"
 cartesi_machine_version := `sed -n 's/^CARTESI_MACHINE_VERSION=v//p' ../../toolchain-pins.env`
-linux_image_release := `grep '^CARTESI_LINUX_IMAGE_RELEASE=' ../../toolchain-pins.env | cut -d= -f2`
+linux_release := `grep '^CARTESI_LINUX_RELEASE=' ../../toolchain-pins.env | cut -d= -f2`
 linux_kernel_filename := `grep '^CARTESI_LINUX_KERNEL_FILENAME=' ../../toolchain-pins.env | cut -d= -f2`
+linux_kernel_sha512 := `grep '^CARTESI_LINUX_KERNEL_SHA512=' ../../toolchain-pins.env | cut -d= -f2`
+
+# cross builds the guest with this channel's x86_64-unknown-linux-gnu
+# toolchain (see `cross-toolchain`).
+rust_channel := `sed -n 's/^channel = "\(.*\)"$/\1/p' ../../rust-toolchain.toml`
 
 out_dir := "out"
 source_date_epoch := "0"
-# Cache the kernel under its pinned filename so a changed pin misses the cache
-# and re-downloads (a generic name would verify a stale kernel against its own
-# stale checksum).
+# Cache the kernel under its pinned filename so a changed pin misses the cache.
 linux_kernel := out_dir + "/" + linux_kernel_filename
-linux_kernel_sha512 := linux_kernel + ".sha512"
-linux_kernel_url := "https://github.com/cartesi/machine-linux-image/releases/download/" + linux_image_release + "/" + linux_kernel_filename
-linux_kernel_sha512_url := linux_kernel_url + ".sha512"
+linux_kernel_url := "https://github.com/cartesi/linux/releases/download/" + linux_release + "/" + linux_kernel_filename
 rootfs_tar := out_dir + "/canonical-rootfs.tar"
 rootfs_ext2 := out_dir + "/canonical-rootfs.ext2"
 machine_image := out_dir + "/canonical-machine-image"
@@ -22,31 +22,39 @@ dapp_binary_devnet := out_dir + "/dapp-devnet"
 dapp_binary_sepolia := out_dir + "/dapp-sepolia"
 machine_image_sepolia := out_dir + "/canonical-machine-image-sepolia"
 
+# The kernel is part of the template hash, so it is checked against the
+# in-tree pin, not against a checksum published beside it.
 download-deps:
     @mkdir -p {{out_dir}}
-    @kernel_tmp="{{linux_kernel}}.tmp"; checksum_tmp="{{linux_kernel_sha512}}.tmp"; \
-      verify_kernel() { (cd {{out_dir}} && shasum -a 512 -c "$(basename {{linux_kernel_sha512}})" >/dev/null); }; \
-      if [[ ! -s {{linux_kernel}} || ! -s {{linux_kernel_sha512}} ]] || ! verify_kernel; then \
-        rm -f "{{linux_kernel}}" "{{linux_kernel_sha512}}" "$kernel_tmp" "$checksum_tmp"; \
+    @verify_kernel() { echo "{{linux_kernel_sha512}}  $1" | shasum -a 512 -c - >/dev/null; }; \
+      if [[ ! -s {{linux_kernel}} ]] || ! verify_kernel "{{linux_kernel}}"; then \
+        kernel_tmp="{{linux_kernel}}.tmp"; \
+        rm -f "{{linux_kernel}}" "$kernel_tmp"; \
         wget "{{linux_kernel_url}}" -O "$kernel_tmp"; \
-        wget "{{linux_kernel_sha512_url}}" -O "$checksum_tmp"; \
+        verify_kernel "$kernel_tmp" \
+          || { echo "{{linux_kernel_filename}} does not match CARTESI_LINUX_KERNEL_SHA512" >&2; exit 1; }; \
         mv "$kernel_tmp" "{{linux_kernel}}"; \
-        sed "s#  artifacts/[^ ]*\$#  $(basename {{linux_kernel}})#" "$checksum_tmp" > "{{linux_kernel_sha512}}"; \
-        rm -f "$checksum_tmp"; \
-        verify_kernel; \
       fi
 
 build-dapp: build-dapp-devnet
 
-build-dapp-devnet:
+# On its first run cross installs the riscv64 target and stops there; a later
+# run adds rust-src, which changes the standard-library paths rustc embeds in
+# panic locations. Installing both before every build keeps the template hash
+# independent of which run compiled which crate. --force-non-host is needed on
+# Apple Silicon and harmless elsewhere.
+cross-toolchain:
+    rustup toolchain install "{{rust_channel}}-x86_64-unknown-linux-gnu" --profile minimal --target riscv64gc-unknown-linux-musl --component rust-src --force-non-host
+
+build-dapp-devnet: cross-toolchain
     mkdir -p {{out_dir}}
-    SOURCE_DATE_EPOCH={{source_date_epoch}} CARGO_PROFILE_RELEASE_STRIP=symbols CARGO_TARGET_DIR=../../target CROSS_CONFIG=Cross.toml DOCKER_DEFAULT_PLATFORM=linux/amd64 cross build --package canonical-app --bin canonical-app-devnet --target riscv64gc-unknown-linux-musl --release
+    SOURCE_DATE_EPOCH={{source_date_epoch}} CARGO_PROFILE_RELEASE_STRIP=symbols CARGO_TARGET_DIR=../../target CROSS_CONFIG=Cross.toml DOCKER_DEFAULT_PLATFORM=linux/amd64 cross build --locked --package canonical-app --bin canonical-app-devnet --target riscv64gc-unknown-linux-musl --release
     cp ../../target/riscv64gc-unknown-linux-musl/release/canonical-app-devnet {{dapp_binary_devnet}}
     cp {{dapp_binary_devnet}} {{dapp_binary}}
 
-build-dapp-sepolia:
+build-dapp-sepolia: cross-toolchain
     mkdir -p {{out_dir}}
-    SOURCE_DATE_EPOCH={{source_date_epoch}} CARGO_PROFILE_RELEASE_STRIP=symbols CARGO_TARGET_DIR=../../target CROSS_CONFIG=Cross.toml DOCKER_DEFAULT_PLATFORM=linux/amd64 cross build --package canonical-app --bin canonical-app-sepolia --target riscv64gc-unknown-linux-musl --release
+    SOURCE_DATE_EPOCH={{source_date_epoch}} CARGO_PROFILE_RELEASE_STRIP=symbols CARGO_TARGET_DIR=../../target CROSS_CONFIG=Cross.toml DOCKER_DEFAULT_PLATFORM=linux/amd64 cross build --locked --package canonical-app --bin canonical-app-sepolia --target riscv64gc-unknown-linux-musl --release
     cp ../../target/riscv64gc-unknown-linux-musl/release/canonical-app-sepolia {{dapp_binary_sepolia}}
     cp {{dapp_binary_sepolia}} {{dapp_binary}}
 
@@ -104,7 +112,7 @@ build-machine-image-sepolia: clean-machine-image-sepolia build-rootfs-sepolia
       --store={{machine_image_sepolia}}
 
 test-guest: build-machine-image
-    cargo run -p canonical-test
+    cargo run --locked -p canonical-test
 
 print-build-hashes: build-machine-image
     echo "== tool versions =="
diff --git a/examples/canonical-app/src/scheduler/mod.rs b/examples/canonical-app/src/scheduler/mod.rs
index dc92b673..cbf5e4cb 100644
--- a/examples/canonical-app/src/scheduler/mod.rs
+++ b/examples/canonical-app/src/scheduler/mod.rs
@@ -1,21 +1,15 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Canonical-app harness around the scheduler library.
-//!
-//! The pure scheduler fold lives in [`sequencer_core::scheduler`]; this module
-//! is the I/O shell that drives it inside the RISC-V app. It pulls inputs off
-//! the `trolley` rollup, coerces host `U256` metadata into the scheduler's
-//! `u64` domain, feeds them through [`Scheduler::process_input`], and emits the
-//! app's notices/vouchers/reports back to the rollup.
+//! I/O shell that drives [`sequencer_core::scheduler`] inside the RISC-V guest:
+//! reads `trolley` rollup inputs, narrows `U256` metadata to the scheduler's `u64`
+//! domain, and emits the app's notices, vouchers and reports.
 
 use alloy_primitives::U256;
 use rollups_types::{Notice, Voucher};
 use sequencer_core::application::AppOutput;
 use sequencer_core::application::{Application, CanonicalState};
-use sequencer_core::scheduler::{
-    InspectError, ProcessOutcome, Scheduler, SchedulerInput, input_domain,
-};
+use sequencer_core::scheduler::{InspectError, ProcessOutcome, Scheduler, SchedulerInput};
 use trolley::{Rollup, RollupRequest};
 
 pub use sequencer_core::scheduler::{STATE_INSPECT_QUERY, SchedulerConfig};
@@ -31,8 +25,10 @@ pub fn run_scheduler_forever<R: Rollup, A: Application + CanonicalState>(
         match rollup.next_input() {
             Ok(RollupRequest::Advance { metadata, payload }) => {
                 let inclusion_block = block_to_u64(metadata.block_number);
-                let domain =
-                    input_domain(chain_id_to_u64(metadata.chain_id), metadata.app_contract);
+                let domain = sequencer_core::build_input_domain(
+                    chain_id_to_u64(metadata.chain_id),
+                    metadata.app_contract,
+                );
 
                 let input = SchedulerInput {
                     sender: metadata.msg_sender,
diff --git a/examples/canonical-test/Cargo.toml b/examples/canonical-test/Cargo.toml
index 8a077c6d..452900b0 100644
--- a/examples/canonical-test/Cargo.toml
+++ b/examples/canonical-test/Cargo.toml
@@ -16,8 +16,10 @@ path = "src/main.rs"
 [dependencies]
 app-core = { path = "../app-core" }
 canonical-app = { path = "../canonical-app" }
-sequencer-core = { path = "../../sequencer-core" }
+sequencer-core = { path = "../../sequencer-core", features = ["test-support"] }
 ssz = { workspace = true }
 testsi = { workspace = true }
-rollups-types = { workspace = true }
+rollups-types = { workspace = true, features = ["test-support"] }
 k256 = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
diff --git a/examples/canonical-test/src/golden.rs b/examples/canonical-test/src/golden.rs
new file mode 100644
index 00000000..204655fc
--- /dev/null
+++ b/examples/canonical-test/src/golden.rs
@@ -0,0 +1,187 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! Golden guest cases from `tests/fixtures/consensus_vectors_v1.json`: pinned
+//! payloads go into the built image unchanged (nothing is signed or encoded here)
+//! and its raw outputs must equal the pinned bytes; a mismatch is a finding.
+//! Reports are diagnostics, not consensus, and are not compared.
+
+use std::collections::BTreeMap;
+
+use rollups_types::alloy_primitives::{Address, Bytes, U256};
+use serde::Deserialize;
+use testsi::{InputBuilder, Output, TestResult};
+
+use crate::{TEST_CHAIN_ID, TEST_DAPP_ADDRESS, devnet_machine};
+
+const CONSENSUS_VECTORS: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../tests/fixtures/consensus_vectors_v1.json"
+));
+
+/// The pinned output that marks the signed transfer as included.
+const SIGNED_TRANSFER_NOTICE: &str = "transfer_notice_alice_bob";
+
+#[derive(Debug, Deserialize)]
+struct ConsensusVectors {
+    signature: PinnedSignature,
+    guest: GuestVectors,
+}
+
+#[derive(Debug, Deserialize)]
+struct PinnedSignature {
+    address: Address,
+    variants: Vec<PinnedVariant>,
+}
+
+#[derive(Debug, Deserialize)]
+struct PinnedVariant {
+    name: String,
+    guest: Option<Address>,
+}
+
+#[derive(Debug, Deserialize)]
+struct GuestVectors {
+    chain_id: u64,
+    app_contract: Address,
+    senders: BTreeMap<String, Address>,
+    first_input_envelope: Bytes,
+    payloads: BTreeMap<String, Bytes>,
+    outputs: BTreeMap<String, PinnedOutput>,
+    scenarios: Vec<Scenario>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum PinnedOutput {
+    Notice(Bytes),
+    Voucher {
+        destination: Address,
+        value: U256,
+        payload: Bytes,
+    },
+}
+
+#[derive(Debug, Deserialize)]
+struct Scenario {
+    name: String,
+    steps: Vec<Step>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Step {
+    from: String,
+    block: usize,
+    payload: String,
+    outputs: Vec<String>,
+}
+
+impl GuestVectors {
+    fn scenario(&self, name: &str) -> &Scenario {
+        self.scenarios
+            .iter()
+            .find(|scenario| scenario.name == name)
+            .unwrap_or_else(|| panic!("no golden scenario {name}"))
+    }
+
+    fn input(&self, step: &Step) -> InputBuilder {
+        InputBuilder::from_address(self.senders[&step.from])
+            .at_block(step.block)
+            .with_payload(&self.payloads[&step.payload])
+    }
+
+    /// Replays `name` on a fresh machine and compares every step's outputs.
+    fn run(&self, name: &str) -> TestResult {
+        assert_eq!(
+            (self.chain_id, self.app_contract),
+            (TEST_CHAIN_ID, TEST_DAPP_ADDRESS),
+            "the golden inputs were pinned against the devnet machine's chain and app"
+        );
+        let mut machine = devnet_machine()?;
+        for (index, step) in self.scenario(name).steps.iter().enumerate() {
+            let (outputs, _reports) = machine.advance_state(self.input(step))?;
+            let actual: Vec<PinnedOutput> = outputs.list().iter().map(pinned_form).collect();
+            let expected: Vec<PinnedOutput> = step
+                .outputs
+                .iter()
+                .map(|output| self.outputs[output].clone())
+                .collect();
+            assert_eq!(actual, expected, "{name}, step {index} ({})", step.payload);
+        }
+        Ok(())
+    }
+}
+
+fn pinned_form(output: &Output) -> PinnedOutput {
+    match output {
+        Output::Notice(notice) => PinnedOutput::Notice(notice.payload.clone()),
+        Output::Voucher(voucher) => PinnedOutput::Voucher {
+            destination: voucher.destination,
+            value: voucher.value,
+            payload: voucher.payload.clone(),
+        },
+    }
+}
+
+fn consensus_vectors() -> ConsensusVectors {
+    serde_json::from_str(CONSENSUS_VECTORS).expect("parse consensus_vectors_v1.json")
+}
+
+#[testsi::test_dapp(kind("golden"))]
+pub fn golden_deposit_emits_the_pinned_notice() -> TestResult {
+    let guest = consensus_vectors().guest;
+    // testsi wraps each payload in an EvmAdvance at test time; pinning the
+    // first envelope tells a host encoder drift apart from a guest change.
+    let first = &guest.scenario("deposit").steps[0];
+    assert_eq!(
+        guest
+            .input(first)
+            .encode(TEST_CHAIN_ID as usize, U256::ZERO, TEST_DAPP_ADDRESS),
+        guest.first_input_envelope.as_ref()
+    );
+    guest.run("deposit")
+}
+
+#[testsi::test_dapp(kind("golden"))]
+pub fn golden_signed_transfer_emits_the_pinned_notice() -> TestResult {
+    consensus_vectors().guest.run("transfer")
+}
+
+#[testsi::test_dapp(kind("golden"))]
+pub fn golden_withdrawal_emits_the_pinned_voucher() -> TestResult {
+    consensus_vectors().guest.run("withdrawal")
+}
+
+#[testsi::test_dapp(kind("golden"))]
+pub fn golden_spill_batch_emits_the_pinned_outputs() -> TestResult {
+    consensus_vectors().guest.run("spill_batch")
+}
+
+/// Each signature variant rides in its own batch after a deposit, followed by
+/// the signer's correctly signed op at the same nonce: a variant that runs as
+/// the signer emits the transfer notice and leaves the follow-up with nothing;
+/// any other emits nothing and the follow-up shows the signer's nonce was not
+/// consumed. The image is thus checked for running each variant as the signer
+/// or not; which other sender a variant recovers is pinned natively, in
+/// sequencer-core.
+#[testsi::test_dapp(kind("golden"))]
+pub fn golden_signature_variants_match_the_pinned_guest_outcome() -> TestResult {
+    let vectors = consensus_vectors();
+    for variant in &vectors.signature.variants {
+        let name = format!("signature_{}", variant.name);
+        vectors.guest.run(&name)?;
+
+        // The pinned outputs agree with the pinned recovery on whether the op
+        // runs as the signer.
+        let included = vectors.guest.scenario(&name).steps[1]
+            .outputs
+            .iter()
+            .any(|output| output == SIGNED_TRANSFER_NOTICE);
+        assert_eq!(
+            included,
+            variant.guest == Some(vectors.signature.address),
+            "{name}"
+        );
+    }
+    Ok(())
+}
diff --git a/examples/canonical-test/src/main.rs b/examples/canonical-test/src/main.rs
index e93dfe9d..ab9977b0 100644
--- a/examples/canonical-test/src/main.rs
+++ b/examples/canonical-test/src/main.rs
@@ -1,6 +1,8 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
+mod golden;
+
 use std::path::PathBuf;
 
 use app_core::application::{
@@ -9,12 +11,11 @@ use app_core::application::{
 };
 use canonical_app::SchedulerConfig;
 use k256::ecdsa::SigningKey;
-use k256::ecdsa::signature::hazmat::PrehashSigner;
-use rollups_types::Erc20Transfer;
-use rollups_types::alloy_primitives::Signature;
 use rollups_types::alloy_primitives::{Address, U256, address};
-use rollups_types::alloy_sol_types::{Eip712Domain, SolCall, SolStruct};
+use rollups_types::alloy_sol_types::{Eip712Domain, SolCall};
+use rollups_types::{Erc20Deposit, Erc20Transfer};
 use sequencer_core::batch::{Batch, Frame, WireUserOp};
+use sequencer_core::test_support::sign_user_op;
 use sequencer_core::user_op::UserOp;
 use testsi::{InputBuilder, Machine, MachineBuilder, OutputsForInput, TestResult};
 
@@ -342,22 +343,7 @@ fn signed_user_op_with_fee(
         max_fee,
         data: data.clone().into(),
     };
-    let signing_hash = user_op.eip712_signing_hash(&input_domain());
-    let k256_sig = signing_key
-        .sign_prehash(signing_hash.as_slice())
-        .expect("sign user op hash");
-    let sender = address_from_signing_key(signing_key);
-    let signature = [false, true]
-        .into_iter()
-        .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-        .find(|candidate| {
-            candidate
-                .recover_address_from_prehash(&signing_hash)
-                .ok()
-                .map(|value| value == sender)
-                .unwrap_or(false)
-        })
-        .expect("recoverable parity for signature");
+    let signature = sign_user_op(signing_key, &input_domain(), &user_op);
 
     WireUserOp {
         nonce,
@@ -377,7 +363,15 @@ fn portal_input(block: usize, token: Address, sender: Address, value: U256) -> I
     let wallet_config = WalletConfig::devnet();
     InputBuilder::from_address(wallet_config.erc20_portal_address)
         .at_block(block)
-        .with_payload(&encode_erc20_deposit_payload(token, sender, value))
+        .with_payload(
+            &Erc20Deposit {
+                token,
+                sender,
+                value,
+                exec_layer_data: Vec::new(),
+            }
+            .encode(),
+        )
 }
 
 fn batch_input(block: usize, batch: Batch) -> InputBuilder {
@@ -427,14 +421,6 @@ fn batch_with_frame_fee(
     }
 }
 
-fn encode_erc20_deposit_payload(token: Address, sender: Address, value: U256) -> Vec<u8> {
-    let mut payload = Vec::with_capacity(rollups_types::ERC20_DEPOSIT_PREFIX_BYTES);
-    payload.extend_from_slice(token.as_slice());
-    payload.extend_from_slice(sender.as_slice());
-    payload.extend_from_slice(value.to_be_bytes::<32>().as_slice());
-    payload
-}
-
 fn assert_invalid_batch_step(outputs: &OutputsForInput, reports: &[Vec<u8>]) {
     assert!(
         outputs.list().is_empty(),
diff --git a/justfile b/justfile
index fff132d4..68283121 100644
--- a/justfile
+++ b/justfile
@@ -11,9 +11,10 @@ mod bench 'tests/benchmarks/justfile'
 # The pre-deployed Anvil state published by the rollups-contracts release,
 # plus the forge-built MockERC20 fixture. Consumed by tests/harness — and
 # through it e2e, benchmarks, and the watchdog compare harness — so the
-# pins and the setup recipe live here at the root, not in any one consumer.
-rollups_contracts_version := "3.0.0-alpha.10"
-anvil_dump_name := "cartesi-rollups-contracts-" + rollups_contracts_version + "-anvil-1.5.1"
+# setup recipe lives here at the root; the versions come from toolchain-pins.env.
+rollups_contracts_version := `grep '^ROLLUPS_CONTRACTS_VERSION=' toolchain-pins.env | cut -d= -f2`
+anvil_version := `sed -n 's/^FOUNDRY_VERSION=v//p' toolchain-pins.env`
+anvil_dump_name := "cartesi-rollups-contracts-" + rollups_contracts_version + "-anvil-" + anvil_version
 anvil_dump_dir := "tests/.deps/" + anvil_dump_name
 anvil_dump_tar := "tests/.deps/" + anvil_dump_name + ".tar.gz"
 anvil_dump_url := "https://github.com/cartesi/rollups-contracts/releases/download/v" + rollups_contracts_version + "/" + anvil_dump_name + ".tar.gz"
@@ -55,12 +56,11 @@ test-watchdog-compare-harness: setup watchdog-lua-deps ensure-machine-image
     cargo build -p wallet-sequencer --bin wallet-sequencer-devnet -p rollups-e2e --bin rollups-e2e
     cargo run -p rollups-e2e --bin rollups-e2e -- watchdog_genesis_compare_test --exact --nocapture
 
-# Run sequencer tests sequentially so partition static config (init) is not shared across parallel tests.
+# Run the sequencer crate's tests.
 test-sequencer:
-    cargo test -p sequencer -- --test-threads=1
+    cargo test -p sequencer
 
 test-rollups-e2e: setup ensure-machine-image ensure-sepolia-machine-image
-    just watchdog-lua-deps
     cargo build -p wallet-sequencer --bin wallet-sequencer-devnet -p c-wallet-engine --bin c-wallet-genesis -p c-wallet-sequencer --bin c-wallet-sequencer -p rollups-e2e --bin rollups-e2e
     cargo run -p rollups-e2e --bin rollups-e2e
 
@@ -117,12 +117,6 @@ clippy:
 
 verify: fmt-check check test clippy
 
-ci:
-    cargo check --workspace --all-targets --locked
-    cargo build --workspace --all-targets --locked
-    cargo fmt --all -- --check
-    cargo test --workspace --all-targets --all-features --locked
-
 run addr="127.0.0.1:3000" data_dir="sequencer-data":
     rm -rf {{data_dir}}
     CARTESI_SEQUENCER_HTTP_ADDR={{addr}} CARTESI_SEQUENCER_DATA_DIR={{data_dir}} cargo run -p wallet-sequencer --release
diff --git a/openapi.yaml b/openapi.yaml
index b4afe92d..526b4dc1 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -4,14 +4,15 @@ info:
   version: 0.1.0
   summary: HTTP and WebSocket API of the app-specific DeFi sequencer.
   description: |
-    The sequencer serves two groups of routes from one listener:
+    The sequencer serves two groups of routes on two listeners:
 
-    - **Ingress** (public): submit signed user operations and read what a
-      wallet needs to sign them. CORS allows any origin on these routes.
-    - **Egress** (internal): application-input subscription, history
-      metadata, snapshot/state downloads, and health probes. These routes
-      have **no authentication and must not be exposed publicly**; gate them
-      with network access controls.
+    - **Ingress** (public, `CARTESI_SEQUENCER_HTTP_ADDR`): submit signed user
+      operations and read what a wallet needs to sign them. CORS allows any
+      origin on these routes.
+    - **Egress** (internal, `CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`):
+      application-input subscription, history metadata, snapshot/state
+      downloads, and health probes. These routes have **no authentication and
+      must not be exposed publicly**; gate them with network access controls.
 
     Address casing differs by route. `sender` in `POST /tx` and `GET /nonce`
     responses and WebSocket messages, and `verifyingContract` in
@@ -37,7 +38,7 @@ externalDocs:
   url: https://github.com/cartesi/sequencer/blob/main/README.md#api
 servers:
   - url: http://127.0.0.1:3000
-    description: Default listen address (`CARTESI_SEQUENCER_HTTP_ADDR`).
+    description: Default public listener (`CARTESI_SEQUENCER_HTTP_ADDR`).
 tags:
   - name: ingress
     description: Public routes for wallets and submitters.
@@ -234,6 +235,9 @@ paths:
                 verifyingContract: "0x1111111111111111111111111111111111111111"
 
   /ws/subscribe:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [history]
       operationId: subscribe
@@ -327,6 +331,9 @@ paths:
           $ref: "#/components/schemas/BroadcastTxMessage"
 
   /history:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [history]
       operationId: getHistory
@@ -388,6 +395,9 @@ paths:
               example: { ok: false, code: UNAVAILABLE, message: history read unavailable }
 
   /historical-l1-inputs:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [history]
       operationId: getHistoricalL1Inputs
@@ -473,6 +483,9 @@ paths:
           $ref: "#/components/responses/Unavailable"
 
   /finalized_state/inclusion_block:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [snapshots]
       operationId: getFinalizedInclusionBlock
@@ -495,6 +508,9 @@ paths:
           $ref: "#/components/responses/Divergence"
 
   /finalized_state/digest:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [snapshots]
       operationId: getFinalizedStateDigest
@@ -518,6 +534,9 @@ paths:
           $ref: "#/components/responses/Divergence"
 
   /finalized_state:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [snapshots]
       operationId: getFinalizedState
@@ -566,6 +585,9 @@ paths:
           $ref: "#/components/responses/Divergence"
 
   /latest_snapshot:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [snapshots]
       operationId: getLatestSnapshot
@@ -599,6 +621,9 @@ paths:
           $ref: "#/components/responses/EmptyInternalError"
 
   /finalized_snapshot:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [snapshots]
       operationId: getFinalizedSnapshot
@@ -635,6 +660,9 @@ paths:
           $ref: "#/components/responses/Divergence"
 
   /livez:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [health]
       operationId: livez
@@ -644,6 +672,9 @@ paths:
           description: The process is serving requests. Empty body.
 
   /readyz:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [health]
       operationId: readyz
@@ -655,6 +686,9 @@ paths:
           description: Shutting down, or the inclusion lane has stopped. Empty body.
 
   /healthz:
+    servers:
+      - url: http://127.0.0.1:3001
+        description: Default internal listener (`CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR`).
     get:
       tags: [health]
       operationId: healthz
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 6360c188..099ed62f 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.95.0"
+channel = "1.99.0"
 components = ["rustfmt", "clippy"]
diff --git a/scripts/ci-c-application-smoke.sh b/scripts/ci-c-application-smoke.sh
index eb9cf34d..d1a6b7f2 100644
--- a/scripts/ci-c-application-smoke.sh
+++ b/scripts/ci-c-application-smoke.sh
@@ -29,6 +29,10 @@ edition = "2024"
 [dependencies]
 c-app-sequencer = { path = "../source/bindings/c-app-sequencer" }
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+
+# The workspace's dev profile, so this build reuses its artifacts.
+[profile.dev]
+debug = "line-tables-only"
 TOML
 cat >"${consumer_dir}/src/main.rs" <<'RUST'
 #[tokio::main]
diff --git a/scripts/generate-release-manifest.sh b/scripts/generate-release-manifest.sh
index b7474b04..4b8e9896 100755
--- a/scripts/generate-release-manifest.sh
+++ b/scripts/generate-release-manifest.sh
@@ -47,10 +47,14 @@ if [[ ! -f "${pins}" ]]; then
   exit 1
 fi
 
-# shellcheck disable=SC1090
 set -a
+# shellcheck disable=SC1090
 source "${pins}"
 set +a
+# rust-toolchain.toml is the only Rust pin.
+RUST_TOOLCHAIN="$(sed -nE 's/^channel[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' "${root}/rust-toolchain.toml")"
+[[ -n "${RUST_TOOLCHAIN}" ]] || { echo "no channel in ${root}/rust-toolchain.toml" >&2; exit 1; }
+export RUST_TOOLCHAIN
 
 artifacts_json="$(cat <<EOF
 [
diff --git a/scripts/load-toolchain-pins.sh b/scripts/load-toolchain-pins.sh
deleted file mode 100755
index 340a4e3e..00000000
--- a/scripts/load-toolchain-pins.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Parse toolchain-pins.env and append KEY=value lines to a GitHub env file.
-set -euo pipefail
-
-root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-pins="${TOOLCHAIN_PINS_FILE:-${root}/toolchain-pins.env}"
-output="${1:-${GITHUB_ENV:-}}"
-
-usage() {
-  echo "usage: $0 OUTPUT_FILE" >&2
-  echo "       $0 -            # print parsed KEY=value lines to stdout" >&2
-  exit 1
-}
-
-trim() {
-  local value="$1"
-  value="${value#"${value%%[![:space:]]*}"}"
-  value="${value%"${value##*[![:space:]]}"}"
-  printf '%s' "${value}"
-}
-
-emit() {
-  if [[ "${output}" == "-" ]]; then
-    printf '%s\n' "$1"
-  else
-    printf '%s\n' "$1" >> "${output}"
-  fi
-}
-
-if [[ -z "${output}" ]]; then
-  usage
-fi
-if [[ ! -f "${pins}" ]]; then
-  echo "missing ${pins}" >&2
-  exit 1
-fi
-
-while IFS= read -r line || [[ -n "${line}" ]]; do
-  line="${line%%#*}"
-  line="$(trim "${line}")"
-  if [[ -z "${line}" ]]; then
-    continue
-  fi
-  if [[ ! "${line}" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; then
-    echo "invalid line in ${pins}: ${line}" >&2
-    exit 1
-  fi
-  emit "${line}"
-done < "${pins}"
diff --git a/scripts/verify-action-pins.sh b/scripts/verify-action-pins.sh
new file mode 100755
index 00000000..81ef0ac2
--- /dev/null
+++ b/scripts/verify-action-pins.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Every remote action under .github/ is pinned to a full commit SHA and the
+# exact release that commit is (`owner/repo@<40 hex> # vX.Y.Z`), one commit per
+# repository, and every job runs on a runner image named by version
+# (`ubuntu-24.04`, never `ubuntu-latest`, which GitHub moves). CI checks that
+# form offline.
+#
+# `--upstream`, run before each release, checks each pin against GitHub and
+# names a bump target: the newest release above the pin that is at least
+# COOLDOWN_DAYS (default 7) old, since a hijacked release is usually caught
+# within days. It edits nothing. It fails when a SHA is not the commit its tag
+# names upstream (a wrong comment, or a moved tag) or when the target runs on
+# another runtime (runs.using), which is how a deprecation such as Node 20
+# shows, or its runtime cannot be read. Needs git, curl, jq and the network; GITHUB_TOKEN lifts the API's
+# anonymous limit of 60 requests an hour (a run uses one per repository).
+#
+# Pins are bumped by hand, not by Dependabot: a bot PR moves a pin without
+# verifying the new code, so it is either rubber-stamped, which undoes the pin,
+# or reviewed as carefully as a manual bump. Revisit if pins go stale across
+# releases, the set of actions grows, or someone owns a weekly review.
+# To bump, read the changelog between the two tags for changes to the inputs we
+# pass, look over the commits between the pinned SHA and the printed one (the
+# age is the release's, and a tag moved after publication keeps it), take the
+# SHA printed here, and make one commit per action. A new action
+# is a design choice: a run step with a preinstalled tool needs no pin.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+pin_re='^[[:space:]-]*uses: ([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)(/[^@[:space:]]+)?@([0-9a-f]{40}) # (v[0-9]+\.[0-9]+\.[0-9]+)$'
+
+errors=0
+fail() { echo "$1" >&2; errors=$((errors + 1)); }
+
+pins=""  # one "repo|path|sha|tag" line per occurrence
+while IFS=: read -r file line text; do
+  [[ "${text}" =~ ^[[:space:]-]*uses:[[:space:]]+\./ ]] && continue  # in-tree action
+  if [[ "${text}" =~ ${pin_re} ]]; then
+    pins+="${BASH_REMATCH[1]}|${BASH_REMATCH[2]}|${BASH_REMATCH[3]}|${BASH_REMATCH[4]}"$'\n'
+  else
+    fail "${file#"${root}/"}:${line}: pin as owner/repo@<40-hex SHA> # vX.Y.Z"
+  fi
+done < <(grep -rnE --include='*.yml' --include='*.yaml' \
+  '^[[:space:]]*(-[[:space:]]+)?uses:' "${root}/.github")
+
+while IFS=: read -r file line _; do
+  fail "${file#"${root}/"}:${line}: name the runner image by version, not -latest"
+done < <(grep -rnE --include='*.yml' --include='*.yaml' \
+  '^[[:space:]]*runs-on:.*-latest' "${root}/.github" || true)
+
+pins="$(sort -u <<<"${pins}" | sed '/^$/d')"
+for repo in $(cut -d'|' -f1,3 <<<"${pins}" | sort -u | cut -d'|' -f1 | uniq -d); do
+  fail "${repo}: pinned at more than one commit; a bump updates every occurrence"
+done
+
+if [[ "${1:-}" != --upstream ]]; then
+  if ((errors > 0)); then exit 1; fi
+  echo "action pins well-formed"
+  exit 0
+fi
+
+cooldown="${COOLDOWN_DAYS:-7}"
+api=(-fsSL -H 'Accept: application/vnd.github+json')
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then api+=(-H "Authorization: Bearer ${GITHUB_TOKEN}"); fi
+
+# tag_commit REPO TAG: the commit TAG names upstream, peeled if annotated.
+tag_commit() {
+  git ls-remote "https://github.com/$1" "refs/tags/$2" "refs/tags/$2^{}" | tail -n1 | cut -f1
+}
+# runtime REPO PATH REF: the action's runs.using at REF.
+runtime() {
+  local file yml
+  for file in action.yml action.yaml; do
+    yml="$(curl -fsSL "https://raw.githubusercontent.com/$1/$3$2/${file}" 2>/dev/null)" || continue
+    sed -nE "/^[[:space:]]+using:/{s/^[[:space:]]+using:[[:space:]]*['\"]?([a-z0-9]+).*/\1/p;q;}" <<<"${yml}"
+    return
+  done
+  echo unknown
+}
+
+printf '%-30s %-8s %-9s %-8s %5s %-9s %s\n' action pinned runtime target age runtime verdict
+while IFS='|' read -r repo path sha tag; do
+  verdict=current
+  pinned_rt="$(runtime "${repo}" "${path}" "${sha}")"
+  if [[ "$(tag_commit "${repo}" "${tag}")" != "${sha}" ]]; then
+    verdict="MISMATCH: upstream ${tag} is another commit"
+    errors=$((errors + 1))
+  fi
+  releases="$(curl "${api[@]}" "https://api.github.com/repos/${repo}/releases?per_page=100")" || {
+    echo "GitHub API request failed for ${repo}; set GITHUB_TOKEN if rate-limited" >&2
+    exit 2
+  }
+  # The newest vX.Y.Z release above the pin, any major, past the cooldown.
+  read -r target age <<<"$(jq -r --arg pinned "${tag}" --argjson cool "${cooldown}" '
+    def semver: ltrimstr("v") | split(".") | map(tonumber);
+    [.[] | select((.draft or .prerelease) | not)
+         | select(.tag_name | test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))
+         | select((.tag_name | semver) > ($pinned | semver))
+         | .age = ((now - (.published_at | fromdateiso8601)) / 86400 | floor)
+         | select(.age >= $cool)]
+    | if length == 0 then "- -"
+      else max_by(.tag_name | semver) | "\(.tag_name) \(.age)d" end' <<<"${releases}")"
+  target_rt=-
+  if [[ "${target}" != - ]]; then
+    target_rt="$(runtime "${repo}" "${path}" "${target}")"
+    if [[ "${verdict}" == current ]]; then
+      verdict="bump: ${repo}${path}@$(tag_commit "${repo}" "${target}") # ${target}"
+      if [[ "${target_rt}" == unknown || "${target_rt}" != "${pinned_rt}" ]]; then
+        verdict="RUNTIME ${verdict}"
+        errors=$((errors + 1))
+      fi
+    fi
+  fi
+  printf '%-30s %-8s %-9s %-8s %5s %-9s %s\n' \
+    "${repo}${path}" "${tag}" "${pinned_rt}" "${target}" "${age}" "${target_rt}" "${verdict}"
+done <<<"${pins}"
+
+if ((errors > 0)); then
+  echo "${errors} pin(s) need a decision before tagging (MISMATCH or RUNTIME above)" >&2
+  exit 1
+fi
diff --git a/scripts/verify-toolchain-pins.sh b/scripts/verify-toolchain-pins.sh
index 0eb64f98..7f035dbd 100755
--- a/scripts/verify-toolchain-pins.sh
+++ b/scripts/verify-toolchain-pins.sh
@@ -1,80 +1,64 @@
 #!/usr/bin/env bash
-# Fail if toolchain-pins.env drifts from other pinned artifacts in-tree.
+# Fail when an in-tree copy of a toolchain-pins.env version drifts. Files that
+# can read the pins (workflows, justfiles) do; this checks those that cannot:
+# Cargo.toml, Rust constants, Dockerfile ARG defaults and vendoring provenance.
+#
+# `--upstream`, run before each release, also checks the pins that pair with
+# the emulator: the kernel release and the guest tools must be the LINUX_TAG
+# and MACHINE_GUEST_TOOLS_TAG of the emulator's dependencies.lock at
+# CARTESI_MACHINE_VERSION, and the kernel's SHA-512 the one its release
+# publishes. Nothing in-tree can check that pairing, since cartesi/linux tags
+# name the kernel version. Needs curl and the network.
 set -euo pipefail
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 pins="${root}/toolchain-pins.env"
 
-if [[ ! -f "${pins}" ]]; then
-  echo "missing ${pins}" >&2
+# load-toolchain-pins appends KEY=value lines to $GITHUB_ENV verbatim.
+if grep -nvE '^(#.*|[A-Z][A-Z0-9_]*=[^[:space:]#]+)?$' "${pins}"; then
+  echo "toolchain-pins.env: the lines above are not KEY=value" >&2
   exit 1
 fi
-
 # shellcheck disable=SC1090
-set -a
 source "${pins}"
-set +a
 
 errors=0
+fail() { echo "$1" >&2; errors=$((errors + 1)); }
+# require FILE TEXT: the repo-relative FILE must contain TEXT verbatim.
+require() { grep -qF -- "$2" "${root}/$1" || fail "$1 does not contain: $2"; }
 
-fail() {
-  echo "$1" >&2
-  errors=$((errors + 1))
-}
-
-rust_channel="$(
-  grep -E '^\s*channel\s*=' "${root}/rust-toolchain.toml" \
-    | head -1 \
-    | sed -E 's/.*=[[:space:]]*"([^"]+)".*/\1/'
-)"
-if [[ "${rust_channel}" != "${RUST_TOOLCHAIN}" ]]; then
-  fail "rust-toolchain.toml channel=${rust_channel} != RUST_TOOLCHAIN=${RUST_TOOLCHAIN}"
-fi
-
-if [[ "${CARTESI_LINUX_IMAGE_RELEASE}" != "${CARTESI_MACHINE_VERSION}" ]]; then
-  fail "CARTESI_LINUX_IMAGE_RELEASE=${CARTESI_LINUX_IMAGE_RELEASE} != CARTESI_MACHINE_VERSION=${CARTESI_MACHINE_VERSION}"
-fi
-
-expected_assert_version="${CARTESI_MACHINE_VERSION#v}"
-if [[ "${CARTESI_LINUX_KERNEL_FILENAME}" != *"${CARTESI_LINUX_IMAGE_RELEASE}"* ]]; then
-  fail "CARTESI_LINUX_KERNEL_FILENAME=${CARTESI_LINUX_KERNEL_FILENAME} does not include ${CARTESI_LINUX_IMAGE_RELEASE}"
-fi
+# A cartesi/linux release names its assets after its tag.
+[[ "${CARTESI_LINUX_KERNEL_FILENAME}" == "linux-${CARTESI_LINUX_RELEASE#v}.bin" ]] \
+  || fail "CARTESI_LINUX_KERNEL_FILENAME must be linux-${CARTESI_LINUX_RELEASE#v}.bin"
+[[ "${CARTESI_LINUX_KERNEL_SHA512}" =~ ^[0-9a-f]{128}$ ]] \
+  || fail "CARTESI_LINUX_KERNEL_SHA512 must be 128 lowercase hex characters"
 
-canonical_just="${root}/examples/canonical-app/justfile"
-if [[ ! -f "${canonical_just}" ]]; then
-  fail "missing ${canonical_just}"
-else
-  resolved_assert_version="$(
-    sed -n 's/^CARTESI_MACHINE_VERSION=v//p' "${pins}"
-  )"
-  resolved_linux_release="$(
-    grep '^CARTESI_LINUX_IMAGE_RELEASE=' "${pins}" | cut -d= -f2
-  )"
-  resolved_kernel_filename="$(
-    grep '^CARTESI_LINUX_KERNEL_FILENAME=' "${pins}" | cut -d= -f2
-  )"
+require Cargo.toml "cartesi-rollups-contracts = \"=${ROLLUPS_CONTRACTS_VERSION}\""
+require tests/harness/src/paths.rs \
+  "cartesi-rollups-contracts-${ROLLUPS_CONTRACTS_VERSION}-anvil-${FOUNDRY_VERSION#v}\""
 
-  if ! grep -q 'pins := "../../toolchain-pins.env"' "${canonical_just}"; then
-    fail "examples/canonical-app/justfile must read ../../toolchain-pins.env"
-  fi
+for dockerfile in examples/canonical-app/Dockerfile watchdog/test-guest/Dockerfile; do
+  require "${dockerfile}" "ARG MACHINE_EMULATOR_TOOLS_VERSION=${MACHINE_GUEST_TOOLS_VERSION}"
+done
+tools_sha="$(grep '^ARG TOOLS_SHA512=' "${root}/examples/canonical-app/Dockerfile")"
+require watchdog/test-guest/Dockerfile "${tools_sha}"
+require sdk/guest/README.md "refs/tags/v${MACHINE_GUEST_TOOLS_VERSION}.tar.gz"
+require sdk/guest/libcmt-sys/Cargo.toml "machine-guest-tools v${MACHINE_GUEST_TOOLS_VERSION}"
 
-  if [[ -z "${resolved_assert_version}" ]]; then
-    fail "could not resolve cartesi_machine_version from ${pins}"
-  elif [[ "${resolved_assert_version}" != "${expected_assert_version}" ]]; then
-    fail "resolved cartesi_machine_version=${resolved_assert_version} != ${expected_assert_version}"
+if [[ "${1:-}" == --upstream ]]; then
+  lock="$(curl -fsSL "https://raw.githubusercontent.com/cartesi/machine-emulator/${CARTESI_MACHINE_VERSION}/dependencies.lock")"
+  linux_tag="$(sed -n 's/^LINUX_TAG?=//p' <<<"${lock}")"
+  tools_tag="$(sed -n 's/^MACHINE_GUEST_TOOLS_TAG?=//p' <<<"${lock}")"
+  [[ "${linux_tag}" == "${CARTESI_LINUX_RELEASE}" ]] \
+    || fail "CARTESI_LINUX_RELEASE is ${CARTESI_LINUX_RELEASE}; emulator ${CARTESI_MACHINE_VERSION} pairs ${linux_tag:-nothing}"
+  [[ "${tools_tag}" == "v${MACHINE_GUEST_TOOLS_VERSION}" ]] \
+    || fail "MACHINE_GUEST_TOOLS_VERSION is ${MACHINE_GUEST_TOOLS_VERSION}; emulator ${CARTESI_MACHINE_VERSION} pairs ${tools_tag:-nothing}"
+  if ! published="$(curl -fsSL "https://github.com/cartesi/linux/releases/download/${CARTESI_LINUX_RELEASE}/${CARTESI_LINUX_KERNEL_FILENAME}.sha512")"; then
+    fail "cannot fetch ${CARTESI_LINUX_KERNEL_FILENAME}.sha512 from cartesi/linux ${CARTESI_LINUX_RELEASE}"
+  elif [[ "${published%% *}" != "${CARTESI_LINUX_KERNEL_SHA512}" ]]; then
+    fail "CARTESI_LINUX_KERNEL_SHA512 differs from the one ${CARTESI_LINUX_RELEASE} publishes"
   fi
-
-  if [[ "${resolved_linux_release}" != "${CARTESI_LINUX_IMAGE_RELEASE}" ]]; then
-    fail "resolved linux_image_release=${resolved_linux_release} != ${CARTESI_LINUX_IMAGE_RELEASE}"
-  fi
-
-  if [[ "${resolved_kernel_filename}" != "${CARTESI_LINUX_KERNEL_FILENAME}" ]]; then
-    fail "resolved linux_kernel_filename=${resolved_kernel_filename} != ${CARTESI_LINUX_KERNEL_FILENAME}"
-  fi
-fi
-
-if [[ "${errors}" -ne 0 ]]; then
-  exit 1
 fi
 
+if ((errors > 0)); then exit 1; fi
 echo "toolchain pins aligned"
diff --git a/sdk/guest/README.md b/sdk/guest/README.md
index 0c6564ca..f35df59f 100644
--- a/sdk/guest/README.md
+++ b/sdk/guest/README.md
@@ -14,7 +14,7 @@ are not published.
   at rev `ed14b98ecfe9796dc3ca7c9b96bfdbf0ef9baf22`
   (`guest/libcmt-sys`, `guest/trolley`, `host/testsi`, and `types`, renamed
   here to `rollups-types`; its examples were not imported). Since then they
-  have been updated here for Cartesi Machine v0.21.0 and machine-guest-tools
+  have been updated here for Cartesi Machine v0.22.0 and machine-guest-tools
   v0.18.0. Apache-2.0 licensed.
 - **libcmt C sources** (`libcmt-sys/libcmt/`): the `sys-utils/libcmt`
   `Makefile`, `include/` and `src/`, plus the top-level `LICENSE` (Apache-2.0)
@@ -23,9 +23,10 @@ are not published.
   tag `v0.18.0` (commit `5222250c69371f7cbe96e6082699a8ca22b5969c`), taken
   from `https://github.com/cartesi/machine-guest-tools/archive/refs/tags/v0.18.0.tar.gz`
   (sha256 `a16ee31a7abb0522ae70497721bf4856665297e1dd26d875a43fadbe48814bb6`).
-  The files are unmodified. libcmt must match the guest-tools version pinned
-  in `examples/canonical-app/Dockerfile`, which pairs with the emulator
-  release in `toolchain-pins.env`.
+  The files are unmodified. libcmt must match `MACHINE_GUEST_TOOLS_VERSION`
+  in `toolchain-pins.env`, which pairs with the emulator release there;
+  `scripts/verify-toolchain-pins.sh` checks both rootfs Dockerfiles and this
+  provenance line against it.
 
 ## Crates
 
@@ -37,7 +38,7 @@ are not published.
   vouchers, notices, reports and GIO.
 - **`testsi`** (with its proc-macro crate `testsi-macros`): a host-side test
   harness that loads a stored machine image and feeds it advance-state inputs.
-  It uses the Cartesi Machine v0.21 Rust bindings from
+  It uses the Cartesi Machine v0.22 Rust bindings from
   [cartesi/dave](https://github.com/cartesi/dave), pinned by rev in
   `testsi/Cargo.toml`. These link the prebuilt emulator named by
   `LIBCARTESI_PATH` / `INCLUDECARTESI_PATH`: the dev flake exports both, and so
diff --git a/sdk/guest/libcmt-sys/Cargo.toml b/sdk/guest/libcmt-sys/Cargo.toml
index 4b1e41bf..bc56bfab 100644
--- a/sdk/guest/libcmt-sys/Cargo.toml
+++ b/sdk/guest/libcmt-sys/Cargo.toml
@@ -9,4 +9,7 @@ publish = false
 [dependencies]
 
 [build-dependencies]
+# Its output compiles into the canonical guest: bump it as a guest-image change
+# of its own, with the generated bindings diffed for riscv64 and the host. 0.73
+# changed layout and bitfield code generation.
 bindgen = "0.72"
diff --git a/sdk/guest/rollups-types/Cargo.toml b/sdk/guest/rollups-types/Cargo.toml
index fe32797e..8e5c3848 100644
--- a/sdk/guest/rollups-types/Cargo.toml
+++ b/sdk/guest/rollups-types/Cargo.toml
@@ -9,3 +9,8 @@ publish = false
 [dependencies]
 alloy-sol-types = "1"
 alloy-primitives = "1"
+
+[features]
+# Test-only encoders (`Erc20Deposit::encode`) for other crates' tests. Only
+# dev-dependencies and test binaries enable it; the guest never does.
+test-support = []
diff --git a/sdk/guest/rollups-types/src/lib.rs b/sdk/guest/rollups-types/src/lib.rs
index 40123270..175dfd62 100644
--- a/sdk/guest/rollups-types/src/lib.rs
+++ b/sdk/guest/rollups-types/src/lib.rs
@@ -233,4 +233,39 @@ impl Erc20Deposit {
             exec_layer_data: payload[72..].to_vec(),
         })
     }
+
+    /// Inverse of [`Self::decode`]: the payload the ERC-20 portal writes.
+    #[cfg(any(test, feature = "test-support"))]
+    pub fn encode(&self) -> Vec<u8> {
+        let mut payload =
+            Vec::with_capacity(ERC20_DEPOSIT_PREFIX_BYTES + self.exec_layer_data.len());
+        payload.extend_from_slice(self.token.as_slice());
+        payload.extend_from_slice(self.sender.as_slice());
+        payload.extend_from_slice(&self.value.to_be_bytes::<32>());
+        payload.extend_from_slice(&self.exec_layer_data);
+        payload
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn erc20_deposit_encode_round_trips_through_decode() {
+        let deposit = Erc20Deposit {
+            token: Address::repeat_byte(0x11),
+            sender: Address::repeat_byte(0x22),
+            value: U256::from(0x0102_0304_u64),
+            exec_layer_data: vec![0xaa, 0xbb],
+        };
+        assert_eq!(Erc20Deposit::decode(&deposit.encode()), Ok(deposit.clone()));
+
+        let bare = Erc20Deposit {
+            exec_layer_data: Vec::new(),
+            ..deposit
+        };
+        assert_eq!(bare.encode().len(), ERC20_DEPOSIT_PREFIX_BYTES);
+        assert_eq!(Erc20Deposit::decode(&bare.encode()), Ok(bare));
+    }
 }
diff --git a/sdk/guest/testsi/Cargo.toml b/sdk/guest/testsi/Cargo.toml
index b42de893..22aa46d4 100644
--- a/sdk/guest/testsi/Cargo.toml
+++ b/sdk/guest/testsi/Cargo.toml
@@ -10,14 +10,14 @@ publish = false
 testsi-macros = { path = "./testsi-macros" }
 rollups-types = { workspace = true }
 
-# Cartesi Machine v0.21 Rust bindings from cartesi/dave main, pinned by rev (no
-# version requirement: from a git source the crate reports Dave's workspace
-# version, not the bindings' 0.21.0). They link the prebuilt emulator named by
-# LIBCARTESI_PATH / INCLUDECARTESI_PATH (exported by the dev flake and by CI's
-# CM .deb install); `external_cartesi` makes a missing LIBCARTESI_PATH a build
-# error instead of a source-checkout fallback.
-cartesi-machine = { git = "https://github.com/cartesi/dave", rev = "79874c0a1b40678465daf533acc976c88301c6d4", features = ["external_cartesi"] }
+# Cartesi Machine v0.22 Rust bindings from cartesi/dave, pinned by rev (the
+# commit tagged v3.0.0-alpha.6; no version requirement: from a git source the
+# crate reports Dave's workspace version, not the bindings' 0.22.0). They link
+# the prebuilt emulator named by LIBCARTESI_PATH / INCLUDECARTESI_PATH (exported
+# by the dev flake and by CI's CM .deb install); `external_cartesi` makes a
+# missing LIBCARTESI_PATH a build error instead of a source-checkout fallback.
+cartesi-machine = { git = "https://github.com/cartesi/dave", rev = "612c54cf22d73b364cd57a7058ba6aa449e5c77a", features = ["external_cartesi"] }
 
 inventory = "0.3"
-libtest-mimic = "0.6"
-thiserror = "1.0"
+libtest-mimic = { workspace = true }
+thiserror = { workspace = true }
diff --git a/sdk/guest/testsi/src/machine.rs b/sdk/guest/testsi/src/machine.rs
index f1fa8787..0f86846f 100644
--- a/sdk/guest/testsi/src/machine.rs
+++ b/sdk/guest/testsi/src/machine.rs
@@ -36,6 +36,8 @@ pub enum TestsiMachineError {
     InputRejected,
     #[error("machine is not awaiting an input (expected a manual rx_accepted yield): {state}")]
     NotAwaitingInput { state: String },
+    #[error("machine did not take the {len}-byte input (the cmio rx buffer holds 2 MiB)")]
+    InputNotDelivered { len: usize },
     #[error("machine execution timed out after {elapsed:?} (timeout {timeout:?})")]
     ExecutionTimeout {
         elapsed: Duration,
@@ -103,7 +105,7 @@ pub struct Machine {
 
 impl Machine {
     pub fn try_new(builder: MachineBuilder) -> Result<Self> {
-        // v0.21 replaced `htif.no_console_putchar` with a console output
+        // `no_console_putchar` maps to the runtime console's output
         // destination; the default writes guest console output to stdout.
         let runtime_config = if builder.no_console_putchar {
             RuntimeConfig::quiet_console()
@@ -136,10 +138,10 @@ impl Machine {
             self.builder.dapp_address,
         );
 
-        // v0.21 accepts an advance-state response only at a manual
-        // rx_accepted yield, and requires the root hash of that pre-input
-        // state (the state a rejected input reverts to). testsi never
-        // reverts: a rejection is reported as `InputRejected`.
+        // An advance-state response is delivered only at a manual
+        // rx_accepted yield, with the root hash of that pre-input state (the
+        // state a rejected input reverts to). testsi never reverts: a
+        // rejection is reported as `InputRejected`.
         expect_awaiting_input(&mut self.cartesi_machine)?;
         let revert_root_hash = self.cartesi_machine.root_hash()?;
         self.cartesi_machine.send_cmio_response(
@@ -147,6 +149,13 @@ impl Machine {
             &encoded_input,
             Some(&revert_root_hash),
         )?;
+        // An undeliverable response is a silent no-op, and only delivery
+        // clears iflags.Y (docs/cartesi-machine.md#rollup-host-semantics).
+        if self.cartesi_machine.iflags_y()? {
+            return Err(TestsiMachineError::InputNotDelivered {
+                len: encoded_input.len(),
+            });
+        }
         advance_input_index(&mut self.builder.input_index);
 
         let mut outputs = OutputsForInput::default();
@@ -268,8 +277,8 @@ fn handle_yield(
     })
 }
 
-/// Fails unless the machine sits at the manual rx_accepted yield that v0.21
-/// requires before an advance-state response.
+/// Fails unless the machine sits at the manual rx_accepted yield, the only
+/// state that takes an advance-state response.
 fn expect_awaiting_input(cartesi_machine: &mut cartesi_machine::machine::Machine) -> Result<()> {
     if !cartesi_machine.iflags_y()? {
         let state = if cartesi_machine.iflags_h()? {
@@ -288,8 +297,8 @@ fn expect_awaiting_input(cartesi_machine: &mut cartesi_machine::machine::Machine
 }
 
 fn sanity_check_cm_config(config: &machine::MachineConfig) {
-    // v0.21 keeps the HTIF feature switches as bitmasks in the iyield and
-    // iconsole CSRs, indexed by HTIF command.
+    // The HTIF feature switches are bitmasks in the iyield and iconsole
+    // CSRs, indexed by HTIF command.
     let htif = &config.processor.registers.htif;
     if htif.iyield & (1 << commands::YIELD_MANUAL) == 0 {
         eprintln!("warning: machine config has manual yields disabled (htif.iyield)");
diff --git a/sdk/rust-client/Cargo.toml b/sdk/rust-client/Cargo.toml
index f3fc05a5..bc879410 100644
--- a/sdk/rust-client/Cargo.toml
+++ b/sdk/rust-client/Cargo.toml
@@ -12,7 +12,7 @@ authors.workspace = true
 [dependencies]
 alloy-primitives = { workspace = true }
 sequencer-core = { path = "../../sequencer-core" }
-reqwest = { workspace = true, features = ["json"] }
+reqwest = { workspace = true, features = ["json", "query", "rustls"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
diff --git a/sdk/rust-client/src/errors.rs b/sdk/rust-client/src/errors.rs
index 67ec3c31..fc2dc5c9 100644
--- a/sdk/rust-client/src/errors.rs
+++ b/sdk/rust-client/src/errors.rs
@@ -84,6 +84,8 @@ pub enum SubscribeError {
     InvalidEndpoint(String),
     #[error("ws connect failed: {0}")]
     Connect(String),
+    #[error("ws handshake timed out")]
+    HandshakeTimeout,
 }
 
 #[derive(Debug, Error)]
diff --git a/sdk/rust-client/src/lib.rs b/sdk/rust-client/src/lib.rs
index 39552e47..1f965fc0 100644
--- a/sdk/rust-client/src/lib.rs
+++ b/sdk/rust-client/src/lib.rs
@@ -41,6 +41,8 @@ pub struct SequencerClient {
 }
 
 impl SequencerClient {
+    /// Accepts `http://` and `https://` endpoints; HTTPS verifies the server
+    /// certificate against the platform trust store.
     pub fn new(endpoint: impl Into<String>) -> Result<Self, ClientBuildError> {
         Self::new_with_timeout(endpoint, Duration::from_secs(3))
     }
@@ -50,7 +52,6 @@ impl SequencerClient {
         request_timeout: Duration,
     ) -> Result<Self, ClientBuildError> {
         let endpoint = endpoint.into();
-        // Validate URL format (must be http://)
         validate_http_url(&endpoint).map_err(ClientBuildError::InvalidEndpoint)?;
         let http_client = build_http_client(request_timeout)
             .map_err(|e| ClientBuildError::InvalidEndpoint(e.to_string()))?;
@@ -67,7 +68,8 @@ impl SequencerClient {
 
     pub fn host_port(&self) -> &str {
         self.endpoint
-            .strip_prefix("http://")
+            .strip_prefix("https://")
+            .or_else(|| self.endpoint.strip_prefix("http://"))
             .unwrap_or(&self.endpoint)
             .split('/')
             .next()
@@ -219,11 +221,16 @@ impl SequencerClient {
         })
     }
 
+    /// Bounds the handshake by the request timeout; callers own the stream.
+    /// The feed is plain `ws://`: a client built from an `https://` endpoint
+    /// cannot subscribe.
     pub async fn subscribe(&self, claim: HistoryClaim) -> Result<SubscribeStream, SubscribeError> {
         let url = self.ws_subscribe_url(claim);
-        let (stream, _response) = connect_async(url.as_str())
-            .await
-            .map_err(map_subscribe_error)?;
+        let (stream, _response) =
+            tokio::time::timeout(self.request_timeout, connect_async(url.as_str()))
+                .await
+                .map_err(|_| SubscribeError::HandshakeTimeout)?
+                .map_err(map_subscribe_error)?;
         Ok(stream)
     }
 }
@@ -250,13 +257,14 @@ fn map_reqwest_error(err: reqwest::Error) -> SubmitTxError {
 }
 
 fn validate_http_url(http_url: &str) -> Result<(), String> {
-    let stripped = http_url
-        .trim_end_matches('/')
-        .strip_prefix("http://")
-        .ok_or_else(|| "only http:// URLs are supported".to_string())?;
+    let trimmed = http_url.trim_end_matches('/');
+    let stripped = trimmed
+        .strip_prefix("https://")
+        .or_else(|| trimmed.strip_prefix("http://"))
+        .ok_or_else(|| "only http:// and https:// URLs are supported".to_string())?;
     let host = stripped.split('/').next().unwrap_or("");
     if host.is_empty() {
-        return Err("missing host in http URL".to_string());
+        return Err("missing host in endpoint URL".to_string());
     }
     Ok(())
 }
@@ -388,6 +396,94 @@ mod tests {
         server.await.unwrap();
     }
 
+    #[tokio::test]
+    async fn subscribe_handshake_keeps_the_configured_request_timeout() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let client = SequencerClient::new(format!("http://{address}"))
+            .unwrap()
+            .with_request_timeout(Duration::from_millis(100));
+        let claim = HistoryClaim {
+            version: HistoryVersion {
+                era_id: "00112233-4455-4677-8899-aabbccddeeff"
+                    .parse::<EraId>()
+                    .unwrap(),
+                recovery_generation: RecoveryGeneration::new(0),
+            },
+            next_input: ExecutedInputCount::new(0),
+        };
+        let stalled_server = async {
+            let (_stream, _) = listener.accept().await.unwrap();
+            std::future::pending::<()>().await;
+        };
+        let result = tokio::time::timeout(Duration::from_secs(2), async {
+            tokio::select! {
+                result = client.subscribe(claim) => result.map(|_| ()),
+                () = stalled_server => unreachable!(),
+            }
+        })
+        .await
+        .expect("an accepted connection with no handshake must reach the configured deadline");
+        assert!(matches!(result, Err(SubscribeError::HandshakeTimeout)));
+    }
+
+    #[test]
+    fn endpoint_accepts_http_and_https_only() {
+        for endpoint in [
+            "http://127.0.0.1:3000",
+            "https://sequencer.example",
+            "https://sequencer.example:8443/base/",
+        ] {
+            assert!(SequencerClient::new(endpoint).is_ok(), "{endpoint}");
+        }
+        for endpoint in [
+            "sequencer.example",
+            "ws://sequencer.example",
+            "wss://sequencer.example",
+            "https://",
+            "https:///tx",
+        ] {
+            assert!(
+                matches!(
+                    SequencerClient::new(endpoint),
+                    Err(ClientBuildError::InvalidEndpoint(_))
+                ),
+                "{endpoint}"
+            );
+        }
+    }
+
+    #[test]
+    fn host_port_strips_either_scheme() {
+        let https = SequencerClient::new("https://sequencer.example:8443/base").unwrap();
+        assert_eq!(https.host_port(), "sequencer.example:8443");
+        let http = SequencerClient::new("http://127.0.0.1:3000").unwrap();
+        assert_eq!(http.host_port(), "127.0.0.1:3000");
+    }
+
+    #[tokio::test]
+    async fn https_endpoint_opens_with_a_tls_client_hello() {
+        use tokio::io::AsyncReadExt;
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let client =
+            SequencerClient::new_with_timeout(format!("https://{address}"), Duration::from_secs(2))
+                .unwrap();
+        let server = async {
+            let (mut stream, _) = tokio::time::timeout(Duration::from_secs(5), listener.accept())
+                .await
+                .expect("an https request must open a connection")
+                .unwrap();
+            let mut record = [0; 3];
+            stream.read_exact(&mut record).await.unwrap();
+            record
+        };
+        let (result, record) = tokio::join!(client.get_fee(), server);
+        // A TLS handshake record starts 0x16 0x03; plaintext HTTP would send "GET".
+        assert_eq!(&record[..2], &[0x16, 0x03]);
+        assert!(matches!(result, Err(QueryError::Transport { .. })));
+    }
+
     #[test]
     fn subscription_url_carries_the_exact_resume_claim() {
         let claim = HistoryClaim {
diff --git a/sequencer-core/Cargo.toml b/sequencer-core/Cargo.toml
index d1ae1e37..aeb8f6d5 100644
--- a/sequencer-core/Cargo.toml
+++ b/sequencer-core/Cargo.toml
@@ -16,9 +16,15 @@ serde = { workspace = true }
 thiserror = { workspace = true }
 ssz = { workspace = true }
 ssz_derive = { workspace = true }
+k256 = { workspace = true, optional = true }
+
+[features]
+# Test-only signing helpers (src/test_support.rs) for other crates' tests.
+# Only test crates enable it; the guest build never does.
+test-support = ["dep:k256"]
 
 [dev-dependencies]
-# Scheduler unit tests sign EIP-712 user-ops to exercise signature recovery.
+# Tests sign EIP-712 user-ops through crate::test_support.
 k256 = { workspace = true }
 serde_json = { workspace = true }
 
diff --git a/sequencer-core/src/api.rs b/sequencer-core/src/api.rs
index 0404eb87..d40b44ad 100644
--- a/sequencer-core/src/api.rs
+++ b/sequencer-core/src/api.rs
@@ -138,12 +138,24 @@ pub struct FeeResponse {
     pub suggested_max_fee: u16,
 }
 
+/// Smallest log-space exponent `n` such that `(129/128)^n >= 3/2`: the signing
+/// slack in [`FeeResponse::quote`]. Distinct from `batch_policy.log_slack`, the
+/// 10× DA margin already in both inputs.
+const SUGGESTED_MAX_FEE_SLACK: u16 = 53;
+
 impl FeeResponse {
     pub fn quote(fee: u16, recommended_fee: u16) -> Self {
+        let suggested_max_fee = match fee
+            .max(recommended_fee)
+            .checked_add(SUGGESTED_MAX_FEE_SLACK)
+        {
+            Some(sum) if sum <= crate::fee::MAX_EXPONENT => sum,
+            _ => crate::fee::MAX_EXPONENT,
+        };
         Self {
             fee,
             recommended_fee,
-            suggested_max_fee: crate::fee::suggested_signing_max_fee(fee, recommended_fee),
+            suggested_max_fee,
         }
     }
 }
@@ -226,6 +238,29 @@ fn parse_signature(bytes: &[u8]) -> Result<Signature, TxRequestError> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::fee::{MAX_EXPONENT, fee_to_linear};
+    use alloy_primitives::U256;
+
+    #[test]
+    fn signing_slack_is_the_smallest_exponent_reaching_three_halves() {
+        assert_eq!(SUGGESTED_MAX_FEE_SLACK, 53);
+        // At this base the linear fees are about 3.3e13 units, so flooring is
+        // far below the 0.08% gap between (129/128)^52 and 3/2.
+        let base = 4000;
+        let three_halves = fee_to_linear(base) * U256::from(3u64);
+        let doubled = |exponent| fee_to_linear(exponent) * U256::from(2u64);
+        assert!(doubled(base + SUGGESTED_MAX_FEE_SLACK) >= three_halves);
+        assert!(doubled(base + SUGGESTED_MAX_FEE_SLACK - 1) < three_halves);
+    }
+
+    #[test]
+    fn quote_adds_the_slack_to_the_higher_input_and_clamps() {
+        let suggested = |fee, recommended| FeeResponse::quote(fee, recommended).suggested_max_fee;
+        assert_eq!(suggested(100, 200), 200 + SUGGESTED_MAX_FEE_SLACK);
+        assert_eq!(suggested(1000, 0), 1000 + SUGGESTED_MAX_FEE_SLACK);
+        assert_eq!(suggested(MAX_EXPONENT, 0), MAX_EXPONENT);
+        assert_eq!(suggested(MAX_EXPONENT - 1, MAX_EXPONENT - 10), MAX_EXPONENT);
+    }
 
     #[test]
     fn sender_parser_accepts_any_case_and_nothing_else() {
@@ -274,4 +309,38 @@ mod tests {
         salted.salt = Some(alloy_primitives::B256::ZERO);
         assert_eq!(DomainResponse::from_domain(&salted), None);
     }
+
+    /// What ingress recovery makes of each pinned signature variant today: the
+    /// recovered sender, or `None` when the signature is refused. The guest
+    /// side of the same table is pinned in `scheduler`.
+    #[test]
+    fn signature_variants_recover_the_pinned_ingress_sender() {
+        let vectors = crate::consensus_vectors::vectors();
+        let pinned = &vectors.signature;
+        let domain = vectors.domain(&pinned.domain);
+        for case in &pinned.variants {
+            let recovered = parse_signature(&case.signature)
+                .and_then(|signature| recover_sender(&pinned.user_op, &signature, &domain))
+                .ok();
+            assert_eq!(recovered, case.ingress, "{}", case.name);
+
+            // `POST /tx` also binds the claimed sender, so only a variant that
+            // recovers the signer is admitted under the signer's address.
+            let request = TxRequest {
+                message: pinned.user_op.clone(),
+                signature: case.signature.to_string(),
+                sender: pinned.address.to_string(),
+            };
+            let admitted = request
+                .into_signed_user_op(&domain, usize::MAX)
+                .ok()
+                .map(|signed| signed.sender);
+            assert_eq!(
+                admitted,
+                case.ingress.filter(|sender| *sender == pinned.address),
+                "{} through POST /tx",
+                case.name
+            );
+        }
+    }
 }
diff --git a/sequencer-core/src/batch.rs b/sequencer-core/src/batch.rs
index 9ab4050b..57bf0d8d 100644
--- a/sequencer-core/src/batch.rs
+++ b/sequencer-core/src/batch.rs
@@ -4,44 +4,13 @@
 use crate::user_op::UserOp;
 use ssz_derive::{Decode, Encode};
 
-// ---------------------------------------------------------------------------
-// Gas-economics-derived batch sizing
-//
-// The InputBox contract charges roughly:
-//   total_gas ≈ base_gas + delta × payload_bytes
-//
-// We charge each user-op a DA fee of (1 + α) × δ per byte, where α amortizes
-// the base cost across the batch:
-//
-//   α × δ × n = base_gas   ⟹   n = base_gas / (α × δ)
-//
-// Choosing α (the overhead fraction) determines the batch size n in bytes.
-// All parameters live in the `batch_policy` SQLite singleton table so they
-// can be hot-swapped at runtime (see 0001_schema.sql). A CHECK constraint
-// on that table ensures batch_size_target < const_max_batch_bytes.
-//
-// Fee encoding:
-//   All fees are **log-space exponents** with base 129/128 (see `crate::fee`).
-//   An exponent N represents a linear fee of `(129/128)^N` smallest-token-units.
-//   Exponent 0 = 1 unit (minimum). No sentinel.
-//
-//   The DB computes `log_recommended_fee` via pure addition of log terms:
-//     log_recommended_fee = log_gas_price + log_slack + log_one_plus_alpha
-//                         + log_delta + log_user_op_bytes
-//
-//   The L1 fee oracle feeds `log_gas_price` directly in log space after
-//   converting L1 gas (base + priority) into fee-token smallest units via a
-//   pinned Uniswap V3 WETH/X TWAP. The tenfold safety margin is
-//   `batch_policy.log_slack`, not part of the oracle quote. Fee-token
-//   identity and decimals are application/deployment config (wallet
-//   prototype: USDC), not a sequencer-core invariant. Frame `fee_price` is
-//   sampled at frame open and stays immutable for that frame's lifetime.
-// ---------------------------------------------------------------------------
+// Frame fees and batch sizing are log-space DA charges; the formula and its
+// knobs live with `batch_policy` in sequencer/src/storage/migrations/0001_schema.sql.
 
 /// Batch submissions are sent as raw `ssz(Batch)` with no tag; classification is
 /// by `msg_sender` everywhere (sender == batch-submitter address ⇒ batch, any
-/// other sender ⇒ direct input) — never by decode-attempt. See AGENTS.md
-/// "InputBox payload classification".
+/// other sender ⇒ direct input) — never by decode-attempt. See
+/// docs/protocol/scheduler-semantics.md, "The one stream, the one classification".
 
 #[derive(Debug, Clone, PartialEq, Eq, Encode, Decode)]
 pub struct Batch {
@@ -215,4 +184,27 @@ mod tests {
             }
         }
     }
+
+    // ── Pinned encoding ─────────────────────────────────────────────
+
+    /// The pinned batch has nine frames, one holding nine signed user ops, so
+    /// both lists decode through offset tables longer than eight entries. Each
+    /// container decode also pushes its fields through ssz's 8-slot `SmallVec`
+    /// builder; no wire type has more than four fields, so that never spills.
+    #[test]
+    fn ssz_spill_batch_matches_the_pinned_bytes() {
+        let vectors = crate::consensus_vectors::vectors();
+        let pinned = &vectors.ssz.spill_batch;
+        let batch = pinned.to_batch();
+        assert!(batch.frames.len() > 8);
+        assert!(batch.frames.iter().any(|frame| frame.user_ops.len() > 8));
+
+        assert_eq!(batch.as_ssz_bytes(), pinned.encoded.as_ref());
+        assert_eq!(
+            Batch::from_ssz_bytes(&pinned.encoded).expect("decode the pinned batch"),
+            batch
+        );
+        // canonical-test replays these same bytes through the guest.
+        assert_eq!(vectors.guest.payloads["spill_batch"], pinned.encoded);
+    }
 }
diff --git a/sequencer-core/src/consensus_vectors.rs b/sequencer-core/src/consensus_vectors.rs
new file mode 100644
index 00000000..cc75a98c
--- /dev/null
+++ b/sequencer-core/src/consensus_vectors.rs
@@ -0,0 +1,257 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! Byte-level consensus vectors from `tests/fixtures/consensus_vectors_v1.json`.
+//! They were pinned once, before any toolchain or dependency move, and are never
+//! regenerated: a mismatch means consensus bytes changed and is a finding.
+//! Signature, SSZ and fee cases are asserted next to the code they pin.
+
+use alloy_primitives::{Address, B256, Bytes, U64, U256, keccak256};
+use alloy_sol_types::{Eip712Domain, SolStruct};
+use serde::Deserialize;
+use std::collections::BTreeMap;
+
+use crate::batch::{Batch, Frame, WireUserOp};
+use crate::user_op::UserOp;
+
+const CONSENSUS_VECTORS: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../tests/fixtures/consensus_vectors_v1.json"
+));
+
+pub(crate) fn vectors() -> ConsensusVectors {
+    serde_json::from_str(CONSENSUS_VECTORS).expect("parse consensus_vectors_v1.json")
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct ConsensusVectors {
+    pub eip712: Eip712Vectors,
+    pub keccak256: Vec<KeccakCase>,
+    pub signature: SignatureVectors,
+    pub ssz: SszVectors,
+    pub fee: FeeVectors,
+    pub guest: GuestPayloads,
+}
+
+impl ConsensusVectors {
+    /// The pinned domain named `name`, built through the production constructor.
+    pub fn domain(&self, name: &str) -> Eip712Domain {
+        let pinned = self
+            .eip712
+            .domains
+            .iter()
+            .find(|domain| domain.name == name)
+            .unwrap_or_else(|| panic!("no pinned domain {name}"));
+        crate::build_input_domain(pinned.chain_id, pinned.verifying_contract)
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct Eip712Vectors {
+    pub domain_encode_type: String,
+    pub domain_type_hash: B256,
+    pub encode_type: String,
+    pub type_hash: B256,
+    pub domains: Vec<DomainCase>,
+    pub user_ops: Vec<UserOpCase>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct DomainCase {
+    pub name: String,
+    pub chain_id: u64,
+    pub verifying_contract: Address,
+    pub separator: B256,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct UserOpCase {
+    pub name: String,
+    pub domain: String,
+    #[serde(flatten)]
+    pub user_op: UserOp,
+    pub struct_hash: B256,
+    pub signing_hash: B256,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct KeccakCase {
+    pub name: String,
+    pub input: Bytes,
+    pub digest: B256,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct SignatureVectors {
+    pub private_key: B256,
+    pub address: Address,
+    pub domain: String,
+    pub user_op: UserOp,
+    pub signature: Bytes,
+    pub variants: Vec<SignatureCase>,
+}
+
+/// One signature variant and what each path makes of it today: the recovered
+/// sender, or `None` when the path refuses the signature.
+#[derive(Debug, Deserialize)]
+pub(crate) struct SignatureCase {
+    pub name: String,
+    pub signature: Bytes,
+    pub guest: Option<Address>,
+    pub ingress: Option<Address>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct SszVectors {
+    pub spill_batch: PinnedBatch,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct PinnedBatch {
+    pub nonce: u64,
+    pub frames: Vec<PinnedFrame>,
+    pub encoded: Bytes,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct PinnedFrame {
+    pub safe_block: u64,
+    pub fee_price: u16,
+    pub user_ops: Vec<PinnedWireUserOp>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct PinnedWireUserOp {
+    pub nonce: u32,
+    pub max_fee: u16,
+    pub data: Bytes,
+    pub signature: Bytes,
+}
+
+impl PinnedBatch {
+    pub fn to_batch(&self) -> Batch {
+        Batch {
+            nonce: self.nonce,
+            frames: self
+                .frames
+                .iter()
+                .map(|frame| Frame {
+                    user_ops: frame
+                        .user_ops
+                        .iter()
+                        .map(|op| WireUserOp {
+                            nonce: op.nonce,
+                            max_fee: op.max_fee,
+                            data: op.data.to_vec(),
+                            signature: op.signature.to_vec(),
+                        })
+                        .collect(),
+                    safe_block: frame.safe_block,
+                    fee_price: frame.fee_price,
+                })
+                .collect(),
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct FeeVectors {
+    pub max_exponent: u16,
+    /// `TABLE[i]` as its four little-endian `u64` limbs.
+    pub table: Vec<[U64; 4]>,
+    pub fee_to_linear: Vec<FeeCase>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct FeeCase {
+    pub exponent: u16,
+    /// The fixed-point accumulator before the final shift.
+    pub fixed: U256,
+    pub linear: U256,
+}
+
+/// The guest scenarios' input payloads; `canonical-test` replays them.
+#[derive(Debug, Deserialize)]
+pub(crate) struct GuestPayloads {
+    pub payloads: BTreeMap<String, Bytes>,
+}
+
+#[test]
+fn eip712_types_and_domain_separators_match_the_pinned_bytes() {
+    let vectors = vectors();
+    let pinned = &vectors.eip712;
+    assert_eq!(UserOp::eip712_encode_type(), pinned.encode_type);
+    let probe = UserOp {
+        nonce: 0,
+        max_fee: 0,
+        data: Bytes::new(),
+    };
+    assert_eq!(probe.eip712_type_hash(), pinned.type_hash);
+    assert_eq!(pinned.type_hash, keccak256(pinned.encode_type.as_bytes()));
+
+    for case in &pinned.domains {
+        let domain = vectors.domain(&case.name);
+        assert_eq!(
+            domain.encode_type(),
+            pinned.domain_encode_type,
+            "{}",
+            case.name
+        );
+        assert_eq!(domain.type_hash(), pinned.domain_type_hash, "{}", case.name);
+        assert_eq!(domain.separator(), case.separator, "{}", case.name);
+    }
+}
+
+#[test]
+fn eip712_signing_hashes_match_the_pinned_bytes() {
+    let vectors = vectors();
+    for case in &vectors.eip712.user_ops {
+        let domain = vectors.domain(&case.domain);
+        assert_eq!(
+            case.user_op.eip712_hash_struct(),
+            case.struct_hash,
+            "{}",
+            case.name
+        );
+        assert_eq!(
+            case.user_op.eip712_signing_hash(&domain),
+            case.signing_hash,
+            "{}",
+            case.name
+        );
+    }
+}
+
+/// The guest hashes through `alloy_primitives::keccak256`; the lengths straddle
+/// the 136-byte sponge rate.
+#[test]
+fn keccak256_matches_the_pinned_digests() {
+    for case in vectors().keccak256 {
+        assert_eq!(keccak256(&case.input), case.digest, "{}", case.name);
+    }
+}
+
+/// RFC 6979 makes the signature a function of key and hash, so the signing
+/// helpers reproduce the pinned bytes the variant tables start from.
+#[test]
+fn signing_reproduces_the_pinned_signature() {
+    let vectors = vectors();
+    let pinned = &vectors.signature;
+    let key = k256::ecdsa::SigningKey::from_slice(pinned.private_key.as_slice())
+        .expect("pinned private key");
+    let encoded_point = key.verifying_key().to_encoded_point(false);
+    assert_eq!(
+        Address::from_raw_public_key(&encoded_point.as_bytes()[1..]),
+        pinned.address
+    );
+
+    let domain = vectors.domain(&pinned.domain);
+    let signature = crate::test_support::sign_user_op(&key, &domain, &pinned.user_op);
+    assert_eq!(signature.as_bytes().as_slice(), pinned.signature.as_ref());
+    assert_eq!(
+        signature
+            .recover_address_from_prehash(&pinned.user_op.eip712_signing_hash(&domain))
+            .expect("recover the pinned signer"),
+        pinned.address
+    );
+}
diff --git a/sequencer-core/src/fee.rs b/sequencer-core/src/fee.rs
index 902f1ec3..79686384 100644
--- a/sequencer-core/src/fee.rs
+++ b/sequencer-core/src/fee.rs
@@ -1,19 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Log-space fee encoding with base 129/128 = 1 + 2⁻⁷.
-//!
-//! All fees in the protocol (frame `fee_price`, user-op `max_fee`, DB `recommended_fee`)
-//! are represented as **log-space exponents** with base 129/128.
-//!
-//! An exponent `n` nominally represents `(129/128)^n` smallest-token-units.
-//! [`fee_to_linear`] owns the exact integer conversion contract, including
-//! intermediate rounding and operation order. Exponent 0 is 1 unit; there is
-//! no special sentinel. The encoding uses two bytes and no floating point.
-//!
-//! `build.rs` generates the 15-entry fixed-point table and [`MAX_EXPONENT`].
-//! Independent implementations must reproduce the conversion bit-for-bit:
-//! fee differences can change validation decisions and application state.
+//! Log-space fees, base 129/128: exponent `n` nominally means `(129/128)^n`
+//! smallest token units (0 is 1 unit; no sentinel), for frame `fee_price`, user-op
+//! `max_fee` and the DB `recommended_fee`. [`fee_to_linear`] owns the exact integer
+//! conversion; ports must match it bit for bit, since fees decide validation and state.
 
 use alloy_primitives::U256;
 
@@ -24,12 +15,6 @@ mod generated {
 pub use generated::MAX_EXPONENT;
 use generated::TABLE;
 
-/// Fee base numerator.
-pub const FEE_BASE_NUM: u64 = 129;
-
-/// Fee base denominator.
-pub const FEE_BASE_DENOM: u64 = 128;
-
 /// Fractional bits used in the fixed-point precomputed table.
 const FRAC_BITS: usize = 64;
 
@@ -62,8 +47,6 @@ pub fn fee_to_linear(log_fee: u16) -> U256 {
 }
 
 /// Compute the rounded fixed-point accumulator specified by [`fee_to_linear`].
-///
-/// Used internally for higher-precision comparisons in binary search.
 fn fee_to_linear_fixed(log_fee: u16) -> U256 {
     assert!(
         log_fee <= MAX_EXPONENT,
@@ -78,166 +61,6 @@ fn fee_to_linear_fixed(log_fee: u16) -> U256 {
     result
 }
 
-/// Convert a linear fee value to the nearest log-space exponent.
-///
-/// Choose the exponent whose rounded fixed-point value is closest to `value`,
-/// breaking ties toward the smaller exponent. Values at or above
-/// `fee_to_linear(MAX_EXPONENT)` saturate to [`MAX_EXPONENT`].
-///
-/// Returns 0 for `value <= 1` (since `(129/128)^0 = 1`).
-///
-/// Uses binary search over `fee_to_linear` — 15 iterations, each doing at
-/// most 15 multiplies = 225 multiplies total. Fine for the rare inverse path.
-///
-/// Accepts [`U256`] for symmetry with [`fee_to_linear`], which returns [`U256`].
-pub fn fee_from_linear(value: U256) -> u16 {
-    if value <= U256::from(1u64) {
-        return 0;
-    }
-    // Values at or above the maximum representable fee saturate to MAX_EXPONENT.
-    // This also prevents overflow in the left-shift below (which requires the
-    // upper 64 bits of `value` to be zero).
-    if value >= fee_to_linear(MAX_EXPONENT) {
-        return MAX_EXPONENT;
-    }
-    // Compare in fixed-point for full precision.
-    let target = value << FRAC_BITS;
-    // Binary search: find smallest n where fee_to_linear_fixed(n) >= target.
-    let mut lo: u32 = 0;
-    let mut hi: u32 = MAX_EXPONENT as u32 + 1;
-    while lo < hi {
-        let mid = (lo + hi) / 2;
-        if fee_to_linear_fixed(mid as u16) < target {
-            lo = mid + 1;
-        } else {
-            hi = mid;
-        }
-    }
-    // Check whether lo or lo-1 is closer.
-    if lo == 0 {
-        return 0;
-    }
-    let above = fee_to_linear_fixed(lo as u16);
-    let below = fee_to_linear_fixed((lo - 1) as u16);
-    if target - below <= above - target {
-        (lo - 1) as u16
-    } else {
-        lo as u16
-    }
-}
-
-/// Convert a linear fee value to the smallest representable log-space fee
-/// that does not undercharge it.
-///
-/// Exact equality with [`fee_to_linear`]`(`[`MAX_EXPONENT`]`)` encodes as
-/// [`MAX_EXPONENT`]. Values **above** that maximum cannot be represented
-/// without undercharging and return [`FeeEncodeError::ExceedsRepresentableRange`].
-pub fn fee_from_linear_ceil(value: U256) -> Result<u16, FeeEncodeError> {
-    if value <= U256::from(1u64) {
-        return Ok(0);
-    }
-    let max_linear = fee_to_linear(MAX_EXPONENT);
-    if value > max_linear {
-        return Err(FeeEncodeError::ExceedsRepresentableRange {
-            max_exponent: MAX_EXPONENT,
-            max_linear,
-        });
-    }
-    if value == max_linear {
-        return Ok(MAX_EXPONENT);
-    }
-    let target = value << FRAC_BITS;
-    let mut lo: u32 = 0;
-    let mut hi: u32 = MAX_EXPONENT as u32 + 1;
-    while lo < hi {
-        let mid = (lo + hi) / 2;
-        if fee_to_linear_fixed(mid as u16) < target {
-            lo = mid + 1;
-        } else {
-            hi = mid;
-        }
-    }
-    Ok(lo as u16)
-}
-
-/// Error from [`fee_from_linear_ceil`] when the linear value lies outside the
-/// representable log-fee range.
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-pub enum FeeEncodeError {
-    #[error(
-        "linear fee exceeds fee_to_linear(MAX_EXPONENT={max_exponent})={max_linear}; \
-         cannot encode without undercharging"
-    )]
-    ExceedsRepresentableRange { max_exponent: u16, max_linear: U256 },
-}
-
-/// Compute `round(log_{129/128}(num / denom))` as a signed integer.
-///
-/// Used by `set_alpha` to convert a rational value (like α = num/denom) to a
-/// log-space exponent. Returns negative values when `num < denom`.
-///
-/// All arithmetic is integer-only (no floats).
-///
-/// # Panics
-///
-/// Panics if `num == 0` or `denom == 0`.
-pub fn log_fee_ratio(num: u64, denom: u64) -> i32 {
-    assert!(
-        num > 0 && denom > 0,
-        "log_fee_ratio requires positive values"
-    );
-    if num >= denom {
-        // log(num/denom) is non-negative. Binary search for n where
-        // fee_to_linear_fixed(n) * denom >= num * FIXED_ONE.
-        let target = U256::from(num) << FRAC_BITS;
-        let scale = U256::from(denom);
-        let mut lo: u32 = 0;
-        let mut hi: u32 = MAX_EXPONENT as u32 + 1;
-        while lo < hi {
-            let mid = (lo + hi) / 2;
-            if fee_to_linear_fixed(mid as u16) * scale < target {
-                lo = mid + 1;
-            } else {
-                hi = mid;
-            }
-        }
-        // Pick whichever of lo-1 or lo is closer.
-        if lo == 0 {
-            return 0;
-        }
-        let above = fee_to_linear_fixed(lo as u16) * scale;
-        let below = fee_to_linear_fixed((lo - 1) as u16) * scale;
-        if target - below <= above - target {
-            (lo - 1) as i32
-        } else {
-            lo as i32
-        }
-    } else {
-        // num < denom: log(num/denom) = -log(denom/num).
-        -log_fee_ratio(denom, num)
-    }
-}
-
-/// Smallest log-space exponent `n` such that `(129/128)^n >= 3/2`.
-///
-/// Signing slack for [`suggested_signing_max_fee`]: wallets may over-estimate
-/// `max_fee` because the user pays the frame fee, not the signed cap. 1.5×
-/// sits on top of `max(open-frame fee, recommended_fee)` so a quote can
-/// survive a frame rotation. Distinct from `batch_policy.log_slack` (the 10×
-/// DA margin already baked into both inputs).
-pub const SUGGESTED_MAX_FEE_SLACK: u16 = 53;
-
-/// Suggested user-op `max_fee`: `max(frame_fee, recommended_fee)` plus
-/// [`SUGGESTED_MAX_FEE_SLACK`] (1.5× in log space), clamped to
-/// [`MAX_EXPONENT`].
-pub fn suggested_signing_max_fee(frame_fee: u16, recommended_fee: u16) -> u16 {
-    let base = frame_fee.max(recommended_fee);
-    match base.checked_add(SUGGESTED_MAX_FEE_SLACK) {
-        Some(sum) if sum <= MAX_EXPONENT => sum,
-        _ => MAX_EXPONENT,
-    }
-}
-
 /// Fixed-point multiplication: `(a * b) >> FRAC_BITS`.
 ///
 /// Uses a 512-bit intermediate to avoid overflow.
@@ -285,86 +108,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn round_trip() {
-        for original in [1u64, 10, 100, 1_000, 1_000_000, 1_000_000_000] {
-            let original_u256 = U256::from(original);
-            let exp = fee_from_linear(original_u256);
-            let recovered = fee_to_linear(exp);
-            // Within ~1% of original (0.78% per step, rounding can add half a step).
-            let lo = original_u256 * U256::from(99u64) / U256::from(100u64);
-            let hi = original_u256 * U256::from(101u64) / U256::from(100u64);
-            assert!(
-                recovered >= lo && recovered <= hi,
-                "round-trip failed for {original}: exp={exp}, recovered={recovered}"
-            );
-        }
-    }
-
-    #[test]
-    fn log_fee_ratio_positive() {
-        // log_{129/128}(26) ≈ 419
-        let v = log_fee_ratio(26, 1);
-        assert!((417..=421).contains(&v), "log(26) = {v}, expected ~419");
-
-        // log_{129/128}(1.168) = log_{129/128}(1168/1000) ≈ 20
-        let v = log_fee_ratio(1168, 1000);
-        assert!((19..=21).contains(&v), "log(1.168) = {v}, expected ~20");
-    }
-
-    #[test]
-    fn log_fee_ratio_negative() {
-        // log_{129/128}(0.168) = log_{129/128}(168/1000) ≈ -229
-        let v = log_fee_ratio(168, 1000);
-        assert!(
-            (-231..=-227).contains(&v),
-            "log(0.168) = {v}, expected ~-229"
-        );
-    }
-
-    #[test]
-    fn log_fee_ratio_one() {
-        assert_eq!(log_fee_ratio(1, 1), 0);
-        assert_eq!(log_fee_ratio(1000, 1000), 0);
-    }
-
-    #[test]
-    fn tenfold_slack_exponent_is_pinned() {
-        assert_eq!(log_fee_ratio(10, 1), 296);
-    }
-
-    #[test]
-    fn suggested_max_fee_slack_is_ceil_three_halves() {
-        assert_eq!(SUGGESTED_MAX_FEE_SLACK, 53);
-        // Nearest-rounding log(1.5) undercharges; the signing slack is ceil.
-        assert!(log_fee_ratio(3, 2) < i32::from(SUGGESTED_MAX_FEE_SLACK));
-        let base = 1000_u16;
-        let suggested = suggested_signing_max_fee(base, 0);
-        assert_eq!(suggested, base + SUGGESTED_MAX_FEE_SLACK);
-        assert!(
-            fee_to_linear(suggested) * U256::from(2u64) >= fee_to_linear(base) * U256::from(3u64)
-        );
-    }
-
-    #[test]
-    fn suggested_signing_max_fee_uses_the_higher_input_and_clamps() {
-        assert_eq!(
-            suggested_signing_max_fee(100, 200),
-            200 + SUGGESTED_MAX_FEE_SLACK
-        );
-        assert_eq!(suggested_signing_max_fee(MAX_EXPONENT, 0), MAX_EXPONENT);
-        assert_eq!(
-            suggested_signing_max_fee(MAX_EXPONENT - 1, MAX_EXPONENT - 10),
-            MAX_EXPONENT
-        );
-    }
-
-    #[test]
-    fn fee_from_linear_zero_and_one() {
-        assert_eq!(fee_from_linear(U256::ZERO), 0);
-        assert_eq!(fee_from_linear(U256::from(1u64)), 0);
-    }
-
     #[test]
     fn fee_to_linear_at_max_exponent() {
         // Should not panic and should return a large value.
@@ -378,52 +121,34 @@ mod tests {
         fee_to_linear(MAX_EXPONENT + 1);
     }
 
-    #[test]
-    fn fee_from_linear_saturates_to_max_exponent() {
-        assert_eq!(fee_from_linear(U256::MAX), MAX_EXPONENT);
-        // A value well above the max representable fee should also saturate.
-        let huge = fee_to_linear(MAX_EXPONENT) + U256::from(1u64);
-        assert_eq!(fee_from_linear(huge), MAX_EXPONENT);
-    }
-
-    #[test]
-    fn fee_from_linear_ceil_never_undercharges() {
-        for value in [
-            U256::ZERO,
-            U256::from(1u64),
-            U256::from(2u64),
-            U256::from(123_456u64),
-        ] {
-            let encoded = fee_from_linear_ceil(value).unwrap();
-            assert!(encoded == MAX_EXPONENT || fee_to_linear(encoded) >= value);
-            assert!(encoded == 0 || fee_to_linear(encoded - 1) < value);
+    /// `build.rs` regenerates the table on every build, and the host and the
+    /// guest each build their own; this pins it against the bytes generated
+    /// before any ruint or toolchain move.
+    #[test]
+    fn generated_table_and_conversions_match_the_pinned_values() {
+        let pinned = crate::consensus_vectors::vectors().fee;
+        assert_eq!(MAX_EXPONENT, pinned.max_exponent);
+        let limbs: Vec<[u64; 4]> = TABLE.iter().map(|entry| *entry.as_limbs()).collect();
+        let pinned_limbs: Vec<[u64; 4]> = pinned
+            .table
+            .iter()
+            .map(|entry| entry.map(|limb| limb.to::<u64>()))
+            .collect();
+        assert_eq!(limbs, pinned_limbs);
+
+        for case in &pinned.fee_to_linear {
+            assert_eq!(
+                fee_to_linear_fixed(case.exponent),
+                case.fixed,
+                "exponent {}",
+                case.exponent
+            );
+            assert_eq!(
+                fee_to_linear(case.exponent),
+                case.linear,
+                "exponent {}",
+                case.exponent
+            );
         }
-        assert_eq!(
-            fee_from_linear_ceil(fee_to_linear(MAX_EXPONENT)).unwrap(),
-            MAX_EXPONENT
-        );
-    }
-
-    #[test]
-    fn fee_from_linear_ceil_rejects_unrepresentable_values() {
-        let huge = fee_to_linear(MAX_EXPONENT) + U256::from(1u64);
-        assert!(matches!(
-            fee_from_linear_ceil(huge),
-            Err(FeeEncodeError::ExceedsRepresentableRange { .. })
-        ));
-        assert!(matches!(
-            fee_from_linear_ceil(U256::MAX),
-            Err(FeeEncodeError::ExceedsRepresentableRange { .. })
-        ));
-    }
-
-    #[test]
-    fn log_fee_ratio_large_ratio() {
-        // log_{129/128}(2^64 - 1) ≈ 5700
-        let v = log_fee_ratio(u64::MAX, 1);
-        assert!(
-            (5690..=5710).contains(&v),
-            "log(u64::MAX) = {v}, expected ~5700"
-        );
     }
 }
diff --git a/sequencer-core/src/lib.rs b/sequencer-core/src/lib.rs
index d8ab1f3c..b9a1ea7f 100644
--- a/sequencer-core/src/lib.rs
+++ b/sequencer-core/src/lib.rs
@@ -8,12 +8,16 @@ pub mod api;
 pub mod application;
 pub mod batch;
 pub mod broadcast;
+#[cfg(test)]
+mod consensus_vectors;
 pub mod fee;
 pub mod history;
 pub mod history_api;
 pub mod l2_tx;
 pub mod protocol;
 pub mod scheduler;
+#[cfg(any(test, feature = "test-support"))]
+pub mod test_support;
 pub mod user_op;
 
 /// Maximum number of L1 blocks a batch can wait before the scheduler considers it stale.
diff --git a/sequencer-core/src/protocol.rs b/sequencer-core/src/protocol.rs
index 549c4ef6..a80b2736 100644
--- a/sequencer-core/src/protocol.rs
+++ b/sequencer-core/src/protocol.rs
@@ -1,27 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Protocol timing parameters the sequencer mirrors from the scheduler, plus
-//! the sequencer-side tuning knobs that govern preemptive self-protection.
-//!
-//! [`ProtocolTiming`] is the single source of truth for time-based protocol
-//! rules:
-//!
-//! - **Scheduler-acceptance** timing (`is_scheduler_stale`, `scheduler_accepts`).
-//!   `max_wait_blocks` matches the on-chain scheduler exactly — mis-aligning
-//!   it would cause the sequencer's cached "gold frontier" to diverge from
-//!   the scheduler's actual accepted set.
-//! - **Preemptive-recovery** tuning (`danger_threshold`,
-//!   `l1_read_stale_after_blocks`, `seconds_per_block`). These do not exist
-//!   on the scheduler side; they control when the sequencer proactively
-//!   stops to avoid issuing soft confirmations against stale or unknowable
-//!   L1 state.
-//!
-//! The batch-submitter address is **not** part of `ProtocolTiming`. It's an
-//! identity, not a timing parameter; the validation in
-//! [`ProtocolTiming::try_new`] only relates timing fields to each other.
-//! Predicates that need the address (`scheduler_accepts`) take it as a
-//! parameter — see those methods.
+//! Protocol timing: the scheduler's staleness rule and its off-chain acceptance
+//! predicate, which must agree with the canonical fold (I1), plus sequencer-only
+//! knobs for when the sequencer stops issuing soft confirmations against stale
+//! or unknowable L1 state.
 
 use crate::batch::Batch;
 use alloy_primitives::Address;
@@ -30,10 +13,8 @@ use thiserror::Error;
 /// Error surfaced by [`ProtocolTiming::try_new`] when timing fields would
 /// produce an unusable danger threshold.
 ///
-/// Returning a typed error rather than panicking lets the runtime convert this
-/// into a `Result` at config-parse time and surface it through the structured
-/// `RunError` taxonomy, instead of crashing later inside
-/// [`ProtocolTiming::danger_threshold`] (or worse, inside a logging macro).
+/// Returning a typed error lets the runtime surface the misconfiguration at
+/// config-parse time through the structured `RunError` taxonomy.
 #[derive(Debug, Error, PartialEq, Eq)]
 pub enum ProtocolTimingError {
     /// `preemptive_margin_blocks == 0` — zero-width preemptive zone defeats
@@ -100,26 +81,25 @@ pub struct WallClockRegression {
 /// plus sequencer-side preemptive-recovery tuning. No identity (the
 /// batch-submitter address is passed separately to predicates that need it).
 ///
-/// Construct via [`ProtocolTiming::try_new`] in production code so the
-/// margin/stale relationships are checked once up front. The fields stay
-/// public to keep test fixtures concise — direct struct-literal construction
-/// is fine where the inputs are controlled.
+/// Construct via [`ProtocolTiming::try_new`]: it checks the margin/stale
+/// relationships once, and the private fields keep every value valid
+/// afterwards.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct ProtocolTiming {
     /// `MAX_WAIT_BLOCKS` — after this many L1 blocks, the scheduler skips a
     /// submitted batch as stale.
-    pub max_wait_blocks: u64,
+    max_wait_blocks: u64,
     /// How many blocks before `max_wait_blocks` the sequencer triggers
     /// preemptive recovery. Sequencer-local; must be strictly less than
     /// `max_wait_blocks` (enforced by [`ProtocolTiming::try_new`]).
-    pub preemptive_margin_blocks: u64,
+    preemptive_margin_blocks: u64,
     /// How long the L1 safe block itself may be stale, measured in assumed L1
     /// blocks. Sequencer-local; startup refuses once the safe block timestamp
     /// is older than this threshold.
-    pub l1_read_stale_after_blocks: u64,
+    l1_read_stale_after_blocks: u64,
     /// Wall-clock estimate of L1 block time, used as a fallback when the L1
     /// safe head appears frozen. Sequencer-local.
-    pub seconds_per_block: u64,
+    seconds_per_block: u64,
 }
 
 impl ProtocolTiming {
@@ -136,10 +116,6 @@ impl ProtocolTiming {
 
     /// Validated constructor. Rejects timing configurations that would
     /// produce an unusable danger threshold or a degenerate margin.
-    ///
-    /// Production callers should use this; tests can still construct
-    /// `ProtocolTiming` directly via struct-literal syntax with controlled
-    /// inputs.
     pub fn try_new(
         max_wait_blocks: u64,
         preemptive_margin_blocks: u64,
@@ -182,34 +158,36 @@ impl ProtocolTiming {
         })
     }
 
+    /// The scheduler staleness window ([`crate::MAX_WAIT_BLOCKS`] in
+    /// production).
+    pub const fn max_wait_blocks(&self) -> u64 {
+        self.max_wait_blocks
+    }
+
+    /// Blocks before [`Self::max_wait_blocks`] at which preemptive recovery
+    /// triggers.
+    pub const fn preemptive_margin_blocks(&self) -> u64 {
+        self.preemptive_margin_blocks
+    }
+
+    /// How many assumed L1 blocks the safe block itself may be stale.
+    pub const fn l1_read_stale_after_blocks(&self) -> u64 {
+        self.l1_read_stale_after_blocks
+    }
+
+    /// Wall-clock estimate of L1 block time, in seconds.
+    pub const fn seconds_per_block(&self) -> u64 {
+        self.seconds_per_block
+    }
+
     /// The block-age threshold at which preemptive recovery triggers.
-    ///
-    /// Production code goes through [`ProtocolTiming::try_new`], which rejects
-    /// an invalid margin up front. A directly-constructed invalid value is a
-    /// test/programming bug and fails loud here.
     pub fn danger_threshold(&self) -> u64 {
-        assert!(
-            self.preemptive_margin_blocks > 0,
-            "ProtocolTiming must be constructed with a nonzero preemptive margin"
-        );
-        assert!(
-            self.preemptive_margin_blocks < self.max_wait_blocks,
-            "ProtocolTiming must be constructed with margin < max_wait_blocks"
-        );
         self.max_wait_blocks - self.preemptive_margin_blocks
     }
 
     /// Wall-clock age, in seconds, after which the L1 safe block is too old
     /// for the sequencer to trust its L1 view.
     pub fn l1_read_stale_after_secs(&self) -> u64 {
-        assert!(
-            self.l1_read_stale_after_blocks > 0,
-            "ProtocolTiming must be constructed with a nonzero L1 read-staleness window"
-        );
-        assert!(
-            self.seconds_per_block > 0,
-            "ProtocolTiming must be constructed with nonzero seconds_per_block"
-        );
         self.l1_read_stale_after_blocks
             .checked_mul(self.seconds_per_block)
             .expect("validated L1 read-staleness window must fit in u64 seconds")
@@ -219,10 +197,6 @@ impl ProtocolTiming {
     /// continued soft confirmations. `None` means the view is unknown and is
     /// treated as unusable.
     pub fn l1_view_is_stale(&self, safe_block_timestamp_secs: Option<u64>, now_ms: u64) -> bool {
-        assert!(
-            self.seconds_per_block > 0,
-            "ProtocolTiming must be constructed with nonzero seconds_per_block"
-        );
         let Some(timestamp_secs) = safe_block_timestamp_secs else {
             return true;
         };
@@ -250,10 +224,6 @@ impl ProtocolTiming {
         safe_block_timestamp_secs: Option<u64>,
         now_ms: u64,
     ) -> bool {
-        assert!(
-            self.seconds_per_block > 0,
-            "ProtocolTiming must be constructed with nonzero seconds_per_block"
-        );
         let Some(timestamp_secs) = safe_block_timestamp_secs else {
             return false;
         };
@@ -295,10 +265,6 @@ impl ProtocolTiming {
         last_safe_progress_ms: Option<u64>,
         now_ms: u64,
     ) -> Result<Option<u64>, WallClockRegression> {
-        assert!(
-            self.seconds_per_block > 0,
-            "ProtocolTiming must be constructed with nonzero seconds_per_block"
-        );
         let Some(last) = last_safe_progress_ms else {
             return Ok(None);
         };
@@ -324,9 +290,9 @@ impl ProtocolTiming {
     }
 
     /// Scheduler's staleness predicate: a batch is stale when
-    /// `inclusion_block - first_frame_safe_block >= max_wait_blocks`. Used by
-    /// the scheduler to skip stale submissions, and by the sequencer's
-    /// frontier simulator to match that behavior.
+    /// `inclusion_block - first_frame_safe_block >= max_wait_blocks`.
+    /// Off-chain mirror of the scheduler's gate e (both call [`age_exceeds`]);
+    /// used by [`Self::scheduler_accepts`].
     pub fn is_scheduler_stale(&self, inclusion_block: u64, first_frame_safe_block: u64) -> bool {
         age_exceeds(
             inclusion_block,
@@ -341,11 +307,6 @@ impl ProtocolTiming {
     /// at the given `expected_nonce`. The caller threads `expected_nonce`
     /// across a stream of inputs, advancing by one on each `Some`.
     ///
-    /// `batch_submitter` is the address the scheduler accepts batches from —
-    /// kept as a parameter (rather than a struct field) because it's
-    /// orthogonal to timing and the validation in [`Self::try_new`] doesn't
-    /// touch it.
-    ///
     /// Rejection paths (wrong sender, SSZ decode failure, stale by inclusion,
     /// nonce mismatch) return `None` without advancing — matching what the
     /// scheduler does on-chain.
@@ -388,50 +349,12 @@ impl ProtocolTiming {
     }
 }
 
-/// Generic "age exceeds threshold" predicate shared between scheduler-staleness
-/// and the preemptive danger-zone check. Saturating subtraction keeps the
-/// arithmetic total over pathological inputs (safe head below a batch's first
-/// frame).
-pub fn age_exceeds(reference_block: u64, first_frame_safe_block: u64, threshold: u64) -> bool {
-    reference_block.saturating_sub(first_frame_safe_block) >= threshold
-}
-
-/// Advance `expected` by greedily consuming any matching observed nonce.
-///
-/// `observed_nonces` is the stream of **batch nonces** (from the SSZ payload)
-/// decoded from `InputAdded` events sent by our batch-submitter EOA, in L1
-/// event order. Because L1 mines txs from a single EOA in strict wallet-nonce
-/// order, this stream is naturally gap-less at the wallet-nonce level:
-/// tx[k]'s event cannot appear on-chain without tx[k-1]'s event, and the
-/// observed batch nonce sequence therefore mirrors our submission order.
-///
-/// Batch nonces themselves (unlike wallet nonces) CAN repeat across recovery
-/// generations — e.g., after a cascade, a fresh batch reuses its invalidated
-/// predecessor's nonce. That's why we still match on equality rather than
-/// trusting a sort: in a post-recovery window, the same batch nonce can be
-/// observed twice (once from the invalidated generation, once from the new
-/// one), and we only want to advance once.
-///
-/// Under the wallet-nonce ordering above, once the next `expected` doesn't
-/// appear in the stream the frontier naturally stops advancing — the gap
-/// means the scheduler hasn't seen that nonce on-chain yet (or observed it at
-/// a different wallet nonce from an earlier generation).
-///
-/// Co-located here next to [`ProtocolTiming::scheduler_accepts`] so all
-/// scheduler-mirroring acceptance logic lives at the library seam (the
-/// off-chain mirror of the canonical scheduler's batch-nonce fold).
-pub fn advance_expected_batch_nonce(
-    mut expected: u64,
-    observed_nonces: impl IntoIterator<Item = u64>,
-) -> u64 {
-    for nonce in observed_nonces {
-        if nonce == expected {
-            expected = expected
-                .checked_add(1)
-                .expect("expected batch nonce overflow: contract-impossible");
-        }
-    }
-    expected
+/// The one staleness formula, `now - start >= window`. Saturating keeps the
+/// consensus path total when `start` is ahead of `now`. Callers: the
+/// scheduler's gate e and overdue-direct backstop, the off-chain
+/// [`ProtocolTiming::is_scheduler_stale`], and the danger check.
+pub fn age_exceeds(now: u64, start: u64, window: u64) -> bool {
+    now.saturating_sub(start) >= window
 }
 
 /// Borrowed view of one safe-input row, in the shape scheduler_accepts needs.
@@ -460,15 +383,10 @@ mod tests {
 
     const SUBMITTER: Address = Address::repeat_byte(0xAA);
     const OTHER: Address = Address::repeat_byte(0xBB);
-    const MAX_WAIT: u64 = 1200;
+    const MAX_WAIT: u64 = crate::MAX_WAIT_BLOCKS;
 
     fn timing() -> ProtocolTiming {
-        ProtocolTiming {
-            max_wait_blocks: MAX_WAIT,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        }
+        ProtocolTiming::try_new(MAX_WAIT, 75, 900, 12).expect("valid test timing")
     }
 
     fn encode(batch: &Batch) -> Vec<u8> {
@@ -541,26 +459,6 @@ mod tests {
         assert!(cfg.clock_cannot_age_l1_view(Some(1_012), 1_000_000));
     }
 
-    #[test]
-    #[should_panic(expected = "nonzero seconds_per_block")]
-    fn l1_view_is_stale_fails_loud_on_zero_block_time_direct_construction() {
-        let cfg = ProtocolTiming {
-            seconds_per_block: 0,
-            ..timing()
-        };
-        let _ = cfg.l1_view_is_stale(Some(1_001), 1_000_000);
-    }
-
-    #[test]
-    #[should_panic(expected = "nonzero seconds_per_block")]
-    fn clock_cannot_age_l1_view_fails_loud_on_zero_block_time_direct_construction() {
-        let cfg = ProtocolTiming {
-            seconds_per_block: 0,
-            ..timing()
-        };
-        let _ = cfg.clock_cannot_age_l1_view(Some(1_001), 1_000_000);
-    }
-
     #[test]
     fn wall_clock_adjusted_threshold_returns_none_without_baseline() {
         assert_eq!(
@@ -635,38 +533,6 @@ mod tests {
         );
     }
 
-    #[test]
-    #[should_panic(expected = "ProtocolTiming must be constructed with margin < max_wait_blocks")]
-    fn danger_threshold_fails_loud_on_invalid_direct_construction() {
-        // Production uses try_new. A direct invalid struct literal is a
-        // programming error and must not be normalized into threshold zero.
-        let cfg = ProtocolTiming {
-            preemptive_margin_blocks: MAX_WAIT,
-            ..timing()
-        };
-        let _ = cfg.danger_threshold();
-    }
-
-    #[test]
-    #[should_panic(expected = "nonzero preemptive margin")]
-    fn danger_threshold_fails_loud_on_zero_margin_direct_construction() {
-        let cfg = ProtocolTiming {
-            preemptive_margin_blocks: 0,
-            ..timing()
-        };
-        let _ = cfg.danger_threshold();
-    }
-
-    #[test]
-    #[should_panic(expected = "nonzero seconds_per_block")]
-    fn wall_clock_helpers_fail_loud_on_zero_block_time_direct_construction() {
-        let cfg = ProtocolTiming {
-            seconds_per_block: 0,
-            ..timing()
-        };
-        let _ = cfg.wall_clock_adjusted_danger_threshold(None, 0);
-    }
-
     #[test]
     fn try_new_rejects_margin_equal_to_max_wait() {
         assert_eq!(
@@ -891,26 +757,4 @@ mod tests {
         };
         assert!(timing().scheduler_accepts(SUBMITTER, input, 0).is_some());
     }
-
-    #[test]
-    fn advance_expected_batch_nonce_matches_scheduler_nonce_rule() {
-        use super::advance_expected_batch_nonce;
-        assert_eq!(advance_expected_batch_nonce(0, Vec::<u64>::new()), 0);
-        assert_eq!(advance_expected_batch_nonce(0, vec![0, 1, 2]), 3);
-        assert_eq!(advance_expected_batch_nonce(0, vec![0, 2, 3]), 1);
-        assert_eq!(advance_expected_batch_nonce(0, vec![1, 2, 3]), 0);
-        assert_eq!(advance_expected_batch_nonce(0, vec![0, 1, 1, 2]), 3);
-        assert_eq!(
-            advance_expected_batch_nonce(0, vec![6, 4, 3, 2, 2, 0, 1]),
-            2
-        );
-        assert_eq!(advance_expected_batch_nonce(0, vec![0, 2, 1]), 2);
-        assert_eq!(advance_expected_batch_nonce(2, vec![2, 3]), 4);
-    }
-
-    #[test]
-    #[should_panic(expected = "expected batch nonce overflow: contract-impossible")]
-    fn advance_expected_batch_nonce_fails_loud_on_overflow() {
-        let _ = advance_expected_batch_nonce(u64::MAX, [u64::MAX]);
-    }
 }
diff --git a/sequencer-core/src/scheduler/fold.rs b/sequencer-core/src/scheduler/fold.rs
index 0448a502..5ae7f820 100644
--- a/sequencer-core/src/scheduler/fold.rs
+++ b/sequencer-core/src/scheduler/fold.rs
@@ -91,7 +91,12 @@ where
             last_seed_block.is_none_or(|prev| seed.inclusion_block >= prev),
             "fold seeds must arrive in ascending inclusion-block order"
         );
-        // SC-3: seeds are reconstructed `(A, B]` *directs* — enqueue_direct skips
+        assert!(
+            seed.inclusion_block <= stop_block,
+            "fold seed at block {} is above stop block {stop_block}",
+            seed.inclusion_block,
+        );
+        // Seeds are reconstructed `(A, B]` *directs* — enqueue_direct skips
         // sender classification, so a mis-sourced `sender == sequencer_address`
         // row would be silently filed as a direct instead of a batch (a wrong
         // S'). Fail loud, matching the ordering/range asserts above.
@@ -123,6 +128,13 @@ where
             last_replay_block.is_none_or(|prev| input.inclusion_block >= prev),
             "fold replay inputs must arrive in ascending inclusion-block order"
         );
+        // A batch above C would execute without leaving anything in the fridge
+        // for the post-drain check below to catch.
+        assert!(
+            input.inclusion_block <= stop_block,
+            "fold replay input at block {} is above stop block {stop_block}",
+            input.inclusion_block,
+        );
         last_replay_block = Some(input.inclusion_block);
         scheduler.process_input(SchedulerInput {
             sender: input.sender,
@@ -137,10 +149,8 @@ where
     // starts past C with no fridge, would otherwise never see them.
     scheduler.drain_covered_at(stop_block)?;
 
-    // Fail loud on a dropped direct: after draining at C the fridge MUST be
-    // empty. A non-empty fridge means an input arrived with `inclusion_block > C`
-    // (seed or replay) — outside the fold's range — which `finish` would
-    // otherwise discard silently, yielding a wrong `S'`.
+    // Backstop for the range asserts above: after draining at C the fridge
+    // must be empty, or `finish` would discard a direct silently.
     assert_eq!(
         scheduler.queued_direct_len(),
         0,
@@ -173,7 +183,7 @@ mod tests {
     }
 
     fn domain() -> Eip712Domain {
-        super::super::input_domain(1, Address::ZERO)
+        crate::build_input_domain(1, Address::ZERO)
     }
 
     /// Minimal `Application` double for the engine tests: records the markers of
@@ -429,11 +439,11 @@ mod tests {
     // --- fail-loud contract guards (always-on, not debug-only) ---
 
     #[test]
-    #[should_panic(expected = "undrained at stop block")]
+    #[should_panic(expected = "is above stop block")]
     fn replay_input_past_stop_block_panics_instead_of_silently_dropping() {
-        // A direct at block 50 with C = 30: never covered, never overdue, so it
-        // lingers in the fridge after step 5. The booting run would never see it,
-        // so a silent drop would diverge `S'` — the guard must catch it.
+        // A direct at block 50 with C = 30 would never be drained by step 5, and
+        // the booting run would never see it. The range assert rejects it before
+        // it reaches the fridge.
         let replay = vec![direct(DIRECT_SENDER, 50, 0xDD)];
         let _ = fold_replay(
             FoldApp::default(),
@@ -446,6 +456,37 @@ mod tests {
         );
     }
 
+    #[test]
+    #[should_panic(expected = "fold replay input at block 50 is above stop block 30")]
+    fn replay_batch_past_stop_block_panics() {
+        // A batch leaves nothing in the fridge, so only the range assert sees it.
+        let replay = vec![empty_batch(50, 0)];
+        let _ = fold_replay(
+            FoldApp::default(),
+            0,
+            config(),
+            domain(),
+            Vec::new(),
+            replay,
+            30,
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "fold seed at block 50 is above stop block 30")]
+    fn seed_past_stop_block_panics() {
+        let seeds = vec![direct(DIRECT_SENDER, 50, 0x01)];
+        let _ = fold_replay(
+            FoldApp::default(),
+            0,
+            config(),
+            domain(),
+            seeds,
+            Vec::new(),
+            30,
+        );
+    }
+
     #[test]
     #[should_panic(expected = "seeds must arrive in ascending")]
     fn out_of_order_seeds_panic() {
@@ -551,7 +592,7 @@ mod tests {
             canonical
                 .direct_q
                 .iter()
-                .all(|input| input.inclusion_block > a),
+                .all(|input| input.block_number > a),
             "the earlier checkpoint is eligible, with a nonempty seed queue"
         );
         assert_eq!(canonical.queued_direct_len(), 1);
@@ -572,7 +613,7 @@ mod tests {
         assert_eq!(canonical.app.executed_directs, vec![1, 2, 3]);
         assert_eq!(canonical.queued_direct_len(), 1);
         assert_eq!(canonical.direct_q[0].payload, vec![4]);
-        assert_eq!(canonical.direct_q[0].inclusion_block, later_a);
+        assert_eq!(canonical.direct_q[0].block_number, later_a);
         // Its pending direct is excluded by (A,B], so the exporter must refuse
         // this later checkpoint. Recovery can use the eligible earlier one.
 
diff --git a/sequencer-core/src/scheduler/mod.rs b/sequencer-core/src/scheduler/mod.rs
index 0caa18bb..75265dca 100644
--- a/sequencer-core/src/scheduler/mod.rs
+++ b/sequencer-core/src/scheduler/mod.rs
@@ -9,13 +9,12 @@ use crate::application::{AppError, AppOutputs, Application, CanonicalState, Exec
 use crate::batch::{Batch, Frame, WireUserOp};
 use crate::history::ExecutedInputCount;
 use crate::l2_tx::DirectInput;
+use crate::protocol::age_exceeds;
 use alloy_primitives::{Address, Signature};
 use alloy_sol_types::Eip712Domain;
 use alloy_sol_types::SolStruct;
 use std::collections::VecDeque;
 
-pub const MAX_WAIT_BLOCKS: u64 = crate::MAX_WAIT_BLOCKS;
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SchedulerConfig {
     /// L1 address whose inputs are trusted as sequencer batches; every other
@@ -28,12 +27,12 @@ pub struct SchedulerConfig {
 
 impl SchedulerConfig {
     /// Production config for `sequencer_address`, pinning the staleness window
-    /// to the protocol's [`MAX_WAIT_BLOCKS`]. Tests that need a custom window
-    /// construct the struct directly.
+    /// to the protocol's [`crate::MAX_WAIT_BLOCKS`]. Tests that need a custom
+    /// window construct the struct directly.
     pub const fn new(sequencer_address: Address) -> Self {
         Self {
             sequencer_address,
-            max_wait_blocks: MAX_WAIT_BLOCKS,
+            max_wait_blocks: crate::MAX_WAIT_BLOCKS,
         }
     }
 }
@@ -70,23 +69,6 @@ impl ProcessResult {
     }
 }
 
-// Test-assertion sugar only: asymmetric cross-type equality in a public
-// consensus API makes `a == b` type-directed and non-obvious, so it stays out
-// of the production surface.
-#[cfg(test)]
-impl PartialEq<ProcessOutcome> for ProcessResult {
-    fn eq(&self, other: &ProcessOutcome) -> bool {
-        self.outcome == *other
-    }
-}
-
-#[cfg(test)]
-impl PartialEq<ProcessResult> for ProcessOutcome {
-    fn eq(&self, other: &ProcessResult) -> bool {
-        *self == other.outcome
-    }
-}
-
 /// Inspect query accepted by the scheduler's state export endpoint.
 pub const STATE_INSPECT_QUERY: &[u8] = b"state";
 
@@ -108,17 +90,10 @@ pub enum BatchRejectReason {
 pub struct Scheduler<A: Application> {
     app: A,
     config: SchedulerConfig,
-    direct_q: VecDeque<QueuedDirectInput>,
+    direct_q: VecDeque<DirectInput>,
     next_expected_batch_nonce: u64,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct QueuedDirectInput {
-    sender: Address,
-    payload: Vec<u8>,
-    inclusion_block: u64,
-}
-
 impl<A: Application> Scheduler<A> {
     /// Construct a scheduler that begins expecting batch nonce
     /// `next_expected_batch_nonce`. The genesis scheduler starts at 0
@@ -164,10 +139,10 @@ impl<A: Application> Scheduler<A> {
     /// replaying `(B, C]`. Callers MUST enqueue in ascending
     /// L1 order (`inclusion_block`) so the FIFO drain matches the on-chain order.
     pub fn enqueue_direct(&mut self, sender: Address, inclusion_block: u64, payload: Vec<u8>) {
-        self.direct_q.push_back(QueuedDirectInput {
+        self.direct_q.push_back(DirectInput {
             sender,
+            block_number: inclusion_block,
             payload,
-            inclusion_block,
         });
     }
 
@@ -191,8 +166,8 @@ impl<A: Application> Scheduler<A> {
     }
 
     /// Watchdog / CM `inspect_state` hook: the app's canonical snapshot bytes
-    /// for the `/finalized_state` byte-compare. `pub` (not `pub(super)`) because
-    /// the canonical-app harness is now a separate crate over this library.
+    /// for the `/finalized_state` byte-compare. `pub` because the canonical-app
+    /// harness is a separate crate.
     pub fn inspect_state(&self, query: &[u8]) -> Result<Vec<u8>, InspectError>
     where
         A: CanonicalState,
@@ -212,10 +187,10 @@ impl<A: Application> Scheduler<A> {
         self.force_execute_overdue(input.inclusion_block, &mut outputs)?;
 
         if input.sender != self.config.sequencer_address {
-            self.direct_q.push_back(QueuedDirectInput {
+            self.direct_q.push_back(DirectInput {
                 sender: input.sender,
+                block_number: input.inclusion_block,
                 payload: input.payload,
-                inclusion_block: input.inclusion_block,
             });
             Ok(ProcessResult::new(ProcessOutcome::DirectEnqueued, outputs))
         } else {
@@ -263,10 +238,10 @@ impl<A: Application> Scheduler<A> {
             ));
         }
 
-        if has_elapsed_since(
+        if age_exceeds(
+            inclusion_block,
             frame_head.safe_block,
             self.config.max_wait_blocks,
-            inclusion_block,
         ) {
             return Ok(ProcessResult::without_outputs(
                 ProcessOutcome::BatchSkippedStale,
@@ -362,62 +337,39 @@ impl<A: Application> Scheduler<A> {
         safe_block: u64,
         outputs: &mut AppOutputs,
     ) -> Result<(), AppError> {
-        while let Some(front) = self.direct_q.front() {
-            if front.inclusion_block > safe_block {
-                break;
-            }
-            let input = DirectInput {
-                sender: front.sender,
-                block_number: front.inclusion_block,
-                payload: front.payload.clone(),
-            };
-            let executed = crate::application::execute_direct_input(&mut self.app, &input)?;
-            outputs.extend(executed.outputs);
-            self.direct_q.pop_front().expect("queue front must exist");
-        }
-        Ok(())
+        self.drain_front_while(outputs, |direct| direct.block_number <= safe_block)
     }
 
     fn force_execute_overdue(
         &mut self,
         current_block: u64,
         outputs: &mut AppOutputs,
+    ) -> Result<(), AppError> {
+        let max_wait_blocks = self.config.max_wait_blocks;
+        self.drain_front_while(outputs, |direct| {
+            age_exceeds(current_block, direct.block_number, max_wait_blocks)
+        })
+    }
+
+    /// Execute fridge directs from the front, in FIFO order, while `due`
+    /// holds. Each direct leaves the queue only after it executed.
+    fn drain_front_while(
+        &mut self,
+        outputs: &mut AppOutputs,
+        due: impl Fn(&DirectInput) -> bool,
     ) -> Result<(), AppError> {
         while let Some(front) = self.direct_q.front() {
-            if has_elapsed_since(
-                front.inclusion_block,
-                self.config.max_wait_blocks,
-                current_block,
-            ) {
-                let input = DirectInput {
-                    sender: front.sender,
-                    block_number: front.inclusion_block,
-                    payload: front.payload.clone(),
-                };
-                let executed = crate::application::execute_direct_input(&mut self.app, &input)?;
-                outputs.extend(executed.outputs);
-
-                self.direct_q.pop_front().expect("queue front must exist");
-            } else {
+            if !due(front) {
                 break;
             }
+            let executed = crate::application::execute_direct_input(&mut self.app, front)?;
+            outputs.extend(executed.outputs);
+            self.direct_q.pop_front();
         }
         Ok(())
     }
 }
 
-/// Scheduler-local spelling of the one staleness predicate. Delegates to
-/// [`crate::protocol::age_exceeds`] so the fold and the off-chain protocol
-/// module cannot drift. Note the argument order differs:
-/// `has_elapsed_since(start, wait, current) == age_exceeds(current, start, wait)`.
-fn has_elapsed_since(start_block: u64, wait_blocks: u64, current_block: u64) -> bool {
-    crate::protocol::age_exceeds(current_block, start_block, wait_blocks)
-}
-
-pub fn input_domain(chain_id: u64, verifying_contract: Address) -> Eip712Domain {
-    crate::build_input_domain(chain_id, verifying_contract)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -425,7 +377,6 @@ mod tests {
     use crate::user_op::UserOp;
     use alloy_primitives::{U256, address};
     use k256::ecdsa::SigningKey;
-    use k256::ecdsa::signature::hazmat::PrehashSigner;
 
     #[cfg(test)]
     #[derive(Default)]
@@ -599,7 +550,7 @@ mod tests {
     const TEST_VERIFYING_CONTRACT: Address = Address::ZERO;
 
     fn test_domain() -> Eip712Domain {
-        input_domain(TEST_CHAIN_ID, TEST_VERIFYING_CONTRACT)
+        crate::build_input_domain(TEST_CHAIN_ID, TEST_VERIFYING_CONTRACT)
     }
 
     fn direct_input(block: u64, marker: u8) -> SchedulerInput {
@@ -646,23 +597,7 @@ mod tests {
             max_fee,
             data: data.clone().into(),
         };
-        let hash = user_op.eip712_signing_hash(domain);
-        let k256_sig = signing_key
-            .sign_prehash(hash.as_slice())
-            .expect("sign user op hash");
-
-        let sender = address_from_signing_key(signing_key);
-        let signature = [false, true]
-            .into_iter()
-            .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-            .find(|candidate| {
-                candidate
-                    .recover_address_from_prehash(&hash)
-                    .ok()
-                    .map(|value| value == sender)
-                    .unwrap_or(false)
-            })
-            .expect("recoverable parity for signature");
+        let signature = crate::test_support::sign_user_op(signing_key, domain, &user_op);
 
         WireUserOp {
             nonce,
@@ -683,7 +618,7 @@ mod tests {
         );
 
         assert_eq!(
-            process_ok(&mut scheduler, direct_input(10, 1)),
+            process_ok(&mut scheduler, direct_input(10, 1)).outcome,
             ProcessOutcome::DirectEnqueued
         );
 
@@ -707,7 +642,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(20, batch)),
+            process_ok(&mut scheduler, batch_input(20, batch)).outcome,
             ProcessOutcome::BatchExecuted
         );
         assert_eq!(
@@ -780,7 +715,7 @@ mod tests {
             }],
         };
 
-        let outcome = process_ok(&mut scheduler, batch_input(10, stale_batch));
+        let outcome = process_ok(&mut scheduler, batch_input(10, stale_batch)).outcome;
         assert_eq!(outcome, ProcessOutcome::BatchSkippedStale);
         assert_eq!(scheduler.app.events(), [RecordedTx::Direct(9)]);
         // Stale batches do NOT consume the nonce — they are true no-ops in nonce space.
@@ -807,7 +742,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(10, fresh_batch)),
+            process_ok(&mut scheduler, batch_input(10, fresh_batch)).outcome,
             ProcessOutcome::BatchExecuted
         );
     }
@@ -853,7 +788,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(10, invalid)),
+            process_ok(&mut scheduler, batch_input(10, invalid)).outcome,
             ProcessOutcome::BatchRejected(BatchRejectReason::NonMonotonicSafeBlocks)
         );
         assert!(scheduler.app.events().is_empty());
@@ -887,7 +822,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(10, invalid)),
+            process_ok(&mut scheduler, batch_input(10, invalid)).outcome,
             ProcessOutcome::BatchRejected(BatchRejectReason::SafeBlockAboveInclusionBlock)
         );
         assert!(scheduler.app.events().is_empty());
@@ -937,13 +872,13 @@ mod tests {
             payload: vec![0xFF, 0xEE, 0xDD],
         };
         assert_eq!(
-            process_ok(&mut scheduler, bad_batch),
+            process_ok(&mut scheduler, bad_batch).outcome,
             ProcessOutcome::BatchRejected(BatchRejectReason::DecodeFailed)
         );
         assert_eq!(scheduler.next_expected_batch_nonce(), 0);
 
         assert_eq!(
-            process_ok(&mut scheduler, direct_input(11, 3)),
+            process_ok(&mut scheduler, direct_input(11, 3)).outcome,
             ProcessOutcome::DirectEnqueued
         );
         assert_eq!(scheduler.queued_direct_len(), 1);
@@ -995,7 +930,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(1, batch)),
+            process_ok(&mut scheduler, batch_input(1, batch)).outcome,
             ProcessOutcome::BatchExecuted
         );
         assert!(scheduler.app.events().is_empty());
@@ -1049,7 +984,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(1, batch)),
+            process_ok(&mut scheduler, batch_input(1, batch)).outcome,
             ProcessOutcome::BatchExecuted
         );
         assert_eq!(scheduler.app.events(), [RecordedTx::UserOp(4)]);
@@ -1071,7 +1006,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(10, batch)),
+            process_ok(&mut scheduler, batch_input(10, batch)).outcome,
             ProcessOutcome::BatchExecuted
         );
         assert!(scheduler.app.events().is_empty());
@@ -1090,7 +1025,7 @@ mod tests {
         let signing_key = SigningKey::from_bytes((&[10_u8; 32]).into()).expect("signing key");
         let sender = address_from_signing_key(&signing_key);
         scheduler.app.credit(sender, 1);
-        let batch_domain = input_domain(
+        let batch_domain = crate::build_input_domain(
             TEST_CHAIN_ID + 7,
             address!("0x3333333333333333333333333333333333333333"),
         );
@@ -1117,7 +1052,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, input),
+            process_ok(&mut scheduler, input).outcome,
             ProcessOutcome::BatchExecuted
         );
         assert_eq!(scheduler.app.events(), [RecordedTx::UserOp(9)]);
@@ -1133,7 +1068,7 @@ mod tests {
             },
         );
         assert_eq!(
-            process_ok(&mut scheduler, direct_input(1, 7)),
+            process_ok(&mut scheduler, direct_input(1, 7)).outcome,
             ProcessOutcome::DirectEnqueued
         );
         // Inspect reflects executed app state, not the direct-input queue.
@@ -1151,7 +1086,7 @@ mod tests {
             }],
         };
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(2, batch)),
+            process_ok(&mut scheduler, batch_input(2, batch)).outcome,
             ProcessOutcome::BatchExecuted
         );
 
@@ -1197,7 +1132,7 @@ mod tests {
         };
 
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(1, batch)),
+            process_ok(&mut scheduler, batch_input(1, batch)).outcome,
             ProcessOutcome::BatchRejected(BatchRejectReason::WrongNonce {
                 expected: 0,
                 got: 1,
@@ -1290,7 +1225,7 @@ mod tests {
         );
 
         assert_eq!(
-            process_ok(&mut scheduler, direct_input(1, 1)),
+            process_ok(&mut scheduler, direct_input(1, 1)).outcome,
             ProcessOutcome::DirectEnqueued
         );
         let error = scheduler
@@ -1359,7 +1294,7 @@ mod tests {
             0,
         );
         assert_eq!(
-            process_ok(&mut scheduler, direct_input(1, 9)),
+            process_ok(&mut scheduler, direct_input(1, 9)).outcome,
             ProcessOutcome::DirectEnqueued
         );
 
@@ -1378,12 +1313,8 @@ mod tests {
     const DUALITY_MAX_WAIT: u64 = 5;
 
     fn duality_timing() -> crate::protocol::ProtocolTiming {
-        crate::protocol::ProtocolTiming {
-            max_wait_blocks: DUALITY_MAX_WAIT,
-            preemptive_margin_blocks: 1,
-            l1_read_stale_after_blocks: 1,
-            seconds_per_block: 12,
-        }
+        crate::protocol::ProtocolTiming::try_new(DUALITY_MAX_WAIT, 1, 1, 12)
+            .expect("valid duality timing")
     }
 
     // A frame with no user ops — accept/reject is then purely about
@@ -1421,7 +1352,9 @@ mod tests {
                 domain: test_domain(),
                 payload: payload.to_vec(),
             },
-        ) == ProcessOutcome::BatchExecuted;
+        )
+        .outcome
+            == ProcessOutcome::BatchExecuted;
         let offchain_accepted = duality_timing()
             .scheduler_accepts(
                 SEQUENCER,
@@ -1544,8 +1477,7 @@ mod tests {
         // The backstop force-executes overdue fridge directs at the START of
         // process_input — before the batch is even classified. So an overdue
         // direct is drained even when the same tick's batch is rejected or
-        // skipped (a danger-zone shape). Previously tested only alongside an
-        // ACCEPTED batch.
+        // skipped (a danger-zone shape).
         for label in ["wrong-nonce", "stale"] {
             let mut scheduler = Scheduler::new(
                 RecordingApp::default(),
@@ -1603,8 +1535,8 @@ mod tests {
     #[test]
     fn multiframe_overheight_in_tail_frame_rejected_by_scheduler() {
         // `batch_reject_reason_for_block` checks `safe_block <= inclusion` in
-        // BOTH the head and the tail frames; only the head case was tested. A
-        // tail frame above the inclusion block must reject the whole batch.
+        // BOTH the head and the tail frames; a tail frame above the inclusion
+        // block must reject the whole batch.
         let mut scheduler = Scheduler::new(
             RecordingApp::default(),
             SchedulerConfig {
@@ -1630,10 +1562,36 @@ mod tests {
             ],
         };
         assert_eq!(
-            process_ok(&mut scheduler, batch_input(10, batch)),
+            process_ok(&mut scheduler, batch_input(10, batch)).outcome,
             ProcessOutcome::BatchRejected(BatchRejectReason::SafeBlockAboveInclusionBlock)
         );
         assert_eq!(scheduler.next_expected_batch_nonce(), 0);
         assert!(scheduler.app.events().is_empty());
     }
+
+    /// What the guest's recovery makes of each pinned signature variant today:
+    /// the sender it executes the op as, or `None` when the op is dropped. The
+    /// ingress side of the same table is pinned in `api.rs`; `canonical-test`
+    /// replays every variant through the built image.
+    #[test]
+    fn signature_variants_recover_the_pinned_guest_sender() {
+        let vectors = crate::consensus_vectors::vectors();
+        let pinned = &vectors.signature;
+        let domain = vectors.domain(&pinned.domain);
+        let scheduler = Scheduler::new(RecordingApp::default(), SchedulerConfig::new(SEQUENCER));
+        for case in &pinned.variants {
+            let wire_user_op = WireUserOp {
+                nonce: pinned.user_op.nonce,
+                max_fee: pinned.user_op.max_fee,
+                data: pinned.user_op.data.to_vec(),
+                signature: case.signature.to_vec(),
+            };
+            assert_eq!(
+                scheduler.recover_sender(&domain, &wire_user_op),
+                case.guest,
+                "{}",
+                case.name
+            );
+        }
+    }
 }
diff --git a/sequencer-core/src/test_support.rs b/sequencer-core/src/test_support.rs
new file mode 100644
index 00000000..9592b708
--- /dev/null
+++ b/sequencer-core/src/test_support.rs
@@ -0,0 +1,24 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! Test-only signing helpers shared across crates. Compiled for this crate's
+//! tests and the `test-support` feature, which the guest build never enables.
+
+use alloy_primitives::{B256, Signature};
+use alloy_sol_types::{Eip712Domain, SolStruct};
+use k256::ecdsa::SigningKey;
+
+use crate::user_op::UserOp;
+
+/// Low-s signature of a 32-byte prehash with the parity that recovers `key`'s address.
+pub fn sign_hash(key: &SigningKey, hash: &B256) -> Signature {
+    let (signature, recovery_id) = key
+        .sign_prehash_recoverable(hash.as_slice())
+        .expect("a 32-byte prehash always signs");
+    Signature::from_signature_and_parity(signature, recovery_id.is_y_odd())
+}
+
+/// Sign `user_op` as a wallet would: EIP-712 under `domain`.
+pub fn sign_user_op(key: &SigningKey, domain: &Eip712Domain, user_op: &UserOp) -> Signature {
+    sign_hash(key, &user_op.eip712_signing_hash(domain))
+}
diff --git a/sequencer/Cargo.toml b/sequencer/Cargo.toml
index 331cdefa..97215cbe 100644
--- a/sequencer/Cargo.toml
+++ b/sequencer/Cargo.toml
@@ -16,16 +16,18 @@ tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync", "ti
 tokio-util = { version = "0.7", features = ["io", "io-util"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
-toml = "0.8"
-tar = "0.4"
+toml = { workspace = true }
+tar = { workspace = true }
 tracing = { workspace = true }
+tower = "0.5"
+# 0.7 waits until reqwest requires it, or two copies ship. 0.7 also drops the
+# CORS `Vary` header under our constant config: pin `.vary(...)` and test it.
 tower-http = { version = "0.6.8", features = ["trace", "cors"] }
 rusqlite = { workspace = true }
 rusqlite_migration = "2.6.0"
 alloy-primitives = { workspace = true }
 alloy-sol-types = { workspace = true }
 alloy = { workspace = true, features = ["contract", "network", "reqwest", "rpc-types", "sol-types", "json-rpc", "signer-local", "signers"] }
-alloy-network-primitives = "2.5"
 alloy-transport = "2.5"
 url = "2.5"
 thiserror = { workspace = true }
@@ -37,6 +39,7 @@ async-trait = "0.1"
 sha2 = "0.10"
 
 [dev-dependencies]
+sequencer-core = { path = "../sequencer-core", features = ["test-support"] }
 app-core = { path = "../examples/app-core" }
 # Anvil bindings are test-only: production builds must not carry the
 # node-spawning surface.
diff --git a/sequencer/src/clock.rs b/sequencer/src/clock.rs
index fd22babf..41fa54db 100644
--- a/sequencer/src/clock.rs
+++ b/sequencer/src/clock.rs
@@ -1,11 +1,8 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Shared clock helper.
-//!
-//! Every callsite that needs "now in Unix-ms" goes through [`unix_now_ms`] so
-//! the sequencer has a single place to swap in a test clock if needed.
-//! `SystemTime::now()` pre-epoch is defended against via `unwrap_or_default()`.
+//! The crate's wall clock: every "now in Unix-ms" goes through [`unix_now_ms`],
+//! and a pre-epoch clock reads as 0.
 
 use std::time::{Duration, SystemTime};
 
diff --git a/sequencer/src/commands/config.rs b/sequencer/src/commands/config.rs
index 33837c7b..0cf26869 100644
--- a/sequencer/src/commands/config.rs
+++ b/sequencer/src/commands/config.rs
@@ -1,19 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! CLI configuration for the three subcommands (`setup`, `run`,
-//! `flush-mempool`).
-//!
-//! The phase split: `setup` is L1-read-only and establishes the
-//! timeless deployment identity + initial sync + genesis snapshot; it takes
-//! the batch-submitter **address** but never the signing key. `run` boots
-//! from an already-set-up DB, reads identity from the DB (so chain id / app
-//! address are not CLI args here), and keeps the signing **key** because it
-//! submits. `flush-mempool` is a keyed operator tool that settles the wallet
-//! nonce on demand.
-//!
-//! Shared, drift-prone arg groups (`TimingArgs`, `KeyArgs`) are flattened into
-//! the per-subcommand configs so defaults and env-var names stay consistent.
+//! CLI configuration for `setup`, `run` and `flush-mempool`: the owner of
+//! env-var names, defaults and validation. Shared arg groups (`L1RpcArgs`,
+//! `TimingArgs`, `KeyArgs`) are flattened into each command so names and defaults
+//! cannot drift. The setup/run phase split is in README "Running".
 
 use alloy_primitives::Address;
 use clap::{ArgGroup, Args};
@@ -23,9 +14,16 @@ use crate::l1::SubmitterKey;
 use sequencer_core::protocol::{ProtocolTiming, ProtocolTimingError};
 
 const DEFAULT_HTTP_ADDR: &str = "127.0.0.1:3000";
+const DEFAULT_INTERNAL_HTTP_ADDR: &str = "127.0.0.1:3001";
 const DEFAULT_DATA_DIR: &str = "sequencer-data";
 const DB_FILENAME: &str = "sequencer.db";
 
+/// Blocks a time-sealed batch needs after its open window to become
+/// safe-accepted before danger: its first frame trails the safe head by under
+/// one frame-clock interval (5), Ethereum's safe head trails inclusion by up to
+/// two epochs (64), and the rest covers submitter pickup, inclusion and the dump.
+const BATCH_SUBMISSION_MARGIN_BLOCKS: u64 = 100;
+
 /// Full path to the SQLite database file inside `data_dir`.
 pub fn db_path_in(data_dir: &str) -> String {
     std::path::Path::new(data_dir)
@@ -34,6 +32,24 @@ pub fn db_path_in(data_dir: &str) -> String {
         .into_owned()
 }
 
+/// L1 RPC endpoint, shared by setup, run and flush-mempool.
+#[derive(Debug, Clone, Args)]
+pub struct L1RpcArgs {
+    #[arg(long, env = "CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT", hide_env_values = true, value_parser = parse_non_empty_string)]
+    pub eth_rpc_url: String,
+    /// Allow plaintext (`http://`) RPC to a non-loopback host — a trusted
+    /// private network (Docker/K8s service name, `host.docker.internal`, a
+    /// private-VPC IP) where anvil-style plaintext is normal. Off by default:
+    /// the provider refuses remote plaintext otherwise, guarding against
+    /// accidentally sending L1 traffic over the public internet in the clear.
+    #[arg(
+        long,
+        env = "CARTESI_SEQUENCER_ALLOW_INSECURE_RPC",
+        default_value_t = false
+    )]
+    pub allow_insecure_rpc: bool,
+}
+
 /// Protocol-timing tuning knobs shared by `setup` and `run`. `setup` needs a
 /// valid `ProtocolTiming` for the initial-sync writes (and validating it here
 /// fails fast at setup, not just at run).
@@ -85,9 +101,15 @@ impl TimingArgs {
 /// local development; public chains use a validated Uniswap V3 TWAP source.
 #[derive(Debug, Clone, Args)]
 pub struct FeeOracleArgs {
-    /// Fixed logarithmic gas price for local/Anvil deployments.
-    #[arg(long, env = "CARTESI_SEQUENCER_FEE_ORACLE_FIXED_LOG_GAS_PRICE")]
-    pub fixed_log_gas_price: Option<u16>,
+    /// Fixed logarithmic gas price for local/Anvil deployments. Negative values
+    /// price below one fee-token smallest unit per gas; setup refuses one that
+    /// would push the recommended fee below exponent 0.
+    #[arg(
+        long,
+        env = "CARTESI_SEQUENCER_FEE_ORACLE_FIXED_LOG_GAS_PRICE",
+        allow_negative_numbers = true
+    )]
+    pub fixed_log_gas_price: Option<i16>,
     #[arg(long, env = "CARTESI_SEQUENCER_FEE_TOKEN_ADDRESS", value_parser = parse_address)]
     pub fee_token_address: Option<Address>,
     #[arg(long, env = "CARTESI_SEQUENCER_WETH_ADDRESS", value_parser = parse_address)]
@@ -117,13 +139,13 @@ pub struct FeeOraclePollArgs {
 /// Resolved fee-oracle source with all chain-specific defaults filled in.
 #[derive(Debug, Clone)]
 pub enum FeeOracleMode {
-    Fixed { log_gas_price: u16 },
+    Fixed { log_gas_price: i16 },
     Uniswap(crate::l1::fee_oracle::UniswapConfig),
 }
 
 impl FeeOracleArgs {
-    /// Resolve explicit overrides, public-chain presets, or the zero-price
-    /// local-development default. This is pure so invalid combinations fail
+    /// Resolve explicit overrides or the public-chain presets; an unknown chain
+    /// needs an explicit source. This is pure so invalid combinations fail
     /// before the inclusion lane can sample a fee.
     pub fn resolve(&self, chain_id: u64) -> Result<FeeOracleMode, String> {
         let has_uniswap_override = self.fee_token_address.is_some()
@@ -271,7 +293,10 @@ fn resolve_key_source(
 /// underneath a running process. `NotFound` is deliberately terminal even
 /// though a secret populated after the process starts hits it: the
 /// orchestrator must mount the key before start, and a typo'd path
-/// restart-looping unpaged is the failure this replaces.
+/// restart-looping unpaged is the failure this replaces. The genesis dump
+/// keeps PermissionDenied operational so native and C engines agree; the key
+/// file is read by the host alone and never crosses the engine seam, so its
+/// denial stays terminal.
 pub(crate) fn key_file_io_is_terminal(source: &std::io::Error) -> bool {
     matches!(
         source.kind(),
@@ -338,22 +363,8 @@ impl OptionalKeyArgs {
 pub struct SetupConfig {
     #[arg(long, env = "CARTESI_SEQUENCER_DATA_DIR", default_value = DEFAULT_DATA_DIR, value_parser = parse_non_empty_string)]
     pub data_dir: String,
-    #[arg(long, env = "CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT", hide_env_values = true, value_parser = parse_non_empty_string)]
-    pub eth_rpc_url: String,
-    /// Allow plaintext (`http://`) RPC to a non-loopback host — a trusted
-    /// private network (Docker/K8s service name, `host.docker.internal`, a
-    /// private-VPC IP) where anvil-style plaintext is normal. Off by default:
-    /// the provider refuses remote plaintext otherwise, guarding against
-    /// accidentally sending L1 traffic over the public internet in the clear.
-    #[arg(
-        long,
-        env = "CARTESI_SEQUENCER_ALLOW_INSECURE_RPC",
-        default_value_t = false
-    )]
-    pub allow_insecure_rpc: bool,
-    /// Error codes that trigger `get_logs` retries with a shorter block range.
-    #[arg(long, env = "CARTESI_SEQUENCER_LONG_BLOCK_RANGE_ERROR_CODES", value_delimiter = ',', default_values = crate::l1::partition::DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES)]
-    pub long_block_range_error_codes: Vec<String>,
+    #[command(flatten)]
+    pub rpc: L1RpcArgs,
     /// Expected chain ID. Validated against the RPC at setup and pinned.
     #[arg(long, env = "CARTESI_SEQUENCER_BLOCKCHAIN_ID")]
     pub chain_id: u64,
@@ -365,14 +376,11 @@ pub struct SetupConfig {
     /// without the secret) rather than the key itself.
     #[arg(long, env = "CARTESI_SEQUENCER_BATCH_SUBMITTER_ADDRESS", value_parser = parse_address)]
     pub batch_submitter_address: Address,
-    /// L1 inclusion block `B` of the trusted checkpoint machine this setup
-    /// boots from. Default `0` = genesis bootstrap. Used only as the lower
-    /// bound of `setup`'s read-only detection scan: if a previous instance
-    /// left any batch-submitter tx past `B` (or its wallet nonce is unsettled),
-    /// `setup` refuses and points the operator at recovery. PR3 does not yet
-    /// load a non-genesis checkpoint machine — that is `setup --recovery`;
-    /// here `B` only scopes detection, so `B > 0` against a genesis-style setup
-    /// merely narrows the scan.
+    /// L1 inclusion block `B` of the trusted checkpoint this setup boots from;
+    /// `0` is genesis. Plain `setup` uses `B` only as the lower bound of its
+    /// read-only detection scan: work a previous instance left past `B`, or an
+    /// unsettled wallet nonce, refuses with exit 40. `setup --recovery` loads the
+    /// checkpoint itself (`docs/recovery/cockroach.md`).
     #[arg(long, env = "CARTESI_SEQUENCER_CHECKPOINT_BLOCK", default_value_t = 0)]
     pub checkpoint_block: u64,
     /// Recovery mode (cockroach recovery): rebuild this freshly-wiped DB from a
@@ -459,26 +467,17 @@ impl SetupConfig {
 /// submits) and the runtime tuning knobs.
 #[derive(Debug, Clone, Args)]
 pub struct RunConfig {
+    /// Public listener: the ingress routes only.
     #[arg(long, env = "CARTESI_SEQUENCER_HTTP_ADDR", default_value = DEFAULT_HTTP_ADDR, value_parser = parse_non_empty_string)]
     pub http_addr: String,
+    /// Internal listener: subscription, history, snapshots, health. No
+    /// authentication; keep it off the public network.
+    #[arg(long, env = "CARTESI_SEQUENCER_INTERNAL_HTTP_ADDR", default_value = DEFAULT_INTERNAL_HTTP_ADDR, value_parser = parse_non_empty_string)]
+    pub internal_http_addr: String,
     #[arg(long, env = "CARTESI_SEQUENCER_DATA_DIR", default_value = DEFAULT_DATA_DIR, value_parser = parse_non_empty_string)]
     pub data_dir: String,
-    #[arg(long, env = "CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT", hide_env_values = true, value_parser = parse_non_empty_string)]
-    pub eth_rpc_url: String,
-    /// Allow plaintext (`http://`) RPC to a non-loopback host — a trusted
-    /// private network (Docker/K8s service name, `host.docker.internal`, a
-    /// private-VPC IP) where anvil-style plaintext is normal. Off by default:
-    /// the provider refuses remote plaintext otherwise, guarding against
-    /// accidentally sending L1 traffic over the public internet in the clear.
-    #[arg(
-        long,
-        env = "CARTESI_SEQUENCER_ALLOW_INSECURE_RPC",
-        default_value_t = false
-    )]
-    pub allow_insecure_rpc: bool,
-    /// Error codes that trigger `get_logs` retries with a shorter block range.
-    #[arg(long, env = "CARTESI_SEQUENCER_LONG_BLOCK_RANGE_ERROR_CODES", value_delimiter = ',', default_values = crate::l1::partition::DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES)]
-    pub long_block_range_error_codes: Vec<String>,
+    #[command(flatten)]
+    pub rpc: L1RpcArgs,
     #[command(flatten)]
     key: KeyArgs,
 
@@ -486,7 +485,8 @@ pub struct RunConfig {
     #[arg(
         long,
         env = "CARTESI_SEQUENCER_BATCH_SUBMITTER_IDLE_POLL_INTERVAL_MS",
-        default_value = "5000"
+        default_value = "5000",
+        value_parser = clap::value_parser!(u64).range(1..)
     )]
     pub batch_submitter_idle_poll_interval_ms: u64,
 
@@ -502,6 +502,8 @@ pub struct RunConfig {
     /// regardless of size — the liveness bound that caps batch-posting latency
     /// for a low-traffic deployment. Default 7200 (2h); operators trade latency
     /// against L1 cost, and tests set it small to seal batches promptly.
+    /// Rounded up to blocks at `--seconds-per-block`, it must leave a
+    /// submission margin below the danger threshold (validated at startup).
     #[arg(
         long,
         env = "CARTESI_SEQUENCER_MAX_BATCH_OPEN_SECONDS",
@@ -528,9 +530,26 @@ impl RunConfig {
         std::time::Duration::from_secs(self.max_batch_open_seconds)
     }
 
-    /// Build a validated [`ProtocolTiming`] from this config's tuning fields.
-    pub fn protocol_timing(&self) -> Result<ProtocolTiming, ProtocolTimingError> {
-        self.timing.protocol_timing()
+    /// Build a validated [`ProtocolTiming`] and refuse a batch-open window that
+    /// would carry a low-volume Tip into danger before it can be sealed,
+    /// submitted and safe-accepted.
+    pub fn protocol_timing(&self) -> Result<ProtocolTiming, BootstrapError> {
+        let timing = self.timing.protocol_timing()?;
+        // Rounding up counts a partial block against the operator.
+        let open_blocks = self
+            .max_batch_open_seconds
+            .div_ceil(timing.seconds_per_block());
+        let danger_threshold = timing.danger_threshold();
+        if open_blocks > danger_threshold.saturating_sub(BATCH_SUBMISSION_MARGIN_BLOCKS) {
+            return Err(BootstrapError::BatchOpenPastDanger {
+                max_batch_open_seconds: self.max_batch_open_seconds,
+                seconds_per_block: timing.seconds_per_block(),
+                open_blocks,
+                danger_threshold,
+                margin_blocks: BATCH_SUBMISSION_MARGIN_BLOCKS,
+            });
+        }
+        Ok(timing)
     }
 
     /// Resolve the batch submitter private key from either the inline value or a key file.
@@ -546,19 +565,8 @@ impl RunConfig {
 pub struct FlushConfig {
     #[arg(long, env = "CARTESI_SEQUENCER_DATA_DIR", default_value = DEFAULT_DATA_DIR, value_parser = parse_non_empty_string)]
     pub data_dir: String,
-    #[arg(long, env = "CARTESI_SEQUENCER_BLOCKCHAIN_HTTP_ENDPOINT", hide_env_values = true, value_parser = parse_non_empty_string)]
-    pub eth_rpc_url: String,
-    /// Allow plaintext (`http://`) RPC to a non-loopback host — a trusted
-    /// private network (Docker/K8s service name, `host.docker.internal`, a
-    /// private-VPC IP) where anvil-style plaintext is normal. Off by default:
-    /// the provider refuses remote plaintext otherwise, guarding against
-    /// accidentally sending L1 traffic over the public internet in the clear.
-    #[arg(
-        long,
-        env = "CARTESI_SEQUENCER_ALLOW_INSECURE_RPC",
-        default_value_t = false
-    )]
-    pub allow_insecure_rpc: bool,
+    #[command(flatten)]
+    pub rpc: L1RpcArgs,
     #[command(flatten)]
     key: KeyArgs,
     /// Assumed L1 block time in seconds; sets the flusher's confirmation /
@@ -826,7 +834,7 @@ mod tests {
             Cli::try_parse_from(args.clone()).is_err(),
             "run requires a batch-submitter key"
         );
-        // chain-id / app-address are no longer run args.
+        // chain-id / app-address are not run args.
         args.push("--batch-submitter-private-key");
         args.push(TEST_KEY);
         args.push("--chain-id");
@@ -837,21 +845,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn run_uses_default_block_range_retry_codes() {
-        let config = run_config_from(&[]);
-        assert_eq!(
-            config.long_block_range_error_codes,
-            vec![
-                "-32005".to_string(),
-                "-32012".to_string(),
-                "-32600".to_string(),
-                "-32602".to_string(),
-                "-32616".to_string()
-            ]
-        );
-    }
-
     #[test]
     fn run_defaults_batch_submitter_confirmation_depth_to_two() {
         assert_eq!(run_config_from(&[]).batch_submitter_confirmation_depth, 2);
@@ -874,6 +867,15 @@ mod tests {
         );
     }
 
+    #[test]
+    fn fee_oracle_fixed_mode_accepts_a_negative_exponent() {
+        let config = setup_config_from(&["--fixed-log-gas-price", "-7"]);
+        assert!(matches!(
+            config.fee_oracle.resolve(31_337),
+            Ok(FeeOracleMode::Fixed { log_gas_price: -7 })
+        ));
+    }
+
     #[test]
     fn fee_oracle_partial_uniswap_override_is_rejected() {
         let config = setup_config_from(&[
@@ -966,6 +968,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn run_rejects_zero_batch_submitter_idle_poll_interval() {
+        let mut args: Vec<&str> = RUN_ARGS.to_vec();
+        args.extend([TEST_KEY, "--batch-submitter-idle-poll-interval-ms", "0"]);
+        let message = Cli::try_parse_from(args)
+            .expect_err("a zero idle poll would spin the submitter against the RPC")
+            .to_string();
+        assert!(
+            message.contains("--batch-submitter-idle-poll-interval-ms"),
+            "error must name the offending field, got: {message}"
+        );
+    }
+
     #[test]
     fn run_default_seconds_per_block_is_12() {
         assert_eq!(run_config_from(&[]).timing.seconds_per_block, 12);
@@ -976,6 +991,126 @@ mod tests {
         assert_eq!(run_config_from(&[]).timing.l1_read_stale_after_blocks, 600);
     }
 
+    const _: () = assert!(
+        sequencer_core::MAX_WAIT_BLOCKS == 1200,
+        "batch-open window fixtures below assume the 1200-block window"
+    );
+
+    #[test]
+    fn run_bounds_batch_open_window_by_danger_threshold_less_submission_margin() {
+        // Defaults: danger_threshold MAX_WAIT_BLOCKS (1200) - 300 = 900; budget 800 blocks =
+        // 9600 s at 12 s.
+        run_config_from(&[])
+            .protocol_timing()
+            .expect("default window fits");
+        run_config_from(&["--max-batch-open-seconds", "9600"])
+            .protocol_timing()
+            .expect("boundary window fits");
+        // 9601 s is 800.08 blocks; rounding up must refuse it.
+        let err = run_config_from(&["--max-batch-open-seconds", "9601"])
+            .protocol_timing()
+            .expect_err("one second past the budget must be refused");
+        assert!(
+            matches!(
+                err,
+                BootstrapError::BatchOpenPastDanger {
+                    max_batch_open_seconds: 9601,
+                    seconds_per_block: 12,
+                    open_blocks: 801,
+                    danger_threshold: 900,
+                    margin_blocks: 100,
+                }
+            ),
+            "{err:?}"
+        );
+        let err = run_config_from(&[
+            "--max-batch-open-seconds",
+            "18446744073709551615",
+            "--seconds-per-block",
+            "1",
+        ])
+        .protocol_timing()
+        .expect_err("an unbounded window must be refused without overflow");
+        assert!(
+            matches!(err, BootstrapError::BatchOpenPastDanger { .. }),
+            "{err:?}"
+        );
+    }
+
+    #[test]
+    fn run_refuses_every_batch_open_window_when_danger_threshold_is_below_the_margin() {
+        // danger_threshold MAX_WAIT_BLOCKS (1200) - 1150 = 50 < 100: no window can land before
+        // danger.
+        let err = run_config_from(&[
+            "--preemptive-margin-blocks",
+            "1150",
+            "--l1-read-stale-after-blocks",
+            "10",
+            "--max-batch-open-seconds",
+            "1",
+        ])
+        .protocol_timing()
+        .expect_err("no budget remains");
+        assert!(
+            matches!(
+                err,
+                BootstrapError::BatchOpenPastDanger {
+                    open_blocks: 1,
+                    danger_threshold: 50,
+                    ..
+                }
+            ),
+            "{err:?}"
+        );
+    }
+
+    #[test]
+    fn boundary_batch_open_window_seals_a_low_volume_tip_before_danger() {
+        use crate::storage::test_helpers::{SENDER_A, temp_db_with_default_deployment_identity};
+        use crate::storage::{DangerStatus, SafeInputRange, Storage};
+
+        let config = run_config_from(&["--max-batch-open-seconds", "9600"]);
+        let timing = config.protocol_timing().expect("boundary window fits");
+        let open_blocks = config
+            .max_batch_open_seconds
+            .div_ceil(timing.seconds_per_block());
+        // Worst case: the first frame trails the safe head by one block less
+        // than the frame-clock interval.
+        let frame_lag = ProtocolTiming::FRAME_CLOCK_INTERVAL_SAFE_BLOCKS - 1;
+        let first_frame = 10;
+        let seal_safe_block = first_frame + frame_lag + open_blocks;
+
+        let db = temp_db_with_default_deployment_identity("batch-open-boundary");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(first_frame, SafeInputRange::empty_at(0))
+            .expect("open Tip");
+        let status_at = |storage: &mut Storage, safe_block: u64| {
+            storage
+                .append_safe_inputs(safe_block, &[], SENDER_A, &timing)
+                .expect("advance safe head");
+            storage
+                .check_danger(&timing, crate::clock::unix_now_ms())
+                .expect("check danger")
+        };
+
+        // Low volume: only the deadline seals the Tip, and it is not in danger yet.
+        assert_eq!(status_at(&mut storage, seal_safe_block), DangerStatus::Safe);
+        // Closure keeps the frame clock; the batch still ages from first_frame.
+        storage
+            .close_frame_and_batch(&mut head, first_frame)
+            .expect("seal by time");
+
+        // The sealed batch keeps the margin, less the frame lag, to become accepted.
+        let last_safe = first_frame + timing.danger_threshold() - 1;
+        assert_eq!(last_safe - seal_safe_block, 100 - frame_lag - 1);
+        assert_eq!(status_at(&mut storage, last_safe), DangerStatus::Safe);
+        assert_eq!(
+            status_at(&mut storage, last_safe + 1),
+            DangerStatus::ClosedBatchInDanger(0)
+        );
+    }
+
     #[test]
     fn timing_args_reject_zero_l1_read_stale_after_blocks() {
         let err = Cli::try_parse_from([
diff --git a/sequencer/src/commands/error.rs b/sequencer/src/commands/error.rs
index 28204902..e54d1f72 100644
--- a/sequencer/src/commands/error.rs
+++ b/sequencer/src/commands/error.rs
@@ -1,15 +1,8 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Command error taxonomy. Three groupings:
-//!
-//! - [`BootstrapError`] / [`IdentityError`]: everything that can go wrong
-//!   before runtime workers come up — config validation, deployment-identity
-//!   guards, startup recovery, initial DB open.
-//! - [`WorkerExit`] + per-worker `*Exit`: how each runtime worker exited.
-//! - [`CommandError`]: the top-level error every command returns (run,
-//!   setup, flush), with generic [`std::io::Error`] /
-//!   [`rusqlite::Error`] catch-alls that are used widely enough not to nest.
+//! Command error taxonomy: [`BootstrapError`] and [`IdentityError`] before workers
+//! start, [`WorkerExit`] for runtime worker exits, and [`CommandError`] on top.
 
 use thiserror::Error;
 
@@ -60,36 +53,22 @@ pub enum CommandError {
 
 // ── Exit-code projection ────────────────────────────────────────────────
 //
-// One exhaustive semantic verdict owns failure classification. The
-// terminal-fault black box and the orchestrator-facing exit code both derive
-// from it, so an operational projection can never become admission policy.
-// The exit code remains an ops hint, never protocol authority over the next
-// boot. Reserved: 1 (unclassified), 2 (clap usage), and 101 for a panic
-// before the command harness can project trusted-code failures to 30. A
-// diagnosed terminal runtime fault immediately exits via `abort()` (SIGABRT/134),
-// bypassing this projection deliberately;
-// supervisors must treat 134 from the sequencer as terminal-class
-// (`docs/watchdog/operator-deployment.md` says how).
-
-/// Restart with backoff; a recovery boot is expected next (it may take 15+
-/// min: flush + safe-finality wait). Startup probes must accommodate it.
+// README "Running" owns the exit-code contract; `CommandFailureVerdict` is the
+// one classification it projects. Also reserved: 2 (clap usage) and 101 (a
+// panic before the command harness). Diagnosed terminal runtime faults bypass
+// this projection with `abort()` (SIGABRT, 134).
+
+/// Restart; a recovery boot follows and may take 15+ min (flush plus
+/// safe-finality wait), so startup probes must allow for it.
 pub const EXIT_RESTART_EXPECT_RECOVERY: u8 = 10;
-/// Restart with backoff; a transient refusal that self-heals when the L1 view
-/// freshens. Alert only if it persists.
+/// Restart with backoff; the refusal clears when the L1 view freshens.
 pub const EXIT_RESTART_TRANSIENT: u8 = 20;
-/// Terminal — do not restart; page an operator. The state cannot self-heal.
+/// Do not restart; page an operator.
 pub const EXIT_TERMINAL: u8 = 30;
-/// Sticky — do **not** auto-restart-loop; an operator must wipe the
-/// uncompleted data dir and run `setup --recovery`. The recovery sibling of
-/// [`EXIT_RESTART_EXPECT_RECOVERY`] (10), but *operator-initiated*: 10 means
-/// "restart and `run()` auto-recovers"; 40 means "a previous instance left work
-/// past the checkpoint, and only an explicit fresh `setup --recovery`
-/// can resolve it" — a plain restart of `setup` would re-detect and re-refuse
-/// forever. Distinct from terminal (30) in that a known recovery procedure
-/// *does* fix it.
+/// Do not restart: a previous instance left work past the checkpoint, so wipe
+/// the uncompleted data dir and run `setup --recovery`.
 pub const EXIT_SETUP_NEEDS_RECOVERY: u8 = 40;
-/// Unclassified operational failure (for example, a provider error). Restart
-/// with backoff.
+/// Unclassified operational failure; restart with backoff.
 pub const EXIT_UNCLASSIFIED: u8 = 1;
 
 /// Semantic disposition of a failed command.
@@ -113,6 +92,26 @@ impl CommandFailureVerdict {
         matches!(self, Self::Terminal)
     }
 
+    /// Exit-line severity: ERROR when the cause is a fault or unknown, WARN
+    /// when the verdict names a planned procedure (a recovery boot, a retry,
+    /// `setup --recovery`). Alert on the exit code, not the level.
+    pub(crate) const fn logs_at_error(self) -> bool {
+        matches!(self, Self::Terminal | Self::Unclassified)
+    }
+
+    /// The supervisor action this verdict asks for, named on the exit line.
+    pub(crate) const fn supervisor_action(self) -> &'static str {
+        match self {
+            Self::ExpectedRecovery => "restart; a recovery boot follows",
+            Self::Retryable => "restart with backoff; alert if it persists",
+            Self::Terminal => "do not restart; page an operator",
+            Self::SetupRecoveryRequired => {
+                "do not restart; wipe the data dir and run setup --recovery"
+            }
+            Self::Unclassified => "restart with backoff",
+        }
+    }
+
     const fn exit_code(self) -> u8 {
         match self {
             Self::ExpectedRecovery => EXIT_RESTART_EXPECT_RECOVERY,
@@ -161,14 +160,19 @@ impl CommandError {
                     source.kind(),
                     std::io::ErrorKind::InvalidInput
                         | std::io::ErrorKind::NotFound
-                        | std::io::ErrorKind::PermissionDenied
                         | std::io::ErrorKind::InvalidData
                         | std::io::ErrorKind::UnexpectedEof
                         | std::io::ErrorKind::IsADirectory
                         | std::io::ErrorKind::NotADirectory
                 ) =>
             {
-                // An absent option or unusable genesis dump needs operator repair.
+                // An absent option or a missing or corrupt genesis dump needs
+                // operator repair. PermissionDenied stays operational, as for
+                // referenced artifacts (`referenced_artifact_io_is_terminal`):
+                // it may clear once permissions are fixed, and the C engine
+                // seam carries no kind for it (IO_ERROR becomes Other), so
+                // native and C engines agree on exit 1. The key file differs
+                // (`key_file_io_is_terminal`) because it never crosses the seam.
                 CommandFailureVerdict::Terminal
             }
             CommandError::ReferencedSnapshotArtifact { source, .. }
@@ -195,8 +199,8 @@ impl CommandError {
 }
 
 // Per-worker terminality lives as `is_terminal_invariant` on each worker's
-// own error type, beside its enum; `WorkerExit::is_terminal` above
-// composes them.
+// own error type, beside its enum; `WorkerExit::is_terminal` below
+// composes them, and takes danger exits from `danger_failure_verdict`.
 
 fn danger_failure_verdict(status: &DangerStatus) -> CommandFailureVerdict {
     match status {
@@ -244,13 +248,23 @@ fn bootstrap_failure_verdict(err: &BootstrapError) -> CommandFailureVerdict {
                 CommandFailureVerdict::Terminal
             }
         }
+        // Setup's reader failures take the startup polarity.
+        BootstrapError::SetupInputReader(source) => {
+            if source.is_retryable_at_startup() {
+                CommandFailureVerdict::Retryable
+            } else {
+                CommandFailureVerdict::Terminal
+            }
+        }
         // Transient: self-heal when the L1 view / provider recovers — or,
         // for the data-dir lock, when the previous owner finishes dying.
         // `FeeOracleTransient` is documented "may self-heal", which is this
         // class's definition.
         BootstrapError::ChainIdRpc { .. }
-        | BootstrapError::Identity(IdentityError::FirstBootRequiresL1)
-        | BootstrapError::DetectionNonceRead { .. }
+        | BootstrapError::Identity(
+            IdentityError::FirstBootRequiresL1 | IdentityError::DeploymentNotYetSafe { .. },
+        )
+        | BootstrapError::DetectionWalletNonceRead { .. }
         | BootstrapError::DataDirLocked { .. }
         | BootstrapError::FeeOracleTransient { .. }
         | BootstrapError::Flush(_) => CommandFailureVerdict::Retryable,
@@ -258,20 +272,19 @@ fn bootstrap_failure_verdict(err: &BootstrapError) -> CommandFailureVerdict {
         // Terminal: needs an operator (wrong config, divergence, or a DB that
         // was never set up).
         BootstrapError::ChainIdMismatch { .. }
+        | BootstrapError::RpcRedirect { .. }
         | BootstrapError::InvalidProtocolTiming(_)
+        | BootstrapError::BatchOpenPastDanger { .. }
         | BootstrapError::FeeOracleMisconfig { .. }
         | BootstrapError::FeeOracleFatal { .. }
         | BootstrapError::SignerMisconfig { .. }
-        | BootstrapError::SetupNotComplete
+        | BootstrapError::SetupNotComplete { .. }
         | BootstrapError::CheckpointBeforeAppDeployment { .. }
         | BootstrapError::SetupRecovery(_)
         | BootstrapError::Identity(IdentityError::Mismatch { .. } | IdentityError::OrphanedState) => {
             CommandFailureVerdict::Terminal
         }
 
-        // Sticky setup refusal: a previous instance left work past the
-        // checkpoint. Distinct from the auto-recovery class (10) — a plain
-        // restart re-refuses; only wipe + `setup --recovery` resolves it.
         BootstrapError::SetupRefuse(_) => CommandFailureVerdict::SetupRecoveryRequired,
         BootstrapError::OpenStorage(_) | BootstrapError::KeyFile { .. } => {
             CommandFailureVerdict::Unclassified
@@ -289,33 +302,55 @@ pub enum BootstrapError {
     OpenStorage(#[from] StorageOpenError),
     #[error("RPC chain ID {rpc} does not match the expected chain ID {config}")]
     ChainIdMismatch { rpc: u64, config: u64 },
-    /// `eth_chainId` failed on a reachable RPC. We treat this as fatal
-    /// rather than warn-and-continue: proceeding with an unverified chain id
+    /// `eth_chainId` failed. It is setup's first L1 read, so an unreachable
+    /// RPC on first boot lands here. The command fails rather than
+    /// warn-and-continue: proceeding with an unverified chain id
     /// would pin a possibly-wrong deployment identity and poison subsequent
     /// L1-unreachable boots, in addition to issuing soft confirmations
     /// against the wrong chain's state. Operator should retry.
     #[error("could not query chain ID from RPC: {message}")]
     ChainIdRpc { message: String },
+    /// `eth_chainId` answered with a redirect. The client follows none
+    /// (`l1/provider.rs`), so every retry gets the same answer until the
+    /// operator configures the provider's final URL.
+    #[error(
+        "the RPC endpoint answered eth_chainId with HTTP {status}; redirects are not \
+         followed, so configure the provider's final URL"
+    )]
+    RpcRedirect { status: u16 },
     /// Protocol-level config (`preemptive_margin_blocks` vs `max_wait_blocks`,
     /// `l1_read_stale_after_blocks` vs `danger_threshold`) failed validation.
     /// See [`ProtocolTimingError`].
     #[error(transparent)]
     InvalidProtocolTiming(#[from] ProtocolTimingError),
+    /// `max_batch_open_seconds`, in blocks, leaves less than the submission
+    /// margin below the danger threshold, so a low-volume Tip would reach
+    /// danger before it can be sealed, submitted and safe-accepted.
+    #[error(
+        "max_batch_open_seconds ({max_batch_open_seconds}) spans {open_blocks} blocks at \
+         seconds_per_block ({seconds_per_block}); it must be at most danger_threshold \
+         ({danger_threshold}) minus the {margin_blocks}-block submission margin"
+    )]
+    BatchOpenPastDanger {
+        max_batch_open_seconds: u64,
+        seconds_per_block: u64,
+        open_blocks: u64,
+        danger_threshold: u64,
+        margin_blocks: u64,
+    },
     /// Setup-pinned fee oracle configuration or validation is invalid.
     #[error("fee oracle misconfiguration: {message}")]
     FeeOracleMisconfig { message: String },
     /// A live quote/transport failed while bootstrapping. It may self-heal.
     #[error("fee oracle bootstrap transient failure: {message}")]
     FeeOracleTransient { message: String },
-    /// Trusted-code join/arithmetic failures while setup persists the first
-    /// quote. These need operator attention but are not source misconfiguration.
+    /// Trusted-code join failures while setup persists the first quote. These
+    /// need operator attention but are not source misconfiguration.
     #[error("fatal fee oracle bootstrap failure: {message}")]
     FeeOracleFatal { message: String },
-    /// The keyed signer provider could not be constructed (bad RPC URL or
-    /// private key). Deterministic operator misconfiguration: re-running the
-    /// same configuration re-fails identically, so it classifies terminal
-    /// like [`Self::ChainIdMismatch`] — the same semantic every command must
-    /// share (recovery, setup, and flush previously disagreed).
+    /// The keyed signer provider could not be built (bad RPC URL or private key).
+    /// Deterministic operator misconfiguration: a rerun fails identically, so it
+    /// is terminal in every command, like [`Self::ChainIdMismatch`].
     #[error("signer provider misconfiguration: {message}")]
     SignerMisconfig { message: String },
     /// The batch-submitter key file could not be read. Classified by kind
@@ -333,6 +368,11 @@ pub enum BootstrapError {
     /// Startup recovery (or refusal) failed before runtime workers started.
     #[error(transparent)]
     Recovery(#[from] RecoveryError),
+    /// An input-reader failure in setup's L1 discovery (the chain-id check's
+    /// client, the safe-head sample, the reader) or initial sync, classified by
+    /// [`InputReaderError::is_retryable_at_startup`].
+    #[error("setup L1 input reader: {0}")]
+    SetupInputReader(InputReaderError),
     /// Deployment-identity guards — see [`IdentityError`].
     #[error(transparent)]
     Identity(#[from] IdentityError),
@@ -340,8 +380,8 @@ pub enum BootstrapError {
     /// has not completed — its completion fact is absent (setup never ran, or
     /// crashed midway), or its outputs are incomplete. The
     /// operator must run `setup` first; restarting `run` cannot self-heal.
-    #[error("setup has not completed for this data dir — run `setup` first")]
-    SetupNotComplete,
+    #[error("setup has not completed for data dir {data_dir} — run `setup` first")]
+    SetupNotComplete { data_dir: String },
     /// Another live process holds the exclusive data-directory lock
     /// (`process_lock`). Retry-safe: the lock is what prevents concurrent
     /// harm, and an orchestrated restart racing the previous owner's drain
@@ -359,8 +399,8 @@ pub enum BootstrapError {
     /// nonce from L1 (the one live RPC the gate makes). Transient — the
     /// operator retries once the provider recovers; the prior sync already
     /// proved L1 reachable, so this is a hiccup, not a misconfig.
-    #[error("setup detection: could not read submitter nonce from RPC: {message}")]
-    DetectionNonceRead { message: String },
+    #[error("setup detection: could not read submitter wallet nonce from RPC: {message}")]
+    DetectionWalletNonceRead { message: String },
     /// `setup`'s read-only detection gate found a previous instance left work
     /// this checkpoint cannot account for. Sticky: only wiping the uncompleted
     /// data dir and running `setup --recovery` resolves it — a plain
@@ -385,11 +425,13 @@ pub enum BootstrapError {
     SetupRecovery(#[from] SetupRecoveryError),
 }
 
-/// Terminal failures of the `setup --recovery` procedure — the ones
-/// an operator must resolve (flush, post-flush re-sync, and a stopping block
-/// behind the checkpoint use the transient [`RecoveryError`] paths instead).
-/// All map to [`EXIT_TERMINAL`]:
-/// a plain restart re-runs the same bad inputs and re-fails identically.
+/// Terminal failures of the `setup --recovery` procedure — the ones an
+/// operator must resolve. All map to [`EXIT_TERMINAL`]: a plain restart
+/// re-runs the same bad inputs and re-fails identically. Other failures take
+/// other paths: the flush as [`BootstrapError::Flush`], the post-flush
+/// re-sync as a [`WorkerExit::InputReader`] exit, and a re-sync behind the
+/// flush or a stopping block behind the checkpoint as a retryable
+/// [`RecoveryError`].
 #[derive(Debug, Error)]
 pub enum SetupRecoveryError {
     /// Cross-field config validation failed (recovery missing its dump dir /
@@ -476,11 +518,24 @@ pub enum SetupRefuse {
 /// state from one deployment with another.
 #[derive(Debug, Error)]
 pub enum IdentityError {
-    /// L1 unreachable AND no cached identity in the DB. We need at least one
+    /// An L1 read after the chain-id check (the safe-head sample or discovery)
+    /// failed AND there is no cached identity in the DB. We need at least one
     /// (live L1 query OR a prior boot's pinned identity) to safely bind this
     /// sequencer to a deployment. Operator: bring up L1 and retry.
     #[error("first boot requires L1: no cached deployment identity and L1 is unreachable")]
     FirstBootRequiresL1,
+    /// The application's deployment block is above the L1 safe head sampled
+    /// before discovery read it, so a reorg could still move it. Setup pins
+    /// only a safe deployment. Operator: retry once the safe head reaches it.
+    #[error(
+        "application deployment block {app_deployment_block} is above the L1 safe head \
+         {safe_block} sampled before discovery; setup pins only a safe deployment, retry once \
+         the safe head reaches it"
+    )]
+    DeploymentNotYetSafe {
+        app_deployment_block: u64,
+        safe_block: u64,
+    },
     /// The DB has persisted state but no pinned identity. Binding the current
     /// config now would silently inherit an unknown deployment's data.
     /// Operator: confirm provenance or wipe the DB.
@@ -488,11 +543,8 @@ pub enum IdentityError {
     OrphanedState,
     /// The pinned identity doesn't match the current config.
     ///
-    /// `stored` and `expected` are boxed so the enum stays small — without
-    /// boxing this variant alone would push `CommandError`'s stack footprint past
-    /// 184 bytes, which clippy's `result_large_err` flags (and which inflates
-    /// every `Result<_, CommandError>` in the codebase, even successful returns).
-    /// The heap allocation is paid only on the error path, which is cold.
+    /// `stored` and `expected` are boxed to keep `CommandError` under clippy's
+    /// `result_large_err` limit; the allocation is on the cold error path.
     #[error("deployment identity mismatch ({fields}); stored={stored:?}; expected={expected:?}")]
     Mismatch {
         fields: String,
@@ -503,11 +555,9 @@ pub enum IdentityError {
 
 // ── Worker exits ───────────────────────────────────────────────────────
 
-/// Which runtime worker exited, and why. One generic stop shape per worker
-/// (this replaced six hand-copied per-worker enums), plus the danger
-/// detector's deliberate `RecoveryRequired` trip as its own first-class arm:
-/// not an error, but causes the runtime to exit so the orchestrator can
-/// respawn into startup recovery.
+/// Which runtime worker exited, and why: one generic stop shape per worker, plus
+/// the danger detector's deliberate `RecoveryRequired` trip, which is not an error
+/// but exits the runtime so the orchestrator respawns into startup recovery.
 #[derive(Debug, Error)]
 pub enum WorkerExit {
     #[error("server: {0}")]
@@ -553,12 +603,8 @@ impl WorkerExit {
             WorkerExit::FeeOracle(stop) => {
                 stop.is_terminal_with(FeeOracleError::is_terminal_invariant)
             }
-            WorkerExit::DangerDetected { status } => {
-                matches!(
-                    status,
-                    DangerStatus::CanonicalDivergence(_) | DangerStatus::Safe
-                )
-            }
+            // One home with the exit code, so the abort decision cannot drift.
+            WorkerExit::DangerDetected { status } => danger_failure_verdict(status).is_terminal(),
         }
     }
 }
@@ -630,17 +676,21 @@ impl From<crate::runtime::process_lock::ProcessLockError> for CommandError {
             ProcessLockError::Locked { path } => {
                 CommandError::Bootstrap(BootstrapError::DataDirLocked { path })
             }
-            ProcessLockError::Io(source) => CommandError::Io(source),
+            ProcessLockError::Io { path, source } => {
+                let kind = source.kind();
+                CommandError::Io(std::io::Error::new(
+                    kind,
+                    ProcessLockError::Io { path, source },
+                ))
+            }
         }
     }
 }
 
 /// One shared classification for the keyed signer-provider constructor, so
-/// `setup`, `flush-mempool`, and any future keyed command cannot drift (the
-/// three sites previously classified `Create` three different ways). The
-/// run-recovery procedure keeps its own explicit Retry/Refuse polarity map —
-/// that polarity is recovery's to own — but its terminal/transient split
-/// must agree with this one.
+/// `setup`, `flush-mempool` and any future keyed command agree. Run recovery
+/// keeps its own Retry/Refuse polarity map, but its terminal/transient split must
+/// agree with this one.
 impl From<crate::l1::provider::VerifiedSignerProviderError> for BootstrapError {
     fn from(e: crate::l1::provider::VerifiedSignerProviderError) -> Self {
         use crate::l1::provider::VerifiedSignerProviderError as E;
@@ -715,11 +765,6 @@ impl From<FeeOracleError> for CommandError {
                     message: FeeOracleError::Join(message).to_string(),
                 })
             }
-            FeeOracleError::FatalMath(error) => {
-                CommandError::Bootstrap(BootstrapError::FeeOracleFatal {
-                    message: FeeOracleError::FatalMath(error).to_string(),
-                })
-            }
         }
     }
 }
@@ -727,7 +772,6 @@ impl From<FeeOracleError> for CommandError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::l1::fee_oracle::math::MathError;
     use crate::l1::fee_oracle::worker::FeeOracleError;
     use crate::l1::provider::VerifiedSignerProviderError;
     use crate::l1::submitter::BatchPosterError;
@@ -818,10 +862,26 @@ mod tests {
         ]
     }
 
+    fn setup_reader(error: InputReaderError) -> CommandError {
+        CommandError::Bootstrap(BootstrapError::SetupInputReader(error))
+    }
+
     /// Class 20: restart; a transient refusal that self-heals when the L1
     /// view or the provider recovers.
     fn transient() -> Vec<Row> {
         vec![
+            (
+                setup_reader(InputReaderError::Provider("offline".into())),
+                "an unreachable provider during setup's L1 sync",
+            ),
+            (
+                setup_reader(InputReaderError::InconsistentL1Response("gap".into())),
+                "an inconsistent L1 response during setup's L1 sync",
+            ),
+            (
+                setup_reader(InputReaderError::Storage(busy())),
+                "busy storage during setup's L1 sync",
+            ),
             (
                 danger(DangerStatus::L1ViewStale),
                 "a stale L1 view at runtime",
@@ -854,6 +914,15 @@ mod tests {
                 )),
                 "a first boot without L1",
             ),
+            (
+                CommandError::Bootstrap(BootstrapError::Identity(
+                    IdentityError::DeploymentNotYetSafe {
+                        app_deployment_block: 10,
+                        safe_block: 9,
+                    },
+                )),
+                "a setup before the deployment is safe",
+            ),
             (
                 CommandError::Bootstrap(BootstrapError::ChainIdRpc {
                     message: "provider unavailable".into(),
@@ -864,9 +933,8 @@ mod tests {
                 CommandError::from(FlushError::Provider("x".into())),
                 "the flush's provider",
             ),
-            // A flush failure surfaced via startup recovery must land in the
-            // same class as the flush-mempool subcommand's FlushError
-            // (review M2).
+            // A flush failure surfaced via startup recovery lands in the same
+            // class as the flush-mempool subcommand's `FlushError`.
             (
                 recovery_retry(RecoveryFailure::Flush(FlushError::Provider("x".into()))),
                 "the same flush provider failure under startup recovery",
@@ -878,9 +946,7 @@ mod tests {
                 recovery_retry(RecoveryFailure::ProviderUnreachable("timeout".into())),
                 "the recovery flush's signer provider unreachable",
             ),
-            // Documented "may self-heal" — the definition of this class (it
-            // previously projected to unclassified/1, misleading restart
-            // policy).
+            // Documented "may self-heal": the definition of the retryable class.
             (
                 CommandError::from(FeeOracleError::Transient("RPC unavailable".into())),
                 "a transient fee-oracle failure at bootstrap",
@@ -903,7 +969,29 @@ mod tests {
     /// Class 30: do not restart; page. The state cannot self-heal, so the
     /// black box records the cause (`is_terminal`) for exactly these rows.
     fn terminal() -> Vec<Row> {
-        let mut rows: Vec<Row> = vec![];
+        let mut rows: Vec<Row> = vec![
+            (
+                setup_reader(InputReaderError::Bootstrap("invalid RPC URL".into())),
+                "a malformed RPC URL or wrong InputBox at setup",
+            ),
+            (
+                setup_reader(InputReaderError::ChainIdMismatch {
+                    rpc: 1,
+                    expected: 2,
+                }),
+                "a wrong-chain RPC at setup",
+            ),
+            (
+                setup_reader(InputReaderError::Join("lost".into())),
+                "a lost sync task at setup",
+            ),
+            (
+                setup_reader(InputReaderError::Storage(
+                    rusqlite::Error::QueryReturnedNoRows,
+                )),
+                "persistent storage failure during setup's L1 sync",
+            ),
+        ];
         // A key file that is missing, unreadable, not a file, or not text is
         // the same operator mistake as bad key content one call later, and
         // must not differ from it by 29 in the exit code.
@@ -926,7 +1014,6 @@ mod tests {
             [
                 std::io::ErrorKind::InvalidInput,
                 std::io::ErrorKind::NotFound,
-                std::io::ErrorKind::PermissionDenied,
                 std::io::ErrorKind::InvalidData,
                 std::io::ErrorKind::UnexpectedEof,
                 std::io::ErrorKind::IsADirectory,
@@ -941,9 +1028,8 @@ mod tests {
         );
         rows.extend([
             // A deterministic signer-construction misconfig (bad RPC URL or
-            // private key) classifies terminal in every command, matching the
-            // ChainIdMismatch precedent; setup/flush previously projected it
-            // unclassified while recovery refused it.
+            // private key) is terminal in every command, matching
+            // ChainIdMismatch.
             (
                 CommandError::from(VerifiedSignerProviderError::Create("bad key".into())),
                 "a signer-construction misconfig",
@@ -1002,6 +1088,32 @@ mod tests {
                 CommandError::from(FlushError::Watermark(persistent_watermark())),
                 "the flush's persistent watermark failure",
             ),
+            (
+                CommandError::from(FlushError::UnsignableTransaction("no signer".into())),
+                "a flush no-op the submit provider cannot sign",
+            ),
+            (
+                recovery_refuse(RecoveryFailure::Flush(FlushError::UnsignableTransaction(
+                    "no signer".into(),
+                ))),
+                "the same unsignable no-op under startup recovery",
+            ),
+            (
+                submitter_worker(BatchSubmitterError::Poster(
+                    BatchPosterError::UnsignableTransaction("no signer".into()),
+                )),
+                "a batch transaction the submit provider cannot sign",
+            ),
+            (
+                submitter_worker(BatchSubmitterError::Poster(
+                    BatchPosterError::UndecodableOwnBatch {
+                        input_index: alloy_primitives::U256::from(7),
+                        transaction_hash: None,
+                        reason: "x".into(),
+                    },
+                )),
+                "an undecodable batch from our own submitter key",
+            ),
             (
                 recovery_refuse(RecoveryFailure::Flush(FlushError::Watermark(
                     persistent_watermark(),
@@ -1017,22 +1129,38 @@ mod tests {
                 "canonical divergence at startup recovery",
             ),
             (
-                CommandError::Bootstrap(BootstrapError::SetupNotComplete),
+                CommandError::Bootstrap(BootstrapError::SetupNotComplete {
+                    data_dir: "/data".to_string(),
+                }),
                 "a data directory whose setup never completed",
             ),
             (
                 CommandError::Bootstrap(BootstrapError::ChainIdMismatch { rpc: 1, config: 2 }),
                 "a chain-id mismatch at boot",
             ),
+            (
+                CommandError::Bootstrap(BootstrapError::RpcRedirect { status: 308 }),
+                "an RPC endpoint that redirects setup's chain-id read",
+            ),
             (
                 CommandError::Bootstrap(BootstrapError::InvalidProtocolTiming(
                     ProtocolTimingError::MarginNotLessThanMaxWait {
-                        margin: 1200,
-                        max_wait: 1200,
+                        margin: sequencer_core::MAX_WAIT_BLOCKS,
+                        max_wait: sequencer_core::MAX_WAIT_BLOCKS,
                     },
                 )),
                 "invalid protocol timing",
             ),
+            (
+                CommandError::Bootstrap(BootstrapError::BatchOpenPastDanger {
+                    max_batch_open_seconds: 9601,
+                    seconds_per_block: 12,
+                    open_blocks: 801,
+                    danger_threshold: 900,
+                    margin_blocks: 100,
+                }),
+                "a batch-open window past the danger budget",
+            ),
             (
                 CommandError::Bootstrap(BootstrapError::Identity(IdentityError::OrphanedState)),
                 "orphaned state",
@@ -1095,16 +1223,8 @@ mod tests {
                 "a persistent open failure during the startup sync",
             ),
             (
-                CommandError::from(FeeOracleError::FatalMath(MathError::Overflow)),
-                "fee-oracle fatal math at bootstrap",
-            ),
-            (
-                fee_oracle_worker(FeeOracleError::FatalMath(MathError::Overflow)),
-                "fee-oracle fatal math in the worker",
-            ),
-            (
-                fee_oracle_worker(FeeOracleError::FatalMath(MathError::ExceedsRepresentableRange)),
-                "fee-oracle out-of-range math in the worker",
+                CommandError::from(FeeOracleError::Join("storage task panicked".into())),
+                "a fee-oracle storage-task panic at bootstrap",
             ),
             (
                 CommandError::from(FeeOracleError::Misconfig("wrong pair".into())),
@@ -1174,6 +1294,13 @@ mod tests {
                 CommandError::Io(std::io::Error::other("boom")),
                 "an operational I/O failure",
             ),
+            (
+                CommandError::from(crate::runtime::process_lock::ProcessLockError::Io {
+                    path: "/data/sequencer.lock".to_string(),
+                    source: std::io::Error::from_raw_os_error(13),
+                }),
+                "an I/O failure on the data-directory lock file",
+            ),
             // An environmental read failure on the key file (a device or
             // memory error, not a wrong path) may clear on restart, so it must
             // not consume the do-not-restart code. EIO is the kind the OS
@@ -1226,6 +1353,13 @@ mod tests {
                 CommandError::AppBootstrap(AppError::Io(std::io::ErrorKind::TimedOut.into())),
                 "a timed out genesis read remains restartable",
             ),
+            (
+                CommandError::AppBootstrap(AppError::Io(
+                    std::io::ErrorKind::PermissionDenied.into(),
+                )),
+                "a genesis dump the process may not read or write: may clear, and the C seam \
+                 cannot carry the kind",
+            ),
         ]
     }
 
@@ -1255,6 +1389,52 @@ mod tests {
         }
     }
 
+    /// A detector exit aborts the run exactly when its exit code is terminal:
+    /// only canonical divergence.
+    #[test]
+    fn danger_exit_aborts_only_on_canonical_divergence() {
+        for status in [
+            DangerStatus::ClosedBatchInDanger(1),
+            DangerStatus::TipInDanger(1),
+            DangerStatus::L1ViewStale,
+            DangerStatus::EstimatedBatchInDanger(1),
+            DangerStatus::CanonicalDivergence(1),
+        ] {
+            let terminal = matches!(status, DangerStatus::CanonicalDivergence(_));
+            assert_eq!(
+                WorkerExit::DangerDetected { status }.is_terminal(),
+                terminal,
+                "{status:?}"
+            );
+        }
+    }
+
+    /// The exhaustive match makes a sixth verdict a compile error until its
+    /// exit-line level is chosen here.
+    #[test]
+    fn exit_line_logs_at_error_only_for_terminal_and_unclassified() {
+        use CommandFailureVerdict::*;
+        let at_error = |verdict: CommandFailureVerdict| match verdict {
+            Terminal | Unclassified => true,
+            ExpectedRecovery | Retryable | SetupRecoveryRequired => false,
+        };
+        let all = [
+            ExpectedRecovery,
+            Retryable,
+            Terminal,
+            SetupRecoveryRequired,
+            Unclassified,
+        ];
+        for verdict in all {
+            assert_eq!(verdict.logs_at_error(), at_error(verdict), "{verdict:?}");
+        }
+        let actions: std::collections::BTreeSet<_> = all
+            .iter()
+            .map(|verdict| verdict.supervisor_action())
+            .collect();
+        assert_eq!(actions.len(), all.len());
+    }
+
     /// The wire values a supervisor matches on, as integers: a renumbered
     /// constant must fail here, not in a runbook. They are pairwise distinct,
     /// which is what lets the table above pin verdicts through codes; the
diff --git a/sequencer/src/commands/flush.rs b/sequencer/src/commands/flush.rs
index c4bfadb2..9f4d3c4d 100644
--- a/sequencer/src/commands/flush.rs
+++ b/sequencer/src/commands/flush.rs
@@ -1,18 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The `flush-mempool` subcommand: settle the batch-submitter
-//! wallet nonce on demand — submit no-ops for every unresolved slot and wait
-//! until `pending <= safe` and `safe >= watermark + 1`.
-//!
-//! Operator tooling (unstick a wedged nonce, prep before a decommission) and
-//! the same flush `setup --recovery` will run internally. It is a keyed L1
-//! write, so it needs the signing key; it reads the submitter address and the
-//! wallet-nonce watermark from the DB, so it refuses unless `setup` completed.
-//! Flush-only — it does not sync or cascade (those stay in normal-run
-//! recovery), and it requires a completed setup. A successful wallet flush
-//! proves nothing about the rest of the runtime and is never treated as if
-//! it did.
+//! The `flush-mempool` command: settle the batch-submitter wallet nonce on demand
+//! with the same flush startup recovery and `setup --recovery` run. It needs the
+//! signing key and a completed setup, and never syncs, cascades or launches
+//! workers (README "Running").
 
 use super::load_setup_identity;
 use crate::commands::config::FlushConfig;
@@ -21,14 +13,14 @@ use crate::recovery::MempoolFlusher;
 use crate::storage::{self, LifecycleCommand};
 
 pub async fn flush_mempool(config: FlushConfig) -> Result<(), CommandError> {
-    std::fs::create_dir_all(&config.data_dir)?;
+    super::require_data_dir(&config.data_dir)?;
     // Exclusive process ownership: a flush must never broadcast beside a
     // live sequencer (or another flush) reading the same watermark.
     let _process_lock = crate::runtime::process_lock::ProcessLock::acquire(&config.data_dir)?;
     let db_path = config.db_path();
 
-    super::preflight_lifecycle_command(&db_path, LifecycleCommand::MaintenanceFlush)?;
-    let identity = load_setup_identity(&db_path)?;
+    super::preflight_lifecycle_command(&config.data_dir, LifecycleCommand::MaintenanceFlush)?;
+    let identity = load_setup_identity(&config.data_dir)?;
 
     // The signing key must match the pinned submitter — flushing under the
     // wrong key would settle the wrong account's nonce.
@@ -54,23 +46,17 @@ async fn flush_mempool_admitted(
         storage.wallet_nonce_watermark()?
     };
 
-    // Wrong-chain RPC guard: flush broadcasts keyed L1 txs, so —
-    // like `setup` and `run` — it must confirm the RPC's chain id matches the
-    // pinned one before signing, or it would burn submitter nonce slots on the
-    // wrong chain. `create_verified_signer_provider` folds that check into the
-    // signer build (the one guarded keyed-write entry point); a mismatch is
-    // terminal (operator misconfig), an RPC error retryable (flush needs L1
-    // reachable anyway).
-    let provider = crate::l1::provider::create_verified_signer_provider(
-        &config.eth_rpc_url,
+    // Chain-id check before signing: `create_verified_keyed_providers`.
+    let providers = crate::l1::provider::create_verified_keyed_providers(
+        &config.rpc.eth_rpc_url,
         key.expose_secret(),
         identity.chain_id,
-        config.allow_insecure_rpc,
+        config.rpc.allow_insecure_rpc,
     )
     .await
     .map_err(CommandError::from)?;
     let safe_block = MempoolFlusher::flush_to_safe(
-        provider,
+        providers,
         identity.batch_submitter_address,
         config.seconds_per_block,
         db_path,
diff --git a/sequencer/src/commands/mod.rs b/sequencer/src/commands/mod.rs
index d881b923..f969ac01 100644
--- a/sequencer/src/commands/mod.rs
+++ b/sequencer/src/commands/mod.rs
@@ -1,28 +1,16 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The operator commands: each child module is one command *bracket* —
-//! acquire the exclusive process lock, preflight the admission facts,
-//! execute the body, and best-effort record a terminal cause in the black
-//! box. The *mechanisms* the brackets invoke live in their domain modules
-//! (`crate::recovery` for startup repair and flushing, `crate::runtime` for the
-//! shared authority machinery: process lock, `RuntimeScope`).
-//!
-//! - [`run`] — boot workers from a set-up DB (plus `workers`, its supervisor)
-//! - [`setup`] — establish the timeless deployment state
-//! - [`flush`] — settle the wallet nonce without launching
-//!
-//! This module hosts the helpers shared by more than one bracket (identity
-//! gates, keyed-writer verification, lifecycle preflights). The CLI harness
-//! that dispatches the commands lives in [`crate::harness`].
+//! Operator commands. Each child is one bracket: take the process lock, preflight
+//! the admission facts, run the body, and best-effort record a terminal cause.
+//! Mechanisms live in `crate::recovery` and `crate::runtime`; this module holds
+//! the helpers shared by brackets, and [`crate::harness`] dispatches them.
 
 pub mod config;
 pub mod error;
 pub mod flush;
 pub mod run;
 pub mod setup;
-#[cfg(test)]
-pub(crate) mod test_support;
 
 pub use error::{
     BootstrapError, CommandError, IdentityError, SetupRecoveryError, SetupRefuse, WorkerExit,
@@ -35,14 +23,55 @@ use alloy_primitives::Address;
 
 pub(crate) const INPUT_READER_POLL_INTERVAL: Duration = Duration::from_secs(2);
 
+fn setup_not_complete(data_dir: &str) -> CommandError {
+    BootstrapError::SetupNotComplete {
+        data_dir: data_dir.to_string(),
+    }
+    .into()
+}
+
+/// Name the path an I/O error happened at, keeping its kind: the OS message
+/// alone does not say which file failed.
+fn io_error_at(
+    what: &str,
+    path: impl AsRef<std::path::Path>,
+    source: std::io::Error,
+) -> CommandError {
+    std::io::Error::new(
+        source.kind(),
+        format!("{what} {}: {source}", path.as_ref().display()),
+    )
+    .into()
+}
+
+/// Only `setup` creates a data directory, so a mistyped path refuses here
+/// instead of becoming an empty directory that holds a lock file. Only real
+/// absence means "not set up"; an unreadable path stays an I/O error.
+fn require_data_dir(data_dir: &str) -> Result<(), CommandError> {
+    match std::fs::metadata(data_dir) {
+        Ok(metadata) if metadata.is_dir() => Ok(()),
+        Ok(_) => Err(io_error_at(
+            "data dir",
+            data_dir,
+            std::io::Error::new(std::io::ErrorKind::NotADirectory, "not a directory"),
+        )),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Err(setup_not_complete(data_dir)),
+        Err(err) => Err(io_error_at("data dir", data_dir, err)),
+    }
+}
+
 fn preflight_lifecycle_command(
-    db_path: &str,
+    data_dir: &str,
     command: LifecycleCommand,
 ) -> Result<(), CommandError> {
-    if !std::path::Path::new(db_path).try_exists()? {
-        return Err(BootstrapError::SetupNotComplete.into());
+    let db_path = config::db_path_in(data_dir);
+    let exists = std::path::Path::new(&db_path)
+        .try_exists()
+        .map_err(|err| io_error_at("database", &db_path, err))?;
+    if !exists {
+        return Err(setup_not_complete(data_dir));
     }
-    let storage = storage::Storage::open_read_only(db_path)?;
+    let storage = storage::Storage::open_read_only(&db_path)?;
     storage.preflight_lifecycle_command(command)?;
     Ok(())
 }
@@ -79,6 +108,14 @@ pub(crate) fn record_terminal_fault_best_effort(
     }
 }
 
+/// A setup that completed after a fault proves the fault resolved; any fault
+/// at or after the last completion is still news. The order is by wall clock,
+/// so a backward step larger than the gap between completion and a later
+/// fault demotes that fault to debug; the black box keeps it either way.
+fn fault_is_news(fault: &storage::TerminalFault, setup_completed_at_ms: Option<u64>) -> bool {
+    setup_completed_at_ms.is_none_or(|completed| fault.recorded_at_ms >= completed)
+}
+
 /// Verdict-neutral startup read of the black box: if a previous command on
 /// this data directory died terminal, say so once at boot, so the cause is in
 /// this process's log even when the last process's final lines were lost.
@@ -87,23 +124,39 @@ pub(crate) fn record_terminal_fault_best_effort(
 /// a controller panic, SIGKILL) left no row, so there is nothing to report. It runs
 /// ahead of the admission preflight so that a
 /// boot the preflight refuses still logs why the last one died; a data
-/// directory with no database yet is the ordinary case, not a warning.
+/// directory with no database yet is the ordinary case, not a warning. A
+/// fault recorded before the last completed setup was resolved by it and
+/// logs at debug.
 pub(crate) fn warn_on_previous_terminal_fault(db_path: &str) {
     let read = storage::Storage::open_read_only(db_path)
         .map_err(|open_error| open_error.to_string())
         .and_then(|storage| {
-            storage
+            let fault = storage
                 .latest_terminal_fault()
-                .map_err(|read_error| read_error.to_string())
+                .map_err(|read_error| read_error.to_string())?;
+            // An unreadable completion fact keeps the warning.
+            let setup_completed_at_ms = storage.setup_completed_at_ms().ok().flatten();
+            Ok((fault, setup_completed_at_ms))
         });
     match read {
-        Ok(Some(fault)) => tracing::warn!(
+        Ok((Some(fault), setup_completed_at_ms))
+            if fault_is_news(&fault, setup_completed_at_ms) =>
+        {
+            tracing::warn!(
+                command = %fault.command,
+                cause = %fault.cause,
+                recorded_at_ms = fault.recorded_at_ms,
+                age_secs = crate::clock::unix_now_ms().saturating_sub(fault.recorded_at_ms) / 1000,
+                "a previous command on this data directory ended in a terminal fault"
+            )
+        }
+        Ok((Some(fault), _)) => tracing::debug!(
             command = %fault.command,
             cause = %fault.cause,
             recorded_at_ms = fault.recorded_at_ms,
-            "a previous command on this data directory ended in a terminal fault"
+            "latest terminal fault predates the completed setup, which resolved it"
         ),
-        Ok(None) => {}
+        Ok((None, _)) => {}
         Err(error) => tracing::debug!(
             error = %error,
             "no readable black box at startup (fresh data directory, or the \
@@ -133,15 +186,14 @@ pub(crate) fn batch_submitter_address_from_private_key(
 /// A missing completion fact — or a completion fact without an identity (a
 /// corrupt/incomplete setup) — is a terminal `SetupNotComplete`: the operator must
 /// (re-)run `setup`, not retry `run`.
-pub(crate) fn load_setup_identity(db_path: &str) -> Result<DeploymentIdentity, CommandError> {
-    let storage = storage::Storage::open_read_only(db_path)?;
+pub(crate) fn load_setup_identity(data_dir: &str) -> Result<DeploymentIdentity, CommandError> {
+    let storage = storage::Storage::open_read_only(&config::db_path_in(data_dir))?;
     if !storage.is_setup_complete()? {
-        return Err(BootstrapError::SetupNotComplete.into());
-    }
-    match storage.deployment_identity()? {
-        Some(identity) => Ok(identity),
-        None => Err(BootstrapError::SetupNotComplete.into()),
+        return Err(setup_not_complete(data_dir));
     }
+    storage
+        .deployment_identity()?
+        .ok_or_else(|| setup_not_complete(data_dir))
 }
 
 /// Verify that the RPC's `eth_chainId` matches the configured chain id.
@@ -149,15 +201,24 @@ pub(crate) fn load_setup_identity(db_path: &str) -> Result<DeploymentIdentity, C
 /// Treated as fatal on mismatch *and* on RPC error: pinning a wrong or
 /// unverified chain id into storage would poison subsequent L1-unreachable
 /// boots and issue soft confirmations against the wrong chain. Caller is
-/// expected to retry on `ChainIdRpc`.
+/// expected to retry on `ChainIdRpc`. A redirect is refused as configuration
+/// (`RpcRedirect`, exit 30): the client follows none, so a retry gets the same
+/// answer. A URL the client refuses (malformed, or plaintext to a remote host
+/// without the opt-in) takes the reader's terminal class: the reader would
+/// refuse it identically one step later.
 pub(crate) async fn validate_rpc_chain_id(
     eth_rpc_url: &str,
     expected: u64,
     allow_insecure: bool,
 ) -> Result<(), CommandError> {
     use alloy::providers::Provider;
-    let check_provider = crate::l1::provider::create_provider(eth_rpc_url, allow_insecure)
-        .map_err(|e| CommandError::Io(std::io::Error::other(e)))?;
+    use alloy_transport::{HttpError, RpcError, TransportErrorKind};
+    let check_provider = crate::l1::provider::create_read_provider(eth_rpc_url, allow_insecure)
+        .map_err(|message| {
+            BootstrapError::SetupInputReader(crate::l1::reader::InputReaderError::Bootstrap(
+                message,
+            ))
+        })?;
     match check_provider.get_chain_id().await {
         Ok(rpc_chain_id) if rpc_chain_id != expected => {
             Err(CommandError::Bootstrap(BootstrapError::ChainIdMismatch {
@@ -166,8 +227,19 @@ pub(crate) async fn validate_rpc_chain_id(
             }))
         }
         Ok(_) => Ok(()),
+        Err(RpcError::Transport(
+            TransportErrorKind::HttpError(HttpError { status, .. })
+            | TransportErrorKind::HttpErrorWithRetryAfter {
+                error: HttpError { status, .. },
+                ..
+            },
+        )) if (300..400).contains(&status) => {
+            Err(CommandError::Bootstrap(BootstrapError::RpcRedirect {
+                status,
+            }))
+        }
         Err(e) => Err(CommandError::Bootstrap(BootstrapError::ChainIdRpc {
-            message: e.to_string(),
+            message: crate::l1::provider::error_chain(&e),
         })),
     }
 }
@@ -254,11 +326,12 @@ mod tests {
     use super::{
         BootstrapError, CommandError, IdentityError, batch_submitter_address_from_private_key,
         deployment_identity_mismatch_fields, ensure_deployment_identity,
-        require_deployment_identity_match,
+        preflight_lifecycle_command, require_data_dir, require_deployment_identity_match,
     };
     use crate::recovery::{RecoveryError, RecoveryRetryReason};
-    use crate::storage::test_helpers::{SENDER_A, default_protocol_timing, temp_db};
-    use crate::storage::{DeploymentIdentity, Storage};
+    use crate::storage::test_helpers::{SENDER_A, default_protocol_timing};
+    use crate::storage::{DeploymentIdentity, LifecycleCommand, Storage};
+    use crate::test_support::temp_db;
     use alloy_primitives::Address;
     use sequencer_core::protocol::ProtocolTimingError;
 
@@ -331,8 +404,8 @@ mod tests {
     #[test]
     fn invalid_protocol_config_propagates_through_run_error() {
         let err: CommandError = ProtocolTimingError::MarginNotLessThanMaxWait {
-            margin: 1200,
-            max_wait: 1200,
+            margin: sequencer_core::MAX_WAIT_BLOCKS,
+            max_wait: sequencer_core::MAX_WAIT_BLOCKS,
         }
         .into();
         assert!(matches!(
@@ -428,4 +501,58 @@ mod tests {
             "private key material must not be reflected in startup errors"
         );
     }
+
+    #[test]
+    fn missing_data_dir_refusal_names_the_path() {
+        let parent = tempfile::tempdir().expect("create parent dir");
+        let mistyped = parent.path().join("mistyped");
+        let mistyped = mistyped.to_str().expect("utf8 path");
+
+        let err = require_data_dir(mistyped).expect_err("a missing data dir must refuse");
+
+        assert!(matches!(
+            err,
+            CommandError::Bootstrap(BootstrapError::SetupNotComplete { .. })
+        ));
+        assert!(err.to_string().contains(mistyped), "{err}");
+    }
+
+    #[test]
+    fn a_data_dir_that_is_a_file_is_an_io_error_not_missing_setup() {
+        let file = tempfile::NamedTempFile::new().expect("create file");
+        let path = file.path().to_str().expect("utf8 path");
+
+        let err = require_data_dir(path).expect_err("a file is not a data dir");
+
+        assert!(matches!(err, CommandError::Io(_)), "{err:?}");
+        assert!(err.to_string().contains(path), "{err}");
+    }
+
+    #[test]
+    fn database_probe_failure_names_the_path() {
+        // A file as the data dir makes the database probe fail with
+        // NotADirectory, which works under root where permission bits do not.
+        let file = tempfile::NamedTempFile::new().expect("create file");
+        let data_dir = file.path().to_str().expect("utf8 path");
+        let db_path = crate::commands::config::db_path_in(data_dir);
+
+        let err = preflight_lifecycle_command(data_dir, LifecycleCommand::Run)
+            .expect_err("a database under a file cannot be probed");
+
+        assert!(matches!(err, CommandError::Io(_)), "{err:?}");
+        assert!(err.to_string().contains(&db_path), "{err}");
+    }
+
+    #[test]
+    fn fault_is_news_only_at_or_after_the_last_completed_setup() {
+        let fault = crate::storage::TerminalFault {
+            command: LifecycleCommand::Setup,
+            cause: "prior terminal death".to_string(),
+            recorded_at_ms: 100,
+        };
+        assert!(super::fault_is_news(&fault, None));
+        assert!(!super::fault_is_news(&fault, Some(200)));
+        assert!(super::fault_is_news(&fault, Some(100)));
+        assert!(super::fault_is_news(&fault, Some(50)));
+    }
 }
diff --git a/sequencer/src/commands/run/mod.rs b/sequencer/src/commands/run/mod.rs
index d2384930..e7b9ffd8 100644
--- a/sequencer/src/commands/run/mod.rs
+++ b/sequencer/src/commands/run/mod.rs
@@ -1,22 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The `run` command: boot the sequencer from an already-set-up DB.
-//!
-//! Phases:
-//!
-//! 1. **Gate + identity**: refuse unless `setup` completed; read the pinned
-//!    deployment identity from the DB (chain id / app address are no longer
-//!    CLI args — they come from the identity).
-//! 2. **Recovery**: inspect local facts, sync L1, and perform the selected repair
-//!    (`crate::recovery` owns the mechanism; this bracket only invokes it).
-//! 3. **Prepare + admit + launch**: prepare every fallible runtime resource,
-//!    recheck admission over one consistent fact set, then consume the
-//!    single-use admission in one non-yielding worker launch (`workers`).
-//!
-//! Two senses of "admitted": phase 1 is the *lifecycle* gate (the
-//! `_admitted` suffix all three command brackets share); the *runtime*
-//! admission witness is minted later, in phase 3.
+//! The `run` command: refuse unless `setup` completed, read the pinned identity,
+//! run startup recovery (`crate::recovery`), then prepare, admit and launch the
+//! workers (`workers`). The `_admitted` suffix names the lifecycle gate, not the
+//! runtime admission witness, which is minted after preparation.
 
 mod startup_hygiene;
 mod workers;
@@ -48,10 +36,10 @@ where
     A: Application + 'static,
 {
     // ── Gate + identity ──────────────────────────────────────
-    std::fs::create_dir_all(&config.data_dir)?;
-    // Exclusive process ownership, ahead of every read. The controller keeps
-    // its own clone through durable settlement; runtime-owned tasks separately
-    // retain clones until they stop.
+    super::require_data_dir(&config.data_dir)?;
+    // Exclusive process ownership, ahead of every read of the directory's
+    // contents. The controller keeps its own clone through durable
+    // settlement; runtime-owned tasks separately retain clones until they stop.
     let process_lock = process_lock::ProcessLock::acquire(&config.data_dir)?;
     let db_path = config.db_path();
     let timing = config.protocol_timing()?;
@@ -60,8 +48,8 @@ where
     // RPC: canonical divergence and the two-sided setup-completion rule.
     // Divergence is never reinterpreted as a provider failure.
     warn_on_previous_terminal_fault(&db_path);
-    preflight_lifecycle_command(&db_path, LifecycleCommand::Run)?;
-    let identity = load_setup_identity(&db_path)?;
+    preflight_lifecycle_command(&config.data_dir, LifecycleCommand::Run)?;
+    let identity = load_setup_identity(&config.data_dir)?;
 
     // `run` holds the signing key (it submits). The key's address must match
     // the pinned submitter address — running with the wrong key against a DB
@@ -72,14 +60,14 @@ where
     // exactly one route to the pinned values exists below this gate.
     let l1_config = L1Config {
         identity,
-        eth_rpc_url: config.eth_rpc_url.clone(),
+        eth_rpc_url: config.rpc.eth_rpc_url.clone(),
         batch_submitter_private_key: key,
-        allow_insecure_rpc: config.allow_insecure_rpc,
+        allow_insecure_rpc: config.rpc.allow_insecure_rpc,
     };
 
     let result = run_admitted::<A>(config, timing, l1_config, process_lock.clone()).await;
     // The Ok-path divergence fact check (run's counterpart of the one
-    // `complete_setup` keeps): divergence persisted during this run must
+    // `complete_baseline_setup` keeps): divergence persisted during this run must
     // exit terminal even through a clean drain — exit 0 is the one code
     // that breaks the supervisor's rediscovery chain (restart → preflight
     // refusal), and the detector's poll cadence leaves a window where a
@@ -116,11 +104,10 @@ where
     // the pinned InputBox address + app deployment block and syncs incrementally.
     let mut input_reader = InputReader::from_parts(
         InputReaderConfig {
-            rpc_url: config.eth_rpc_url.clone(),
-            allow_insecure_rpc: config.allow_insecure_rpc,
+            rpc_url: config.rpc.eth_rpc_url.clone(),
+            allow_insecure_rpc: config.rpc.allow_insecure_rpc,
             app_address: l1_config.identity.app_address,
             poll_interval: INPUT_READER_POLL_INTERVAL,
-            long_block_range_error_codes: config.long_block_range_error_codes.clone(),
             expected_chain_id: l1_config.identity.chain_id,
         },
         l1_config.identity.input_box_address,
@@ -137,16 +124,23 @@ where
 
     tracing::info!(
         http_addr = %config.http_addr,
+        internal_http_addr = %config.internal_http_addr,
         data_dir = %config.data_dir,
-        eth_rpc_url = %l1_config.eth_rpc_url,
+        eth_rpc_origin = %crate::l1::provider::rpc_endpoint_origin(&l1_config.eth_rpc_url),
         input_box_address = %l1_config.identity.input_box_address,
         app_deployment_block = l1_config.identity.app_deployment_block,
         chain_id = l1_config.identity.chain_id,
         app_address = %l1_config.identity.app_address,
         batch_submitter_address = %l1_config.identity.batch_submitter_address,
-        max_wait_blocks = timing.max_wait_blocks,
-        preemptive_margin_blocks = timing.preemptive_margin_blocks,
+        max_wait_blocks = timing.max_wait_blocks(),
+        preemptive_margin_blocks = timing.preemptive_margin_blocks(),
         danger_threshold = timing.danger_threshold(),
+        l1_read_stale_after_blocks = timing.l1_read_stale_after_blocks(),
+        seconds_per_block = timing.seconds_per_block(),
+        max_batch_open_seconds = config.max_batch_open_seconds,
+        batch_submitter_confirmation_depth = config.batch_submitter_confirmation_depth,
+        batch_submitter_idle_poll_interval_ms = config.batch_submitter_idle_poll_interval_ms,
+        fee_oracle_poll_interval_ms = config.fee_oracle.poll_interval_ms,
         "sequencer startup"
     );
 
@@ -174,9 +168,9 @@ where
                 pool,
                 twap_window_secs,
             };
-            let provider = crate::l1::provider::create_provider(
-                &config.eth_rpc_url,
-                config.allow_insecure_rpc,
+            let provider = crate::l1::provider::create_read_provider(
+                &config.rpc.eth_rpc_url,
+                config.rpc.allow_insecure_rpc,
             )
             .map_err(crate::l1::fee_oracle::worker::FeeOracleError::Misconfig)?;
             let token = crate::l1::fee_oracle::UniswapV3PriceSource::from_setup_validated(
@@ -217,7 +211,8 @@ where
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::test_helpers::{record_canonical_divergence, temp_db};
+    use crate::storage::test_helpers::record_canonical_divergence;
+    use crate::test_support::temp_db;
 
     #[test]
     fn clean_exit_over_persisted_divergence_is_terminal() {
diff --git a/sequencer/src/commands/run/startup_hygiene.rs b/sequencer/src/commands/run/startup_hygiene.rs
index bfbf7366..3f565f33 100644
--- a/sequencer/src/commands/run/startup_hygiene.rs
+++ b/sequencer/src/commands/run/startup_hygiene.rs
@@ -12,10 +12,11 @@ use crate::ingress::inclusion_lane::dump_info::{self, delete_dump_dir};
 /// Repair interrupted artifact creation/collection before starting workers.
 pub(super) fn run_snapshot_hygiene(
     storage: &mut crate::storage::Storage,
+    data_dir: &str,
     dumps_dir: &std::path::Path,
 ) -> Result<(), CommandError> {
     storage.reset_dump_leases()?;
-    require_rollback_snapshot(storage)?;
+    require_rollback_snapshot(storage, data_dir)?;
     let gc_removed = snapshot_gc_at_startup(storage)?;
     let sweep_removed = sweep_orphan_dumps(storage, dumps_dir)?;
     tracing::debug!(
@@ -26,10 +27,15 @@ pub(super) fn run_snapshot_hygiene(
     Ok(())
 }
 
-fn require_rollback_snapshot(storage: &mut crate::storage::Storage) -> Result<(), CommandError> {
-    let snapshot = storage.rollback_snapshot()?.ok_or(CommandError::Bootstrap(
-        crate::commands::error::BootstrapError::SetupNotComplete,
-    ))?;
+fn require_rollback_snapshot(
+    storage: &mut crate::storage::Storage,
+    data_dir: &str,
+) -> Result<(), CommandError> {
+    let snapshot = storage.rollback_snapshot()?.ok_or_else(|| {
+        CommandError::Bootstrap(crate::commands::error::BootstrapError::SetupNotComplete {
+            data_dir: data_dir.to_string(),
+        })
+    })?;
     dump_info::read_info(&snapshot.dump.prefix).map_err(|source| {
         CommandError::ReferencedSnapshotArtifact {
             path: snapshot.dump.prefix,
@@ -82,21 +88,29 @@ fn sweep_orphan_dumps(
         })
         .collect::<Result<std::collections::HashSet<_>, _>>()?;
     let mut removed = 0;
-    for entry in std::fs::read_dir(dumps_dir)? {
-        let entry = entry?;
+    let listing_error =
+        |err: std::io::Error| crate::commands::io_error_at("dumps dir", dumps_dir, err);
+    for entry in std::fs::read_dir(dumps_dir).map_err(listing_error)? {
+        let entry = entry.map_err(listing_error)?;
         let path = entry.path();
         let retained = match dump_identity(&path) {
             Ok(identity) => known.contains(&identity),
             // GC or an earlier orphan deletion can leave an unregistered
             // dangling symlink. Retained references already resolved above.
             Err(err) if err.kind() == std::io::ErrorKind::NotFound => false,
-            Err(err) => return Err(err.into()),
+            Err(err) => return Err(crate::commands::io_error_at("dump", &path, err)),
         };
         if retained {
             continue;
         }
         match delete_dump_dir(&path) {
-            Ok(()) => removed += 1,
+            Ok(()) => {
+                tracing::info!(
+                    ?path,
+                    "orphan dump sweep: deleted unregistered dump directory"
+                );
+                removed += 1;
+            }
             Err(err) => {
                 tracing::warn!(
                     error = %err,
@@ -118,9 +132,9 @@ fn dump_identity(path: &std::path::Path) -> std::io::Result<(u64, u64)> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::commands::test_support::create_structured_dump;
     use crate::storage::Storage;
-    use crate::storage::test_helpers::temp_db;
+    use crate::test_support::create_structured_dump;
+    use crate::test_support::temp_db;
 
     #[test]
     fn startup_validation_rejects_missing_referenced_snapshot_as_terminal() {
@@ -132,7 +146,7 @@ mod tests {
             .insert_baseline_snapshot(&missing, crate::storage::ExecutedInputCount::ZERO)
             .expect("register missing fixture");
 
-        let err = require_rollback_snapshot(&mut storage)
+        let err = require_rollback_snapshot(&mut storage, "/data")
             .expect_err("a durable DB reference cannot point at a missing artifact");
 
         assert!(matches!(
@@ -155,7 +169,7 @@ mod tests {
             .insert_baseline_snapshot(&corrupt, crate::storage::ExecutedInputCount::ZERO)
             .expect("register corrupt fixture");
 
-        let err = require_rollback_snapshot(&mut storage)
+        let err = require_rollback_snapshot(&mut storage, "/data")
             .expect_err("corrupt durable metadata cannot be retried as operational I/O");
 
         assert!(matches!(
@@ -396,6 +410,43 @@ mod tests {
         assert_eq!(storage.list_dump_rows().unwrap().len(), 2);
     }
 
+    #[test]
+    fn sweep_listing_failure_names_the_dumps_dir() {
+        let db = temp_db("sweep-missing-dumps-dir");
+        let mut storage = Storage::open(db.path.as_str()).expect("open");
+        let parent = tempfile::tempdir().expect("create parent dir");
+        let missing = parent.path().join("dumps");
+
+        let err = sweep_orphan_dumps(&mut storage, &missing)
+            .expect_err("a missing dumps dir cannot be listed");
+
+        assert!(matches!(err, CommandError::Io(_)), "{err:?}");
+        assert!(
+            err.to_string()
+                .contains(missing.to_str().expect("utf8 path")),
+            "{err}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn sweep_identity_failure_names_the_entry() {
+        let db = temp_db("sweep-symlink-loop");
+        let mut storage = Storage::open(db.path.as_str()).expect("open");
+        let dumps = tempfile::tempdir().expect("create dumps dir");
+        let looped = dumps.path().join("loop");
+        std::os::unix::fs::symlink(&looped, &looped).expect("create symlink loop");
+
+        let err = sweep_orphan_dumps(&mut storage, dumps.path())
+            .expect_err("a symlink loop cannot be resolved");
+
+        assert!(
+            err.to_string()
+                .contains(looped.to_str().expect("utf8 path")),
+            "{err}"
+        );
+    }
+
     #[cfg(unix)]
     #[test]
     fn sweep_removes_orphan_symlinks_without_following_them() {
@@ -464,7 +515,7 @@ mod tests {
         assert!(storage.gc_unreferenced_dumps().unwrap().is_empty());
         assert!(obsolete.exists(), "the persisted lease blocks ordinary GC");
 
-        run_snapshot_hygiene(&mut storage, dumps.path()).unwrap();
+        run_snapshot_hygiene(&mut storage, "/data", dumps.path()).unwrap();
 
         assert_eq!(storage.dump_lease_count(baseline_id).unwrap(), Some(0));
         assert_eq!(storage.dump_lease_count(obsolete_id).unwrap(), None);
diff --git a/sequencer/src/commands/run/workers.rs b/sequencer/src/commands/run/workers.rs
index eab65d2a..59971cf4 100644
--- a/sequencer/src/commands/run/workers.rs
+++ b/sequencer/src/commands/run/workers.rs
@@ -1,29 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Runtime worker lifecycle: prepare → admit → launch → stop.
-//!
-//! [`Workers`] owns the core runtime worker handles plus an optional live
-//! Uniswap fee-oracle worker; fixed pricing has no worker.
-//! Runtime construction has one explicit authority boundary:
-//!
-//! - [`PreparedRuntime::prepare`]: prepare every fallible or awaited
-//!   dependency while launching zero workers.
-//! - [`PreparedRuntime::launch`]: consume the controller's single-use durable
-//!   admission witness and launch all workers in one infallible,
-//!   non-yielding step, returning the owning struct.
-//! - [`Workers::select_first_exit`]: race the workers + OS shutdown signal,
-//!   return whichever fired first.
-//! - [`Workers::finish`]: abort terminal failures; otherwise request shutdown,
-//!   drain the remaining workers concurrently, and surface the primary failure.
-//!
-//! Worker plumbing is explicit per worker: one field, one spawn statement,
-//! one select arm, one cleanup entry. Adding a worker means editing each of
-//! those sites, and a missed one fails the build: a field missing from the
-//! `Workers` literal in `launch` or from the exhaustive `let Self { .. }`
-//! destructures in `select_first_exit` and `finish` is a hard error, and a
-//! bound-but-unused field fails under `-D warnings`. Keep those destructures
-//! exhaustive (no `..`).
+//! Runtime worker lifecycle: prepare -> admit -> launch -> stop. Each worker is one
+//! field, one spawn, one select arm and one cleanup entry. The `Workers` literal in
+//! `launch` and the `let Self { .. }` destructures in `select_first_exit` and
+//! `finish` stay exhaustive (no `..`), so a missed site fails the build.
 
 use std::future::Future;
 use std::marker::PhantomData;
@@ -32,7 +13,6 @@ use std::sync::Arc;
 use std::task::Poll;
 use std::time::Duration;
 
-use alloy::providers::DynProvider;
 use tokio::task::JoinHandle;
 use tracing::warn;
 
@@ -45,10 +25,11 @@ use crate::ingress::inclusion_lane::{
 };
 use crate::l1::L1Config;
 use crate::l1::fee_oracle::FeeOracle;
+use crate::l1::provider::KeyedProviders;
 use crate::l1::reader::{InputReader, InputReaderError};
 use crate::l1::submitter::{
     BatchPosterConfig, BatchSubmitter, BatchSubmitterConfig, BatchSubmitterError,
-    EthereumBatchPoster, SubmitterExit,
+    EthereumBatchPoster,
 };
 use crate::recovery::{DangerDetector, DangerDetectorError, DetectorExit};
 use crate::runtime::process_lock::ProcessLock;
@@ -123,8 +104,9 @@ pub(super) struct PreparedRuntime<A> {
     submitter: BatchSubmitter<EthereumBatchPoster>,
     detector: DangerDetector,
     tx_feed: L2TxFeed,
-    listener: tokio::net::TcpListener,
-    bound_addr: std::net::SocketAddr,
+    listeners: http::ApiListeners,
+    public_addr: std::net::SocketAddr,
+    internal_addr: std::net::SocketAddr,
     snapshot_state: http::SnapshotState,
     shutdown: RuntimeScope,
     shutdown_on_drop: ShutdownOnDrop,
@@ -141,7 +123,7 @@ pub(super) struct Workers {
     server: JoinHandle<std::io::Result<()>>,
     lane: JoinHandle<Result<(), InclusionLaneError>>,
     reader: JoinHandle<Result<(), InputReaderError>>,
-    submitter: JoinHandle<Result<SubmitterExit, BatchSubmitterError>>,
+    submitter: JoinHandle<Result<(), BatchSubmitterError>>,
     detector: JoinHandle<Result<DetectorExit, DangerDetectorError>>,
     fee_oracle: Option<JoinHandle<Result<(), crate::l1::fee_oracle::worker::FeeOracleError>>>,
     shutdown: RuntimeScope,
@@ -182,10 +164,15 @@ impl<A: Application + 'static> PreparedRuntime<A> {
         let shutdown_on_drop = ShutdownOnDrop(shutdown.clone());
         let mut storage = crate::storage::Storage::open(&db_path)?;
         let dumps_dir = std::path::Path::new(&run_config.data_dir).join("dumps");
-        std::fs::create_dir_all(&dumps_dir)?;
+        std::fs::create_dir_all(&dumps_dir)
+            .map_err(|err| crate::commands::io_error_at("dumps dir", &dumps_dir, err))?;
 
         // Validate rollback checkpoint metadata and collect obsolete snapshots before admission.
-        super::startup_hygiene::run_snapshot_hygiene(&mut storage, &dumps_dir)?;
+        super::startup_hygiene::run_snapshot_hygiene(
+            &mut storage,
+            &run_config.data_dir,
+            &dumps_dir,
+        )?;
 
         // Prepare every remaining fallible or awaited dependency before the
         // authority boundary. Cancellation observes zero workers.
@@ -197,16 +184,11 @@ impl<A: Application + 'static> PreparedRuntime<A> {
             batch_submitter_address: l1_config.identity.batch_submitter_address,
             start_block: l1_config.identity.app_deployment_block,
             confirmation_depth: run_config.batch_submitter_confirmation_depth,
-            seconds_per_block: timing.seconds_per_block,
-            long_block_range_error_codes: run_config.long_block_range_error_codes.clone(),
+            seconds_per_block: timing.seconds_per_block(),
             expected_chain_id: l1_config.identity.chain_id,
         };
-        let provider = build_batch_submitter_provider(&l1_config)?;
-        let poster = Arc::new(EthereumBatchPoster::new(
-            provider,
-            poster_config,
-            shutdown.clone(),
-        ));
+        let providers = build_batch_submitter_providers(&l1_config)?;
+        let poster = Arc::new(EthereumBatchPoster::new(providers, poster_config));
         let submitter_config = BatchSubmitterConfig {
             idle_poll_interval_ms: run_config.batch_submitter_idle_poll_interval_ms,
         };
@@ -234,8 +216,20 @@ impl<A: Application + 'static> PreparedRuntime<A> {
         let lane_config =
             InclusionLaneConfig::new(dumps_dir).with_max_batch_open(run_config.max_batch_open());
         let api_config = ApiConfig::new(domain, A::max_method_payload_bytes());
-        let listener = tokio::net::TcpListener::bind(&run_config.http_addr).await?;
-        let bound_addr = listener.local_addr()?;
+        let bind = |what: &'static str, addr: &str| {
+            let addr = addr.to_owned();
+            async move {
+                tokio::net::TcpListener::bind(&addr)
+                    .await
+                    .map_err(|err| crate::commands::io_error_at(what, &addr, err))
+            }
+        };
+        let listeners = http::ApiListeners {
+            public: bind("public listener", &run_config.http_addr).await?,
+            internal: bind("internal listener", &run_config.internal_http_addr).await?,
+        };
+        let public_addr = listeners.public.local_addr()?;
+        let internal_addr = listeners.internal.local_addr()?;
         let snapshot_state = http::SnapshotState {
             db_path,
             // The DB row stores the dump *directory*; the app's state
@@ -252,8 +246,9 @@ impl<A: Application + 'static> PreparedRuntime<A> {
             submitter,
             detector,
             tx_feed,
-            listener,
-            bound_addr,
+            listeners,
+            public_addr,
+            internal_addr,
             snapshot_state,
             shutdown,
             shutdown_on_drop,
@@ -275,8 +270,9 @@ impl<A: Application + 'static> PreparedRuntime<A> {
             submitter,
             detector,
             tx_feed,
-            listener,
-            bound_addr,
+            listeners,
+            public_addr,
+            internal_addr,
             snapshot_state,
             shutdown,
             shutdown_on_drop,
@@ -293,16 +289,16 @@ impl<A: Application + 'static> PreparedRuntime<A> {
         let submitter = submitter.start_preflighted(shutdown.clone());
         let detector = detector.start_preflighted(shutdown.signal());
         let fee_oracle = fee_oracle.map(|oracle| oracle.start(shutdown.signal()));
-        // HTTP server (ingress /tx + read routes, egress /ws/subscribe + /health, currently merged).
-        let server = http::start_on_listener(
-            listener,
+        // One task serves the public and internal listeners.
+        let server = http::start_on_listeners(
+            listeners,
             tx,
             shutdown.clone(),
             tx_feed,
             api_config,
             snapshot_state,
         );
-        tracing::info!(address = %bound_addr, "listening");
+        tracing::info!(public = %public_addr, internal = %internal_addr, "listening");
 
         Workers {
             server,
@@ -346,12 +342,9 @@ impl Workers {
                 FirstExit::Worker(WorkerExit::Lane(WorkerStop::from_select(lane_result))),
             reader_result = &mut *reader =>
                 FirstExit::Worker(WorkerExit::InputReader(WorkerStop::from_select(reader_result))),
-            submitter_result = &mut *submitter =>
-                FirstExit::Worker(WorkerExit::BatchSubmitter(WorkerStop::from_select(
-                    // A worker returning `Shutdown` outside a real shutdown
-                    // means it stopped on its own — the unexpected case.
-                    submitter_result.map(|r| r.map(|SubmitterExit::Shutdown| ())),
-                ))),
+            submitter_result = &mut *submitter => FirstExit::Worker(WorkerExit::BatchSubmitter(
+                WorkerStop::from_select(submitter_result),
+            )),
             detector_result = &mut *detector => FirstExit::detector(detector_result),
             fee_oracle_result = async {
                 match fee_oracle.as_mut() {
@@ -616,10 +609,9 @@ async fn wait_for_input_reader_shutdown(
 }
 
 async fn wait_for_batch_submitter_shutdown(
-    handle: JoinHandle<Result<SubmitterExit, BatchSubmitterError>>,
+    handle: JoinHandle<Result<(), BatchSubmitterError>>,
 ) -> Result<(), WorkerExit> {
-    WorkerStop::from_shutdown(handle.await.map(|r| r.map(|SubmitterExit::Shutdown| ())))
-        .map_err(WorkerExit::BatchSubmitter)
+    WorkerStop::from_shutdown(handle.await).map_err(WorkerExit::BatchSubmitter)
 }
 
 /// Detector `Shutdown` is the graceful drain; a `RecoveryRequired` trip
@@ -643,17 +635,14 @@ async fn wait_for_fee_oracle_shutdown(
     WorkerStop::from_shutdown(handle.await).map_err(WorkerExit::FeeOracle)
 }
 
-// Built once during preparation (sync, raw `create_signer_provider`). The
-// submitter is long-lived, so a one-shot startup chain-id check would go stale; the
-// keyed-write guard instead lives in `EthereumBatchPoster::submit_batches`,
-// which re-confirms the chain id immediately before every productive send.
-// The key was already verified against the pinned submitter, so a build
-// failure here is a bad RPC URL / client misconfiguration — the same
-// deterministic terminal class as every signer misconfig.
-fn build_batch_submitter_provider(l1: &L1Config) -> Result<DynProvider, CommandError> {
-    crate::l1::provider::create_signer_provider(
+// Built once during preparation; the poster rechecks the chain id before every
+// send. The key already matched the pinned submitter, so a build failure is a
+// terminal client misconfiguration.
+fn build_batch_submitter_providers(l1: &L1Config) -> Result<KeyedProviders, CommandError> {
+    crate::l1::provider::create_keyed_providers(
         &l1.eth_rpc_url,
         l1.batch_submitter_private_key.expose_secret(),
+        l1.identity.chain_id,
         l1.allow_insecure_rpc,
     )
     .map_err(|message| {
@@ -666,74 +655,9 @@ mod tests {
     use super::*;
     use crate::recovery::DangerDetectorError;
     use crate::storage::DangerStatus;
+    use crate::test_support::{StubApp, create_structured_dump};
     use clap::Parser;
 
-    #[derive(Default)]
-    struct StartupProbeApp {
-        _single_owner: std::cell::Cell<()>,
-        progress: sequencer_core::application::ApplicationProgress,
-    }
-
-    impl Application for StartupProbeApp {
-        fn max_method_payload_bytes() -> usize {
-            0
-        }
-
-        fn validate_user_op(
-            &self,
-            _sender: alloy_primitives::Address,
-            _user_op: &sequencer_core::user_op::UserOp,
-            _current_fee: u16,
-        ) -> Result<
-            sequencer_core::application::ValidationOutcome,
-            sequencer_core::application::AppError,
-        > {
-            Ok(sequencer_core::application::ValidationOutcome::Accept)
-        }
-
-        fn apply_valid_user_op(
-            &mut self,
-            _user_op: &sequencer_core::l2_tx::ValidUserOp,
-            safe_block: u64,
-        ) -> Result<sequencer_core::application::AppOutputs, sequencer_core::application::AppError>
-        {
-            self.progress.advance(safe_block);
-            Ok(Vec::new())
-        }
-
-        fn apply_direct_input(
-            &mut self,
-            input: &sequencer_core::l2_tx::DirectInput,
-        ) -> Result<sequencer_core::application::AppOutputs, sequencer_core::application::AppError>
-        {
-            self.progress.advance(input.block_number);
-            Ok(Vec::new())
-        }
-
-        fn progress(&self) -> sequencer_core::application::ApplicationProgress {
-            self.progress
-        }
-
-        fn from_dump(
-            _prefix: &std::path::Path,
-        ) -> Result<Self, sequencer_core::application::AppError> {
-            Ok(Self::default())
-        }
-
-        fn create_dump(
-            &mut self,
-            prefix: &std::path::Path,
-        ) -> Result<(), sequencer_core::application::AppError> {
-            std::fs::create_dir(prefix)?;
-            std::fs::write(prefix.join("state"), [])?;
-            Ok(())
-        }
-
-        fn state_file_in_dump(prefix: &std::path::Path) -> std::path::PathBuf {
-            prefix.join("state")
-        }
-    }
-
     // ── select!-arm `From<JoinResult>` conversions ──────────────────
     //
     // The detector arm is the interesting one (DangerDetected vs Shutdown vs
@@ -793,7 +717,7 @@ mod tests {
             let shutdown = shutdown.clone();
             async move {
                 shutdown.wait_for_shutdown().await;
-                Ok(SubmitterExit::Shutdown)
+                Ok(())
             }
         });
         let detector = tokio::spawn({
@@ -852,7 +776,7 @@ mod tests {
 
         release_tx.send(()).expect("release worker");
         stopped_rx.await.expect("worker stopped");
-        ProcessLock::acquire(data_dir).expect("lock releases after the last worker exits");
+        ProcessLock::acquire_released(data_dir);
     }
 
     #[test]
@@ -869,6 +793,7 @@ mod tests {
 
     fn startup_workers_config(
         http_addr: String,
+        internal_http_addr: String,
     ) -> (tempfile::TempDir, String, String, WorkersConfig) {
         const KEY: &str = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
 
@@ -879,6 +804,8 @@ mod tests {
             "run".to_string(),
             "--http-addr".to_string(),
             http_addr,
+            "--internal-http-addr".to_string(),
+            internal_http_addr,
             "--data-dir".to_string(),
             data_dir.clone(),
             "--eth-rpc-url".to_string(),
@@ -937,11 +864,10 @@ mod tests {
         };
         let input_reader = InputReader::from_parts(
             crate::l1::reader::InputReaderConfig {
-                rpc_url: run_config.eth_rpc_url.clone(),
+                rpc_url: run_config.rpc.eth_rpc_url.clone(),
                 allow_insecure_rpc: false,
                 app_address: identity.app_address,
                 poll_interval: crate::commands::INPUT_READER_POLL_INTERVAL,
-                long_block_range_error_codes: run_config.long_block_range_error_codes.clone(),
                 expected_chain_id: identity.chain_id,
             },
             identity.input_box_address,
@@ -953,7 +879,7 @@ mod tests {
         );
         let l1_config = L1Config {
             identity,
-            eth_rpc_url: run_config.eth_rpc_url.clone(),
+            eth_rpc_url: run_config.rpc.eth_rpc_url.clone(),
             batch_submitter_private_key: crate::l1::SubmitterKey::new(KEY.to_string()),
             allow_insecure_rpc: false,
         };
@@ -980,9 +906,10 @@ mod tests {
             .await
             .expect("bind occupied listener");
         let http_addr = occupied.local_addr().expect("listener address").to_string();
-        let (_dir, data_dir, _db_path, workers_config) = startup_workers_config(http_addr);
+        let (_dir, data_dir, _db_path, workers_config) =
+            startup_workers_config(http_addr, "127.0.0.1:0".to_string());
 
-        let result = PreparedRuntime::<StartupProbeApp>::prepare(workers_config).await;
+        let result = PreparedRuntime::<StubApp>::prepare(workers_config).await;
         let err = match result {
             Ok(_) => panic!("occupied listener must refuse preparation"),
             Err(err) => err,
@@ -991,21 +918,42 @@ mod tests {
             matches!(&err, CommandError::Io(source) if source.kind() == std::io::ErrorKind::AddrInUse),
             "expected AddrInUse, got {err:?}"
         );
+        assert!(err.to_string().contains("public listener"), "{err}");
         // The boundary check: a worker spawned during preparation would keep
         // the process lock held — through its `RuntimeScope` clone or, for
         // the reader, detector, and fee oracle, its own `ProcessLock` — so
         // this acquire succeeding proves zero workers launched.
-        ProcessLock::acquire(&data_dir)
-            .expect("failed preparation must release ownership with zero live workers");
+        ProcessLock::acquire_released(&data_dir);
+    }
+
+    #[tokio::test]
+    async fn occupied_internal_http_port_fails_before_any_worker_launches() {
+        let occupied = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind occupied listener");
+        let internal_addr = occupied.local_addr().expect("listener address").to_string();
+        let (_dir, data_dir, _db_path, workers_config) =
+            startup_workers_config("127.0.0.1:0".to_string(), internal_addr);
+
+        let err = match PreparedRuntime::<StubApp>::prepare(workers_config).await {
+            Ok(_) => panic!("an occupied internal listener must refuse preparation"),
+            Err(err) => err,
+        };
+        assert!(
+            matches!(&err, CommandError::Io(source) if source.kind() == std::io::ErrorKind::AddrInUse),
+            "expected AddrInUse, got {err:?}"
+        );
+        assert!(err.to_string().contains("internal listener"), "{err}");
+        ProcessLock::acquire_released(&data_dir);
     }
 
     #[tokio::test]
     async fn launch_requires_a_fresh_admission_after_preparation() {
         let (_dir, data_dir, db_path, workers_config) =
-            startup_workers_config("127.0.0.1:0".to_string());
+            startup_workers_config("127.0.0.1:0".to_string(), "127.0.0.1:0".to_string());
 
         let timing = workers_config.timing;
-        let prepared = PreparedRuntime::<StartupProbeApp>::prepare(workers_config)
+        let prepared = PreparedRuntime::<StubApp>::prepare(workers_config)
             .await
             .expect("runtime prepares");
         let admission = crate::recovery::admit_runtime(&db_path, &timing)
@@ -1034,10 +982,10 @@ mod tests {
     #[tokio::test]
     async fn admission_refuses_when_facts_age_during_preparation() {
         let (_dir, _data_dir, db_path, workers_config) =
-            startup_workers_config("127.0.0.1:0".to_string());
+            startup_workers_config("127.0.0.1:0".to_string(), "127.0.0.1:0".to_string());
         let timing = workers_config.timing;
 
-        let prepared = PreparedRuntime::<StartupProbeApp>::prepare(workers_config)
+        let prepared = PreparedRuntime::<StubApp>::prepare(workers_config)
             .await
             .expect("runtime prepares");
 
@@ -1045,7 +993,7 @@ mod tests {
         // while preparation was in flight. The final reducer invocation must
         // classify the new clock refusal before durable Live or launch.
         let future_ms = i64::try_from(crate::clock::unix_now_ms()).expect("clock fits")
-            + i64::try_from(timing.seconds_per_block * 2_000).expect("offset fits");
+            + i64::try_from(timing.seconds_per_block() * 2_000).expect("offset fits");
         crate::storage::Storage::open_connection(&db_path)
             .expect("open raw test connection")
             .execute(
@@ -1215,8 +1163,6 @@ mod tests {
         panic!("terminal runtime returned instead of aborting");
     }
 
-    use crate::commands::test_support::create_structured_dump;
-
     #[test]
     fn detector_inner_error_maps_to_source_variant() {
         let result: DetectorJoinResult = Ok(Err(DangerDetectorError::Join("boom".into())));
diff --git a/sequencer/src/commands/setup/checkpoint_tests.rs b/sequencer/src/commands/setup/checkpoint_tests.rs
index 21f603e4..c1d43c86 100644
--- a/sequencer/src/commands/setup/checkpoint_tests.rs
+++ b/sequencer/src/commands/setup/checkpoint_tests.rs
@@ -16,10 +16,9 @@ use super::{Checkpoint, rebuild_from_checkpoint};
 use crate::commands::error::{BootstrapError, CommandError, EXIT_RESTART_TRANSIENT};
 use crate::ingress::inclusion_lane::dump_info;
 use crate::recovery::{RecoveryError, RecoveryFailure, RecoveryRetryReason};
-use crate::storage::test_helpers::{
-    SENDER_A, default_protocol_timing, pin_test_deployment_identity, temp_db,
-};
+use crate::storage::test_helpers::{SENDER_A, default_protocol_timing};
 use crate::storage::{FrontierMode, LifecycleCommand, Storage, StoredSafeInput};
+use crate::test_support::{pin_test_deployment_identity, temp_db};
 
 struct ReplayForbiddenApp(ApplicationProgress);
 
diff --git a/sequencer/src/commands/setup/fill.rs b/sequencer/src/commands/setup/fill.rs
index c7a01996..a141e8ed 100644
--- a/sequencer/src/commands/setup/fill.rs
+++ b/sequencer/src/commands/setup/fill.rs
@@ -77,11 +77,11 @@ fn write_baseline_dump<A: Application>(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::commands::test_support::SweepTestApp;
-    use crate::ingress::inclusion_lane::{InclusionLane, InclusionLaneConfig, InclusionLaneError};
+    use crate::ingress::inclusion_lane::{InclusionLane, InclusionLaneConfig};
     use crate::runtime::shutdown::RuntimeScope;
-    use crate::storage::test_helpers::{pin_test_deployment_identity, temp_db};
     use crate::storage::{LifecycleCommand, Storage};
+    use crate::test_support::{pin_test_deployment_identity, temp_db};
+    use crate::test_support::{shutdown_lane, wait_until};
     use alloy_primitives::{Address, U256};
     use app_core::application::{WalletApp, WalletConfig};
     use sequencer_core::application::{
@@ -160,7 +160,7 @@ mod tests {
         }
 
         fn state_file_in_dump(prefix: &Path) -> std::path::PathBuf {
-            <SweepTestApp as Application>::state_file_in_dump(prefix)
+            prefix.join("state")
         }
     }
 
@@ -319,7 +319,11 @@ mod tests {
                 .base_executed_input_count,
             42
         );
-        assert_eq!(storage.open_tip_nonce().expect("root nonce"), Some(4));
+        let root = storage.open_state().expect("open state").expect("root tip");
+        assert_eq!(
+            storage.batch_nonce(root.batch_index).expect("root nonce"),
+            4
+        );
     }
 
     #[test]
@@ -589,27 +593,4 @@ mod tests {
 
         shutdown_lane(&shutdown, handle).await;
     }
-
-    async fn wait_until(timeout: Duration, mut predicate: impl FnMut() -> bool) -> bool {
-        let started = tokio::time::Instant::now();
-        while started.elapsed() < timeout {
-            if predicate() {
-                return true;
-            }
-            tokio::time::sleep(Duration::from_millis(5)).await;
-        }
-        predicate()
-    }
-
-    async fn shutdown_lane(
-        shutdown: &RuntimeScope,
-        handle: tokio::task::JoinHandle<Result<(), InclusionLaneError>>,
-    ) {
-        shutdown.request_shutdown();
-        let joined = tokio::time::timeout(Duration::from_secs(2), handle)
-            .await
-            .expect("wait for lane shutdown");
-        let result = joined.expect("join lane task");
-        assert!(result.is_ok(), "lane should shut down cleanly: {result:?}");
-    }
 }
diff --git a/sequencer/src/commands/setup/mod.rs b/sequencer/src/commands/setup/mod.rs
index 69ecb0a0..1af58695 100644
--- a/sequencer/src/commands/setup/mod.rs
+++ b/sequencer/src/commands/setup/mod.rs
@@ -1,28 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The `setup` subcommand: establish everything timeless
-//! and pin it in the DB, then mark setup complete so `run` will boot.
-//!
-//! Steps, in order. The storage phases are re-entry-safe (a crashed
-//! attempt's retry begins fresh over its idempotent residue), and the final
-//! transaction is the single linearization point for "A finished":
-//!
-//! 1. Validate protocol timing; create the data dir + `dumps/`.
-//! 2. Require L1: discover the InputBox address + app deployment block from the app
-//!    contract, validate the RPC chain id. (No cached-identity fallback —
-//!    this is first-boot; an unreachable L1 is a retryable refusal.)
-//! 3. Resolve the fee source, pin the complete deployment identity (chain id,
-//!    app address, InputBox address, app deployment block, batch-submitter
-//!    **address**, and fee-oracle identity), and persist the first price.
-//!    `setup` never signs.
-//! 4. Initial L1 sync: read all direct inputs up to the current safe head.
-//! 5. Create the durable genesis or recovered application baseline dump.
-//! 6. Atomically register complete baseline metadata, its artifact, any recovery
-//!    root, and the `setup_complete` fact.
-//!
-//! `setup` is L1-read-only: it takes the batch-submitter address (not the
-//! key) and does no L1 writes.
+//! The `setup` command: pin the deployment identity and fee source, sync L1 to
+//! the safe head, and register the genesis baseline (or the `--recovery` rebuild),
+//! committing `setup_complete` last as its single completion point. Storage phases
+//! are re-entry safe. Plain `setup` reads L1 only and never signs.
 
 use alloy_primitives::Address;
 use sequencer_core::application::{AppError, Application};
@@ -38,7 +20,7 @@ use crate::commands::error::{
     BootstrapError, CommandError, IdentityError, SetupRecoveryError, SetupRefuse, WorkerExit,
 };
 use crate::ingress::inclusion_lane::dump_info;
-use crate::l1::reader::{InputReader, InputReaderConfig, InputReaderError};
+use crate::l1::reader::{InputReader, InputReaderConfig, InputReaderError, sample_safe_block};
 use crate::recovery::{
     MempoolFlusher, RecoveryError, RecoveryRetryReason, assert_resync_caught_up,
 };
@@ -55,7 +37,8 @@ where
         .validate()
         .map_err(|message| SetupRecoveryError::InvalidConfig { message })?;
 
-    std::fs::create_dir_all(&config.data_dir)?;
+    std::fs::create_dir_all(&config.data_dir)
+        .map_err(|err| super::io_error_at("data dir", &config.data_dir, err))?;
     // Exclusive process ownership before any read or mutation: setup rewrites
     // deployment state and must never run beside a live sequencer (or a
     // second setup) on the same data dir.
@@ -95,48 +78,55 @@ where
     // Do not create auxiliary data-dir entries before durable lifecycle
     // admission. The lock file itself is the unavoidable ownership anchor.
     let dumps_dir = std::path::Path::new(&config.data_dir).join("dumps");
-    std::fs::create_dir_all(&dumps_dir)?;
+    std::fs::create_dir_all(&dumps_dir)
+        .map_err(|err| super::io_error_at("dumps dir", &dumps_dir, err))?;
 
     // ── L1 discovery (required) ──────────────────────────────
+    // The chain check comes first, so a wrong-chain endpoint is reported as
+    // such rather than as a missing contract.
+    validate_rpc_chain_id(
+        &config.rpc.eth_rpc_url,
+        config.chain_id,
+        config.rpc.allow_insecure_rpc,
+    )
+    .await?;
+
     let input_reader_config = InputReaderConfig {
-        rpc_url: config.eth_rpc_url.clone(),
-        allow_insecure_rpc: config.allow_insecure_rpc,
+        rpc_url: config.rpc.eth_rpc_url.clone(),
+        allow_insecure_rpc: config.rpc.allow_insecure_rpc,
         app_address: config.app_address,
         poll_interval: super::INPUT_READER_POLL_INTERVAL,
-        long_block_range_error_codes: config.long_block_range_error_codes.clone(),
-        // `validate_rpc_chain_id` below re-checks this against the live RPC; the
+        // `validate_rpc_chain_id` above checked this against the live RPC; the
         // reader's own check then verifies every sync provider serves it too.
         expected_chain_id: config.chain_id,
     };
-    let mut input_reader = match InputReader::new(
-        db_path.clone(),
-        input_reader_config,
-        config.batch_submitter_address,
-        timing,
-        process_lock.clone(),
-    )
-    .await
-    {
-        Ok(reader) => reader,
+    // Safe is sampled before discovery reads the deployment block at latest: a
+    // later sample could approve a deployment that a reorg in between moved.
+    let discovered = async {
+        let safe_block =
+            sample_safe_block(&config.rpc.eth_rpc_url, config.rpc.allow_insecure_rpc).await?;
+        let reader = InputReader::new(
+            db_path.clone(),
+            input_reader_config,
+            config.batch_submitter_address,
+            timing,
+            process_lock.clone(),
+        )
+        .await?;
+        Ok::<_, InputReaderError>((safe_block, reader))
+    }
+    .await;
+    let (safe_before_discovery, mut input_reader) = match discovered {
+        Ok(discovered) => discovered,
         Err(InputReaderError::Provider(e)) => {
             // First boot needs L1 to discover + pin identity. Retryable: the
             // operator brings L1 up and re-runs `setup`.
-            tracing::error!(error = %e, "L1 unreachable during setup — cannot discover identity");
+            tracing::warn!(error = %e, "L1 unreachable during setup — cannot discover identity");
             return Err(IdentityError::FirstBootRequiresL1.into());
         }
-        Err(source) => {
-            return Err(CommandError::Worker(WorkerExit::InputReader(
-                crate::commands::error::WorkerStop::Source(source),
-            )));
-        }
+        Err(source) => return Err(BootstrapError::SetupInputReader(source).into()),
     };
-
-    validate_rpc_chain_id(
-        &config.eth_rpc_url,
-        config.chain_id,
-        config.allow_insecure_rpc,
-    )
-    .await?;
+    require_deployment_safe(input_reader.app_deployment_block(), safe_before_discovery)?;
 
     // Resolve and validate the complete fee source while setup still owns all
     // address-bearing configuration. `run` later reads only this pinned tuple.
@@ -148,7 +138,7 @@ where
         .map_err(|message| BootstrapError::FeeOracleMisconfig { message })?;
     enum PreparedFeeOracle {
         Fixed {
-            log_gas_price: u16,
+            log_gas_price: i16,
         },
         Uniswap {
             identity: FeeOracleIdentity,
@@ -157,24 +147,19 @@ where
         },
     }
     let prepared_fee_oracle = match fee_oracle {
-        FeeOracleMode::Fixed { log_gas_price } => PreparedFeeOracle::Fixed { log_gas_price },
+        FeeOracleMode::Fixed { log_gas_price } => {
+            check_fixed_log_gas_price(&db_path, log_gas_price)?;
+            PreparedFeeOracle::Fixed { log_gas_price }
+        }
         FeeOracleMode::Uniswap(uniswap) => {
-            // Setup requires L1: transient and misconfig both abort, before
-            // anything pins (one connect/classify home).
+            // Setup requires L1: transient and misconfig both abort before
+            // anything pins.
             let (provider, token) = crate::l1::fee_oracle::connect_uniswap(
-                &config.eth_rpc_url,
-                config.allow_insecure_rpc,
+                &config.rpc.eth_rpc_url,
+                config.rpc.allow_insecure_rpc,
                 uniswap,
             )
-            .await
-            .map_err(|error| match error {
-                crate::l1::fee_oracle::UniswapConnectError::Transient { message, .. } => {
-                    BootstrapError::FeeOracleTransient { message }
-                }
-                crate::l1::fee_oracle::UniswapConnectError::Misconfig(message) => {
-                    BootstrapError::FeeOracleMisconfig { message }
-                }
-            })?;
+            .await?;
             PreparedFeeOracle::Uniswap {
                 identity: FeeOracleIdentity::Uniswap {
                     weth: uniswap.weth,
@@ -264,11 +249,7 @@ where
     input_reader
         .sync_to_current_safe_head()
         .await
-        .map_err(|e| {
-            CommandError::Worker(WorkerExit::InputReader(
-                crate::commands::error::WorkerStop::Source(e),
-            ))
-        })?;
+        .map_err(BootstrapError::SetupInputReader)?;
 
     // ── Branch: recovery rebuild vs the genesis-style detect-and-refuse ──
     let mut storage = storage::Storage::open(&db_path)?;
@@ -296,8 +277,8 @@ where
         // plain `setup` is a no-op; detecting a dirty chain is the job of a
         // fresh setup/rebuild.
         //
-        // Coherence: read the submitter's `safe` nonce at the **persisted** safe
-        // block from the sync, not the live `Safe` tag. The head can advance
+        // Coherence: read the submitter's `safe` wallet nonce at the
+        // **persisted** safe block from the sync, not the live `Safe` tag. The head can advance
         // between the sync and this read; pinning step 1 to the same block step 2
         // scans (`safe_inputs` up to that block) closes the window where a batch
         // landing in between would be counted as settled by a live-tag read yet
@@ -308,18 +289,18 @@ where
         // from this pool but alive elsewhere evades it, bounded at runtime by the
         // content-identity check (CanonicalDivergence → cockroach recovery).
         let synced_safe_block = storage.current_safe_block()?;
-        let nonce_views = read_submitter_nonce_views(
-            &config.eth_rpc_url,
+        let wallet_nonces = read_submitter_wallet_nonces(
+            &config.rpc.eth_rpc_url,
             config.batch_submitter_address,
             synced_safe_block,
-            config.allow_insecure_rpc,
+            config.rpc.allow_insecure_rpc,
         )
         .await?;
         run_detection_gate(
             &mut storage,
             config.batch_submitter_address,
             config.checkpoint_block,
-            nonce_views,
+            wallet_nonces,
         )?;
 
         // ── Genesis snapshot ─────────────────────────────────────
@@ -348,13 +329,31 @@ enum SetupAdmission {
     AlreadyComplete,
 }
 
+/// Refuse a fixed price the fee-floor CHECK would reject, before it pins an
+/// identity whose first price write could never succeed.
+fn check_fixed_log_gas_price(db_path: &str, log_gas_price: i16) -> Result<(), CommandError> {
+    let floor = storage::Storage::open(db_path)?.log_gas_price_floor()?;
+    if log_gas_price < floor {
+        return Err(BootstrapError::FeeOracleMisconfig {
+            message: format!(
+                "fixed log gas price {log_gas_price} is below {floor}, which would make \
+                 the recommended fee negative"
+            ),
+        }
+        .into());
+    }
+    Ok(())
+}
+
 fn admit_setup_lifecycle(
     db_path: &str,
     command: storage::LifecycleCommand,
     recovery: bool,
 ) -> Result<SetupAdmission, CommandError> {
-    let populated =
-        std::path::Path::new(db_path).try_exists()? && !existing_sqlite_schema_is_empty(db_path)?;
+    let exists = std::path::Path::new(db_path)
+        .try_exists()
+        .map_err(|err| super::io_error_at("database", db_path, err))?;
+    let populated = exists && !existing_sqlite_schema_is_empty(db_path)?;
     if !populated {
         storage::Storage::initialize_for_command(db_path, command)?;
         return Ok(SetupAdmission::Proceed);
@@ -535,7 +534,7 @@ where
 
     // 2. Flush the previous instance's batch txs → C, the post-flush safe head.
     let stop_block =
-        flush_wallet_nonce(config, identity, timing.seconds_per_block, storage).await?;
+        flush_wallet_nonce(config, identity, timing.seconds_per_block(), storage).await?;
 
     // 3. Re-sync through C, then verify the resynced safe block reaches the
     //    flush observation before cascade. Frontier population stays OFF (the
@@ -641,17 +640,17 @@ async fn flush_wallet_nonce(
     // so re-confirm the RPC serves the pinned chain right before building the
     // signer (the earlier `validate_rpc_chain_id` may have gone stale). Same
     // guarded constructor the runtime flush and `flush-mempool` use.
-    let provider = crate::l1::provider::create_verified_signer_provider(
-        &config.eth_rpc_url,
+    let providers = crate::l1::provider::create_verified_keyed_providers(
+        &config.rpc.eth_rpc_url,
         key.expose_secret(),
         config.chain_id,
-        config.allow_insecure_rpc,
+        config.rpc.allow_insecure_rpc,
     )
     .await
     .map_err(CommandError::from)?;
     let watermark = storage.wallet_nonce_watermark()?;
     let stop_block = MempoolFlusher::flush_to_safe(
-        provider,
+        providers,
         identity.batch_submitter_address,
         seconds_per_block,
         config.db_path(),
@@ -675,23 +674,23 @@ fn to_fold_input(input: crate::storage::StoredSafeInput) -> FoldInput {
 /// The read-only detection gate, separated
 /// from the L1/RPC I/O so its logic is unit-testable against a seeded DB.
 ///
-/// `nonce_views` is the submitter's `(pending, safe)` wallet nonce read from
+/// `wallet_nonces` is the submitter's `(pending, safe)` wallet nonce read from
 /// L1; `storage` holds the safe inputs synced to the safe head. The two steps
-/// are ordered on purpose: step 1 (nonce settled?) gates step 2 (scan). An
-/// unsettled nonce refuses *without* scanning — unsafe batches are not yet in
+/// are ordered on purpose: step 1 (wallet nonce settled?) gates step 2 (scan).
+/// An unsettled wallet nonce refuses *without* scanning — unsafe batches are not yet in
 /// `safe_inputs`, so the scan would be incomplete and could false-negative.
 fn run_detection_gate(
     storage: &mut storage::Storage,
     batch_submitter: Address,
     checkpoint_block: u64,
-    (pending_nonce, safe_nonce): (u64, u64),
+    (pending_wallet_nonce, safe_wallet_nonce): (u64, u64),
 ) -> Result<(), CommandError> {
     // Step 1 — `pending > safe` means a previous instance left in-flight
     // (pending or mined-but-unsafe) batch txs.
-    if pending_nonce > safe_nonce {
+    if pending_wallet_nonce > safe_wallet_nonce {
         return Err(SetupRefuse::WalletNonceUnsettled {
-            pending: pending_nonce,
-            safe: safe_nonce,
+            pending: pending_wallet_nonce,
+            safe: safe_wallet_nonce,
         }
         .into());
     }
@@ -725,13 +724,13 @@ fn run_detection_gate(
 /// a TOCTOU gap. `None` (no safe head persisted — not expected after a
 /// successful sync) falls back to the `Safe` tag.
 ///
-/// Builds a provider from the RPC URL via the same `create_provider` the input
+/// Builds a provider from the RPC URL via the same `create_read_provider` the input
 /// reader uses (the reader holds no long-lived provider — it builds one per
 /// pass), so no second persistent connection is introduced. Both reads are the
 /// batch-submitter's `eth_getTransactionCount`; an RPC failure here is
-/// transient ([`BootstrapError::DetectionNonceRead`]) — the prior sync already
+/// transient ([`BootstrapError::DetectionWalletNonceRead`]) — the prior sync already
 /// proved L1 reachable.
-async fn read_submitter_nonce_views(
+async fn read_submitter_wallet_nonces(
     eth_rpc_url: &str,
     batch_submitter: Address,
     safe_block: Option<u64>,
@@ -740,14 +739,14 @@ async fn read_submitter_nonce_views(
     use alloy::providers::Provider;
     use alloy::rpc::types::BlockNumberOrTag;
 
-    let provider = crate::l1::provider::create_provider(eth_rpc_url, allow_insecure)
-        .map_err(|message| BootstrapError::DetectionNonceRead { message })?;
+    let provider = crate::l1::provider::create_read_provider(eth_rpc_url, allow_insecure)
+        .map_err(|message| BootstrapError::DetectionWalletNonceRead { message })?;
     let pending = provider
         .get_transaction_count(batch_submitter)
         .block_id(BlockNumberOrTag::Pending.into())
         .await
-        .map_err(|e| BootstrapError::DetectionNonceRead {
-            message: e.to_string(),
+        .map_err(|e| BootstrapError::DetectionWalletNonceRead {
+            message: crate::l1::provider::error_chain(&e),
         })?;
     let safe_tag = match safe_block {
         Some(block) => BlockNumberOrTag::Number(block),
@@ -757,8 +756,8 @@ async fn read_submitter_nonce_views(
         .get_transaction_count(batch_submitter)
         .block_id(safe_tag.into())
         .await
-        .map_err(|e| BootstrapError::DetectionNonceRead {
-            message: e.to_string(),
+        .map_err(|e| BootstrapError::DetectionWalletNonceRead {
+            message: crate::l1::provider::error_chain(&e),
         })?;
     Ok((pending, safe))
 }
@@ -771,7 +770,9 @@ async fn read_submitter_nonce_views(
 fn existing_sqlite_schema_is_empty(
     db_path: &str,
 ) -> Result<bool, crate::commands::error::CommandError> {
-    if std::fs::metadata(db_path)?.len() == 0 {
+    let metadata =
+        std::fs::metadata(db_path).map_err(|err| super::io_error_at("database", db_path, err))?;
+    if metadata.len() == 0 {
         return Ok(true);
     }
     let connection = rusqlite::Connection::open_with_flags(
@@ -783,19 +784,53 @@ fn existing_sqlite_schema_is_empty(
     Ok(object_count == 0)
 }
 
+/// Setup pins the application's deployment block, the reader's scan floor, only
+/// once it is at or below a safe head sampled before the block was read. Until
+/// then a reorg could move the deployment earlier, and the reader would advance
+/// its safe head over blocks below the pinned floor without reading the inputs
+/// they hold, which the scheduler then drains: divergence. Assumes safe blocks
+/// are permanent and that `block.number` is the RPC block number
+/// (`docs/threat-model/README.md`, L1 chain semantics).
+fn require_deployment_safe(
+    app_deployment_block: u64,
+    safe_block: u64,
+) -> Result<(), IdentityError> {
+    if app_deployment_block > safe_block {
+        return Err(IdentityError::DeploymentNotYetSafe {
+            app_deployment_block,
+            safe_block,
+        });
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::storage::Storage;
     use crate::storage::StoredSafeInput;
-    use crate::storage::test_helpers::{SENDER_A, default_protocol_timing, temp_db};
+    use crate::storage::test_helpers::{SENDER_A, default_protocol_timing};
+    use crate::test_support::temp_db;
+
+    #[test]
+    fn setup_pins_only_a_safe_deployment() {
+        assert!(matches!(
+            require_deployment_safe(10, 9),
+            Err(IdentityError::DeploymentNotYetSafe {
+                app_deployment_block: 10,
+                safe_block: 9
+            })
+        ));
+        require_deployment_safe(10, 10).expect("a deployment at the safe head is final");
+        require_deployment_safe(10, 11).expect("a deployment below the safe head is final");
+    }
 
     #[test]
     fn checkpoint_load_requires_an_export_receipt_matching_the_artifact_and_block() {
-        use crate::commands::test_support::SweepTestApp;
+        use crate::test_support::StubApp;
         let dir = tempfile::tempdir().expect("checkpoint parent");
         let prefix = dir.path().join("checkpoint");
-        let mut app = SweepTestApp;
+        let mut app = StubApp::default();
         dump_info::create_dump_dir_with_info(
             &mut app,
             &prefix,
@@ -803,7 +838,7 @@ mod tests {
         )
         .expect("create artifact");
         assert!(matches!(
-            Checkpoint::<SweepTestApp>::load(&prefix, 10),
+            Checkpoint::<StubApp>::load(&prefix, 10),
             Err(SetupRecoveryError::CheckpointLoad { .. })
         ));
         let write_receipt = |nonce| {
@@ -820,15 +855,15 @@ mod tests {
         };
         write_receipt(4);
         assert!(matches!(
-            Checkpoint::<SweepTestApp>::load(&prefix, 10),
+            Checkpoint::<StubApp>::load(&prefix, 10),
             Err(SetupRecoveryError::CheckpointLoad { .. })
         ));
         write_receipt(3);
         assert!(matches!(
-            Checkpoint::<SweepTestApp>::load(&prefix, 11),
+            Checkpoint::<StubApp>::load(&prefix, 11),
             Err(SetupRecoveryError::CheckpointLoad { .. })
         ));
-        let checkpoint = Checkpoint::<SweepTestApp>::load(&prefix, 10).unwrap();
+        let checkpoint = Checkpoint::<StubApp>::load(&prefix, 10).unwrap();
         assert_eq!(
             (checkpoint.checkpoint_nonce, checkpoint.checkpoint_block),
             (3, 10)
@@ -837,10 +872,10 @@ mod tests {
 
     #[test]
     fn genesis_checkpoint_loads_and_has_an_empty_seed_interval() {
-        use crate::commands::test_support::SweepTestApp;
+        use crate::test_support::StubApp;
         let dir = tempfile::tempdir().expect("checkpoint parent");
         let prefix = dir.path().join("genesis");
-        let mut app = SweepTestApp;
+        let mut app = StubApp::default();
         dump_info::create_dump_dir_with_info(
             &mut app,
             &prefix,
@@ -857,7 +892,7 @@ mod tests {
             .unwrap(),
         )
         .expect("genesis receipt");
-        let checkpoint = Checkpoint::<SweepTestApp>::load(&prefix, 0).expect("load genesis export");
+        let checkpoint = Checkpoint::<StubApp>::load(&prefix, 0).expect("load genesis export");
         assert_eq!(checkpoint.executed_safe_block, checkpoint.checkpoint_block);
         let db = temp_db("genesis-checkpoint-seed");
         let mut storage = Storage::open(&db.path).expect("storage");
@@ -1002,7 +1037,7 @@ mod tests {
     }
 
     #[test]
-    fn detection_refuses_unsettled_nonce_before_scanning() {
+    fn detection_refuses_unsettled_wallet_nonce_before_scanning() {
         let db = temp_db("detect-unsettled");
         let mut storage = Storage::open(db.path.as_str()).expect("open");
         // Step 1 gates step 2: `pending > safe` refuses regardless of inputs
@@ -1045,6 +1080,189 @@ mod tests {
         assert!(run_detection_gate(&mut storage, SENDER_A, 18, (1, 1)).is_ok());
     }
 
+    /// A fixed price below the fee floor would pin an identity whose first
+    /// price write the schema refuses; setup refuses it first.
+    #[test]
+    fn fixed_price_below_the_floor_is_refused() {
+        let db = crate::test_support::temp_db("fixed-price-floor");
+        drop(storage::Storage::open(db.path.as_str()).expect("initialize schema"));
+
+        let err = check_fixed_log_gas_price(&db.path, -1357)
+            .expect_err("one below the floor must be refused");
+        assert!(
+            matches!(
+                err,
+                CommandError::Bootstrap(BootstrapError::FeeOracleMisconfig { .. })
+            ),
+            "{err:?}"
+        );
+        check_fixed_log_gas_price(&db.path, -1356).expect("the floor itself is accepted");
+    }
+
+    /// Setup's L1 discovery uses the startup polarity: a URL the client refuses
+    /// re-fails identically, so it is terminal, and so is an endpoint that
+    /// redirects the chain-id read; an unreachable RPC fails at the chain-id
+    /// read (`ChainIdRpc`) and is retried. The fee-source connect follows the
+    /// runtime classification with setup's messages.
+    #[tokio::test]
+    async fn setup_l1_failures_exit_by_startup_phase() {
+        use crate::commands::error::{EXIT_RESTART_TRANSIENT, EXIT_TERMINAL};
+        use crate::harness::{Cli, Command};
+        use clap::Parser;
+
+        async fn setup_with(rpc_url: &str) -> CommandError {
+            let data_dir = tempfile::tempdir().expect("data dir");
+            let cli = Cli::try_parse_from([
+                "sequencer",
+                "setup",
+                "--data-dir",
+                data_dir.path().to_str().expect("utf8 path"),
+                "--eth-rpc-url",
+                rpc_url,
+                "--chain-id",
+                "31337",
+                "--app-address",
+                "0x1111111111111111111111111111111111111111",
+                "--batch-submitter-address",
+                "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
+            ])
+            .expect("parse setup");
+            let Command::Setup(config) = cli.command else {
+                panic!("expected setup subcommand");
+            };
+            setup(
+                *config,
+                || -> Result<crate::test_support::StubApp, AppError> {
+                    unreachable!("setup fails before building the genesis app")
+                },
+            )
+            .await
+            .expect_err("setup cannot discover L1")
+        }
+
+        let malformed = setup_with("not a url").await;
+        assert!(
+            matches!(
+                malformed,
+                CommandError::Bootstrap(BootstrapError::SetupInputReader(
+                    InputReaderError::Bootstrap(_)
+                ))
+            ),
+            "{malformed:?}"
+        );
+        assert_eq!(malformed.exit_code(), EXIT_TERMINAL);
+
+        let unreachable = setup_with("http://127.0.0.1:1").await;
+        assert_eq!(
+            unreachable.exit_code(),
+            EXIT_RESTART_TRANSIENT,
+            "{unreachable:?}"
+        );
+
+        // Called directly: clap would read CARTESI_SEQUENCER_ALLOW_INSECURE_RPC
+        // from the environment.
+        let plaintext_remote =
+            crate::commands::validate_rpc_chain_id("http://example.invalid:8545", 31337, false)
+                .await
+                .expect_err("plaintext to a remote host needs the opt-in");
+        assert!(
+            matches!(
+                plaintext_remote,
+                CommandError::Bootstrap(BootstrapError::SetupInputReader(
+                    InputReaderError::Bootstrap(_)
+                ))
+            ),
+            "{plaintext_remote:?}"
+        );
+        assert_eq!(plaintext_remote.exit_code(), EXIT_TERMINAL);
+
+        // The client follows no redirect, so a retry would get the same 308.
+        let endpoint = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind endpoint");
+        let endpoint_address = endpoint.local_addr().expect("endpoint address");
+        tokio::spawn(crate::test_support::answer_once(
+            endpoint,
+            "HTTP/1.1 308 Permanent Redirect\r\nLocation: http://127.0.0.1:1/\r\n\
+             Content-Length: 0\r\nConnection: close\r\n\r\n"
+                .to_owned(),
+        ));
+        let redirect = crate::commands::validate_rpc_chain_id(
+            &format!("http://{endpoint_address}/"),
+            31337,
+            false,
+        )
+        .await
+        .expect_err("a redirect is not followed");
+        assert!(
+            matches!(
+                redirect,
+                CommandError::Bootstrap(BootstrapError::RpcRedirect { status: 308 })
+            ),
+            "{redirect:?}"
+        );
+        assert_eq!(redirect.exit_code(), EXIT_TERMINAL);
+
+        use crate::l1::fee_oracle::UniswapConfig;
+        use crate::l1::fee_oracle::uniswap::{PriceSourceError, UniswapV3PriceSource};
+        let uniswap = |twap_window_secs| UniswapConfig {
+            chain_id: 31337,
+            weth: alloy_primitives::Address::repeat_byte(1),
+            fee_token: alloy_primitives::Address::repeat_byte(2),
+            pool: alloy_primitives::Address::repeat_byte(3),
+            twap_window_secs,
+        };
+        async fn connect_with(url: &str, uniswap: UniswapConfig) -> CommandError {
+            match crate::l1::fee_oracle::connect_uniswap(url, false, uniswap).await {
+                Ok(_) => panic!("no pool behind {url}"),
+                Err(error) => error.into(),
+            }
+        }
+
+        let bad_url = connect_with("not a url", uniswap(1_800)).await;
+        let expected = crate::l1::provider::create_read_provider("not a url", false)
+            .expect_err("the client refuses it");
+        assert!(
+            matches!(
+                &bad_url,
+                CommandError::Bootstrap(BootstrapError::FeeOracleMisconfig { message })
+                    if *message == expected
+            ),
+            "{bad_url:?}"
+        );
+        assert_eq!(bad_url.exit_code(), EXIT_TERMINAL);
+
+        let zero_window = connect_with("http://127.0.0.1:1", uniswap(0)).await;
+        assert!(
+            matches!(
+                &zero_window,
+                CommandError::Bootstrap(BootstrapError::FeeOracleMisconfig { message })
+                    if *message == PriceSourceError::ZeroTwapWindow.to_string()
+            ),
+            "{zero_window:?}"
+        );
+        assert_eq!(zero_window.exit_code(), EXIT_TERMINAL);
+
+        let unavailable = connect_with("http://127.0.0.1:1", uniswap(1_800)).await;
+        let provider = crate::l1::provider::create_read_provider("http://127.0.0.1:1", false)
+            .expect("provider construction is local");
+        let Err(PriceSourceError::Provider(expected)) =
+            UniswapV3PriceSource::connect(provider, uniswap(1_800)).await
+        else {
+            panic!("an unreachable RPC is a provider error");
+        };
+        // The provider's text, without the runtime variant's prefix.
+        assert!(
+            matches!(
+                &unavailable,
+                CommandError::Bootstrap(BootstrapError::FeeOracleTransient { message })
+                    if *message == expected
+            ),
+            "{unavailable:?}"
+        );
+        assert_eq!(unavailable.exit_code(), EXIT_RESTART_TRANSIENT);
+    }
+
     /// `setup --recovery`'s flush signs L1 no-ops with the recovery key, so it
     /// must match the pinned batch-submitter — otherwise it would settle some
     /// other account's nonce while recovery never settles the intended wallet.
diff --git a/sequencer/src/commands/test_support.rs b/sequencer/src/commands/test_support.rs
deleted file mode 100644
index f71d5afe..00000000
--- a/sequencer/src/commands/test_support.rs
+++ /dev/null
@@ -1,89 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-//! Shared `#[cfg(test)]` fixtures for the runtime modules: a minimal
-//! [`Application`] stub plus a dump-layout helper, used by the worker
-//! lifecycle tests (`run::workers`), the startup-hygiene tests
-//! (`run::startup_hygiene`), and the setup-fill tests (`setup::fill`).
-
-use std::path::Path;
-
-use crate::ingress::inclusion_lane::dump_info::{self, create_dump_dir_with_info};
-use sequencer_core::application::{
-    AppError, AppOutputs, Application, ApplicationProgress, ValidationOutcome,
-};
-use sequencer_core::history::ExecutedInputCount;
-use sequencer_core::l2_tx::ValidUserOp;
-use sequencer_core::user_op::UserOp;
-
-/// Application stub used in the sweep tests: `create_dump` makes
-/// a directory with a marker file inside. The marker content is irrelevant —
-/// we only care about which directories exist post-sweep.
-#[derive(Clone, Default)]
-pub(crate) struct SweepTestApp {
-    progress: ApplicationProgress,
-}
-
-// Preserve the unit-struct-like fixture spelling used across runtime tests
-// while carrying the execution progress required by `Application`.
-#[allow(non_upper_case_globals)]
-pub(crate) const SweepTestApp: SweepTestApp = SweepTestApp {
-    progress: ApplicationProgress::try_new(ExecutedInputCount::ZERO, 0).expect("coherent progress"),
-};
-
-impl Application for SweepTestApp {
-    fn max_method_payload_bytes() -> usize {
-        0
-    }
-    fn validate_user_op(
-        &self,
-        _sender: alloy_primitives::Address,
-        _user_op: &UserOp,
-        _current_fee: u16,
-    ) -> Result<ValidationOutcome, AppError> {
-        Ok(ValidationOutcome::Accept)
-    }
-    fn apply_valid_user_op(
-        &mut self,
-        _user_op: &ValidUserOp,
-        safe_block: u64,
-    ) -> Result<AppOutputs, AppError> {
-        self.progress.advance(safe_block);
-        Ok(Vec::new())
-    }
-    fn apply_direct_input(
-        &mut self,
-        _input: &sequencer_core::l2_tx::DirectInput,
-    ) -> Result<AppOutputs, AppError> {
-        unimplemented!("not used in these tests")
-    }
-    fn progress(&self) -> ApplicationProgress {
-        self.progress
-    }
-
-    fn from_dump(_prefix: &Path) -> Result<Self, AppError> {
-        Ok(Self::default())
-    }
-    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
-        std::fs::create_dir(prefix)?;
-        std::fs::write(prefix.join("state"), b"")?;
-        Ok(())
-    }
-    fn state_file_in_dump(prefix: &Path) -> std::path::PathBuf {
-        prefix.join("state")
-    }
-}
-
-/// Mirror of the production dump layout for these tests: structured
-/// dir with `info.toml` + the stub app's dump under `state`.
-pub(crate) fn create_structured_dump(dump_dir: &std::path::Path) {
-    create_dump_dir_with_info(
-        &mut SweepTestApp::default(),
-        dump_dir,
-        &dump_info::DumpInfo {
-            format_version: dump_info::FORMAT_VERSION,
-            next_batch_nonce: 0,
-        },
-    )
-    .expect("create structured dump");
-}
diff --git a/sequencer/src/egress/api/health.rs b/sequencer/src/egress/api/health.rs
index 29e4b542..83e65559 100644
--- a/sequencer/src/egress/api/health.rs
+++ b/sequencer/src/egress/api/health.rs
@@ -1,15 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Health probes (k8s-style):
-//!
-//! - `GET /livez`   — process is up. Always 200.
-//! - `GET /readyz`  — ready to accept new transactions. 503 if shutdown is in
-//!   progress or the inclusion lane has dropped its receiver.
-//! - `GET /healthz` — JSON status report. 200 / 503 mirroring `/readyz`.
-//!
-//! Lives on egress because operators (and kubelet, in practice) probe from the
-//! internal-cluster side.
+//! Health probes `/livez`, `/readyz` and `/healthz` (contract: README "Health
+//! probes"). They live on the internal listener because operators and kubelet
+//! probe from inside the cluster.
 
 use std::sync::Arc;
 
diff --git a/sequencer/src/egress/api/history.rs b/sequencer/src/egress/api/history.rs
index e14cd260..caaad0e8 100644
--- a/sequencer/src/egress/api/history.rs
+++ b/sequencer/src/egress/api/history.rs
@@ -84,8 +84,8 @@ async fn history(
     if query.from_generation.is_some() && query.era_id.is_none() {
         return ApiError::bad_request("from_generation requires era_id").into_response();
     }
-    if state.shutdown.is_shutdown_requested() {
-        return ApiError::unavailable("sequencer shutting down").into_response();
+    if let Err(error) = crate::http::reject_if_shutting_down(&state.shutdown) {
+        return error.into_response();
     }
     let db_path = state.db_path.clone();
     match storage_task(state.shutdown.clone(), "read history metadata", move |_| {
@@ -110,8 +110,8 @@ async fn historical_l1_inputs(
         Ok(start) => start,
         Err(error) => return error.into_response(),
     };
-    if state.shutdown.is_shutdown_requested() {
-        return ApiError::unavailable("sequencer shutting down").into_response();
+    if let Err(error) = crate::http::reject_if_shutting_down(&state.shutdown) {
+        return error.into_response();
     }
     let permit = match state.responses.clone().try_acquire_owned() {
         Ok(permit) => permit,
diff --git a/sequencer/src/egress/api/mod.rs b/sequencer/src/egress/api/mod.rs
index 37e2d643..1ff749ab 100644
--- a/sequencer/src/egress/api/mod.rs
+++ b/sequencer/src/egress/api/mod.rs
@@ -21,9 +21,8 @@ pub(crate) use health::HealthState;
 pub use snapshot::SnapshotState;
 pub(crate) use state::SubscribeState;
 
-/// Build the egress router. Each subrouter has its own state; the merge is
-/// transparent to axum's routing. Snapshot routes are always part of the
-/// egress (internal) side — the public/ingress side is a separate router.
+/// Build the egress router, served on the internal listener. Each subrouter
+/// has its own state; the merge is transparent to axum's routing.
 pub(crate) fn router(
     subscribe_state: Arc<SubscribeState>,
     health_state: Arc<HealthState>,
diff --git a/sequencer/src/egress/api/snapshot.rs b/sequencer/src/egress/api/snapshot.rs
index 34595b91..edc8d7b3 100644
--- a/sequencer/src/egress/api/snapshot.rs
+++ b/sequencer/src/egress/api/snapshot.rs
@@ -188,7 +188,10 @@ async fn finalized_state(
             .body(stream_body(file, guard, path))
             .expect("snapshot response headers are well-formed"),
         // `guard` is a local here; on this error path it drops → lease released.
-        Err(err) => internal_error("open finalized state file", err),
+        Err(err) => internal_error(
+            "open finalized state file",
+            format!("{}: {err}", path.display()),
+        ),
     }
 }
 
@@ -257,7 +260,15 @@ fn archive_response(
                     prefix.display()
                 ))
             }
-            Ok(result) => result,
+            Ok(Err(err)) => {
+                if is_client_disconnect(&err) {
+                    tracing::debug!(error = %err, prefix = %prefix.display(), "snapshot archive client disconnected mid-stream");
+                } else {
+                    tracing::warn!(error = %err, prefix = %prefix.display(), "snapshot archive stream failed after the 200");
+                }
+                Err(err)
+            }
+            Ok(Ok(())) => Ok(()),
             Err(_) => abort_terminal("snapshot archive producer panicked"),
         };
         let _ = done_tx.send(result);
@@ -278,11 +289,9 @@ fn archive_response(
         response = response.header("X-Inclusion-Block", block.to_string());
     }
     response
-        .body(Body::from_stream(ReaderStream::new(GuardedReader {
-            file: ArchiveReader {
-                reader,
-                done: Some(done_rx),
-            },
+        .body(Body::from_stream(ReaderStream::new(ArchiveReader {
+            reader,
+            done: Some(done_rx),
             _guard: guard,
         })))
         .expect("snapshot headers are well-formed")
@@ -295,9 +304,10 @@ fn state_file_path(state: &SnapshotState, prefix: &Path) -> PathBuf {
 }
 
 fn stream_body(file: File, guard: LeaseGuard, path: PathBuf) -> Body {
-    Body::from_stream(ReaderStream::new(GuardedReader {
-        file: ComparisonReader { reader: file, path },
-        _guard: Arc::new(guard),
+    Body::from_stream(ReaderStream::new(ComparisonReader {
+        reader: file,
+        path,
+        _guard: guard,
     }))
 }
 
@@ -316,6 +326,9 @@ fn comparison_io<T>(result: std::io::Result<T>, path: &Path) -> std::io::Result<
 struct ComparisonReader<R> {
     reader: R,
     path: PathBuf,
+    /// Owns the lease: dropping the body (completion, error or disconnect)
+    /// releases it.
+    _guard: LeaseGuard,
 }
 
 impl<R: AsyncRead + Unpin> AsyncRead for ComparisonReader<R> {
@@ -327,7 +340,11 @@ impl<R: AsyncRead + Unpin> AsyncRead for ComparisonReader<R> {
         let this = self.get_mut();
         Pin::new(&mut this.reader)
             .poll_read(cx, buf)
-            .map(|result| comparison_io(result, &this.path))
+            .map(|result| {
+                comparison_io(result, &this.path).inspect_err(|error| {
+                    tracing::warn!(error = %error, path = %this.path.display(), "finalized state file read failed after the 200");
+                })
+            })
     }
 }
 
@@ -335,6 +352,8 @@ impl<R: AsyncRead + Unpin> AsyncRead for ComparisonReader<R> {
 struct ArchiveReader {
     reader: tokio::io::DuplexStream,
     done: Option<tokio::sync::oneshot::Receiver<std::io::Result<()>>>,
+    /// The body and the producer each hold the lease (docs/snapshots/lifecycle.md).
+    _guard: Arc<LeaseGuard>,
 }
 
 impl AsyncRead for ArchiveReader {
@@ -409,28 +428,6 @@ async fn acquire_latest(state: &SnapshotApiState) -> Result<Option<LeasedDump>,
     .await
 }
 
-// ── Streaming body that owns the lease guard ───────────────────────────────
-
-/// A file reader that also owns the lease guard. When the response body is
-/// dropped — stream completion, I/O error, or client disconnect — the guard
-/// drops with it and releases the lease.
-struct GuardedReader<R> {
-    file: R,
-    _guard: Arc<LeaseGuard>,
-}
-
-impl<R: AsyncRead + Unpin> AsyncRead for GuardedReader<R> {
-    fn poll_read(
-        self: Pin<&mut Self>,
-        cx: &mut Context<'_>,
-        buf: &mut ReadBuf<'_>,
-    ) -> Poll<std::io::Result<()>> {
-        // `GuardedReader` is `Unpin` (both fields are), so this is sound.
-        let this = self.get_mut();
-        Pin::new(&mut this.file).poll_read(cx, buf)
-    }
-}
-
 // ── Helpers ────────────────────────────────────────────────────────────────
 
 fn if_none_match(headers: &HeaderMap, etag: &str) -> bool {
@@ -440,6 +437,11 @@ fn if_none_match(headers: &HeaderMap, etag: &str) -> bool {
         == Some(etag)
 }
 
+/// The client dropped the body, so the duplex writer's next write fails.
+fn is_client_disconnect(error: &std::io::Error) -> bool {
+    error.kind() == std::io::ErrorKind::BrokenPipe
+}
+
 fn internal_error(context: &str, err: impl std::fmt::Display) -> Response {
     tracing::warn!(error = %err, context, "snapshot endpoint failed");
     StatusCode::INTERNAL_SERVER_ERROR.into_response()
@@ -461,7 +463,19 @@ fn finalized_error(context: &str, err: StorageTaskError) -> Response {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::test_helpers::temp_db;
+    use crate::test_support::temp_db;
+
+    #[tokio::test]
+    async fn client_disconnect_surfaces_as_broken_pipe() {
+        let (writer, reader) = tokio::io::duplex(8);
+        drop(reader);
+        let mut bridge = SyncIoBridge::new(writer);
+        let err = tokio::task::spawn_blocking(move || std::io::Write::write_all(&mut bridge, b"x"))
+            .await
+            .unwrap()
+            .unwrap_err();
+        assert!(is_client_disconnect(&err), "{err:?}");
+    }
 
     async fn read_corrupt_comparison(path: &Path) {
         let db = temp_db("corrupt-comparison-path");
@@ -524,9 +538,15 @@ mod tests {
                 )))
             }
         }
+        let fixture = baseline_state("comparison-nonterminal", b"state");
+        let lease = acquire_finalized(&fixture.state)
+            .await
+            .expect("acquire lease")
+            .expect("baseline lease");
         let mut reader = ComparisonReader {
             reader: Unavailable,
             path: PathBuf::from("temporarily-unavailable"),
+            _guard: lease.dump.guard,
         };
         let error = tokio::io::AsyncReadExt::read(&mut reader, &mut [0; 1])
             .await
@@ -535,7 +555,7 @@ mod tests {
     }
 
     struct BaselineFixture {
-        _db: crate::storage::test_helpers::TestDb,
+        _db: crate::test_support::TestDb,
         _root: tempfile::TempDir,
         state: Arc<SnapshotApiState>,
     }
diff --git a/sequencer/src/egress/api/state.rs b/sequencer/src/egress/api/state.rs
index 44a1487f..8617d296 100644
--- a/sequencer/src/egress/api/state.rs
+++ b/sequencer/src/egress/api/state.rs
@@ -31,14 +31,6 @@ impl SubscribeState {
         }
     }
 
-    pub(crate) fn reject_if_shutting_down(&self) -> Result<(), ApiError> {
-        if self.shutdown.is_shutdown_requested() {
-            Err(ApiError::unavailable("sequencer shutting down"))
-        } else {
-            Ok(())
-        }
-    }
-
     pub(crate) fn try_acquire_ws_subscriber_permit(
         &self,
     ) -> Result<OwnedSemaphorePermit, ApiError> {
diff --git a/sequencer/src/egress/api/subscribe.rs b/sequencer/src/egress/api/subscribe.rs
index 9fc9d5d0..ca0debf8 100644
--- a/sequencer/src/egress/api/subscribe.rs
+++ b/sequencer/src/egress/api/subscribe.rs
@@ -39,7 +39,7 @@ pub(crate) async fn subscribe_l2_txs(
     Query(query): Query<SubscribeQuery>,
     ws: WebSocketUpgrade,
 ) -> Response {
-    if let Err(err) = state.reject_if_shutting_down() {
+    if let Err(err) = crate::http::reject_if_shutting_down(&state.shutdown) {
         return err.into_response();
     }
 
@@ -119,7 +119,7 @@ async fn run_ws_session(
     }
 
     if let Err(err) = subscription.finish().await {
-        warn!(error = %err, "tx feed subscription cleanup failed");
+        warn!(error = %err, "tx feed subscription ended with error");
     }
 }
 
diff --git a/sequencer/src/egress/l2_tx_feed/error.rs b/sequencer/src/egress/l2_tx_feed/error.rs
index 97234739..6de76e40 100644
--- a/sequencer/src/egress/l2_tx_feed/error.rs
+++ b/sequencer/src/egress/l2_tx_feed/error.rs
@@ -10,13 +10,13 @@ use crate::storage::{
 
 #[derive(Debug, Error)]
 pub enum SubscribeError {
-    #[error("cannot open subscription storage")]
+    #[error("cannot open subscription storage: {source}")]
     OpenStorage {
         #[source]
         source: StorageOpenError,
     },
-    #[error("cannot load feed head offset")]
-    LoadHeadOffset {
+    #[error("cannot read canonical history: {source}")]
+    ReadHistory {
         #[source]
         source: rusqlite::Error,
     },
@@ -33,7 +33,7 @@ impl From<crate::storage::HistoryReadError> for SubscribeError {
     fn from(error: crate::storage::HistoryReadError) -> Self {
         match error {
             crate::storage::HistoryReadError::Policy(error) => Self::History(error),
-            crate::storage::HistoryReadError::Storage(source) => Self::LoadHeadOffset { source },
+            crate::storage::HistoryReadError::Storage(source) => Self::ReadHistory { source },
         }
     }
 }
@@ -42,7 +42,7 @@ impl SubscribeError {
     pub(super) fn is_persistent_storage_invariant(&self) -> bool {
         match self {
             Self::OpenStorage { source } => open_error_is_persistent(source),
-            Self::LoadHeadOffset { source } => is_persistent_storage_error(source),
+            Self::ReadHistory { source } => is_persistent_storage_error(source),
             Self::Join { source } => source.is_panic(),
             Self::History(_) => false,
         }
@@ -53,12 +53,12 @@ impl SubscribeError {
 pub enum SubscriptionError {
     #[error(transparent)]
     History(HistoryPolicyError),
-    #[error("cannot open subscription storage")]
+    #[error("cannot open subscription storage: {source}")]
     OpenStorage {
         #[source]
         source: StorageOpenError,
     },
-    #[error("cannot load ordered tx page from offset {offset}")]
+    #[error("cannot load ordered tx page from offset {offset}: {source}")]
     LoadReplay {
         offset: u64,
         #[source]
diff --git a/sequencer/src/egress/l2_tx_feed/mod.rs b/sequencer/src/egress/l2_tx_feed/mod.rs
index 376b9975..3bfb3ee3 100644
--- a/sequencer/src/egress/l2_tx_feed/mod.rs
+++ b/sequencer/src/egress/l2_tx_feed/mod.rs
@@ -1,7 +1,7 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! DB-backed ordered-L2-tx feed used by WS subscriptions and catch-up replay.
+//! DB-backed ordered-L2-tx feed for WS subscriptions.
 
 mod error;
 
diff --git a/sequencer/src/egress/l2_tx_feed/tests.rs b/sequencer/src/egress/l2_tx_feed/tests.rs
index e23a1d94..eae227e1 100644
--- a/sequencer/src/egress/l2_tx_feed/tests.rs
+++ b/sequencer/src/egress/l2_tx_feed/tests.rs
@@ -10,8 +10,8 @@ use super::{BroadcastTxMessage, L2TxFeed, L2TxFeedConfig, SubscribeError};
 use crate::ingress::inclusion_lane::{IncludedUserOp, PendingUserOp, SequencerError};
 use crate::runtime::process_lock::{ProcessLock, ProcessLockError};
 use crate::runtime::shutdown::RuntimeScope;
-use crate::storage::test_helpers::{pin_test_deployment_identity, temp_db};
 use crate::storage::{FrontierMode, IngestedSafeInput, SafeInputRange, Storage};
+use crate::test_support::{pin_test_deployment_identity, temp_db};
 use sequencer_core::history::{
     ExecutedInputCount, HistoryClaim, HistoryPolicyError, RecoveryGeneration,
 };
@@ -136,8 +136,8 @@ async fn subscription_accepts_more_than_fifty_thousand_inputs_without_a_total_ca
 }
 
 #[test]
-fn cancelled_catchup_prepare_retains_process_lock_until_blocking_read_finishes() {
-    let db = temp_db("cancelled-catchup-prepare-lock");
+fn cancelled_subscription_prepare_retains_process_lock_until_blocking_read_finishes() {
+    let db = temp_db("cancelled-subscription-prepare-lock");
     seed_ordered_txs(db.path.as_str());
     let data_dir = db._dir.path().to_str().expect("utf8 data dir").to_string();
     let db_path = db.path.clone();
@@ -182,7 +182,7 @@ fn cancelled_catchup_prepare_retains_process_lock_until_blocking_read_finishes()
                 ProcessLock::acquire(&data_dir),
                 Err(ProcessLockError::Locked { .. })
             ),
-            "detached catch-up preparation must retain process ownership"
+            "detached subscription preparation must retain process ownership"
         );
 
         release_blocker_tx.send(()).expect("release blocking pool");
@@ -198,7 +198,7 @@ fn cancelled_catchup_prepare_retains_process_lock_until_blocking_read_finishes()
             }
         })
         .await
-        .expect("detached catch-up preparation should release ownership");
+        .expect("detached subscription preparation should release ownership");
         drop(reacquired);
     });
 }
@@ -380,12 +380,7 @@ fn seed_ordered_txs(db_path: &str) {
                 transaction_hash: B256::repeat_byte(0xcd),
             }],
             NO_OWN_BATCHES,
-            &sequencer_core::protocol::ProtocolTiming {
-                max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-                preemptive_margin_blocks: 75,
-                l1_read_stale_after_blocks: 900,
-                seconds_per_block: 12,
-            },
+            &crate::storage::test_helpers::default_protocol_timing(),
             FrontierMode::Populate,
         )
         .expect("append direct input");
diff --git a/sequencer/src/egress/mod.rs b/sequencer/src/egress/mod.rs
index ac7b75ae..9a945f6f 100644
--- a/sequencer/src/egress/mod.rs
+++ b/sequencer/src/egress/mod.rs
@@ -1,9 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Outbound side: WS subscribe (today), future read-only endpoints, and the
-//! L2-tx feed that backs them. Operated for internal indexers; the future api
-//! split puts these on a separate port from ingress.
+//! Outbound side: the internal listener's subscription, history, snapshot and
+//! health routes, and the L2-tx feed that backs them. Operated for internal
+//! indexers and the watchdog.
 
 pub mod api;
 pub mod l2_tx_feed;
diff --git a/sequencer/src/harness.rs b/sequencer/src/harness.rs
index 0b6c6fd3..1791f179 100644
--- a/sequencer/src/harness.rs
+++ b/sequencer/src/harness.rs
@@ -1,26 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! CLI harness: the subcommand parser, dispatch, and exit-code projection,
-//! exported once from the library so every app binary inherits them.
-//!
-//! An app's `main` is ~5 lines: init tracing, then [`run_main`] with a
-//! genesis-app factory closure. The factory is invoked only when plain `setup`
-//! reaches genesis-snapshot registration; completed setup no-ops, recovery,
-//! `run`, and `flush-mempool` never construct an app value.
-//!
-//! ```ignore
-//! #[tokio::main]
-//! async fn main() -> std::process::ExitCode {
-//!     init_tracing();
-//!     sequencer::harness::run_main(|| Ok(WalletApp::new(WalletConfig::default()))).await
-//! }
-//! ```
-//!
-//! Genesis construction stays off the `Application` trait (it varies per impl).
-//! Apps with their own CLI options can parse [`Command`] and call [`run_command`]
-//! with a lazy, fallible genesis factory. Both entry points share the command
-//! lifecycle and exit policy without imposing a `clap` bound on the app type.
+//! CLI harness: subcommand parsing, dispatch and exit-code projection, exported
+//! once so every app binary inherits them. Binaries pass [`run_main`] a genesis
+//! factory (genesis varies per app, so it stays off the `Application` trait);
+//! apps with their own CLI parse [`Command`] and call [`run_command`].
 
 use clap::{Parser, Subcommand};
 use sequencer_core::application::{AppError, Application};
@@ -87,6 +71,7 @@ fn project_dispatch_join(
         Err(join) if join.is_panic() => {
             tracing::error!(
                 error = %join,
+                verdict = ?crate::commands::error::CommandFailureVerdict::Terminal,
                 exit_code = crate::commands::error::EXIT_TERMINAL,
                 "sequencer command panicked — trusted-code invariant failure"
             );
@@ -95,6 +80,7 @@ fn project_dispatch_join(
         Err(join) => {
             tracing::error!(
                 error = %join,
+                verdict = ?crate::commands::error::CommandFailureVerdict::Unclassified,
                 exit_code = crate::commands::error::EXIT_UNCLASSIFIED,
                 "sequencer command task failed"
             );
@@ -125,8 +111,15 @@ where
     match result {
         Ok(()) => std::process::ExitCode::SUCCESS,
         Err(err) => {
+            let verdict = err.failure_verdict();
             let code = err.exit_code();
-            tracing::error!(error = %err, exit_code = code, "sequencer exiting");
+            let action = verdict.supervisor_action();
+            // tracing needs a constant level per callsite, hence the branch.
+            if verdict.logs_at_error() {
+                tracing::error!(?verdict, supervisor_action = action, exit_code = code, error = %err, "sequencer exiting");
+            } else {
+                tracing::warn!(?verdict, supervisor_action = action, exit_code = code, error = %err, "sequencer exiting");
+            }
             std::process::ExitCode::from(code)
         }
     }
@@ -138,8 +131,8 @@ mod tests {
 
     #[tokio::test]
     async fn completed_setup_does_not_construct_genesis_app() {
-        use crate::commands::test_support::SweepTestApp;
         use crate::storage::{LifecycleCommand, Storage};
+        use crate::test_support::StubApp;
         use std::sync::Arc;
         use std::sync::atomic::{AtomicUsize, Ordering};
 
@@ -180,7 +173,7 @@ mod tests {
 
         let constructions = Arc::new(AtomicUsize::new(0));
         let observed = Arc::clone(&constructions);
-        let exit = run_command::<SweepTestApp, _>(cli.command, move || {
+        let exit = run_command::<StubApp, _>(cli.command, move || {
             observed.fetch_add(1, Ordering::SeqCst);
             Err(AppError::Io(std::io::Error::new(
                 std::io::ErrorKind::NotFound,
@@ -204,7 +197,7 @@ mod tests {
     /// refuses before the key is read or any provider is built.
     #[tokio::test]
     async fn run_on_a_never_set_up_data_dir_exits_30() {
-        use crate::commands::test_support::SweepTestApp;
+        use crate::test_support::StubApp;
 
         let data_dir = tempfile::tempdir().expect("create data dir");
         let cli = Cli::try_parse_from([
@@ -212,6 +205,8 @@ mod tests {
             "run",
             "--http-addr",
             "127.0.0.1:0",
+            "--internal-http-addr",
+            "127.0.0.1:0",
             "--data-dir",
             data_dir.path().to_str().expect("utf8 path"),
             "--eth-rpc-url",
@@ -221,11 +216,40 @@ mod tests {
         ])
         .expect("parse run");
 
-        let exit = dispatch::<SweepTestApp, _>(cli.command, || Ok(SweepTestApp)).await;
+        let exit = dispatch::<StubApp, _>(cli.command, || Ok(StubApp::default())).await;
 
         assert_eq!(exit, std::process::ExitCode::from(30));
     }
 
+    #[tokio::test]
+    async fn run_and_flush_on_a_missing_data_dir_exit_30_without_creating_it() {
+        use crate::test_support::StubApp;
+
+        for command in ["run", "flush-mempool"] {
+            let parent = tempfile::tempdir().expect("create parent dir");
+            let mistyped = parent.path().join("mistyped");
+            let cli = Cli::try_parse_from([
+                "sequencer",
+                command,
+                "--data-dir",
+                mistyped.to_str().expect("utf8 path"),
+                "--eth-rpc-url",
+                "http://127.0.0.1:1",
+                "--batch-submitter-private-key",
+                "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80",
+            ])
+            .expect("parse command");
+
+            let exit = dispatch::<StubApp, _>(cli.command, || Ok(StubApp::default())).await;
+
+            assert_eq!(exit, std::process::ExitCode::from(30), "{command}");
+            assert!(
+                !mistyped.exists(),
+                "{command} must not create a missing data dir"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn top_level_command_panic_maps_to_terminal_exit() {
         let result = tokio::spawn(async {
diff --git a/sequencer/src/http.rs b/sequencer/src/http.rs
index 1a0369a9..7776719b 100644
--- a/sequencer/src/http.rs
+++ b/sequencer/src/http.rs
@@ -2,13 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 //! Shared HTTP surface: error type + JSON response shape used by both
-//! ingress (`/tx`, `/fee`, `/nonce`, `/domain`) and egress (`/ws/subscribe`,
-//! future routes), plus the `axum::serve` orchestration that wires the two
-//! side routers together.
-//!
-//! Today both sides serve from one listener; the planned api split puts each
-//! side on its own port (same binary, two listeners). When that lands, the
-//! orchestration here becomes per-side `start_*` calls.
+//! ingress (`/tx`, `/fee`, `/nonce`, `/domain`) and egress (subscription,
+//! history, snapshots, health), plus the `axum::serve` orchestration that
+//! serves each side on its own listener: ingress public, egress internal.
 
 use std::sync::Arc;
 
@@ -139,8 +135,7 @@ impl IntoResponse for ApiError {
 
 // ── HTTP server orchestration ────────────────────────────────────────────────
 //
-// Combines ingress + egress routers into one axum::serve. The api split will
-// replace this with per-side starts on different ports.
+// One task serves the public (ingress) and internal (egress) listeners.
 
 const DEFAULT_WS_MAX_SUBSCRIBERS: usize = 64;
 const DEFAULT_MAX_BODY_BYTES: usize = TxRequest::MAX_JSON_BYTES_RECOMMENDED;
@@ -210,6 +205,16 @@ async fn run_snapshot_release_supervisor(
     }
 }
 
+/// The `503` a handler returns when it refuses new work after shutdown is
+/// requested.
+pub(crate) fn reject_if_shutting_down(shutdown: &RuntimeScope) -> Result<(), ApiError> {
+    if shutdown.is_shutdown_requested() {
+        Err(ApiError::unavailable("sequencer shutting down"))
+    } else {
+        Ok(())
+    }
+}
+
 // ── Blocking storage tasks ─────────────────────────────────────────────────
 //
 // Shared by ingress (`GET /fee`, `GET /nonce`) and egress snapshot handlers. Classify
@@ -294,8 +299,14 @@ impl ApiConfig {
     }
 }
 
-pub(crate) fn start_on_listener(
-    listener: tokio::net::TcpListener,
+/// The two listeners `run` binds before launch.
+pub(crate) struct ApiListeners {
+    pub public: tokio::net::TcpListener,
+    pub internal: tokio::net::TcpListener,
+}
+
+pub(crate) fn start_on_listeners(
+    listeners: ApiListeners,
     tx_sender: mpsc::Sender<PendingUserOp>,
     shutdown: RuntimeScope,
     tx_feed: L2TxFeed,
@@ -328,30 +339,42 @@ pub(crate) fn start_on_listener(
         tx_feed,
         config.ws_max_subscribers,
     ));
-    let app: Router = crate::ingress::api::router(submit_state, read_state)
-        .merge(crate::egress::api::router(
-            subscribe_state,
-            health_state,
-            snapshot_state,
-            shutdown.clone(),
-            snapshot_release_scheduler,
-        ))
+    let public: Router = crate::ingress::api::router(submit_state, read_state)
         // Enforces a raw request-body cap before JSON deserialization, including whitespace.
         .layer(DefaultBodyLimit::max(config.max_body_bytes))
         .layer(TraceLayer::new_for_http());
+    let internal: Router = crate::egress::api::router(
+        subscribe_state,
+        health_state,
+        snapshot_state,
+        shutdown.clone(),
+        snapshot_release_scheduler,
+    )
+    .layer(TraceLayer::new_for_http());
 
     tokio::spawn(async move {
-        let result = axum::serve(listener, app)
-            .with_graceful_shutdown(async move {
-                shutdown.wait_for_shutdown().await;
-            })
-            .await;
+        // Each serve resolves only after the shared shutdown signal, so the
+        // two drain together.
+        let (public, internal) = tokio::join!(
+            serve(listeners.public, public, shutdown.clone()),
+            serve(listeners.internal, internal, shutdown),
+        );
         // Finish every scheduled release before ordinary HTTP shutdown ends.
         snapshot_release_drain.finish().await;
-        result
+        public.and(internal)
     })
 }
 
+async fn serve(
+    listener: tokio::net::TcpListener,
+    app: Router,
+    shutdown: RuntimeScope,
+) -> std::io::Result<()> {
+    axum::serve(listener, app)
+        .with_graceful_shutdown(async move { shutdown.wait_for_shutdown().await })
+        .await
+}
+
 #[cfg(test)]
 mod tests {
     use std::time::Duration;
diff --git a/sequencer/src/ingress/api.rs b/sequencer/src/ingress/api.rs
index e88e574e..bd616849 100644
--- a/sequencer/src/ingress/api.rs
+++ b/sequencer/src/ingress/api.rs
@@ -1,26 +1,8 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Public ingress HTTP:
-//!
-//! - `POST /tx` — validate a signed user op, enqueue it for the inclusion
-//!   lane, and wait for the lane's commit ack. Synchronous from the client's
-//!   perspective: 200 means included.
-//! - `GET /fee` — quote the open-frame fee, recommended fee, and a suggested
-//!   `max_fee` so a wallet can sign before submitting.
-//! - `GET /nonce?sender=` — the nonce `sender` must sign next, derived from the
-//!   user ops the lane has committed.
-//! - `GET /domain` — the EIP-712 domain signatures are verified against.
-//!
-//! `/fee` and `/nonce` query SQLite on a read-only connection, never the lane:
-//! WAL readers do not block its writes.
-//!
-//! Admission checks only what the lane cannot cheaply check itself: payload
-//! size and the signature. Nonce and `max_fee` are left to the lane. A stale
-//! op costs it an in-memory comparison and no transaction, whereas an ingress
-//! pre-check would add a SQLite read to every honest submit, and a future
-//! nonce or a fresh address bypasses it. Revisit if persistent `429`s trace
-//! back to stale-nonce floods.
+//! Public ingress routes (`POST /tx`, `GET /fee`, `GET /nonce`, `GET /domain`);
+//! README "API" owns their contract. `/fee` and `/nonce` read SQLite, never the lane.
 
 use std::sync::Arc;
 use std::time::{Duration, SystemTime};
@@ -36,7 +18,7 @@ use tokio::sync::oneshot;
 use tower_http::cors::{Any, CorsLayer};
 use tracing::debug;
 
-use crate::http::{ApiError, storage_task};
+use crate::http::{ApiError, reject_if_shutting_down, storage_task};
 use crate::ingress::inclusion_lane::PendingUserOp;
 use crate::runtime::shutdown::RuntimeScope;
 use crate::storage::Storage;
@@ -49,10 +31,10 @@ use serde::Deserialize;
 /// State for the submit endpoint. Kept narrow — only what `/tx` actually needs.
 #[derive(Clone)]
 pub(crate) struct SubmitState {
-    pub tx_sender: mpsc::Sender<PendingUserOp>,
-    pub domain: Eip712Domain,
-    pub max_user_op_data_bytes: usize,
-    pub shutdown: RuntimeScope,
+    tx_sender: mpsc::Sender<PendingUserOp>,
+    domain: Eip712Domain,
+    max_user_op_data_bytes: usize,
+    shutdown: RuntimeScope,
 }
 
 impl SubmitState {
@@ -69,14 +51,6 @@ impl SubmitState {
             shutdown,
         }
     }
-
-    fn reject_if_shutting_down(&self) -> Result<(), ApiError> {
-        if self.shutdown.is_shutdown_requested() {
-            Err(ApiError::unavailable("sequencer shutting down"))
-        } else {
-            Ok(())
-        }
-    }
 }
 
 /// State for the public read routes. `/fee` reads the open frame and the fee
@@ -97,14 +71,6 @@ impl ReadState {
             shutdown,
         }
     }
-
-    fn reject_if_shutting_down(&self) -> Result<(), ApiError> {
-        if self.shutdown.is_shutdown_requested() {
-            Err(ApiError::unavailable("sequencer shutting down"))
-        } else {
-            Ok(())
-        }
-    }
 }
 
 /// Build the ingress router. Caller wires it into an `axum::serve` listener.
@@ -128,6 +94,11 @@ pub(crate) fn router(submit: Arc<SubmitState>, read: Arc<ReadState>) -> Router {
         )
 }
 
+/// Admission checks only size and signature. Nonce and `max_fee` are left to the
+/// lane, where a stale op costs an in-memory comparison and no transaction; a
+/// pre-check here would add a SQLite read to every honest submit, and a future
+/// nonce or fresh address bypasses it. Revisit if persistent `429`s trace back to
+/// stale-nonce floods.
 async fn submit_tx(
     State(state): State<Arc<SubmitState>>,
     req: Result<Json<TxRequest>, axum::extract::rejection::JsonRejection>,
@@ -156,7 +127,7 @@ async fn submit_tx(
 }
 
 async fn get_fee(State(state): State<Arc<ReadState>>) -> Result<Response, ApiError> {
-    state.reject_if_shutting_down()?;
+    reject_if_shutting_down(&state.shutdown)?;
     let db_path = state.db_path.clone();
     let result = storage_task(state.shutdown.clone(), "read fee quote", move |_scope| {
         let mut storage = Storage::open_read_only(&db_path)?;
@@ -186,7 +157,7 @@ async fn get_nonce(
     State(state): State<Arc<ReadState>>,
     query: Result<Query<NonceQuery>, axum::extract::rejection::QueryRejection>,
 ) -> Result<Response, ApiError> {
-    state.reject_if_shutting_down()?;
+    reject_if_shutting_down(&state.shutdown)?;
     let sender = query
         .ok()
         .and_then(|Query(query)| parse_sender_address(&query.sender).ok())
@@ -252,7 +223,7 @@ fn enqueue_verified_tx(
     signed: SignedUserOp,
 ) -> Result<oneshot::Receiver<Result<(), crate::ingress::inclusion_lane::SequencerError>>, ApiError>
 {
-    state.reject_if_shutting_down()?;
+    reject_if_shutting_down(&state.shutdown)?;
 
     let (respond_to, recv) = oneshot::channel();
     let pending = PendingUserOp {
@@ -274,10 +245,10 @@ mod tests {
 
     use alloy_primitives::{Address, Signature};
     use alloy_sol_types::Eip712Domain;
-    use alloy_sol_types::SolStruct;
+
     use axum::http::StatusCode;
     use k256::ecdsa::SigningKey;
-    use k256::ecdsa::signature::hazmat::PrehashSigner;
+    use sequencer_core::test_support::{sign_hash, sign_user_op};
     use std::sync::Arc;
     use tempfile::TempDir;
     use tokio::sync::mpsc;
@@ -509,23 +480,7 @@ mod tests {
         user_op: &UserOp,
         signing_key: &SigningKey,
     ) -> String {
-        let hash = user_op.eip712_signing_hash(domain);
-        let k256_sig = signing_key
-            .sign_prehash(hash.as_slice())
-            .expect("sign user op hash");
-
-        let sender = address_from_signing_key(signing_key);
-        let signature = [false, true]
-            .into_iter()
-            .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-            .find(|candidate| {
-                candidate
-                    .recover_address_from_prehash(&hash)
-                    .ok()
-                    .map(|value| value == sender)
-                    .unwrap_or(false)
-            })
-            .expect("recoverable parity for signature");
+        let signature = sign_user_op(signing_key, domain, user_op);
 
         alloy_primitives::hex::encode_prefixed(signature.as_bytes())
     }
@@ -556,21 +511,8 @@ mod tests {
         let expected_sender = address_from_signing_key(&signing_key);
 
         let msg_hash = B256::from([0xfe_u8; 32]);
-        let k256_sig = signing_key
-            .sign_prehash(msg_hash.as_slice())
-            .expect("sign prehash");
-
-        // k256's `sign_prehash` returns a low-s signature by default. Find the
-        // parity that pairs with it to recover the expected signer.
-        let valid_sig = [false, true]
-            .into_iter()
-            .map(|p| Signature::from_signature_and_parity(k256_sig, p))
-            .find(|s| {
-                s.recover_address_from_prehash(&msg_hash)
-                    .ok()
-                    .is_some_and(|a| a == expected_sender)
-            })
-            .expect("low-s signature must recover the signer with one parity");
+        // k256 signs low-s; sign_hash picks the parity that recovers the signer.
+        let valid_sig = sign_hash(&signing_key, &msg_hash);
 
         // Construct the S-malleable variant: same r, s' = n - s, flipped parity.
         let malleable_sig =
diff --git a/sequencer/src/ingress/inclusion_lane/catch_up.rs b/sequencer/src/ingress/inclusion_lane/catch_up.rs
index 1571437d..76fe269d 100644
--- a/sequencer/src/ingress/inclusion_lane/catch_up.rs
+++ b/sequencer/src/ingress/inclusion_lane/catch_up.rs
@@ -3,9 +3,7 @@
 
 //! Replay committed application history after launch, before processing new user ops.
 
-use std::path::PathBuf;
-
-use crate::storage::{HistoryReadError, L2TxContext, Storage};
+use crate::storage::{HistoryReadError, L2TxContext, Snapshot, Storage};
 use sequencer_core::application::{Application, execute_direct_input, execute_valid_user_op};
 use sequencer_core::history::{ExecutedInputCount, HistoryClaim};
 
@@ -13,21 +11,11 @@ use super::error::CatchUpError;
 
 const DEFAULT_CATCH_UP_PAGE_SIZE: usize = 256;
 
-#[derive(Debug, Clone)]
-pub(super) struct CatchUpSnapshot {
-    pub(super) dump_dir: PathBuf,
-    pub(super) executed_input_count: ExecutedInputCount,
-}
-
-pub(super) fn catch_up_snapshot(storage: &mut Storage) -> Result<CatchUpSnapshot, CatchUpError> {
-    let snapshot = storage
+pub(super) fn catch_up_snapshot(storage: &mut Storage) -> Result<Snapshot, CatchUpError> {
+    storage
         .latest_snapshot()
         .map_err(|source| CatchUpError::LoadSnapshot { source })?
-        .ok_or(CatchUpError::NoSnapshot)?;
-    Ok(CatchUpSnapshot {
-        dump_dir: snapshot.dump.prefix,
-        executed_input_count: snapshot.executed_input_count,
-    })
+        .ok_or(CatchUpError::NoSnapshot)
 }
 
 pub(super) fn catch_up_application(
@@ -50,6 +38,10 @@ pub(super) fn catch_up_application_paged(
             storage: start.get(),
         });
     }
+    tracing::debug!(
+        executed_input_count = start.get(),
+        "inclusion lane resuming from snapshot"
+    );
     let bounds = storage
         .history_bounds()
         .map_err(|source| CatchUpError::LoadReplay {
diff --git a/sequencer/src/ingress/inclusion_lane/dump_info.rs b/sequencer/src/ingress/inclusion_lane/dump_info.rs
index 98cf12dd..17fe4425 100644
--- a/sequencer/src/ingress/inclusion_lane/dump_info.rs
+++ b/sequencer/src/ingress/inclusion_lane/dump_info.rs
@@ -51,7 +51,8 @@ impl DumpInfo {
         }
     }
 
-    pub fn at_baseline(next_batch_nonce: u64) -> Self {
+    #[cfg(test)]
+    pub(crate) fn at_baseline(next_batch_nonce: u64) -> Self {
         Self {
             format_version: FORMAT_VERSION,
             next_batch_nonce,
@@ -76,7 +77,10 @@ pub fn read_checkpoint_info(dump_dir: &Path) -> io::Result<CheckpointInfo> {
     if info.format_version != FORMAT_VERSION {
         return Err(io::Error::new(
             io::ErrorKind::InvalidData,
-            "unsupported checkpoint format",
+            format!(
+                "unsupported checkpoint format version {} (expected {FORMAT_VERSION})",
+                info.format_version
+            ),
         ));
     }
     Ok(info)
@@ -94,7 +98,10 @@ pub(crate) fn write_archive<W: io::Write>(
     if info.next_batch_nonce != next_batch_nonce {
         return Err(io::Error::new(
             io::ErrorKind::InvalidData,
-            "dump nonce differs from snapshot boundary",
+            format!(
+                "dump next_batch_nonce {} differs from snapshot boundary {next_batch_nonce}",
+                info.next_batch_nonce
+            ),
         ));
     }
     let mut archive = tar::Builder::new(writer);
@@ -171,16 +178,9 @@ pub fn write_info(dump_dir: &Path, info: &DumpInfo) -> io::Result<()> {
     Ok(())
 }
 
-/// Read and strictly parse `info.toml` from `dump_dir`. Unknown keys
-/// (`deny_unknown_fields`), duplicate keys (TOML forbids them), malformed
-/// values, and missing required keys all fail loud — a dump with corrupt
-/// metadata is not silently usable. The `format_version` gate runs after the
-/// parse; there is a single frozen schema (`FORMAT_VERSION`), so a
-/// forward-version dump is rejected outright rather than partially read.
-///
-/// Missing/`ENOENT` paths get an operator-facing diagnosis via
-/// [`diagnose_missing_dump`] so a watchdog CM checkpoint (or any other
-/// non-dump directory) is not reported as a bare "No such file or directory".
+/// Read and strictly parse `info.toml` from `dump_dir`; corrupt or
+/// forward-version metadata fails loud. A missing file gets an operator-facing
+/// diagnosis from [`diagnose_missing_dump`].
 pub fn read_info(dump_dir: &Path) -> io::Result<DumpInfo> {
     let content = match std::fs::read_to_string(dump_dir.join(INFO_FILE)) {
         Ok(c) => c,
@@ -503,9 +503,8 @@ mod tests {
 
     #[test]
     fn read_tolerates_comments_blanks_and_reordering() {
-        // The robustness win from real TOML over the old line parser: an
-        // operator inspecting/annotating the file under recovery pressure can
-        // add comments, blank lines, and reorder keys without bricking it.
+        // An operator annotating the file during recovery may add comments and
+        // blank lines and reorder keys.
         let dir = tempfile::tempdir().unwrap();
         std::fs::write(
             dir.path().join(INFO_FILE),
@@ -571,4 +570,48 @@ mod tests {
         .unwrap();
         assert!(read_info(dir.path()).is_err());
     }
+
+    #[test]
+    fn write_archive_nonce_mismatch_names_both_nonces() {
+        let dir = tempfile::tempdir().expect("dump dir");
+        write_info(
+            dir.path(),
+            &DumpInfo {
+                format_version: FORMAT_VERSION,
+                next_batch_nonce: 41,
+            },
+        )
+        .expect("write info");
+
+        let err = write_archive(std::io::sink(), dir.path(), 42, None)
+            .expect_err("a nonce mismatch must refuse the archive");
+
+        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
+        let message = err.to_string();
+        assert!(
+            message.contains("41") && message.contains("42"),
+            "{message}"
+        );
+    }
+
+    #[test]
+    fn read_checkpoint_info_names_both_format_versions() {
+        let dir = tempfile::tempdir().expect("dump dir");
+        let unsupported = FORMAT_VERSION + 1;
+        std::fs::write(
+            dir.path().join("checkpoint.toml"),
+            format!("format_version = {unsupported}\nnext_batch_nonce = 1\ninclusion_block = 2\n"),
+        )
+        .expect("write checkpoint");
+
+        let message = read_checkpoint_info(dir.path())
+            .expect_err("an unsupported version must refuse")
+            .to_string();
+
+        assert!(
+            message.contains(&unsupported.to_string())
+                && message.contains(&FORMAT_VERSION.to_string()),
+            "{message}"
+        );
+    }
 }
diff --git a/sequencer/src/ingress/inclusion_lane/error.rs b/sequencer/src/ingress/inclusion_lane/error.rs
index 74d4331a..79c50724 100644
--- a/sequencer/src/ingress/inclusion_lane/error.rs
+++ b/sequencer/src/ingress/inclusion_lane/error.rs
@@ -14,7 +14,7 @@ use super::snapshot::{GcError, TakeDumpError};
 pub enum InclusionLaneError {
     #[error("inclusion lane input channel closed")]
     ChannelClosed,
-    #[error("application catchup failed")]
+    #[error("application catchup failed: {source}")]
     CatchUp {
         #[source]
         source: CatchUpError,
@@ -26,21 +26,21 @@ pub enum InclusionLaneError {
          cockroach recovery required"
     )]
     CanonicalDivergence { nonce: u64, safe_input_index: u64 },
-    #[error("user op execution failed")]
+    #[error("user op execution failed: {source}")]
     ExecuteUserOp {
         #[source]
         source: AppError,
     },
-    #[error("direct input execution failed")]
+    #[error("direct input execution failed: {source}")]
     ExecuteDirectInput {
         #[source]
         source: AppError,
     },
-    #[error("snapshot at batch close failed")]
+    #[error("snapshot at batch close failed: {0}")]
     Snapshot(#[from] TakeDumpError),
     #[error("loading Application from finalized snapshot failed: {0}")]
     LoadFromDump(AppError),
-    #[error("snapshot garbage collection failed")]
+    #[error("snapshot garbage collection failed: {0}")]
     Gc(#[from] GcError),
     #[error(
         "no open Tip at lane startup; the runtime must establish it via \
@@ -91,12 +91,12 @@ fn take_dump_error_is_terminal(source: &TakeDumpError) -> bool {
 pub enum CatchUpError {
     #[error(transparent)]
     History(#[from] sequencer_core::history::HistoryPolicyError),
-    #[error("cannot load resume snapshot")]
+    #[error("cannot load resume snapshot: {source}")]
     LoadSnapshot {
         #[source]
         source: rusqlite::Error,
     },
-    #[error("cannot load replay entries from offset {offset}")]
+    #[error("cannot load replay entries from offset {offset}: {source}")]
     LoadReplay {
         offset: u64,
         #[source]
@@ -235,4 +235,32 @@ mod tests {
             assert!(error.is_terminal_invariant(), "{error}");
         }
     }
+
+    #[test]
+    fn display_carries_the_nested_root_cause() {
+        let cases = [
+            (
+                InclusionLaneError::Snapshot(TakeDumpError::CreateDump(CreateDumpDirError::App(
+                    AppError::Io(std::io::Error::other("No space left on device")),
+                ))),
+                "snapshot at batch close failed: app: io: No space left on device".to_string(),
+            ),
+            (
+                InclusionLaneError::CatchUp {
+                    source: CatchUpError::LoadReplay {
+                        offset: 7,
+                        source: rusqlite::Error::QueryReturnedNoRows,
+                    },
+                },
+                format!(
+                    "application catchup failed: cannot load replay entries from offset 7: {}",
+                    rusqlite::Error::QueryReturnedNoRows
+                ),
+            ),
+        ];
+
+        for (error, expected) in cases {
+            assert_eq!(error.to_string(), expected);
+        }
+    }
 }
diff --git a/sequencer/src/ingress/inclusion_lane/mod.rs b/sequencer/src/ingress/inclusion_lane/mod.rs
index 685e3d0a..dc1a7799 100644
--- a/sequencer/src/ingress/inclusion_lane/mod.rs
+++ b/sequencer/src/ingress/inclusion_lane/mod.rs
@@ -1,28 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Single ordering lane with a latency-critical user-op regime and a slower L1
-//! reconciliation regime. It runs three layers of amortization:
-//!
-//! - **Fast processing** (`run_fast_turn`): processes at most one bounded
-//!   user-op chunk per turn. Rejected requests therefore cannot keep a
-//!   continuously nonempty queue from starving reconciliation.
-//! - **Per-chunk persistence** (`max_user_ops_per_chunk`): a nonempty accepted
-//!   subset commits at most once, bounding ack latency for its first op.
-//!   All-rejected chunks mutate nothing and do not open a transaction.
-//! - **L1 reconciliation** (observed at `frontier_min_interval`): once five
-//!   newly-safe blocks have accumulated, executes the complete direct-input range and advances one frame directly to the observed tip. The time
-//!   gate bounds SQL load; block distance is the semantic clock criterion.
-//!   That frontier read is also the lane's divergence refusal point (I15):
-//!   a marker already present closes intake before direct execution,
-//!   or the frame-clock decision.
-//!
-//! The lane is a single-thread `spawn_blocking` task. SQLite is the durable data
-//! coordination boundary with the input reader and batch submitter. HTTP
-//! ingress uses the deliberate bounded-channel request/response exception;
-//! `RuntimeScope` is process control, not data coordination. Reconciliation
-//! has no timeout/resume protocol: supported applications are assumed to
-//! promptly digest the complete newly-safe range in the supported envelope.
+//! The single ordering lane. The fast regime takes one bounded user-op chunk per
+//! turn and commits its accepted subset at most once before acking; the L1 regime
+//! opens one frame at the observed tip once five newly-safe blocks accumulate and
+//! refuses on a divergence marker (I15). Design: authority-boundary ADR, mechanism 4.
 
 mod catch_up;
 mod config;
@@ -97,20 +79,8 @@ impl<A: Application + 'static> InclusionLane<A> {
             // can never drift apart.
             let checkpoint = catch_up_snapshot(&mut storage)
                 .map_err(|source| InclusionLaneError::CatchUp { source })?;
-            let app = A::from_dump(&dump_info::app_prefix(&checkpoint.dump_dir))
+            let app = A::from_dump(&dump_info::app_prefix(&checkpoint.dump.prefix))
                 .map_err(InclusionLaneError::LoadFromDump)?;
-            if app.executed_input_count() != checkpoint.executed_input_count {
-                return Err(InclusionLaneError::CatchUp {
-                    source: error::CatchUpError::SnapshotExecutionCountMismatch {
-                        application: app.executed_input_count().get(),
-                        storage: checkpoint.executed_input_count.get(),
-                    },
-                });
-            }
-            tracing::debug!(
-                executed_input_count = checkpoint.executed_input_count.get(),
-                "inclusion lane resuming from snapshot"
-            );
             let mut lane = Self {
                 rx,
                 shutdown,
@@ -147,7 +117,15 @@ impl<A: Application + 'static> InclusionLane<A> {
             }
 
             self.maybe_advance_safe_frontier(&mut lane_state, &mut safe_inputs)?;
-            let turn = self.run_fast_turn(&mut lane_state.head, &mut included)?;
+            let turn = match self.run_fast_turn(&mut lane_state.head, &mut included) {
+                // The HTTP router owns every sender and drops them when its
+                // graceful shutdown completes, which can land after the check
+                // above.
+                Err(InclusionLaneError::ChannelClosed) if self.shutdown.is_shutdown_requested() => {
+                    return Ok(());
+                }
+                turn => turn?,
+            };
 
             if turn.hit_batch_target() || should_close_batch_by_time(&lane_state.head, &self.config)
             {
diff --git a/sequencer/src/ingress/inclusion_lane/snapshot.rs b/sequencer/src/ingress/inclusion_lane/snapshot.rs
index 3542eb5f..f817f4f9 100644
--- a/sequencer/src/ingress/inclusion_lane/snapshot.rs
+++ b/sequencer/src/ingress/inclusion_lane/snapshot.rs
@@ -5,7 +5,7 @@
 
 use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{SystemTime, UNIX_EPOCH};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use super::dump_info::{self, DumpInfo};
 use crate::storage::{Storage, WriteHead};
@@ -36,6 +36,10 @@ pub(super) fn run_gc(storage: &mut Storage) -> Result<usize, GcError> {
     Ok(removed.len())
 }
 
+/// Snapshot creation blocks user-op admission; a close that spends half the
+/// 500 ms `POST /tx` acknowledgement budget on it is logged at WARN.
+const SLOW_SNAPSHOT: Duration = Duration::from_millis(250);
+
 /// Files become durable before the atomic batch seal and snapshot registration.
 /// A failed commit leaves only an orphan directory for the startup sweep.
 pub(super) fn close_batch_with_snapshot<A: Application>(
@@ -48,14 +52,31 @@ pub(super) fn close_batch_with_snapshot<A: Application>(
     let batch_index = head.batch_index;
     let nonce = storage.batch_nonce(batch_index)?;
     let dump_dir = make_dump_dir(dumps_dir, nonce);
+    let started = Instant::now();
     dump_info::create_dump_dir_with_info(app, &dump_dir, &DumpInfo::at_batch_close(nonce))?;
+    let snapshot_elapsed = started.elapsed();
     storage.close_frame_and_batch_with_snapshot(
         head,
         next_safe_block,
         &dump_dir,
-        batch_index,
         app.executed_input_count(),
     )?;
+    let snapshot_ms = snapshot_elapsed.as_millis();
+    if snapshot_elapsed >= SLOW_SNAPSHOT {
+        tracing::warn!(
+            batch_index,
+            nonce,
+            snapshot_ms,
+            "slow batch-close snapshot blocked user-op admission"
+        );
+    } else {
+        tracing::debug!(
+            batch_index,
+            nonce,
+            snapshot_ms,
+            "batch closed with snapshot"
+        );
+    }
     Ok(())
 }
 
diff --git a/sequencer/src/ingress/inclusion_lane/tests.rs b/sequencer/src/ingress/inclusion_lane/tests.rs
index 9f58bfa0..33634720 100644
--- a/sequencer/src/ingress/inclusion_lane/tests.rs
+++ b/sequencer/src/ingress/inclusion_lane/tests.rs
@@ -1,28 +1,26 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::time::{Duration, SystemTime};
 
 use alloy_primitives::{Address, Signature};
-use app_core::application::MAX_METHOD_PAYLOAD_BYTES as WALLET_MAX_METHOD_PAYLOAD_BYTES;
 use rusqlite::params;
 use tokio::sync::{mpsc, oneshot};
 
 use crate::runtime::shutdown::RuntimeScope;
 use crate::storage::test_helpers::{
-    SENDER_A, default_protocol_timing, pin_test_deployment_identity, record_canonical_divergence,
-    temp_db,
+    SENDER_A, default_protocol_timing, record_canonical_divergence, set_one_op_batch_target,
 };
 use crate::storage::{DirectInputExecution, SafeInputRange, Storage, StoredSafeInput, WriteHead};
-use sequencer_core::application::{
-    AppError, AppOutputs, Application, ApplicationProgress, InvalidReason, ValidationOutcome,
-};
+use crate::test_support::{pin_test_deployment_identity, temp_db};
+use sequencer_core::application::{AppError, Application};
 use sequencer_core::history::ExecutedInputCount;
-use sequencer_core::l2_tx::{DirectInput, SequencedL2Tx, ValidUserOp};
+use sequencer_core::l2_tx::{DirectInput, SequencedL2Tx};
 use sequencer_core::user_op::{SignedUserOp, UserOp};
 
+use crate::test_support::{ReplayEvent, StubApp, shutdown_lane, wait_until};
+
 use super::catch_up::{catch_up_application_paged, catch_up_snapshot};
 use super::dequeue_and_execute_user_op_chunk;
 use super::error::CatchUpError;
@@ -31,330 +29,6 @@ use super::{
     PendingUserOp, SequencerError, TurnOutcome,
 };
 
-fn encode_progress(progress: ApplicationProgress) -> [u8; 16] {
-    let mut bytes = [0_u8; 16];
-    bytes[..8].copy_from_slice(&progress.executed_input_count().get().to_le_bytes());
-    bytes[8..].copy_from_slice(&progress.last_executed_safe_block().to_le_bytes());
-    bytes
-}
-
-fn decode_progress(bytes: &[u8], app_name: &str) -> Result<ApplicationProgress, AppError> {
-    if bytes.len() != 16 {
-        return Err(AppError::Internal {
-            reason: format!("{app_name} dump must be exactly 16 bytes"),
-        });
-    }
-    let count = u64::from_le_bytes(bytes[..8].try_into().expect("checked slice length"));
-    let safe_block = u64::from_le_bytes(bytes[8..].try_into().expect("checked slice length"));
-    Ok(
-        ApplicationProgress::try_new(ExecutedInputCount::new(count), safe_block)
-            .expect("coherent progress"),
-    )
-}
-
-#[derive(Default)]
-struct TestApp {
-    nonces: HashMap<Address, u32>,
-    progress: ApplicationProgress,
-    fail_dump: bool,
-    /// Test-only scheduling seam used to keep a rejected queue saturated long
-    /// enough to distinguish one bounded turn from an unbounded drain.
-    reject_user_ops_after: Option<Duration>,
-}
-
-impl Application for TestApp {
-    fn max_method_payload_bytes() -> usize {
-        WALLET_MAX_METHOD_PAYLOAD_BYTES
-    }
-
-    fn validate_user_op(
-        &self,
-        _sender: Address,
-        user_op: &UserOp,
-        _current_fee: u16,
-    ) -> Result<ValidationOutcome, AppError> {
-        if let Some(delay) = self.reject_user_ops_after {
-            std::thread::sleep(delay);
-            return Ok(ValidationOutcome::Reject(InvalidReason::InvalidNonce {
-                expected: user_op.nonce.wrapping_add(1),
-                got: user_op.nonce,
-            }));
-        }
-        Ok(ValidationOutcome::Accept)
-    }
-
-    fn apply_valid_user_op(
-        &mut self,
-        user_op: &ValidUserOp,
-        safe_block: u64,
-    ) -> Result<AppOutputs, AppError> {
-        let current = self.nonces.get(&user_op.sender).copied().unwrap_or(0);
-        let next_nonce = current.wrapping_add(1);
-        self.nonces.insert(user_op.sender, next_nonce);
-        self.progress.advance(safe_block);
-        Ok(Vec::new())
-    }
-
-    fn apply_direct_input(&mut self, input: &DirectInput) -> Result<AppOutputs, AppError> {
-        self.progress.advance(input.block_number);
-        Ok(Vec::new())
-    }
-
-    fn progress(&self) -> ApplicationProgress {
-        self.progress
-    }
-
-    // The lane loads its app via `from_dump` after the runtime
-    // registers a genesis dump, so test stubs must reload to the
-    // initial state (an empty `nonces` map). `create_dump` writes
-    // an empty marker file — `from_dump` ignores the contents and
-    // returns `Self::default()`.
-    fn from_dump(_prefix: &Path) -> Result<Self, AppError> {
-        Ok(Self::default())
-    }
-
-    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
-        if self.fail_dump {
-            return Err(std::io::Error::other("injected application dump failure").into());
-        }
-        std::fs::create_dir(prefix)?;
-        std::fs::write(Self::state_file_in_dump(prefix), b"")?;
-        Ok(())
-    }
-
-    fn state_file_in_dump(prefix: &Path) -> PathBuf {
-        prefix.join("state")
-    }
-}
-
-#[derive(Default)]
-struct InternalUserOpApp {
-    fail_validation: bool,
-    progress: ApplicationProgress,
-}
-
-impl Application for InternalUserOpApp {
-    fn max_method_payload_bytes() -> usize {
-        WALLET_MAX_METHOD_PAYLOAD_BYTES
-    }
-
-    fn validate_user_op(
-        &self,
-        _sender: Address,
-        _user_op: &UserOp,
-        _current_fee: u16,
-    ) -> Result<ValidationOutcome, AppError> {
-        if self.fail_validation {
-            return Err(AppError::Internal {
-                reason: "app invariant failed".into(),
-            });
-        }
-        Ok(ValidationOutcome::Accept)
-    }
-
-    fn apply_valid_user_op(
-        &mut self,
-        _user_op: &ValidUserOp,
-        _safe_block: u64,
-    ) -> Result<AppOutputs, AppError> {
-        Err(AppError::Internal {
-            reason: "app invariant failed".to_string(),
-        })
-    }
-
-    fn apply_direct_input(&mut self, _input: &DirectInput) -> Result<AppOutputs, AppError> {
-        unimplemented!("not used in these tests")
-    }
-
-    fn progress(&self) -> ApplicationProgress {
-        self.progress
-    }
-
-    fn from_dump(_prefix: &Path) -> Result<Self, AppError> {
-        Ok(Self::default())
-    }
-
-    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
-        std::fs::create_dir(prefix)?;
-        std::fs::write(Self::state_file_in_dump(prefix), b"")?;
-        Ok(())
-    }
-
-    fn state_file_in_dump(prefix: &Path) -> PathBuf {
-        prefix.join("state")
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-enum ReplayEvent {
-    UserOp {
-        sender: Address,
-        data: Vec<u8>,
-    },
-    DirectInput {
-        sender: Address,
-        block_number: u64,
-        payload: Vec<u8>,
-    },
-}
-
-struct ReplayRecordingApp {
-    progress: ApplicationProgress,
-    replayed: Vec<ReplayEvent>,
-}
-
-/// App that counts direct-input executions and persists the count
-/// through `create_dump` / `from_dump`. Tests verify the count by
-/// reading the state file from a snapshot (rather than by sharing
-/// an `Arc<AtomicU64>` across thread boundaries) — the lane loads
-/// its own instance via `from_dump`, so external observation has to
-/// go through the on-disk snapshot.
-struct SharedCountingApp {
-    progress: ApplicationProgress,
-}
-
-impl SharedCountingApp {
-    fn new() -> Self {
-        Self {
-            progress: ApplicationProgress::default(),
-        }
-    }
-}
-
-impl Application for SharedCountingApp {
-    fn max_method_payload_bytes() -> usize {
-        WALLET_MAX_METHOD_PAYLOAD_BYTES
-    }
-
-    fn validate_user_op(
-        &self,
-        _sender: Address,
-        _user_op: &UserOp,
-        _current_fee: u16,
-    ) -> Result<ValidationOutcome, AppError> {
-        Ok(ValidationOutcome::Accept)
-    }
-
-    fn apply_valid_user_op(
-        &mut self,
-        _user_op: &ValidUserOp,
-        safe_block: u64,
-    ) -> Result<AppOutputs, AppError> {
-        self.progress.advance(safe_block);
-        Ok(Vec::new())
-    }
-
-    fn apply_direct_input(&mut self, input: &DirectInput) -> Result<AppOutputs, AppError> {
-        self.progress.advance(input.block_number);
-        Ok(Vec::new())
-    }
-
-    fn progress(&self) -> ApplicationProgress {
-        self.progress
-    }
-
-    fn from_dump(prefix: &Path) -> Result<Self, AppError> {
-        let bytes = std::fs::read(Self::state_file_in_dump(prefix))?;
-        let progress = decode_progress(bytes.as_slice(), "SharedCountingApp")?;
-        Ok(Self { progress })
-    }
-
-    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
-        std::fs::create_dir(prefix)?;
-        std::fs::write(
-            Self::state_file_in_dump(prefix),
-            encode_progress(self.progress),
-        )?;
-        Ok(())
-    }
-
-    fn state_file_in_dump(prefix: &Path) -> PathBuf {
-        prefix.join("state")
-    }
-}
-
-impl ReplayRecordingApp {
-    fn with_executed_input_count(executed_input_count: u64) -> Self {
-        Self {
-            progress: ApplicationProgress::try_new(
-                ExecutedInputCount::new(executed_input_count),
-                0,
-            )
-            .expect("coherent progress"),
-            replayed: Vec::new(),
-        }
-    }
-}
-
-impl Default for ReplayRecordingApp {
-    fn default() -> Self {
-        Self::with_executed_input_count(0)
-    }
-}
-
-impl Application for ReplayRecordingApp {
-    fn max_method_payload_bytes() -> usize {
-        WALLET_MAX_METHOD_PAYLOAD_BYTES
-    }
-
-    fn validate_user_op(
-        &self,
-        _sender: Address,
-        _user_op: &UserOp,
-        _current_fee: u16,
-    ) -> Result<ValidationOutcome, AppError> {
-        Ok(ValidationOutcome::Accept)
-    }
-
-    fn apply_valid_user_op(
-        &mut self,
-        user_op: &ValidUserOp,
-        safe_block: u64,
-    ) -> Result<AppOutputs, AppError> {
-        self.replayed.push(ReplayEvent::UserOp {
-            sender: user_op.sender,
-            data: user_op.data.clone(),
-        });
-        self.progress.advance(safe_block);
-        Ok(Vec::new())
-    }
-
-    fn apply_direct_input(&mut self, input: &DirectInput) -> Result<AppOutputs, AppError> {
-        self.replayed.push(ReplayEvent::DirectInput {
-            sender: input.sender,
-            block_number: input.block_number,
-            payload: input.payload.clone(),
-        });
-        self.progress.advance(input.block_number);
-        Ok(Vec::new())
-    }
-
-    fn progress(&self) -> ApplicationProgress {
-        self.progress
-    }
-
-    fn from_dump(prefix: &Path) -> Result<Self, AppError> {
-        let bytes = std::fs::read(Self::state_file_in_dump(prefix))?;
-        Ok(Self {
-            progress: decode_progress(&bytes, "ReplayRecordingApp")?,
-            replayed: Vec::new(),
-        })
-    }
-
-    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
-        std::fs::create_dir(prefix)?;
-        std::fs::write(
-            Self::state_file_in_dump(prefix),
-            encode_progress(self.progress),
-        )?;
-        Ok(())
-    }
-
-    fn state_file_in_dump(prefix: &Path) -> PathBuf {
-        prefix.join("state")
-    }
-}
-
 fn default_test_config() -> InclusionLaneConfig {
     InclusionLaneConfig {
         // A leaked tempdir per call: the lane unconditionally writes
@@ -411,7 +85,7 @@ async fn start_lane(
     storage
         .append_safe_inputs(0, &[], SENDER_A, &default_protocol_timing())
         .expect("seed observed safe head");
-    let mut app = TestApp::default();
+    let mut app = StubApp::default();
     register_genesis_snapshot(&mut app, &mut storage, &config.dumps_dir);
     // `app` instance is dropped here; the lane reloads it from the
     // genesis dump on its background thread.
@@ -420,7 +94,7 @@ async fn start_lane(
     // hand its head to the lane — which now only loads, never initializes.
     storage.ensure_open_tip().expect("establish genesis tip");
     let shutdown = RuntimeScope::default();
-    let (tx, handle) = InclusionLane::<TestApp>::start(128, shutdown.clone(), storage, config);
+    let (tx, handle) = InclusionLane::<StubApp>::start(128, shutdown.clone(), storage, config);
     (tx, shutdown, handle)
 }
 
@@ -486,7 +160,7 @@ fn fast_turn_processes_at_most_one_rejected_chunk() {
     let mut lane = InclusionLane {
         rx,
         shutdown: RuntimeScope::default(),
-        app: TestApp::default(),
+        app: StubApp::default(),
         storage,
         config,
     };
@@ -530,9 +204,9 @@ async fn sustained_rejected_queue_cannot_starve_poisoned_frontier() {
     let mut lane = InclusionLane {
         rx,
         shutdown: shutdown.clone(),
-        app: TestApp {
+        app: StubApp {
             reject_user_ops_after: Some(Duration::from_millis(2)),
-            ..TestApp::default()
+            ..StubApp::default()
         },
         storage,
         config,
@@ -627,7 +301,7 @@ fn reconciliation_digests_an_epoch_sized_outage_backlog_in_one_turn() {
     let mut lane = InclusionLane {
         rx,
         shutdown: RuntimeScope::default(),
-        app: TestApp::default(),
+        app: StubApp::default(),
         storage,
         config,
     };
@@ -671,7 +345,7 @@ fn frame_clock_waits_five_blocks_and_collapses_observation_jumps() {
     let mut lane = InclusionLane {
         rx,
         shutdown: RuntimeScope::default(),
-        app: TestApp::default(),
+        app: StubApp::default(),
         storage,
         config,
     };
@@ -766,7 +440,7 @@ fn structural_batch_frame_does_not_reset_frame_clock_anchor() {
     let mut lane = InclusionLane {
         rx,
         shutdown: RuntimeScope::default(),
-        app: TestApp::default(),
+        app: StubApp::default(),
         storage,
         config: default_test_config(),
     };
@@ -811,7 +485,7 @@ fn poisoned_frontier_outranks_frame_clock_and_closes_intake() {
     let mut lane = InclusionLane {
         rx,
         shutdown: RuntimeScope::default(),
-        app: TestApp::default(),
+        app: StubApp::default(),
         storage,
         config: default_test_config(),
     };
@@ -997,29 +671,6 @@ fn read_frame_safe_blocks(db_path: &str) -> Vec<u64> {
         .collect()
 }
 
-async fn wait_until(timeout: Duration, mut predicate: impl FnMut() -> bool) -> bool {
-    let started = tokio::time::Instant::now();
-    while started.elapsed() < timeout {
-        if predicate() {
-            return true;
-        }
-        tokio::time::sleep(Duration::from_millis(5)).await;
-    }
-    predicate()
-}
-
-async fn shutdown_lane(
-    shutdown: &RuntimeScope,
-    handle: tokio::task::JoinHandle<Result<(), InclusionLaneError>>,
-) {
-    shutdown.request_shutdown();
-    let joined = tokio::time::timeout(Duration::from_secs(2), handle)
-        .await
-        .expect("wait for lane shutdown");
-    let result = joined.expect("join lane task");
-    assert!(result.is_ok(), "lane should shut down cleanly: {result:?}");
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn ack_happens_after_chunk_commit_without_closing_frame() {
     let db = temp_db("ack-chunk-commit");
@@ -1084,13 +735,13 @@ async fn sequenced_safe_inputs_are_drained_but_not_executed() {
     let config = default_test_config();
     pin_test_deployment_identity(&mut storage, batch_submitter_address);
     {
-        let mut app = SharedCountingApp::new();
+        let mut app = StubApp::default();
         register_genesis_snapshot(&mut app, &mut storage, &config.dumps_dir);
     }
     storage.ensure_open_tip().expect("establish genesis tip");
     let shutdown = RuntimeScope::default();
     let (_tx, lane_handle) =
-        InclusionLane::<SharedCountingApp>::start(128, shutdown.clone(), storage, config);
+        InclusionLane::<StubApp>::start(128, shutdown.clone(), storage, config);
     let initialized = wait_until(Duration::from_secs(2), || {
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
         storage.open_state().expect("load open state").is_some()
@@ -1131,7 +782,7 @@ async fn sequenced_safe_inputs_are_drained_but_not_executed() {
     let mut storage = Storage::open(db.path.as_str()).unwrap();
     assert!(history_rows(&mut storage, 16).is_empty());
     assert_eq!(read_frame_direct_count(db.path.as_str(), 0, 1), 0);
-    let mut fresh_app = SharedCountingApp::new();
+    let mut fresh_app = StubApp::default();
     catch_up_application_paged(&mut fresh_app, &mut storage, ExecutedInputCount::ZERO, 16)
         .expect("catch up");
     assert_eq!(
@@ -1281,7 +932,7 @@ async fn batch_closes_when_max_user_op_bytes_is_reached() {
     // 55000*1000/(17000*26) = 124 bytes < 126.
     {
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage.set_alpha(17000, 1000).expect("set alpha");
+        set_one_op_batch_target(&mut storage);
     }
     let config = default_test_config();
     let (tx, shutdown, lane_handle) = start_lane(db.path.as_str(), config).await;
@@ -1324,7 +975,7 @@ fn unbounded_head() -> WriteHead {
 fn dequeue_returns_channel_closed_when_disconnected() {
     let (tx, mut rx) = mpsc::channel::<PendingUserOp>(1);
     drop(tx);
-    let mut app = TestApp::default();
+    let mut app = StubApp::default();
     let mut included = Vec::new();
     let head = unbounded_head();
 
@@ -1340,7 +991,7 @@ fn dequeue_flushes_executed_ops_before_observing_disconnect() {
     tx.blocking_send(pending).expect("enqueue pending user op");
     drop(tx);
 
-    let mut app = TestApp::default();
+    let mut app = StubApp::default();
     let mut included = Vec::new();
     let head = unbounded_head();
     dequeue_and_execute_user_op_chunk(&mut rx, &mut app, 16, &head, &mut included)
@@ -1355,9 +1006,10 @@ fn dequeue_returns_lane_error_when_app_reports_internal() {
         let (pending, recv) = make_pending_user_op(0x45);
         tx.blocking_send(pending).expect("enqueue pending user op");
 
-        let mut app = InternalUserOpApp {
+        let mut app = StubApp {
             fail_validation,
-            ..InternalUserOpApp::default()
+            fail_apply: true,
+            ..StubApp::default()
         };
         let mut included = Vec::new();
         let head = unbounded_head();
@@ -1396,7 +1048,7 @@ fn catch_up_replays_multiple_pages() {
         .map(|row| row.offset.get())
         .collect();
     assert_eq!(mappings, vec![0, 1, 2, 3, 4, 5]);
-    let mut app = ReplayRecordingApp::default();
+    let mut app = StubApp::default();
 
     catch_up_application_paged(&mut app, &mut storage, ExecutedInputCount::ZERO, 2)
         .expect("catch up in pages");
@@ -1417,7 +1069,7 @@ fn catch_up_rejects_history_gap_before_execution() {
     let mut storage = Storage::open(&db.path).unwrap();
     let conn = Storage::open_connection(&db.path).unwrap();
     conn.execute_batch("DROP TRIGGER trg_protect_valid_application_input_delete; DELETE FROM application_inputs WHERE offset=1;").unwrap();
-    let mut app = ReplayRecordingApp::default();
+    let mut app = StubApp::default();
     let failure = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
         let _ = catch_up_application_paged(&mut app, &mut storage, ExecutedInputCount::ZERO, 2);
     }));
@@ -1430,7 +1082,7 @@ fn catch_up_rejects_wrong_snapshot_count_before_execution() {
     let db = temp_db("catch-up-wrong-mapping");
     seed_replay_fixture(db.path.as_str());
     let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-    let mut app = ReplayRecordingApp::with_executed_input_count(3);
+    let mut app = StubApp::with_progress(3, 0);
 
     let err = catch_up_application_paged(&mut app, &mut storage, ExecutedInputCount::ZERO, 2)
         .expect_err("mapping from a different application boundary must stop catch-up");
@@ -1455,7 +1107,7 @@ fn catch_up_handles_mixed_user_ops_and_direct_inputs_across_page_boundary() {
     let db = temp_db("catch-up-mixed-page-boundary");
     let expected = seed_replay_fixture(db.path.as_str());
     let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-    let mut app = ReplayRecordingApp::default();
+    let mut app = StubApp::default();
 
     catch_up_application_paged(&mut app, &mut storage, ExecutedInputCount::ZERO, 4)
         .expect("catch up across page boundary");
@@ -1478,7 +1130,7 @@ fn standard_recovery_rebases_history_and_restart_on_surviving_checkpoint() {
     storage.ensure_open_tip().expect("open genesis Tip");
     let mut head = storage.open_state().unwrap().unwrap();
     let initial_history = storage.history_state().expect("initial history");
-    let mut live_app = SharedCountingApp::new();
+    let mut live_app = StubApp::default();
 
     // Batch 0 is the surviving prefix. Its pending snapshot reflects exactly
     // input 0 and becomes the recovery checkpoint once the batch lands.
@@ -1630,9 +1282,8 @@ fn standard_recovery_rebases_history_and_restart_on_surviving_checkpoint() {
         checkpoint.executed_input_count,
         finalized_before.executed_input_count
     );
-    let mut restarted =
-        SharedCountingApp::from_dump(&super::dump_info::app_prefix(&checkpoint.dump_dir))
-            .expect("load surviving application checkpoint");
+    let mut restarted = StubApp::from_dump(&super::dump_info::app_prefix(&checkpoint.dump.prefix))
+        .expect("load surviving application checkpoint");
     assert_eq!(restarted.executed_input_count(), ExecutedInputCount::new(1));
     catch_up_application_paged(
         &mut restarted,
@@ -1681,7 +1332,7 @@ fn standard_recovery_rebases_history_and_restart_on_surviving_checkpoint() {
     assert_eq!(user_seeds, vec![0x51, 0x53]);
 
     let mut restarted_again =
-        SharedCountingApp::from_dump(&super::dump_info::app_prefix(&checkpoint.dump_dir))
+        StubApp::from_dump(&super::dump_info::app_prefix(&checkpoint.dump.prefix))
             .expect("reload surviving checkpoint");
     catch_up_application_paged(
         &mut restarted_again,
@@ -1701,7 +1352,7 @@ fn standard_recovery_rebases_history_and_restart_on_surviving_checkpoint() {
 fn catch_up_load_error_reports_offset() {
     let db = temp_db("catch-up-load-error");
     let mut storage = Storage::open_writer(db.path.as_str()).expect("open raw storage");
-    let mut app = ReplayRecordingApp::default();
+    let mut app = StubApp::default();
 
     let err = catch_up_application_paged(&mut app, &mut storage, ExecutedInputCount::ZERO, 2)
         .expect_err("catch up should fail without schema");
@@ -1724,15 +1375,12 @@ async fn lane_refuses_snapshot_whose_application_count_disagrees_with_storage()
         )
         .expect("seed observed safe head");
 
-    let mut app = SharedCountingApp {
-        progress: ApplicationProgress::try_new(ExecutedInputCount::new(1), 0)
-            .expect("coherent progress"),
-    };
+    let mut app = StubApp::with_progress(1, 0);
     register_genesis_snapshot(&mut app, &mut storage, &config.dumps_dir);
     storage.ensure_open_tip().expect("establish genesis tip");
 
     let shutdown = RuntimeScope::default();
-    let (_tx, handle) = InclusionLane::<SharedCountingApp>::start(1, shutdown, storage, config);
+    let (_tx, handle) = InclusionLane::<StubApp>::start(1, shutdown, storage, config);
     let err = handle
         .await
         .expect("join lane startup")
@@ -1750,90 +1398,17 @@ async fn lane_refuses_snapshot_whose_application_count_disagrees_with_storage()
     assert!(err.is_terminal_invariant());
 }
 
-/// App that counts executed user ops and persists the count through
-/// `create_dump` / `from_dump` (two LE `u64`s at `prefix/state`). The
-/// restart-resume regression test reads this count back from the
-/// snapshot the lane writes on its own thread — the only way to observe
-/// how much state the lane rebuilt across a restart.
-struct UserOpCounterApp {
-    progress: ApplicationProgress,
-}
-
-impl UserOpCounterApp {
-    fn new() -> Self {
-        Self {
-            progress: ApplicationProgress::default(),
-        }
-    }
-}
-
-impl Application for UserOpCounterApp {
-    fn max_method_payload_bytes() -> usize {
-        WALLET_MAX_METHOD_PAYLOAD_BYTES
-    }
-
-    fn validate_user_op(
-        &self,
-        _sender: Address,
-        _user_op: &UserOp,
-        _current_fee: u16,
-    ) -> Result<ValidationOutcome, AppError> {
-        Ok(ValidationOutcome::Accept)
-    }
-
-    fn apply_valid_user_op(
-        &mut self,
-        _user_op: &ValidUserOp,
-        safe_block: u64,
-    ) -> Result<AppOutputs, AppError> {
-        self.progress.advance(safe_block);
-        Ok(Vec::new())
-    }
-
-    fn apply_direct_input(&mut self, _input: &DirectInput) -> Result<AppOutputs, AppError> {
-        unimplemented!("not used in these tests")
-    }
-
-    fn progress(&self) -> ApplicationProgress {
-        self.progress
-    }
-
-    fn from_dump(prefix: &Path) -> Result<Self, AppError> {
-        let bytes = std::fs::read(Self::state_file_in_dump(prefix))?;
-        let progress = decode_progress(bytes.as_slice(), "UserOpCounterApp")?;
-        Ok(Self { progress })
-    }
-
-    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
-        std::fs::create_dir(prefix)?;
-        std::fs::write(
-            Self::state_file_in_dump(prefix),
-            encode_progress(self.progress),
-        )?;
-        Ok(())
-    }
-
-    fn state_file_in_dump(prefix: &Path) -> PathBuf {
-        prefix.join("state")
-    }
-}
-
 fn read_dump_counter(dump_dir: &Path) -> u64 {
-    let state_file = UserOpCounterApp::state_file_in_dump(&super::dump_info::app_prefix(dump_dir));
-    let bytes = std::fs::read(state_file).expect("read dump state file");
-    decode_progress(bytes.as_slice(), "UserOpCounterApp")
+    StubApp::from_dump(&super::dump_info::app_prefix(dump_dir))
         .expect("decode dump progress")
         .executed_input_count()
         .get()
 }
 
-/// Regression for the resume-checkpoint bug: the lane used to load its
-/// Application from one snapshot (the finalized) but replay catch-up
-/// from a *different* snapshot's offset (the latest pending). With a
-/// pending snapshot present at restart — the common "closed batch not
-/// yet observed on L1" case — the loaded state and the replay cursor
-/// must come from the *same* checkpoint, or restart silently drops the
-/// pending batch's txs.
+/// Restart must load the application and the catch-up cursor from the same
+/// checkpoint. With a pending snapshot present (a closed batch not yet observed
+/// on L1), loading the finalized snapshot's state but replaying from the pending
+/// snapshot's offset would silently drop the pending batch's txs.
 ///
 /// Setup: 3 user ops each close their own batch (aggressive sizing) →
 /// 3 pending snapshots, none promoted, so finalized stays at genesis
@@ -1847,7 +1422,7 @@ async fn restart_resumes_from_pending_checkpoint_without_skipping_txs() {
     {
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
         // Batch size target < one user op, so every op closes its batch.
-        storage.set_alpha(17000, 1000).expect("set alpha");
+        set_one_op_batch_target(&mut storage);
         storage
             .append_safe_inputs(0, &[], SENDER_A, &default_protocol_timing())
             .expect("seed observed safe head");
@@ -1861,12 +1436,12 @@ async fn restart_resumes_from_pending_checkpoint_without_skipping_txs() {
     let mut storage = Storage::open(db.path.as_str()).expect("open storage");
     // `app` only writes the genesis dump here; the lane reloads its own
     // instance via `from_dump` on its background thread.
-    let mut app = UserOpCounterApp::new();
+    let mut app = StubApp::default();
     register_genesis_snapshot(&mut app, &mut storage, &config1.dumps_dir);
     storage.ensure_open_tip().expect("establish genesis tip");
     let shutdown1 = RuntimeScope::default();
     let (tx1, handle1) =
-        InclusionLane::<UserOpCounterApp>::start(128, shutdown1.clone(), storage, config1.clone());
+        InclusionLane::<StubApp>::start(128, shutdown1.clone(), storage, config1.clone());
     assert!(
         wait_until(Duration::from_secs(2), || {
             Storage::open(db.path.as_str())
@@ -1925,8 +1500,7 @@ async fn restart_resumes_from_pending_checkpoint_without_skipping_txs() {
     // Restart: the Tip already exists, so this loads its head (warm path).
     storage2.ensure_open_tip().expect("load existing tip");
     let shutdown2 = RuntimeScope::default();
-    let (tx2, handle2) =
-        InclusionLane::<UserOpCounterApp>::start(128, shutdown2.clone(), storage2, config2);
+    let (tx2, handle2) = InclusionLane::<StubApp>::start(128, shutdown2.clone(), storage2, config2);
 
     let (pending, recv) = make_pending_user_op(0x20);
     tx2.send(pending).await.expect("send gen-2 op");
@@ -1967,7 +1541,7 @@ fn application_dump_failure_leaves_tip_and_latest_snapshot_unchanged() {
         .initialize_open_state(0, SafeInputRange::empty_at(0))
         .unwrap();
     let dumps = tempfile::tempdir().unwrap();
-    let mut app = TestApp::default();
+    let mut app = StubApp::default();
     register_genesis_snapshot(&mut app, &mut storage, dumps.path());
     super::snapshot::close_batch_with_snapshot(&mut app, &mut storage, &mut head, 0, dumps.path())
         .unwrap();
@@ -2002,7 +1576,7 @@ fn empty_batch_snapshot_preserves_application_count() {
     let db = temp_db("empty-snapshot-count");
     let expected = seed_replay_fixture(&db.path);
     let mut storage = Storage::open(&db.path).unwrap();
-    let mut app = ReplayRecordingApp::default();
+    let mut app = StubApp::default();
     catch_up_application_paged(&mut app, &mut storage, ExecutedInputCount::ZERO, 2).unwrap();
     assert_eq!(app.replayed, expected);
     let mut head = storage.open_state().unwrap().unwrap();
@@ -2014,8 +1588,7 @@ fn empty_batch_snapshot_preserves_application_count() {
     let snapshot = storage.latest_snapshot().unwrap().unwrap();
     assert_eq!(snapshot.executed_input_count.get(), 6);
     let restored =
-        ReplayRecordingApp::from_dump(&super::dump_info::app_prefix(&snapshot.dump.prefix))
-            .unwrap();
+        StubApp::from_dump(&super::dump_info::app_prefix(&snapshot.dump.prefix)).unwrap();
     assert_eq!(restored.executed_input_count().get(), 6);
 }
 
@@ -2039,3 +1612,66 @@ fn context_tx(context: crate::storage::L2TxContext) -> SequencedL2Tx {
         crate::storage::L2TxContext::DirectInput { tx, .. } => SequencedL2Tx::Direct(tx),
     }
 }
+
+/// A lane with its queue already closed and one direct input due at the first
+/// frame-clock tick.
+fn lane_with_closed_queue_and_due_direct(
+    name: &str,
+    request_shutdown_on_direct: bool,
+) -> (tempfile::TempDir, InclusionLane<StubApp>, RuntimeScope) {
+    let db = temp_db(name);
+    let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+    pin_test_deployment_identity(&mut storage, Address::repeat_byte(0xff));
+    storage
+        .append_safe_inputs(0, &[], SENDER_A, &default_protocol_timing())
+        .expect("seed observed safe head");
+    storage.ensure_open_tip().expect("establish open tip");
+    storage
+        .append_safe_inputs(
+            5,
+            &[StoredSafeInput {
+                sender: Address::ZERO,
+                payload: vec![0xaa],
+                block_number: 5,
+            }],
+            SENDER_A,
+            &default_protocol_timing(),
+        )
+        .expect("append a direct at the first clock tick");
+
+    let (tx, rx) = mpsc::channel(1);
+    drop(tx);
+    let shutdown = RuntimeScope::default();
+    let lane = InclusionLane {
+        rx,
+        shutdown: shutdown.clone(),
+        app: StubApp {
+            shutdown_on_direct: request_shutdown_on_direct.then(|| shutdown.clone()),
+            ..StubApp::default()
+        },
+        storage,
+        config: default_test_config(),
+    };
+    (db._dir, lane, shutdown)
+}
+
+#[test]
+fn lane_stops_cleanly_when_its_queue_closes_during_shutdown() {
+    let (_dir, mut lane, shutdown) =
+        lane_with_closed_queue_and_due_direct("closed-queue-during-shutdown", true);
+
+    let result = lane.run_forever(ExecutedInputCount::ZERO);
+
+    assert!(shutdown.is_shutdown_requested());
+    assert!(result.is_ok(), "{result:?}");
+}
+
+#[test]
+fn lane_reports_a_closed_queue_without_shutdown() {
+    let (_dir, mut lane, _shutdown) =
+        lane_with_closed_queue_and_due_direct("closed-queue-without-shutdown", false);
+
+    let result = lane.run_forever(ExecutedInputCount::ZERO);
+
+    assert!(matches!(result, Err(InclusionLaneError::ChannelClosed)));
+}
diff --git a/sequencer/src/integration_tests/batch_submitter.rs b/sequencer/src/integration_tests/batch_submitter.rs
index 41f2d03f..5df9c05d 100644
--- a/sequencer/src/integration_tests/batch_submitter.rs
+++ b/sequencer/src/integration_tests/batch_submitter.rs
@@ -16,7 +16,7 @@ use sequencer::storage::{SafeInputRange, Storage};
 use sequencer_core::batch::Batch;
 use sequencer_core::protocol::ProtocolTiming;
 
-use super::common::{TestDb, temp_db};
+use crate::test_support::{TestDb, temp_db};
 
 /// Minimal mock for integration tests.
 ///
@@ -204,7 +204,7 @@ async fn submitter_loop_submits_closed_batches_then_exits_on_shutdown() {
 
 // ── Loop cadence invariants ───────────────────────────────────────────────
 //
-// These pin the behavior the two-worker refactor unlocked:
+// These pin the loop cadence:
 //   - Submitted → re-enter IMMEDIATELY (no sleep).
 //   - Transient (Poster error) → log + sleep + retry (loop must NOT exit).
 //
@@ -270,13 +270,9 @@ async fn submitter_re_enters_immediately_after_productive_tick() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn submitter_recovers_from_transient_poster_error_without_exiting() {
-    // Design of the test:
-    //
-    //   t=0ms   Submitter starts. Tick 1 calls submit_batches, which returns
-    //           a Provider error (the first of N injected failures).
-    //   t=0ms   Loop maps Err(Poster) → TickOutcome::Transient → sleep idle_poll.
-    //   t~80ms  Tick 2 runs. submit_batches succeeds, batch 0 recorded.
-    //   t=250ms Test asserts: exactly 1 submission AND loop is still alive.
+    // Tick 1 gets an injected Provider error and sleeps one idle interval;
+    // tick 2 submits batch 0. The test waits for that submission, then
+    // watches a few more ticks: exactly one submission, loop still alive.
     //
     // Regressions this catches:
     //   - Propagating Poster errors as fatal (loop would exit; handle would
@@ -291,9 +287,7 @@ async fn submitter_recovers_from_transient_poster_error_without_exiting() {
     mock.fail_next_n_submits(1);
     let shutdown = RuntimeScope::default();
     let config = BatchSubmitterConfig {
-        // Short poll interval so the retry sleep completes well within the
-        // test window. Still long enough that accidentally always-sleeping
-        // would delay the single submission past the assertion.
+        // Short poll interval so the retry after the failure comes quickly.
         idle_poll_interval_ms: 50,
     };
     let submitter = BatchSubmitter::new(
@@ -306,7 +300,16 @@ async fn submitter_recovers_from_transient_poster_error_without_exiting() {
         .start(shutdown.clone())
         .expect("start batch submitter");
 
-    tokio::time::sleep(Duration::from_millis(250)).await;
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
+    while mock.submissions().is_empty() {
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "no submission within 5 s after a transient Poster error",
+        );
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    }
+    // A few more ticks, so a duplicate submission would show up.
+    tokio::time::sleep(Duration::from_millis(3 * 50)).await;
 
     assert!(
         !handle.is_finished(),
diff --git a/sequencer/src/integration_tests/chain_id_validation.rs b/sequencer/src/integration_tests/chain_id_validation.rs
index 324bf82f..da5b5d29 100644
--- a/sequencer/src/integration_tests/chain_id_validation.rs
+++ b/sequencer/src/integration_tests/chain_id_validation.rs
@@ -1,23 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! `run`-side bootstrap guards after the setup/run split.
-//!
-//! `run` no longer takes `--chain-id` / `--app-address` — it reads the pinned
-//! deployment identity from the DB that `setup` created. These tests lock the
-//! refusal paths that protect that handoff, without needing the on-chain
-//! contracts that `setup`'s L1 discovery requires (those live in the full
-//! rollups-e2e harness):
-//!
-//!   - **No setup** → `BootstrapError::SetupNotComplete` (terminal; operator
-//!     must run `setup`). Fires before any L1 contact.
-//!   - **Wrong signing key** → `IdentityError::Mismatch { batch_submitter_address }`
-//!     (the key's address must match the pinned submitter). Fires before L1.
-//!   - **Wrong-chain RPC** → `ChainIdMismatch`: a reachable RPC
-//!     whose `eth_chainId` differs from the pinned chain id is refused. Needs
-//!     a live RPC, so it uses Anvil.
-//!   - **Matching-chain RPC** positive control: a matching chain must NOT
-//!     produce `ChainIdMismatch`.
+//! `run`'s bootstrap guards on the identity `setup` pinned: no setup, a key for
+//! another submitter, and a wrong-chain RPC (against Anvil) are refused, and a
+//! matching chain is not. Setup's on-chain discovery is covered by the e2e suite.
 
 use std::time::Duration;
 
@@ -57,6 +43,8 @@ fn run_config(data_dir: &str, eth_rpc_url: &str, key: &str) -> sequencer::RunCon
         "run",
         "--http-addr",
         "127.0.0.1:0",
+        "--internal-http-addr",
+        "127.0.0.1:0",
         "--data-dir",
         data_dir,
         "--eth-rpc-url",
@@ -77,7 +65,7 @@ fn run_config(data_dir: &str, eth_rpc_url: &str, key: &str) -> sequencer::RunCon
 /// `setup`'s on-chain discovery. Uses the same typed controller path `setup`
 /// itself records through (admission → facts → completion), so this seed
 /// cannot drift from the lifecycle schema or encode a state the controller
-/// would never write (previously raw SQL from outside the crate).
+/// would never write.
 fn seed_setup_complete(db_path: &str, chain_id: u64, submitter: Address) {
     use sequencer::storage::LifecycleCommand;
 
@@ -122,7 +110,9 @@ async fn run_refuses_when_setup_incomplete() {
     assert!(
         matches!(
             result,
-            Err(CommandError::Bootstrap(BootstrapError::SetupNotComplete))
+            Err(CommandError::Bootstrap(
+                BootstrapError::SetupNotComplete { .. }
+            ))
         ),
         "expected SetupNotComplete, got: {result:?}"
     );
diff --git a/sequencer/src/integration_tests/common.rs b/sequencer/src/integration_tests/common.rs
deleted file mode 100644
index b1c5be53..00000000
--- a/sequencer/src/integration_tests/common.rs
+++ /dev/null
@@ -1,23 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-//! Shared fixtures for crate-internal integration-style tests.
-
-use tempfile::TempDir;
-
-pub struct TestDb {
-    pub _dir: TempDir,
-    pub path: String,
-}
-
-pub fn temp_db(name: &str) -> TestDb {
-    let dir = tempfile::Builder::new()
-        .prefix(format!("sequencer-{name}-").as_str())
-        .tempdir()
-        .expect("create temporary test directory");
-    let path = dir.path().join("sequencer.sqlite");
-    TestDb {
-        _dir: dir,
-        path: path.to_string_lossy().into_owned(),
-    }
-}
diff --git a/sequencer/src/integration_tests/e2e_sequencer.rs b/sequencer/src/integration_tests/e2e_sequencer.rs
index 0011a6e0..c66ca45d 100644
--- a/sequencer/src/integration_tests/e2e_sequencer.rs
+++ b/sequencer/src/integration_tests/e2e_sequencer.rs
@@ -1,46 +1,36 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-use std::io::ErrorKind;
 use std::time::Duration;
 
 use crate::storage::{ApplicationInputRow, L2TxContext};
-use alloy_primitives::{Address, Signature, U256};
-use alloy_sol_types::{Eip712Domain, SolStruct};
-use app_core::application::{
-    MAX_METHOD_PAYLOAD_BYTES, Method, WalletApp, WalletConfig, Withdrawal,
-};
+use alloy_primitives::{Address, U256};
+use alloy_sol_types::Eip712Domain;
+use app_core::application::{MAX_METHOD_PAYLOAD_BYTES, Method, WalletConfig, Withdrawal};
 use futures_util::StreamExt;
 use k256::ecdsa::SigningKey;
-use k256::ecdsa::signature::hazmat::PrehashSigner;
-use sequencer::egress::l2_tx_feed::{L2TxFeed, L2TxFeedConfig};
-use sequencer::http::{self, ApiConfig};
-use sequencer::ingress::inclusion_lane::{
-    InclusionLane, InclusionLaneConfig, InclusionLaneError, PendingUserOp, dump_info,
-};
-use sequencer::runtime::shutdown::RuntimeScope;
-use sequencer::storage::{DeploymentIdentity, FeeOracleIdentity, Storage, StoredSafeInput};
+use sequencer::storage::{Storage, StoredSafeInput};
 use sequencer_core::api::{TxRequest, TxResponse, WsTxMessage};
-use sequencer_core::application::Application;
 use sequencer_core::history::{ExecutedInputCount, HistoryClaim};
+use sequencer_core::test_support::sign_user_op;
 use sequencer_core::user_op::UserOp;
 use sequencer_rust_client::SequencerClient;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::sync::mpsc;
 use tokio_tungstenite::connect_async;
 use tokio_tungstenite::tungstenite::Message;
 
-use super::common::temp_db;
+use crate::test_support::server::TestServer;
+use crate::test_support::{pin_test_deployment_identity, temp_db};
 
 const TEST_BATCH_SUBMITTER: Address = Address::repeat_byte(0xff);
 
-// ── V1 regression: cross-boundary signature domain consistency ────────
+// ── Regression: cross-boundary signature domain consistency ────────
 //
 // The sequencer signs user-ops with `sequencer_core::build_input_domain`. The
 // scheduler (canonical-app) recovers senders with the same function. If the
-// two sides ever drift (the V1 bug: scheduler had `name: None`, sequencer had
-// `name: Some("CartesiAppSequencer")`), every signature recovers a different
-// address on each side, structurally breaking the rollup.
+// two sides ever drift (for example, the scheduler with `name: None` and the
+// sequencer with `name: Some("CartesiAppSequencer")`), every signature recovers a
+// different address on each side, structurally breaking the rollup.
 //
 // These tests lock the invariant at two levels:
 //   1. A signature built via the shared constructor recovers the signer's
@@ -67,17 +57,7 @@ fn v1_regression_shared_domain_recovers_signer() {
     };
 
     // Sign with the shared domain.
-    let hash = user_op.eip712_signing_hash(&domain);
-    let k256_sig = signing_key.sign_prehash(hash.as_slice()).expect("sign");
-    let signature = [false, true]
-        .into_iter()
-        .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-        .find(|s| {
-            s.recover_address_from_prehash(&hash)
-                .ok()
-                .is_some_and(|r| r == signer_address)
-        })
-        .expect("recoverable parity");
+    let signature = sign_user_op(&signing_key, &domain, &user_op);
 
     // Recover with the shared domain — must equal signer.
     let hash_again = user_op.eip712_signing_hash(&domain);
@@ -101,7 +81,7 @@ fn v1_regression_name_none_domain_recovers_different_address() {
     let app = Address::from_slice(&[0xaa; 20]);
     let correct_domain = sequencer_core::build_input_domain(chain_id, app);
 
-    // The exact buggy domain the scheduler used pre-V1 fix.
+    // A drifted scheduler domain with no `name`.
     let buggy_domain = Eip712Domain {
         name: None,
         version: None,
@@ -117,20 +97,9 @@ fn v1_regression_name_none_domain_recovers_different_address() {
     };
 
     // Sign with the correct (shared) domain.
-    let hash = user_op.eip712_signing_hash(&correct_domain);
-    let k256_sig = signing_key.sign_prehash(hash.as_slice()).expect("sign");
-    let signature = [false, true]
-        .into_iter()
-        .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-        .find(|s| {
-            s.recover_address_from_prehash(&hash)
-                .ok()
-                .is_some_and(|r| r == signer_address)
-        })
-        .expect("recoverable parity");
+    let signature = sign_user_op(&signing_key, &correct_domain, &user_op);
 
     // Recover with the buggy domain — must NOT recover the signer.
-    // (This is what would silently fail at the scheduler under the V1 bug.)
     let buggy_hash = user_op.eip712_signing_hash(&buggy_domain);
     let recovered_under_buggy = signature
         .recover_address_from_prehash(&buggy_hash)
@@ -159,17 +128,7 @@ fn v1_regression_domain_fields_all_affect_recovery() {
 
     // Sign with chain_id = 1.
     let chain_a = sequencer_core::build_input_domain(1, app);
-    let hash_a = user_op.eip712_signing_hash(&chain_a);
-    let k256_sig = signing_key.sign_prehash(hash_a.as_slice()).expect("sign");
-    let signature = [false, true]
-        .into_iter()
-        .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-        .find(|s| {
-            s.recover_address_from_prehash(&hash_a)
-                .ok()
-                .is_some_and(|r| r == signer_address)
-        })
-        .expect("recoverable parity");
+    let signature = sign_user_op(&signing_key, &chain_a, &user_op);
 
     // Cross-chain replay must fail: recover under chain_id=2 with the same app.
     let chain_b = sequencer_core::build_input_domain(2, app);
@@ -204,14 +163,14 @@ async fn e2e_submit_tx_ack_and_broadcast() {
     // Fund the sender so the user-op passes the balance check.
     bootstrap_open_frame_with_deposits(db.path.as_str(), &[(sender, U256::from(1_000_000_u64))]);
 
-    let Some(mut runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let mut runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint.clone(), Duration::from_secs(2))
         .expect("build sequencer client");
-    let ws_url = client.ws_subscribe_url(history_claim(&db.path, 0));
+    let ws_url = SequencerClient::new(format!("http://{}", runtime.internal_addr))
+        .expect("build feed client")
+        .ws_subscribe_url(history_claim(&db.path, 0));
     let (mut ws, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(ws_url))
         .await
         .expect("timeout connecting websocket")
@@ -290,7 +249,7 @@ async fn e2e_submit_tx_ack_and_broadcast() {
     }
 
     drop(ws);
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -299,11 +258,9 @@ async fn api_rejects_signature_with_wrong_hex_length() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -323,7 +280,7 @@ async fn api_rejects_signature_with_wrong_hex_length() {
         "expected signature length message, got: {body}"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -332,11 +289,9 @@ async fn api_rejects_sender_with_wrong_hex_length() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -353,7 +308,7 @@ async fn api_rejects_sender_with_wrong_hex_length() {
         "expected sender length message, got: {body}"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -362,16 +317,19 @@ async fn api_rejects_oversized_json_body_before_parsing() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server_with_max_body(db.path.as_str(), domain, 256).await else {
-        return;
-    };
+    let runtime = TestServer::builder(db.path.as_str())
+        .domain(domain)
+        .with_lane()
+        .max_body(256)
+        .start()
+        .await;
 
     let oversized_json = format!(
         r#"{{"message":{{"nonce":0,"max_fee":0,"data":"0x"}},"signature":"0x{}","sender":null,"pad":"{}"}}"#,
         "00".repeat(65),
         " ".repeat(4096)
     );
-    let (status, body) = post_raw_json(runtime.addr, oversized_json.as_str()).await;
+    let (status, body) = post_raw_json(runtime.public_addr, oversized_json.as_str()).await;
 
     assert_eq!(
         status, 413,
@@ -382,7 +340,7 @@ async fn api_rejects_oversized_json_body_before_parsing() {
         "expected payload-too-large error code, got: {body}"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -391,14 +349,11 @@ async fn api_rejects_malformed_json_as_bad_request() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server_with_max_body(db.path.as_str(), domain, 128 * 1024).await
-    else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain).await;
 
     let malformed_json =
         r#"{"message":{"nonce":0,"max_fee":0,"data":"0x"},"signature":"0x00","sender":"0x1234""#;
-    let (status, body) = post_raw_json(runtime.addr, malformed_json).await;
+    let (status, body) = post_raw_json(runtime.public_addr, malformed_json).await;
 
     assert_eq!(
         status, 400,
@@ -422,7 +377,7 @@ async fn api_rejects_malformed_json_as_bad_request() {
         "body must not reflect attacker-submitted input bytes, got: {body}"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -433,20 +388,17 @@ async fn api_rejects_missing_content_type_with_fixed_message() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server_with_max_body(db.path.as_str(), domain, 128 * 1024).await
-    else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain).await;
 
     // Valid JSON body, but sent without Content-Type: application/json.
-    let (status, body) = post_raw_body_no_content_type(runtime.addr, "{}").await;
+    let (status, body) = post_raw_body_no_content_type(runtime.public_addr, "{}").await;
     assert_eq!(status, 400, "missing content-type: {body}");
     assert!(
         body.contains("\"message\":\"missing content type\""),
         "expected fixed 'missing content type' message, got: {body}"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -455,22 +407,15 @@ async fn api_returns_429_when_queue_is_full() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) =
-        start_api_only_server(db.path.as_str(), domain.clone(), 128 * 1024, 1).await
-    else {
-        return;
-    };
+    let runtime = TestServer::builder(db.path.as_str())
+        .domain(domain.clone())
+        .full_queue()
+        .start()
+        .await;
 
     let request = make_valid_request(&domain);
     let request_json = serde_json::to_string(&request).expect("serialize valid request");
-    let first = tokio::spawn({
-        let body = request_json.clone();
-        let addr = runtime.addr;
-        async move { post_raw_json(addr, body.as_str()).await }
-    });
-    tokio::time::sleep(Duration::from_millis(50)).await;
-
-    let (status, body) = post_raw_json(runtime.addr, request_json.as_str()).await;
+    let (status, body) = post_raw_json(runtime.public_addr, request_json.as_str()).await;
     assert_eq!(status, 429, "expected 429 for queue-full overload: {body}");
     assert!(
         body.contains("queue full"),
@@ -481,8 +426,7 @@ async fn api_returns_429_when_queue_is_full() {
         "expected OVERLOADED code for queue-full overload: {body}"
     );
 
-    first.abort();
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -491,11 +435,9 @@ async fn api_rejects_user_op_payloads_above_application_limit() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -530,7 +472,7 @@ async fn api_rejects_user_op_payloads_above_application_limit() {
         "expected max payload size in error body, got: {body}"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -543,13 +485,10 @@ async fn api_rejects_json_with_missing_fields_using_fixed_envelope() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server_with_max_body(db.path.as_str(), domain, 128 * 1024).await
-    else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain).await;
 
     // Empty object — valid JSON, missing every required field.
-    let (status, body) = post_raw_json(runtime.addr, "{}").await;
+    let (status, body) = post_raw_json(runtime.public_addr, "{}").await;
     assert_eq!(status, 400, "missing fields: {body}");
 
     // Parse the response envelope and assert the message is exactly the fixed
@@ -584,12 +523,13 @@ async fn api_rejects_json_with_missing_fields_using_fixed_envelope() {
         );
     }
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn api_payload_size_check_fires_before_signature_recovery() {
-    //  sharpening: oversized `data` must be rejected by
+    // Sharpens `api_rejects_user_op_payloads_above_application_limit`:
+    // oversized `data` must be rejected by
     // `validate_payload_size` BEFORE any cryptographic work. We submit an
     // oversized payload paired with a garbage-but-correctly-shaped signature:
     // if the size check is enforced first, the response says "user op payload
@@ -601,9 +541,7 @@ async fn api_payload_size_check_fires_before_signature_recovery() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain).await;
 
     // Hand-craft a request: oversized data + correctly-shaped but garbage
     // signature. The 65-byte signature passes `validate_hex_lengths`, so the
@@ -624,7 +562,7 @@ async fn api_payload_size_check_fires_before_signature_recovery() {
         body.len(),
     );
 
-    let (status, response_body) = post_raw_json(runtime.addr, body.as_str()).await;
+    let (status, response_body) = post_raw_json(runtime.public_addr, body.as_str()).await;
     assert_eq!(status, 400, "oversized + bogus sig: {response_body}");
     assert!(
         response_body.contains("user op payload too large"),
@@ -646,7 +584,7 @@ async fn api_payload_size_check_fires_before_signature_recovery() {
         );
     }
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -659,11 +597,9 @@ async fn api_rejects_signature_with_invalid_parity_byte() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -690,13 +626,14 @@ async fn api_rejects_signature_with_invalid_parity_byte() {
         "expected INVALID_SIGNATURE code, got: {body}",
     );
     // Defensive: make sure the rejection is from the signature layer, not the
-    // hex-length gate ( covers that) and not the payload-size gate.
+    // hex-length gate (`api_rejects_signature_with_wrong_hex_length` covers
+    // that) and not the payload-size gate.
     assert!(
         !body.contains("signature must be") && !body.contains("payload too large"),
         "expected sig-recovery class error, not hex-length or size: {body}",
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -711,11 +648,9 @@ async fn api_rejects_sender_claim_that_mismatches_signature_recovery() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -756,26 +691,25 @@ async fn api_rejects_sender_claim_that_mismatches_signature_recovery() {
         "expected INVALID_SIGNATURE code, got: {body}",
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn api_rejects_user_op_with_nonce_gap() {
     // submitting a user-op with a nonce above the next expected one
     // (i.e., a gap) must return 422 `InvalidNonce` and leave state
-    // unchanged. Complement to  (nonce too low / replay) — together
-    // they pin the strict-equality requirement on `current_user_nonce`.
+    // unchanged. Complements the e2e `rejected_user_op_not_broadcast_test`
+    // scenario (nonce too low) — together they pin the strict-equality
+    // requirement on `current_user_nonce`.
     let db = temp_db("nonce-gap-too-high");
     let domain = test_domain();
     let signing_key = SigningKey::from_bytes((&[7_u8; 32]).into()).expect("create signing key");
     let sender = address_from_signing_key(&signing_key);
     bootstrap_open_frame_with_deposits(db.path.as_str(), &[(sender, U256::from(1_000_000_u64))]);
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -808,15 +742,15 @@ async fn api_rejects_user_op_with_nonce_gap() {
         "expected nonce-class error, got: {body}",
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn api_accepts_user_op_with_max_fee_equal_to_current_frame_fee() {
-    //  boundary: the check is `max_fee >= current_frame_fee` (strict
+    // Boundary: the check is `max_fee >= current_frame_fee` (strict
     // less-than rejects). An op with `max_fee == current_frame_fee` must be
-    // accepted. Pairs with  (`fee_below_minimum_rejected_test`) — the
-    // two together pin the comparator.
+    // accepted. Pairs with the e2e `fee_below_minimum_rejected_test` scenario —
+    // the two together pin the comparator.
     let db = temp_db("fee-boundary-equal");
     let domain = test_domain();
     let signing_key = SigningKey::from_bytes((&[9_u8; 32]).into()).expect("create signing key");
@@ -828,11 +762,9 @@ async fn api_accepts_user_op_with_max_fee_equal_to_current_frame_fee() {
     // for the boundary case.
     const FRAME_FEE_BOUNDARY: u16 = 1356;
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -859,7 +791,7 @@ async fn api_accepts_user_op_with_max_fee_equal_to_current_frame_fee() {
         "max_fee == current_frame_fee boundary must be accepted (comparator is `<`, not `<=`), got {status}: {body}",
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -868,11 +800,9 @@ async fn api_quotes_open_frame_fee() {
     let domain = test_domain();
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
     let quoted = client.get_fee().await.expect("GET /fee");
@@ -880,7 +810,7 @@ async fn api_quotes_open_frame_fee() {
         quoted.fee, 1356,
         "quoted fee must match the bootstrapped open-frame fee"
     );
-    let raw = reqwest::get(format!("http://{}/fee", runtime.addr))
+    let raw = reqwest::get(format!("http://{}/fee", runtime.public_addr))
         .await
         .expect("raw GET /fee");
     assert_eq!(raw.headers()["cache-control"], "no-store");
@@ -889,12 +819,11 @@ async fn api_quotes_open_frame_fee() {
         "bootstrapped recommended_fee matches the open-frame fee"
     );
     assert_eq!(
-        quoted.suggested_max_fee,
-        sequencer_core::fee::suggested_signing_max_fee(quoted.fee, quoted.recommended_fee),
-        "suggested_max_fee is max(fee, recommended_fee) plus signing slack"
+        quoted.suggested_max_fee, 1409,
+        "suggested_max_fee is max(1356, 1356) plus the 53-exponent signing slack"
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -905,10 +834,8 @@ async fn api_serves_the_next_nonce_after_each_ack_and_the_signing_domain() {
     let sender = address_from_signing_key(&signing_key);
     bootstrap_open_frame_with_deposits(db.path.as_str(), &[(sender, U256::from(1_000_000_u64))]);
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
-    let endpoint = format!("http://{}", runtime.addr);
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -951,7 +878,7 @@ async fn api_serves_the_next_nonce_after_each_ack_and_the_signing_domain() {
     }
     assert_eq!(client.get_nonce(sender).await.unwrap().next_nonce, 2);
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -969,11 +896,9 @@ async fn api_rejects_user_op_when_balance_below_fee_cost() {
     // No deposit for `sender` → balance = 0.
     bootstrap_open_frame(db.path.as_str());
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint, Duration::from_secs(2))
         .expect("build sequencer client");
 
@@ -1004,7 +929,7 @@ async fn api_rejects_user_op_when_balance_below_fee_cost() {
         "expected InsufficientFeeBalance message, got: {body}",
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -1019,9 +944,7 @@ async fn api_concurrent_same_nonce_leaves_exactly_one_committed() {
     let sender = address_from_signing_key(&signing_key);
     bootstrap_open_frame_with_deposits(db.path.as_str(), &[(sender, U256::from(10_000_000_u64))]);
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
     let user_op = UserOp {
         nonce: 0,
@@ -1039,7 +962,7 @@ async fn api_concurrent_same_nonce_leaves_exactly_one_committed() {
     let request_json = serde_json::to_string(&request).expect("serialize request");
 
     // Two concurrent POSTs with byte-identical bodies.
-    let addr = runtime.addr;
+    let addr = runtime.public_addr;
     let body_a = request_json.clone();
     let body_b = request_json;
     let a = tokio::spawn(async move { post_raw_json(addr, body_a.as_str()).await });
@@ -1067,7 +990,7 @@ async fn api_concurrent_same_nonce_leaves_exactly_one_committed() {
         "rejected concurrent op should be nonce-class, got: {rejected_body}",
     );
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -1081,14 +1004,14 @@ async fn restart_replays_same_ordered_l2_tx_stream_from_db() {
     // Seed an additional safe direct input (arbitrary payload) for the restart-replay test.
     seed_safe_direct_input(db.path.as_str(), 10, vec![0xaa]);
 
-    let Some(runtime) = start_full_server(db.path.as_str(), domain.clone()).await else {
-        return;
-    };
+    let runtime = start_full_server(db.path.as_str(), domain.clone()).await;
 
-    let endpoint = format!("http://{}", runtime.addr);
+    let endpoint = format!("http://{}", runtime.public_addr);
     let client = SequencerClient::new_with_timeout(endpoint.clone(), Duration::from_secs(2))
         .expect("build sequencer client");
-    let ws_url = client.ws_subscribe_url(history_claim(&db.path, 0));
+    let ws_url = SequencerClient::new(format!("http://{}", runtime.internal_addr))
+        .expect("build feed client")
+        .ws_subscribe_url(history_claim(&db.path, 0));
     let (mut ws, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(ws_url))
         .await
         .expect("timeout connecting websocket")
@@ -1123,13 +1046,11 @@ async fn restart_replays_same_ordered_l2_tx_stream_from_db() {
     assert_ws_message_matches_tx(first_live, &expected[1], 1);
     assert_ws_message_matches_tx(second_live, &expected[2], 2);
 
-    shutdown_runtime(runtime).await;
+    runtime.shutdown().await;
 
-    let Some(restarted) = start_full_server(db.path.as_str(), domain).await else {
-        return;
-    };
+    let restarted = start_full_server(db.path.as_str(), domain).await;
 
-    let restarted_endpoint = format!("http://{}", restarted.addr);
+    let restarted_endpoint = format!("http://{}", restarted.internal_addr);
     let restarted_client =
         SequencerClient::new_with_timeout(restarted_endpoint, Duration::from_secs(2))
             .expect("build sequencer client after restart");
@@ -1147,219 +1068,16 @@ async fn restart_replays_same_ordered_l2_tx_stream_from_db() {
     }
     drop(restarted_ws);
 
-    shutdown_runtime(restarted).await;
+    restarted.shutdown().await;
 }
 
-struct FullServerRuntime {
-    addr: std::net::SocketAddr,
-    shutdown: RuntimeScope,
-    server_task: Option<http::ApiServerTask>,
-    lane_handle: Option<
-        tokio::task::JoinHandle<Result<(), sequencer::ingress::inclusion_lane::InclusionLaneError>>,
-    >,
-    _parked_rx: Option<mpsc::Receiver<PendingUserOp>>,
-}
-
-impl Drop for FullServerRuntime {
-    fn drop(&mut self) {
-        self.shutdown.request_shutdown();
-        if let Some(task) = self.server_task.take() {
-            task.abort();
-        }
-        if let Some(task) = self.lane_handle.take() {
-            task.abort();
-        }
-    }
-}
-
-async fn start_full_server(db_path: &str, domain: Eip712Domain) -> Option<FullServerRuntime> {
-    start_full_server_with_max_body(db_path, domain, 128 * 1024).await
-}
-
-async fn start_full_server_with_max_body(
-    db_path: &str,
-    domain: Eip712Domain,
-    max_body_bytes: usize,
-) -> Option<FullServerRuntime> {
-    let listener = match tokio::net::TcpListener::bind("127.0.0.1:0").await {
-        Ok(value) => value,
-        Err(err) if err.kind() == ErrorKind::PermissionDenied => {
-            eprintln!(
-                "skipping e2e integration test: cannot bind test listener in this environment"
-            );
-            return None;
-        }
-        Err(err) => panic!("bind test listener: {err}"),
-    };
-    let addr = listener.local_addr().expect("read listener addr");
-
-    let mut storage = Storage::open(db_path).expect("open storage");
-    let shutdown = RuntimeScope::default();
-
-    let dumps_dir = tempfile::tempdir().expect("e2e dumps dir").keep();
-    // Always-load invariant: ensure a finalized snapshot exists
-    // before the lane starts. On warm restart there's already one;
-    // on cold start we register a genesis dump from a fresh wallet.
-    // The lane reloads via `from_dump` either way.
-    if storage.finalized_dump().expect("read finalized").is_none() {
-        let mut app = WalletApp::new(WalletConfig::default());
-        let genesis_dir = dumps_dir.join("genesis");
-        dump_info::create_dump_dir_with_info(
-            &mut app,
-            &genesis_dir,
-            &dump_info::DumpInfo {
-                format_version: dump_info::FORMAT_VERSION,
-                next_batch_nonce: 0,
-            },
-        )
-        .expect("genesis dump");
-        storage
-            .insert_baseline_snapshot(&genesis_dir, ExecutedInputCount::ZERO)
-            .expect("register genesis");
-    }
-
-    // Tip-existence invariant: open the genesis Tip only after the genesis
-    // snapshot exists. Opening the Tip may attribute already-ingested direct
-    // inputs, so doing this first would give the fresh application dump the
-    // wrong executed-input count.
-    storage.ensure_open_tip().expect("establish open tip");
-    let head = storage
-        .open_state()
-        .expect("load open state")
-        .expect("open state exists");
-    // Default log_gas_price=0 -> 0+296+20+419+621 = 1356.
-    assert_eq!(head.frame_fee, 1356);
-
-    let (tx, lane_handle) = InclusionLane::<WalletApp>::start(
-        128,
-        shutdown.clone(),
-        storage,
-        InclusionLaneConfig {
-            dumps_dir,
-            max_user_ops_per_chunk: 32,
-            safe_input_buffer_capacity: 32,
-            max_batch_open: Duration::from_secs(60 * 60),
-            idle_poll_interval: Duration::from_millis(2),
-            frontier_min_interval: Duration::ZERO,
-        },
-    );
-
-    let tx_feed = L2TxFeed::new(
-        db_path.to_string(),
-        shutdown.clone(),
-        L2TxFeedConfig {
-            idle_poll_interval: Duration::from_millis(2),
-            page_size: 64,
-            // Sentinel submitter: the WS assertions here observe the
-            // unfiltered stream, so pass an address no fixture seeds.
-        },
-    );
-
-    let server_task = http::start_on_listener(
-        listener,
-        tx,
-        shutdown.clone(),
-        tx_feed,
-        ApiConfig {
-            max_body_bytes,
-            ..ApiConfig::new(domain, MAX_METHOD_PAYLOAD_BYTES)
-        },
-        http::SnapshotState {
-            db_path: db_path.to_string(),
-            state_file_in_dump: |dump_dir| {
-                WalletApp::state_file_in_dump(&dump_info::app_prefix(dump_dir))
-            },
-        },
-    );
-
-    Some(FullServerRuntime {
-        addr,
-        shutdown,
-        server_task: Some(server_task),
-        lane_handle: Some(lane_handle),
-        _parked_rx: None,
-    })
-}
-
-async fn start_api_only_server(
-    db_path: &str,
-    domain: Eip712Domain,
-    max_body_bytes: usize,
-    queue_capacity: usize,
-) -> Option<FullServerRuntime> {
-    let listener = match tokio::net::TcpListener::bind("127.0.0.1:0").await {
-        Ok(value) => value,
-        Err(err) if err.kind() == ErrorKind::PermissionDenied => {
-            eprintln!("skipping api overload test: cannot bind test listener in this environment");
-            return None;
-        }
-        Err(err) => panic!("bind test listener: {err}"),
-    };
-    let addr = listener.local_addr().expect("read listener addr");
-
-    let _storage = Storage::open(db_path).expect("open storage");
-    let (tx, rx) = mpsc::channel::<PendingUserOp>(queue_capacity);
-    let shutdown = RuntimeScope::default();
-    let tx_feed = L2TxFeed::new(
-        db_path.to_string(),
-        shutdown.clone(),
-        L2TxFeedConfig {
-            idle_poll_interval: Duration::from_millis(2),
-            page_size: 64,
-            // Sentinel submitter: the WS assertions here observe the
-            // unfiltered stream, so pass an address no fixture seeds.
-        },
-    );
-    let server_task = http::start_on_listener(
-        listener,
-        tx,
-        shutdown.clone(),
-        tx_feed,
-        ApiConfig {
-            max_body_bytes,
-            ..ApiConfig::new(domain, MAX_METHOD_PAYLOAD_BYTES)
-        },
-        http::SnapshotState {
-            db_path: db_path.to_string(),
-            state_file_in_dump: |dump_dir| {
-                WalletApp::state_file_in_dump(&dump_info::app_prefix(dump_dir))
-            },
-        },
-    );
-
-    Some(FullServerRuntime {
-        addr,
-        shutdown,
-        server_task: Some(server_task),
-        lane_handle: None,
-        _parked_rx: Some(rx),
-    })
-}
-
-async fn shutdown_runtime(mut runtime: FullServerRuntime) {
-    runtime.shutdown.request_shutdown();
-    if let Some(task) = runtime.lane_handle.take() {
-        let lane_result = tokio::time::timeout(Duration::from_secs(3), task)
-            .await
-            .expect("wait for inclusion lane")
-            .expect("join inclusion lane task");
-        let ok =
-            lane_result.is_ok() || matches!(lane_result, Err(InclusionLaneError::ChannelClosed));
-        assert!(
-            ok,
-            "expected clean shutdown (Ok or ChannelClosed), got {lane_result:?}"
-        );
-    }
-    if let Some(task) = runtime.server_task.take() {
-        let server_result = tokio::time::timeout(Duration::from_secs(3), task)
-            .await
-            .expect("wait for server task")
-            .expect("join server task");
-        assert!(
-            server_result.is_ok(),
-            "expected clean server shutdown, got {server_result:?}"
-        );
-    }
+async fn start_full_server(db_path: &str, domain: Eip712Domain) -> TestServer {
+    TestServer::builder(db_path)
+        .domain(domain)
+        .with_lane()
+        .max_body(128 * 1024)
+        .start()
+        .await
 }
 
 fn bootstrap_open_frame(db_path: &str) {
@@ -1371,16 +1089,7 @@ fn bootstrap_open_frame(db_path: &str) {
 fn bootstrap_open_frame_with_deposits(db_path: &str, deposits: &[(Address, U256)]) {
     let mut storage = Storage::open(db_path).expect("open storage");
     let config = WalletConfig::default();
-    storage
-        .load_or_insert_deployment_identity(DeploymentIdentity {
-            chain_id: 1,
-            app_address: Address::repeat_byte(0x11),
-            input_box_address: Address::repeat_byte(0x22),
-            app_deployment_block: 0,
-            batch_submitter_address: TEST_BATCH_SUBMITTER,
-            fee_oracle: FeeOracleIdentity::Fixed { log_gas_price: 0 },
-        })
-        .expect("pin test deployment identity");
+    pin_test_deployment_identity(&mut storage, TEST_BATCH_SUBMITTER);
 
     // Always record a safe-head observation: production callers are gated by
     // the startup recovery procedure, so storage paths like `safe_input_frontier`
@@ -1405,12 +1114,7 @@ fn bootstrap_open_frame_with_deposits(db_path: &str, deposits: &[(Address, U256)
             1,
             &safe_inputs,
             TEST_BATCH_SUBMITTER,
-            &sequencer_core::protocol::ProtocolTiming {
-                max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-                preemptive_margin_blocks: 75,
-                l1_read_stale_after_blocks: 900,
-                seconds_per_block: 12,
-            },
+            &crate::storage::test_helpers::default_protocol_timing(),
         )
         .expect("seed safe head (and any deposits)");
 }
@@ -1448,12 +1152,7 @@ fn seed_safe_direct_input(db_path: &str, safe_block: u64, payload: Vec<u8>) {
                 block_number: safe_block,
             }],
             TEST_BATCH_SUBMITTER,
-            &sequencer_core::protocol::ProtocolTiming {
-                max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-                preemptive_margin_blocks: 75,
-                l1_read_stale_after_blocks: 900,
-                seconds_per_block: 12,
-            },
+            &crate::storage::test_helpers::default_protocol_timing(),
         )
         .expect("append safe direct input");
 }
@@ -1584,23 +1283,7 @@ fn parse_http_response(raw: &[u8]) -> (u16, String) {
 }
 
 fn sign_user_op_hex(domain: &Eip712Domain, user_op: &UserOp, signing_key: &SigningKey) -> String {
-    let hash = user_op.eip712_signing_hash(domain);
-    let k256_sig = signing_key
-        .sign_prehash(hash.as_slice())
-        .expect("sign user op hash");
-
-    let sender = address_from_signing_key(signing_key);
-    let signature = [false, true]
-        .into_iter()
-        .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-        .find(|candidate| {
-            candidate
-                .recover_address_from_prehash(&hash)
-                .ok()
-                .map(|value| value == sender)
-                .unwrap_or(false)
-        })
-        .expect("recoverable parity for signature");
+    let signature = sign_user_op(signing_key, domain, user_op);
 
     alloy_primitives::hex::encode_prefixed(signature.as_bytes())
 }
diff --git a/sequencer/src/integration_tests/historical_bootstrap.rs b/sequencer/src/integration_tests/historical_bootstrap.rs
index 4cb1bbc1..9d5cbc47 100644
--- a/sequencer/src/integration_tests/historical_bootstrap.rs
+++ b/sequencer/src/integration_tests/historical_bootstrap.rs
@@ -37,13 +37,12 @@ use crate::egress::l2_tx_feed::{L2TxFeed, L2TxFeedConfig};
 use crate::http::{self, ApiConfig};
 use crate::ingress::inclusion_lane::{PendingUserOp, dump_info};
 use crate::runtime::shutdown::RuntimeScope;
-use crate::storage::test_helpers::{default_protocol_timing, pin_test_deployment_identity};
+use crate::storage::test_helpers::default_protocol_timing;
 use crate::storage::{
     DirectInputExecution, FrontierMode, IngestedSafeInput, LifecycleCommand, SafeInputRange,
     Storage,
 };
-
-use super::common::temp_db;
+use crate::test_support::{pin_test_deployment_identity, temp_db};
 
 const SUBMITTER: Address = Address::repeat_byte(0x33);
 const APP: Address = Address::repeat_byte(0x11);
@@ -161,8 +160,8 @@ impl Drop for Server {
 
 impl Server {
     async fn start(db_path: &str) -> Self {
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
+        let (listeners, _public_addr, addr) =
+            crate::test_support::server::bind_api_listeners().await;
         let shutdown = RuntimeScope::default();
         let (tx, rx) = mpsc::channel(1);
         let feed = L2TxFeed::new(
@@ -170,8 +169,8 @@ impl Server {
             shutdown.clone(),
             L2TxFeedConfig::default(),
         );
-        let task = http::start_on_listener(
-            listener,
+        let task = http::start_on_listeners(
+            listeners,
             tx,
             shutdown.clone(),
             feed,
diff --git a/sequencer/src/integration_tests/historical_bootstrap/recovery_compatibility.rs b/sequencer/src/integration_tests/historical_bootstrap/recovery_compatibility.rs
index 165ed235..f701e9cc 100644
--- a/sequencer/src/integration_tests/historical_bootstrap/recovery_compatibility.rs
+++ b/sequencer/src/integration_tests/historical_bootstrap/recovery_compatibility.rs
@@ -125,7 +125,6 @@ fn close_and_accept(
             head,
             head.safe_block,
             &prefix,
-            index,
             app.executed_input_count(),
         )
         .unwrap();
diff --git a/sequencer/src/integration_tests/mod.rs b/sequencer/src/integration_tests/mod.rs
index 3aba7cee..26b078d4 100644
--- a/sequencer/src/integration_tests/mod.rs
+++ b/sequencer/src/integration_tests/mod.rs
@@ -3,7 +3,6 @@
 
 mod batch_submitter;
 mod chain_id_validation;
-mod common;
 mod e2e_sequencer;
 mod historical_bootstrap;
 mod snapshot_endpoints;
diff --git a/sequencer/src/integration_tests/snapshot_endpoints.rs b/sequencer/src/integration_tests/snapshot_endpoints.rs
index 7eaff6b2..7e075978 100644
--- a/sequencer/src/integration_tests/snapshot_endpoints.rs
+++ b/sequencer/src/integration_tests/snapshot_endpoints.rs
@@ -1,88 +1,21 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Integration tests for the operator-only snapshot HTTP endpoints:
-//! `/finalized_state`, `/finalized_state/inclusion_block`, `/latest_snapshot`.
-//!
-//! These drive a real listener (so client disconnect is modelled faithfully)
-//! and assert the lease lifecycle — held while streaming, released on
-//! completion, 304, and crucially on mid-stream client disconnect.
-
-use std::io::ErrorKind;
+//! Operator snapshot endpoints over a real listener: the lease is held while
+//! streaming and released on completion, on 304, and on mid-stream disconnect.
+
 use std::net::SocketAddr;
 use std::path::Path;
 use std::time::Duration;
 
-use alloy_sol_types::Eip712Domain;
-use app_core::application::{MAX_METHOD_PAYLOAD_BYTES, WalletApp};
+use app_core::application::WalletApp;
 use futures_util::StreamExt;
-use sequencer::egress::l2_tx_feed::{L2TxFeed, L2TxFeedConfig};
-use sequencer::http::{self, ApiConfig};
-use sequencer::ingress::inclusion_lane::PendingUserOp;
 use sequencer::ingress::inclusion_lane::dump_info;
-use sequencer::runtime::shutdown::RuntimeScope;
 use sequencer::storage::Storage;
 use sequencer_core::application::Application;
-use tokio::sync::mpsc;
-
-use super::common::temp_db;
-
-fn dummy_domain() -> Eip712Domain {
-    sequencer_core::build_input_domain(1, alloy_primitives::Address::ZERO)
-}
 
-/// Holds the server task + channel alive for the duration of a test.
-struct TestServer {
-    addr: SocketAddr,
-    _rx: mpsc::Receiver<PendingUserOp>,
-    _shutdown: RuntimeScope,
-    _task: http::ApiServerTask,
-}
-
-impl TestServer {
-    fn url(&self, path: &str) -> String {
-        format!("http://{}{path}", self.addr)
-    }
-}
-
-async fn start_server(db_path: &str) -> Option<TestServer> {
-    let listener = match tokio::net::TcpListener::bind("127.0.0.1:0").await {
-        Ok(value) => value,
-        Err(err) if err.kind() == ErrorKind::PermissionDenied => {
-            eprintln!("skipping snapshot endpoint test: cannot bind test listener");
-            return None;
-        }
-        Err(err) => panic!("bind test listener: {err}"),
-    };
-    let addr = listener.local_addr().expect("listener addr");
-    let (tx_sender, _rx) = mpsc::channel::<PendingUserOp>(1);
-    let shutdown = RuntimeScope::default();
-    // Sentinel submitter: this fixture seeds no own-batch rows.
-    let tx_feed = L2TxFeed::new(
-        db_path.to_string(),
-        shutdown.clone(),
-        L2TxFeedConfig::default(),
-    );
-    let task = http::start_on_listener(
-        listener,
-        tx_sender,
-        shutdown.clone(),
-        tx_feed,
-        ApiConfig::new(dummy_domain(), MAX_METHOD_PAYLOAD_BYTES),
-        http::SnapshotState {
-            db_path: db_path.to_string(),
-            state_file_in_dump: |dump_dir| {
-                WalletApp::state_file_in_dump(&dump_info::app_prefix(dump_dir))
-            },
-        },
-    );
-    Some(TestServer {
-        addr,
-        _rx,
-        _shutdown: shutdown,
-        _task: task,
-    })
-}
+use crate::test_support::server::{PUBLIC_ROUTES, TestServer};
+use crate::test_support::temp_db;
 
 /// Build a structured dump dir mirroring production layout: the app's
 /// state under `state`, plus a minimal `info.toml`.
@@ -111,7 +44,7 @@ fn register_accepted(
 ) -> i64 {
     let mut storage = Storage::open(db_path).unwrap();
     let sender = alloy_primitives::Address::repeat_byte(0x7f);
-    crate::storage::test_helpers::pin_test_deployment_identity(&mut storage, sender);
+    crate::test_support::pin_test_deployment_identity(&mut storage, sender);
     let mut head = storage.open_state().unwrap().unwrap_or_else(|| {
         storage
             .initialize_open_state(inclusion_block, crate::storage::SafeInputRange::empty_at(0))
@@ -119,14 +52,12 @@ fn register_accepted(
     });
     let nonce = storage.batch_nonce(head.batch_index).unwrap();
     let prefix = write_state(dir, name, bytes, nonce + 1);
-    let index = head.batch_index;
     let safe_block = head.safe_block;
     storage
         .close_frame_and_batch_with_snapshot(
             &mut head,
             safe_block,
             &prefix,
-            index,
             crate::storage::ExecutedInputCount::ZERO,
         )
         .unwrap();
@@ -150,14 +81,12 @@ fn register_optimistic(db_path: &str, dir: &Path, name: &str, bytes: &[u8], nonc
             format!("intermediate-{current}")
         };
         let prefix = write_state(dir, &dump_name, bytes, current + 1);
-        let index = head.batch_index;
         let safe_block = head.safe_block;
         storage
             .close_frame_and_batch_with_snapshot(
                 &mut head,
                 safe_block,
                 &prefix,
-                index,
                 crate::storage::ExecutedInputCount::ZERO,
             )
             .unwrap();
@@ -176,10 +105,9 @@ fn archive_state(bytes: &[u8]) -> Vec<u8> {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn same_block_divergence_refuses_every_finalized_endpoint() {
-    use crate::storage::test_helpers::{
-        default_protocol_timing, local_batch_payload, pin_test_deployment_identity,
-    };
+    use crate::storage::test_helpers::{default_protocol_timing, local_batch_payload};
     use crate::storage::{ExecutedInputCount, SafeInputRange, StoredSafeInput};
+    use crate::test_support::pin_test_deployment_identity;
     use sequencer_core::batch::{Batch, Frame};
     use sequencer_core::scheduler::{Scheduler, SchedulerConfig, SchedulerInput};
     use ssz::Encode;
@@ -194,7 +122,7 @@ async fn same_block_divergence_refuses_every_finalized_endpoint() {
         .unwrap();
     let prefix = write_state(root.path(), "local", b"local checkpoint", 1);
     storage
-        .close_frame_and_batch_with_snapshot(&mut head, 5, &prefix, 0, ExecutedInputCount::ZERO)
+        .close_frame_and_batch_with_snapshot(&mut head, 5, &prefix, ExecutedInputCount::ZERO)
         .unwrap();
     let snapshot = storage.latest_snapshot().unwrap().unwrap();
     let inputs = vec![
@@ -245,7 +173,7 @@ async fn same_block_divergence_refuses_every_finalized_endpoint() {
     assert_eq!(app.executed_input_count().get(), 1);
     assert_eq!(snapshot.executed_input_count, ExecutedInputCount::ZERO);
 
-    let server = start_server(&db.path).await.expect("test listener");
+    let server = TestServer::start(&db.path).await;
     let client = reqwest::Client::new();
     for (path, conditional) in [
         ("/finalized_state/inclusion_block", false),
@@ -359,9 +287,7 @@ async fn finalized_state_round_trips_bytes_and_headers() {
     let dir = tempfile::tempdir().expect("dumps dir");
     let state = b"the-canonical-finalized-state".to_vec();
     let dump_id = register_accepted(db.path.as_str(), dir.path(), "fin", &state, 4242);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::Client::new()
         .get(server.url("/finalized_state"))
@@ -393,9 +319,7 @@ async fn finalized_inclusion_block_returns_cheap_json() {
     let db = temp_db("snap-inclusion-block");
     let dir = tempfile::tempdir().expect("dumps dir");
     register_accepted(db.path.as_str(), dir.path(), "fin", b"x", 999);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::get(server.url("/finalized_state/inclusion_block"))
         .await
@@ -413,9 +337,7 @@ async fn endpoints_404_when_no_finalized_snapshot() {
     // Migrate the schema (as startup does) but register no snapshot: the
     // endpoints then see no registered snapshot and return 404.
     Storage::open(db.path.as_str()).expect("init schema");
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let finalized = reqwest::get(server.url("/finalized_state"))
         .await
@@ -438,9 +360,7 @@ async fn finalized_state_if_none_match_returns_304() {
     let db = temp_db("snap-etag");
     let dir = tempfile::tempdir().expect("dumps dir");
     let dump_id = register_accepted(db.path.as_str(), dir.path(), "fin", b"abc", 500);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::Client::new()
         .get(server.url("/finalized_state"))
@@ -464,9 +384,7 @@ async fn latest_snapshot_prefers_newest_valid_batch() {
     let dir = tempfile::tempdir().expect("dumps dir");
     register_accepted(db.path.as_str(), dir.path(), "fin", b"finalized-bytes", 100);
     let pending_id = register_optimistic(db.path.as_str(), dir.path(), "pend", b"pending-bytes", 3);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::get(server.url("/latest_snapshot"))
         .await
@@ -491,9 +409,7 @@ async fn finalized_state_streams_large_file() {
     let dir = tempfile::tempdir().expect("dumps dir");
     let big = vec![0x5Au8; 8 * 1024 * 1024];
     let dump_id = register_accepted(db.path.as_str(), dir.path(), "big", &big, 1);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::get(server.url("/finalized_state"))
         .await
@@ -518,9 +434,7 @@ async fn finalized_state_disconnect_mid_stream_releases_lease() {
     // when we disconnect.
     let big = vec![0xABu8; 8 * 1024 * 1024];
     let dump_id = register_accepted(db.path.as_str(), dir.path(), "big", &big, 7);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::Client::new()
         .get(server.url("/finalized_state"))
@@ -557,9 +471,7 @@ async fn finalized_state_concurrent_streams_count_and_release_independently() {
     let dir = tempfile::tempdir().expect("dumps dir");
     let big = vec![0xCDu8; 8 * 1024 * 1024];
     let dump_id = register_accepted(db.path.as_str(), dir.path(), "big", &big, 1);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     // Two concurrent readers of the same finalized dump.
     let client = reqwest::Client::new();
@@ -604,9 +516,7 @@ async fn live_stream_blocks_gc_until_it_drops() {
     let dir = tempfile::tempdir().expect("dumps dir");
     let big = vec![0xABu8; 8 * 1024 * 1024];
     let served_id = register_accepted(db.path.as_str(), dir.path(), "served", &big, 1);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     // Open a stream and keep it alive.
     let resp = reqwest::Client::new()
@@ -663,9 +573,7 @@ async fn finalized_state_missing_registered_artifact_aborts_process() {
         &dir.path().join("fin"),
     )))
     .expect("remove state file");
-    let server = start_server(db.path.as_str())
-        .await
-        .expect("missing-artifact abort probe needs a real listener");
+    let server = TestServer::start(db.path.as_str()).await;
 
     let _ = reqwest::get(server.url("/finalized_state")).await;
     panic!("missing registered snapshot returned instead of aborting");
@@ -677,9 +585,7 @@ async fn latest_snapshot_restores_accepted_batch_when_it_is_newest() {
     let dir = tempfile::tempdir().expect("dumps dir");
     let fin_id = register_accepted(db.path.as_str(), dir.path(), "fin", b"finalized-bytes", 100);
     // No pending registered.
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::get(server.url("/latest_snapshot"))
         .await
@@ -698,12 +604,57 @@ async fn latest_snapshot_restores_accepted_batch_when_it_is_newest() {
     assert!(wait_for_lease(db.path.as_str(), fin_id, 0).await);
 }
 
+/// Each route answers only on its own listener: a wrong-method probe gets 405
+/// where the route exists and 404 on the other listener, whatever the
+/// handler's state.
+#[tokio::test]
+async fn every_route_is_served_on_exactly_its_own_listener() {
+    const INTERNAL_ROUTES: [&str; 11] = [
+        "/ws/subscribe",
+        "/history",
+        "/historical-l1-inputs",
+        "/finalized_state",
+        "/finalized_state/inclusion_block",
+        "/finalized_state/digest",
+        "/latest_snapshot",
+        "/finalized_snapshot",
+        "/livez",
+        "/readyz",
+        "/healthz",
+    ];
+    let db = temp_db("listener-placement");
+    let server = TestServer::start(db.path.as_str()).await;
+    let client = reqwest::Client::new();
+    let probe = |addr: SocketAddr, route: &str| {
+        client
+            .request(reqwest::Method::DELETE, format!("http://{addr}{route}"))
+            .send()
+    };
+    for (routes, own, other) in [
+        (&PUBLIC_ROUTES[..], server.public_addr, server.internal_addr),
+        (
+            &INTERNAL_ROUTES[..],
+            server.internal_addr,
+            server.public_addr,
+        ),
+    ] {
+        for route in routes {
+            let served = probe(own, route).await.expect("probe own listener");
+            assert_eq!(served.status().as_u16(), 405, "{route} on its own listener");
+            let absent = probe(other, route).await.expect("probe other listener");
+            assert_eq!(
+                absent.status().as_u16(),
+                404,
+                "{route} on the other listener"
+            );
+        }
+    }
+}
+
 #[tokio::test]
 async fn cors_permits_browser_preflight_on_tx() {
     let db = temp_db("cors-preflight");
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::Client::new()
         .request(reqwest::Method::OPTIONS, server.url("/tx"))
@@ -745,9 +696,7 @@ async fn cors_permits_browser_preflight_on_tx() {
 #[tokio::test]
 async fn cors_permits_browser_preflight_on_fee() {
     let db = temp_db("cors-fee-preflight");
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
 
     let resp = reqwest::Client::new()
         .request(reqwest::Method::OPTIONS, server.url("/fee"))
@@ -788,9 +737,7 @@ async fn cors_is_limited_to_ingress_and_covers_rejections() {
     let db = temp_db("cors-route-scope");
     let dumps = tempfile::tempdir().expect("snapshot directory");
     let dump_id = register_accepted(&db.path, dumps.path(), "finalized", b"canonical", 1);
-    let Some(server) = start_server(db.path.as_str()).await else {
-        return;
-    };
+    let server = TestServer::start(db.path.as_str()).await;
     let client = reqwest::Client::new();
     let rejected = client
         .post(server.url("/tx"))
@@ -860,11 +807,10 @@ async fn sdk_snapshot_restores_application_and_recovery_export_is_self_contained
     let app = WalletApp::default();
     let encoded = app_core::wallet_snapshot::encode(&app);
     register_accepted(&db.path, dir.path(), "accepted", &encoded, 1);
-    let Some(server) = start_server(&db.path).await else {
-        return;
-    };
+    let server = TestServer::start(&db.path).await;
     let client =
-        sequencer_rust_client::SequencerClient::new(format!("http://{}", server.addr)).unwrap();
+        sequencer_rust_client::SequencerClient::new(format!("http://{}", server.internal_addr))
+            .unwrap();
     let snapshot = client.latest_snapshot().await.unwrap();
     let claim = snapshot.claim;
     assert_eq!(
@@ -916,9 +862,7 @@ async fn archive_disconnect_releases_both_stream_and_producer_lease_owners() {
     let db = temp_db("archive-disconnect");
     let dir = tempfile::tempdir().unwrap();
     let id = register_accepted(&db.path, dir.path(), "large", &vec![1; 8 * 1024 * 1024], 1);
-    let Some(server) = start_server(&db.path).await else {
-        return;
-    };
+    let server = TestServer::start(&db.path).await;
     let response = reqwest::get(server.url("/latest_snapshot")).await.unwrap();
     let mut stream = response.bytes_stream();
     stream.next().await.unwrap().unwrap();
diff --git a/sequencer/src/integration_tests/ws_broadcaster.rs b/sequencer/src/integration_tests/ws_broadcaster.rs
index a057e93a..59781399 100644
--- a/sequencer/src/integration_tests/ws_broadcaster.rs
+++ b/sequencer/src/integration_tests/ws_broadcaster.rs
@@ -1,7 +1,6 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-use std::io::ErrorKind;
 use std::time::{Duration, SystemTime};
 
 use crate::storage::{ApplicationInputRow, L2TxContext};
@@ -10,7 +9,7 @@ use app_core::application::MAX_METHOD_PAYLOAD_BYTES;
 use futures_util::{SinkExt, StreamExt};
 use sequencer::egress::l2_tx_feed::{L2TxFeed, L2TxFeedConfig};
 use sequencer::http::{self, ApiConfig};
-use sequencer::ingress::inclusion_lane::{PendingUserOp, SequencerError};
+use sequencer::ingress::inclusion_lane::{IncludedUserOp, PendingUserOp, SequencerError};
 use sequencer::runtime::shutdown::RuntimeScope;
 use sequencer::storage::{SafeInputRange, Storage, StoredSafeInput};
 use sequencer_core::api::WsTxMessage;
@@ -21,7 +20,7 @@ use tokio::sync::{mpsc, oneshot};
 use tokio_tungstenite::connect_async;
 use tokio_tungstenite::tungstenite::Message;
 
-use super::common::temp_db;
+use crate::test_support::temp_db;
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn ws_subscribe_streams_ordered_txs_from_offset_zero() {
@@ -30,9 +29,7 @@ async fn ws_subscribe_streams_ordered_txs_from_offset_zero() {
     let expected = load_ordered_l2_txs_page(db.path.as_str(), 0, 2);
     assert_eq!(expected.len(), 2, "seeded replay must contain two txs");
 
-    let Some(runtime) = start_test_server(db.path.as_str()).await else {
-        return;
-    };
+    let runtime = start_test_server(db.path.as_str()).await;
     let url = ws_subscribe_url(&db.path, runtime.addr, 0);
     let (mut ws, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(url))
         .await
@@ -62,9 +59,7 @@ async fn ws_subscribe_resumes_from_given_offset() {
         "resume snapshot must contain one event at offset 1"
     );
 
-    let Some(runtime) = start_test_server(db.path.as_str()).await else {
-        return;
-    };
+    let runtime = start_test_server(db.path.as_str()).await;
     let url = ws_subscribe_url(&db.path, runtime.addr, 1);
     let (mut ws, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(url))
         .await
@@ -85,9 +80,7 @@ async fn ws_subscribe_receives_live_events_after_subscribing() {
     seed_ordered_txs(db.path.as_str());
     let base_offset = ordered_l2_tx_count(db.path.as_str());
 
-    let Some(runtime) = start_test_server(db.path.as_str()).await else {
-        return;
-    };
+    let runtime = start_test_server(db.path.as_str()).await;
 
     // Subscribe at the current DB head to exercise live-only delivery.
     let url = ws_subscribe_url(&db.path, runtime.addr, base_offset);
@@ -117,9 +110,7 @@ async fn ws_subscribe_fanout_delivers_live_event_to_multiple_subscribers() {
     seed_ordered_txs(db.path.as_str());
     let base_offset = ordered_l2_tx_count(db.path.as_str());
 
-    let Some(runtime) = start_test_server(db.path.as_str()).await else {
-        return;
-    };
+    let runtime = start_test_server(db.path.as_str()).await;
 
     let url = ws_subscribe_url(&db.path, runtime.addr, base_offset);
     let (mut ws_a, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(url.as_str()))
@@ -156,9 +147,7 @@ async fn ws_subscribe_replies_with_pong_on_ping() {
     seed_ordered_txs(db.path.as_str());
     let from_offset = ordered_l2_tx_count(&db.path);
 
-    let Some(runtime) = start_test_server(db.path.as_str()).await else {
-        return;
-    };
+    let runtime = start_test_server(db.path.as_str()).await;
 
     let url = ws_subscribe_url(&db.path, runtime.addr, from_offset);
     let (mut ws, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(url))
@@ -187,9 +176,7 @@ async fn ws_subscribe_rejects_when_subscriber_limit_is_reached() {
     seed_ordered_txs(db.path.as_str());
     let base_offset = ordered_l2_tx_count(db.path.as_str());
 
-    let Some(runtime) = start_test_server_with_limits(db.path.as_str(), 1).await else {
-        return;
-    };
+    let runtime = start_test_server_with_limits(db.path.as_str(), 1).await;
 
     let url = ws_subscribe_url(&db.path, runtime.addr, base_offset);
     let (ws_a, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(url.as_str()))
@@ -216,9 +203,7 @@ async fn ws_subscribe_rejects_when_subscriber_limit_is_reached() {
 async fn ws_subscribe_requires_a_valid_history_claim_before_upgrade() {
     let db = temp_db("ws-history-claims");
     seed_ordered_txs(&db.path);
-    let Some(runtime) = start_test_server(&db.path).await else {
-        return;
-    };
+    let runtime = start_test_server(&db.path).await;
     let client = SequencerClient::new(format!("http://{}", runtime.addr)).unwrap();
     let mut start = history_claim(&db.path, 3);
     assert!(matches!(client.subscribe(start).await,
@@ -244,9 +229,7 @@ async fn ws_subscribe_closes_on_oversized_inbound_message() {
     let db = temp_db("ws-oversized-inbound");
     seed_ordered_txs(db.path.as_str());
 
-    let Some(runtime) = start_test_server(db.path.as_str()).await else {
-        return;
-    };
+    let runtime = start_test_server(db.path.as_str()).await;
 
     let url = ws_subscribe_url(&db.path, runtime.addr, ordered_l2_tx_count(&db.path));
     let (mut ws, _) = tokio::time::timeout(Duration::from_secs(5), connect_async(url))
@@ -275,10 +258,7 @@ async fn ws_subscribe_closes_on_oversized_inbound_message() {
 
 fn seed_ordered_txs(db_path: &str) {
     let mut storage = Storage::open(db_path).expect("open storage");
-    crate::storage::test_helpers::pin_test_deployment_identity(
-        &mut storage,
-        Address::repeat_byte(0x7f),
-    );
+    crate::test_support::pin_test_deployment_identity(&mut storage, Address::repeat_byte(0x7f));
     let mut head = storage
         .initialize_open_state(0, SafeInputRange::empty_at(0))
         .expect("initialize open state");
@@ -298,8 +278,15 @@ fn seed_ordered_txs(db_path: &str) {
         received_at: SystemTime::now(),
     };
 
+    let executed_input_offset = storage.next_executed_input_count().expect("next offset");
     storage
-        .append_user_ops_chunk(&mut head, &[pending])
+        .append_executed_user_ops_chunk(
+            &mut head,
+            &[IncludedUserOp {
+                pending,
+                executed_input_offset,
+            }],
+        )
         .expect("append user-op chunk");
     storage
         .append_safe_inputs(
@@ -310,12 +297,7 @@ fn seed_ordered_txs(db_path: &str) {
                 block_number: 10,
             }],
             Address::repeat_byte(0x7f),
-            &sequencer_core::protocol::ProtocolTiming {
-                max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-                preemptive_margin_blocks: 75,
-                l1_read_stale_after_blocks: 900,
-                seconds_per_block: 12,
-            },
+            &crate::storage::test_helpers::default_protocol_timing(),
         )
         .expect("append direct input");
     storage
@@ -346,12 +328,7 @@ fn append_drained_direct_input(db_path: &str, payload: Vec<u8>) {
                 block_number: safe_block,
             }],
             Address::repeat_byte(0x7f),
-            &sequencer_core::protocol::ProtocolTiming {
-                max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-                preemptive_margin_blocks: 75,
-                l1_read_stale_after_blocks: 900,
-                seconds_per_block: 12,
-            },
+            &crate::storage::test_helpers::default_protocol_timing(),
         )
         .expect("append direct input");
     storage
@@ -384,25 +361,15 @@ fn snapshot_state_file(prefix: &std::path::Path) -> std::path::PathBuf {
     prefix.join("state")
 }
 
-async fn start_test_server(db_path: &str) -> Option<WsServerRuntime> {
+async fn start_test_server(db_path: &str) -> WsServerRuntime {
     start_test_server_with_limits(db_path, 64).await
 }
 
 async fn start_test_server_with_limits(
     db_path: &str,
     ws_max_subscribers: usize,
-) -> Option<WsServerRuntime> {
-    let listener = match tokio::net::TcpListener::bind("127.0.0.1:0").await {
-        Ok(value) => value,
-        Err(err) if err.kind() == ErrorKind::PermissionDenied => {
-            eprintln!(
-                "skipping ws integration test: cannot bind test listener in this environment"
-            );
-            return None;
-        }
-        Err(err) => panic!("bind test listener: {err}"),
-    };
-    let addr = listener.local_addr().expect("read listener addr");
+) -> WsServerRuntime {
+    let (listeners, _public_addr, addr) = crate::test_support::server::bind_api_listeners().await;
 
     let (tx_sender, _rx) = mpsc::channel::<PendingUserOp>(1);
     let shutdown = RuntimeScope::default();
@@ -414,8 +381,8 @@ async fn start_test_server_with_limits(
             page_size: 64,
         },
     );
-    let task = http::start_on_listener(
-        listener,
+    let task = http::start_on_listeners(
+        listeners,
         tx_sender,
         shutdown.clone(),
         tx_feed,
@@ -432,11 +399,11 @@ async fn start_test_server_with_limits(
         },
     );
 
-    Some(WsServerRuntime {
+    WsServerRuntime {
         addr,
         shutdown,
         server_task: Some(task),
-    })
+    }
 }
 
 async fn shutdown_runtime(mut runtime: WsServerRuntime) {
diff --git a/sequencer/src/l1/eip1559.rs b/sequencer/src/l1/eip1559.rs
index 9031a83e..3071d8aa 100644
--- a/sequencer/src/l1/eip1559.rs
+++ b/sequencer/src/l1/eip1559.rs
@@ -19,7 +19,7 @@ pub struct Eip1559Fees {
 
 /// Pad an `eth_estimateGas` result so a tight estimate cannot mine as an
 /// out-of-gas revert (which would burn the wallet-nonce slot with no
-/// `InputAdded` and desynchronize payload↔nonce assignment).
+/// `InputAdded` and desynchronize payload↔wallet-nonce assignment).
 pub fn pad_gas_estimate(gas: u64) -> u64 {
     gas.saturating_add(gas / 10)
 }
@@ -37,14 +37,14 @@ pub async fn estimate_fees(provider: &DynProvider) -> Result<Eip1559Fees, String
             &[utils::EIP1559_FEE_ESTIMATION_REWARD_PERCENTILE],
         )
         .await
-        .map_err(|err| err.to_string())?;
+        .map_err(|err| crate::l1::provider::error_chain(&err))?;
 
     let base_fee_per_gas = match history.latest_block_base_fee() {
         Some(base_fee) if base_fee != 0 => base_fee,
         _ => provider
             .get_block_by_number(BlockNumberOrTag::Latest)
             .await
-            .map_err(|err| err.to_string())?
+            .map_err(|err| crate::l1::provider::error_chain(&err))?
             .and_then(|block| block.header.base_fee_per_gas())
             .ok_or_else(|| "RPC does not support EIP-1559 base fees".to_string())?
             .into(),
diff --git a/sequencer/src/l1/fee_oracle/bootstrap.rs b/sequencer/src/l1/fee_oracle/bootstrap.rs
index 42de1091..40b8cafd 100644
--- a/sequencer/src/l1/fee_oracle/bootstrap.rs
+++ b/sequencer/src/l1/fee_oracle/bootstrap.rs
@@ -8,41 +8,23 @@
 
 use alloy::providers::DynProvider;
 
-use super::uniswap::{UniswapConfig, UniswapV3PriceSource, bootstrap_price_source_error};
+use super::uniswap::{UniswapConfig, UniswapV3PriceSource};
 use super::worker::{FeeOracle, FeeOracleError};
 use crate::runtime::process_lock::ProcessLock;
 
-/// Failure to reach the configured pool at connect time.
-#[derive(Debug)]
-pub(crate) enum UniswapConnectError {
-    /// Wrong pool/pair/chain or a bad RPC URL: deterministic; retrying the
-    /// same configuration re-fails identically.
-    Misconfig(String),
-    /// The source is unavailable right now; retrying may succeed.
-    Transient { message: String },
-}
-
-/// Connect to the configured pool and classify any failure. `setup` calls
-/// this while it still owns all address-bearing configuration and before
-/// anything is pinned, so a misconfigured pool never pins an identity.
+/// Connect to the configured pool. `setup` calls this while it still owns all
+/// address-bearing configuration and before anything is pinned, so a
+/// misconfigured pool never pins an identity. Failures classify as at runtime
+/// (`From<PriceSourceError> for FeeOracleError`); a bad RPC URL is Misconfig.
 pub(crate) async fn connect_uniswap(
     rpc_url: &str,
     allow_insecure_rpc: bool,
     uniswap: UniswapConfig,
-) -> Result<(DynProvider, UniswapV3PriceSource), UniswapConnectError> {
-    let provider = crate::l1::provider::create_provider(rpc_url, allow_insecure_rpc)
-        .map_err(UniswapConnectError::Misconfig)?;
-    match UniswapV3PriceSource::connect(provider.clone(), uniswap).await {
-        Ok(token) => Ok((provider, token)),
-        Err(error) => {
-            let (transient, message) = bootstrap_price_source_error(error);
-            Err(if transient {
-                UniswapConnectError::Transient { message }
-            } else {
-                UniswapConnectError::Misconfig(message)
-            })
-        }
-    }
+) -> Result<(DynProvider, UniswapV3PriceSource), FeeOracleError> {
+    let provider = crate::l1::provider::create_read_provider(rpc_url, allow_insecure_rpc)
+        .map_err(FeeOracleError::Misconfig)?;
+    let token = UniswapV3PriceSource::connect(provider.clone(), uniswap).await?;
+    Ok((provider, token))
 }
 
 /// `setup`'s persist step: construct the oracle on an already-validated
diff --git a/sequencer/src/l1/fee_oracle/math.rs b/sequencer/src/l1/fee_oracle/math.rs
index a357e24d..72606c34 100644
--- a/sequencer/src/l1/fee_oracle/math.rs
+++ b/sequencer/src/l1/fee_oracle/math.rs
@@ -1,150 +1,99 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0
 
-//! Integer-only conversion from L1 gas prices to fee-token gas prices.
+//! Host-side conversion from an L1 gas price and a Uniswap TWAP tick to the
+//! fee-token gas-price exponent. This is approximate f64 arithmetic: only the
+//! published frame fee is consensus, and `fee_to_linear` converts it exactly.
 
-use alloy_primitives::U256;
-use sequencer_core::fee::{FeeEncodeError, fee_from_linear_ceil};
+use sequencer_core::fee::MAX_EXPONENT;
 
-/// Encode a linear price without ever rounding it down.
-///
-/// Values above [`sequencer_core::fee::fee_to_linear`]`(`[`sequencer_core::fee::MAX_EXPONENT`]`)`
-/// fail rather than undercharge.
-pub fn encode_log_gas_price(linear: U256) -> Result<u16, MathError> {
-    fee_from_linear_ceil(linear).map_err(MathError::from)
+/// Fee-token smallest units per L1 gas. `directed_tick` orients the TWAP so
+/// `1.0001^directed_tick` is fee-token smallest units per wei. Pricing slack
+/// is applied by `batch_policy.log_slack`, so this stays the quoted gas cost.
+pub fn x_units_per_gas(gas_price_wei: f64, directed_tick: i32) -> f64 {
+    gas_price_wei * 1.0001_f64.powi(directed_tick)
 }
 
-/// Compute fee-token smallest units charged per L1 gas.
-///
-/// `quote_x_per_weth` is the number of fee-token smallest units for 1 WETH.
-/// The multiplication is checked and rounded up. Pricing slack is applied by
-/// `batch_policy.log_slack`, so this stays the actual quoted gas cost.
-pub fn compute_x_units_per_gas(
-    base_fee: u128,
-    priority_fee: u128,
-    quote_x_per_weth: U256,
-) -> Result<U256, MathError> {
-    let gas_price = U256::from(base_fee)
-        .checked_add(U256::from(priority_fee))
-        .ok_or(MathError::Overflow)?;
-    let numerator = gas_price
-        .checked_mul(quote_x_per_weth)
-        .ok_or(MathError::Overflow)?;
-    let quotient = numerator / U256::from(1_000_000_000_000_000_000u128);
-    if numerator % U256::from(1_000_000_000_000_000_000u128) == U256::ZERO {
-        Ok(quotient)
-    } else {
-        quotient
-            .checked_add(U256::from(1))
-            .ok_or(MathError::Overflow)
-    }
-}
-
-#[derive(Debug, thiserror::Error, PartialEq, Eq)]
-pub enum MathError {
-    #[error("integer arithmetic overflow")]
-    Overflow,
-    #[error("linear gas price exceeds the representable log-fee range")]
-    ExceedsRepresentableRange,
-}
-
-impl From<FeeEncodeError> for MathError {
-    fn from(error: FeeEncodeError) -> Self {
-        match error {
-            FeeEncodeError::ExceedsRepresentableRange { .. } => Self::ExceedsRepresentableRange,
-        }
-    }
+/// Round a linear price up to a base-129/128 exponent, clamped to
+/// `[floor, MAX_EXPONENT]` (see `Storage::log_gas_price_floor`). Near an
+/// exponent boundary the f64 ceil can land one step (0.78%) low; `log_slack`
+/// absorbs it.
+pub fn log_gas_price_ceil(x_units_per_gas: f64, floor: i16) -> i16 {
+    assert!(
+        x_units_per_gas >= 0.0,
+        "gas price {x_units_per_gas} is negative or NaN"
+    );
+    let exponent = (x_units_per_gas.ln() / (129.0_f64 / 128.0).ln()).ceil();
+    // ln(0) is -inf, which the clamp maps to `floor`.
+    exponent.clamp(f64::from(floor), f64::from(MAX_EXPONENT)) as i16
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use sequencer_core::fee::{MAX_EXPONENT, fee_to_linear};
+
+    const BASE: f64 = 129.0 / 128.0;
 
     #[test]
-    fn gas_price_charges_base_plus_priority_without_slack() {
-        // ETH ~= $1800, USDC has 6 decimals, and a 20 gwei paid gas price:
-        // 20e9 wei * 1.8e9 USDC-smallest/WETH / 1e18 = 36 USDC units.
-        assert_eq!(
-            compute_x_units_per_gas(19_000_000_000, 1_000_000_000, U256::from(1_800_000_000))
-                .unwrap(),
-            U256::from(36)
-        );
+    fn x_units_per_gas_matches_reference_quotes() {
+        // Per 1e18 wei: ~2063 USDC (6 decimals), ~2.718 of an 18-decimal token, the largest quote.
+        for (directed_tick, expected) in [
+            (-200_000, 2_063_215_670.0),
+            (10_000, 2.718_145_926_825_225e18),
+            (887_272, 3.402_567_868_363_881e56),
+        ] {
+            let quote = x_units_per_gas(1e18, directed_tick);
+            assert!(
+                (quote - expected).abs() <= expected * 1e-8,
+                "tick {directed_tick}: {quote} vs {expected}"
+            );
+        }
+        assert!(x_units_per_gas(1.0, -887_272) > 0.0);
     }
 
     #[test]
-    fn detects_multiplication_overflow() {
-        assert_eq!(
-            compute_x_units_per_gas(u128::MAX, u128::MAX, U256::MAX),
-            Err(MathError::Overflow)
-        );
+    fn log_gas_price_is_the_next_exponent_up_within_tolerance() {
+        for e in [1i32, 100, 1356, 10_000] {
+            let encoded = i32::from(log_gas_price_ceil(BASE.powi(e), i16::MIN));
+            assert!(
+                (encoded - e).abs() <= 1,
+                "exponent {e} encoded as {encoded}"
+            );
+        }
+        for v in [1.5, 36.0, 1e6, 123_456_789.0] {
+            let e = i32::from(log_gas_price_ceil(v, i16::MIN));
+            assert!(BASE.powi(e) >= v * (1.0 - 1e-9));
+            assert!(BASE.powi(e - 1) < v * (1.0 + 1e-9));
+        }
     }
 
     #[test]
-    fn conservative_log_encoding_never_undercharges() {
-        let target = U256::from(123_456_789u64);
-        let encoded = encode_log_gas_price(target).unwrap();
-        assert!(fee_to_linear(encoded) >= target);
-        assert!(encoded == 0 || fee_to_linear(encoded - 1) < target);
+    fn sub_two_unit_price_rounds_in_log_space_not_to_whole_units() {
+        // The removed whole-unit ceil charged 2 units (exponent 90) for 1.25.
+        assert_eq!(log_gas_price_ceil(1.25, i16::MIN), 29);
     }
 
     #[test]
-    fn encode_zero_and_exact_max_exponent() {
-        assert_eq!(encode_log_gas_price(U256::ZERO).unwrap(), 0);
-        assert_eq!(
-            encode_log_gas_price(fee_to_linear(MAX_EXPONENT)).unwrap(),
-            MAX_EXPONENT
-        );
+    fn prices_below_one_unit_go_negative_down_to_the_floor() {
+        assert_eq!(log_gas_price_ceil(0.5, -1356), -89);
+        assert_eq!(log_gas_price_ceil(1.0, -1356), 0);
+        assert_eq!(log_gas_price_ceil(0.0, -1356), -1356);
+        assert_eq!(log_gas_price_ceil(1e-300, -1356), -1356);
     }
 
     #[test]
-    fn encode_rejects_values_above_max_representable() {
-        assert_eq!(
-            encode_log_gas_price(fee_to_linear(MAX_EXPONENT) + U256::from(1u64)),
-            Err(MathError::ExceedsRepresentableRange)
-        );
+    fn prices_above_the_representable_range_saturate() {
+        let max = i16::try_from(MAX_EXPONENT).expect("MAX_EXPONENT fits i16");
+        assert_eq!(log_gas_price_ceil(f64::MAX, i16::MIN), max);
         assert_eq!(
-            encode_log_gas_price(U256::MAX),
-            Err(MathError::ExceedsRepresentableRange)
+            log_gas_price_ceil(x_units_per_gas(2.0 * u128::MAX as f64, 887_272), i16::MIN),
+            max
         );
     }
 
     #[test]
-    fn encode_bumps_when_fee_from_linear_rounds_down() {
-        // Pick a linear value whose nearest exponent rounds down; ceiling
-        // encoding must choose the next exponent.
-        let mut target = U256::from(2u64);
-        let mut found = None;
-        for _ in 0..10_000 {
-            let rounded = sequencer_core::fee::fee_from_linear(target);
-            if fee_to_linear(rounded) < target && rounded < MAX_EXPONENT {
-                found = Some((target, rounded));
-                break;
-            }
-            target += U256::from(1u64);
-        }
-        let (target, rounded) = found.expect("find a rounding-down candidate");
-        let encoded = encode_log_gas_price(target).unwrap();
-        assert_eq!(encoded, rounded + 1);
-        assert!(fee_to_linear(encoded) >= target);
-    }
-
-    #[test]
-    fn compute_rounds_up_fractional_wei_quote() {
-        // 1 wei * 1 quote-unit = 1 — strictly less than 1e18, so ceil → 1.
-        assert_eq!(
-            compute_x_units_per_gas(1, 0, U256::from(1)).unwrap(),
-            U256::from(1)
-        );
-        // Exact multiple of 1e18 stays exact (no round-up).
-        assert_eq!(
-            compute_x_units_per_gas(1, 0, U256::from(1_000_000_000_000_000_000u128)).unwrap(),
-            U256::from(1)
-        );
-        // One extra quote unit pushes numerator over the next 1e18 boundary.
-        assert_eq!(
-            compute_x_units_per_gas(1, 0, U256::from(1_000_000_000_000_000_001u128)).unwrap(),
-            U256::from(2)
-        );
+    #[should_panic(expected = "negative or NaN")]
+    fn nan_price_fails_loud() {
+        log_gas_price_ceil(f64::NAN, i16::MIN);
     }
 }
diff --git a/sequencer/src/l1/fee_oracle/mod.rs b/sequencer/src/l1/fee_oracle/mod.rs
index 822597bf..c0cbad99 100644
--- a/sequencer/src/l1/fee_oracle/mod.rs
+++ b/sequencer/src/l1/fee_oracle/mod.rs
@@ -8,6 +8,6 @@ pub mod math;
 pub mod uniswap;
 pub mod worker;
 
-pub(crate) use bootstrap::{UniswapConnectError, connect_uniswap, persist_first_price};
+pub(crate) use bootstrap::{connect_uniswap, persist_first_price};
 pub use uniswap::{TokenPriceSource, UniswapConfig, UniswapV3PriceSource};
 pub use worker::FeeOracle;
diff --git a/sequencer/src/l1/fee_oracle/uniswap.rs b/sequencer/src/l1/fee_oracle/uniswap.rs
index a67917b3..7eaa4aac 100644
--- a/sequencer/src/l1/fee_oracle/uniswap.rs
+++ b/sequencer/src/l1/fee_oracle/uniswap.rs
@@ -6,7 +6,7 @@
 use alloy::contract::Error as ContractError;
 use alloy::providers::{DynProvider, Provider};
 use alloy::sol;
-use alloy_primitives::{Address, U256};
+use alloy_primitives::Address;
 use alloy_sol_types::Revert;
 use async_trait::async_trait;
 use thiserror::Error;
@@ -50,8 +50,9 @@ impl UniswapConfig {
 
 #[async_trait]
 pub trait TokenPriceSource: Send + Sync {
-    /// Fee-token smallest units quoted for one WETH (10^18 wei).
-    async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError>;
+    /// TWAP mean tick oriented so `1.0001^tick` is fee-token smallest units
+    /// per wei, within the Uniswap V3 tick range.
+    async fn directed_tick(&self) -> Result<i32, PriceSourceError>;
 }
 
 /// Read-only Uniswap V3 source. Validation must complete before use.
@@ -75,8 +76,8 @@ pub enum PriceSourceError {
     InsufficientObservations,
     #[error("invalid TWAP window of zero seconds")]
     ZeroTwapWindow,
-    #[error("TWAP arithmetic overflow")]
-    ArithmeticOverflow,
+    #[error("TWAP mean tick {0} is outside the Uniswap V3 tick range")]
+    TickOutOfRange(i32),
 }
 
 impl UniswapV3PriceSource {
@@ -90,7 +91,7 @@ impl UniswapV3PriceSource {
         let rpc_chain_id = provider
             .get_chain_id()
             .await
-            .map_err(|err| PriceSourceError::Provider(err.to_string()))?;
+            .map_err(|err| PriceSourceError::Provider(crate::l1::provider::error_chain(&err)))?;
         if rpc_chain_id != config.chain_id {
             return Err(PriceSourceError::ChainIdMismatch {
                 rpc: rpc_chain_id,
@@ -100,7 +101,7 @@ impl UniswapV3PriceSource {
         let code = provider
             .get_code_at(config.pool)
             .await
-            .map_err(|err| PriceSourceError::Provider(err.to_string()))?;
+            .map_err(|err| PriceSourceError::Provider(crate::l1::provider::error_chain(&err)))?;
         if code.is_empty() {
             return Err(PriceSourceError::MissingPoolCode(config.pool));
         }
@@ -156,10 +157,16 @@ impl UniswapV3PriceSource {
             .call()
             .await
             .map_err(classify_observe_error)?;
-        let start: i64 = observed.tickCumulatives[0]
+        let &[start, end] = observed.tickCumulatives.as_slice() else {
+            return Err(PriceSourceError::Provider(format!(
+                "observe returned {} tick cumulatives for a 2-point window",
+                observed.tickCumulatives.len()
+            )));
+        };
+        let start: i64 = start
             .try_into()
             .expect("Uniswap int56 tick cumulative fits i64");
-        let end: i64 = observed.tickCumulatives[1]
+        let end: i64 = end
             .try_into()
             .expect("Uniswap int56 tick cumulative fits i64");
         let delta = end
@@ -178,14 +185,13 @@ impl UniswapV3PriceSource {
 
 #[async_trait]
 impl TokenPriceSource for UniswapV3PriceSource {
-    async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError> {
-        let tick = self.mean_tick().await?;
-        quote_x_per_weth_from_tick(tick, self.weth_is_token0)
+    async fn directed_tick(&self) -> Result<i32, PriceSourceError> {
+        orient_tick(self.mean_tick().await?, self.weth_is_token0)
     }
 }
 
-fn provider_error(error: impl std::fmt::Display) -> PriceSourceError {
-    PriceSourceError::Provider(error.to_string())
+fn provider_error(error: ContractError) -> PriceSourceError {
+    PriceSourceError::Provider(crate::l1::provider::error_chain(&error))
 }
 
 /// Exact Uniswap V3 Oracle reason for an `observe` window that exceeds history.
@@ -202,7 +208,7 @@ fn is_old_observation_reason(reason: &str) -> bool {
 fn classify_observe_error(error: ContractError) -> PriceSourceError {
     classify_decoded_observe_revert(
         error.as_decoded_error::<Revert>().as_ref(),
-        error.to_string(),
+        crate::l1::provider::error_chain(&error),
     )
 }
 
@@ -218,62 +224,20 @@ fn classify_decoded_observe_revert(
     }
 }
 
-/// Setup-time mapping: provider/RPC failures and an unavailable observation
-/// window may self-heal. Both still fail setup's hard first-read requirement;
-/// only their restart classification differs from deterministic misconfig.
-pub(super) fn bootstrap_price_source_error(error: PriceSourceError) -> (bool, String) {
-    match error {
-        PriceSourceError::Provider(message) => (true, message),
-        error @ PriceSourceError::InsufficientObservations => (true, error.to_string()),
-        error => (false, error.to_string()),
-    }
-}
-
-/// Estimate fee-token smallest units per WETH from a Uniswap tick.
-///
-/// Host pricing is approximate, with headroom supplied by `batch_policy.log_slack`.
-/// Ceiling rounds up the estimate, not an exact TickMath price. Recorded frame
-/// fees use the shared deterministic integer conversion.
-pub fn quote_x_per_weth_from_tick(
-    tick: i32,
-    weth_is_token0: bool,
-) -> Result<U256, PriceSourceError> {
+/// Orient a pool tick so `1.0001^tick` is fee-token smallest units per wei.
+/// The pool price is token1 per token0 in smallest units.
+fn orient_tick(tick: i32, weth_is_token0: bool) -> Result<i32, PriceSourceError> {
     const MAX_TICK: i32 = 887_272;
     if !(-MAX_TICK..=MAX_TICK).contains(&tick) {
-        return Err(PriceSourceError::ArithmeticOverflow);
-    }
-    let directed_tick = if weth_is_token0 { tick } else { -tick };
-    // The raw ratio already uses token smallest units; 1 WETH supplies 10^18 wei.
-    let quote = 1.0001_f64.powi(directed_tick) * 1e18;
-    if !quote.is_finite() || quote <= 0.0 {
-        return Err(PriceSourceError::ArithmeticOverflow);
+        return Err(PriceSourceError::TickOutOfRange(tick));
     }
-    U256::try_from(quote.ceil()).map_err(|_| PriceSourceError::ArithmeticOverflow)
+    Ok(if weth_is_token0 { tick } else { -tick })
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn tick_zero_quotes_one_weth_in_each_direction() {
-        assert_eq!(
-            quote_x_per_weth_from_tick(0, true).unwrap(),
-            U256::from(1_000_000_000_000_000_000u128)
-        );
-        assert_eq!(
-            quote_x_per_weth_from_tick(0, false).unwrap(),
-            U256::from(1_000_000_000_000_000_000u128)
-        );
-    }
-
-    #[test]
-    fn negative_tick_directionality_matches_token_order() {
-        let one_weth = U256::from(1_000_000_000_000_000_000u128);
-        assert!(quote_x_per_weth_from_tick(-1, true).unwrap() < one_weth);
-        assert!(quote_x_per_weth_from_tick(-1, false).unwrap() > one_weth);
-    }
-
     #[test]
     fn pinned_usdc_pool_constants_are_distinct_pairs() {
         assert_ne!(MAINNET_WETH, MAINNET_USDC);
@@ -281,18 +245,6 @@ mod tests {
         assert_ne!(MAINNET_USDC_WETH_005_POOL, SEPOLIA_USDC_WETH_005_POOL);
     }
 
-    #[test]
-    fn out_of_range_ticks_overflow() {
-        for tick in [-887_273, 887_273, i32::MIN, i32::MAX] {
-            for weth_is_token0 in [false, true] {
-                assert!(matches!(
-                    quote_x_per_weth_from_tick(tick, weth_is_token0),
-                    Err(PriceSourceError::ArithmeticOverflow)
-                ));
-            }
-        }
-    }
-
     #[test]
     fn old_observation_reason_is_exact_match() {
         assert!(is_old_observation_reason("OLD"));
@@ -340,21 +292,9 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn bootstrap_maps_source_availability_as_transient() {
-        let (transient, _) =
-            bootstrap_price_source_error(PriceSourceError::Provider("timeout".into()));
-        assert!(transient);
-        let (transient, _) =
-            bootstrap_price_source_error(PriceSourceError::InsufficientObservations);
-        assert!(transient);
-        let (transient, _) = bootstrap_price_source_error(PriceSourceError::WrongTokenPair);
-        assert!(!transient);
-    }
-
     #[test]
     fn runtime_source_derives_canonical_token_order_without_rpc() {
-        let provider = crate::l1::provider::create_provider("http://127.0.0.1:1", false)
+        let provider = crate::l1::provider::create_read_provider("http://127.0.0.1:1", false)
             .expect("provider construction is local");
         let source = UniswapV3PriceSource::from_setup_validated(
             provider,
@@ -370,46 +310,21 @@ mod tests {
     }
 
     #[test]
-    fn boundary_ticks_are_representable() {
-        for weth_is_token0 in [false, true] {
-            let tick = if weth_is_token0 { 887_272 } else { -887_272 };
-            assert!(
-                quote_x_per_weth_from_tick(tick, weth_is_token0).unwrap() > U256::from(u128::MAX)
-            );
-            assert_eq!(
-                quote_x_per_weth_from_tick(-tick, weth_is_token0).unwrap(),
-                U256::from(1)
-            );
+    fn orient_tick_follows_token_order() {
+        for tick in [-887_272, -1, 0, 1, 887_272] {
+            assert_eq!(orient_tick(tick, true).unwrap(), tick);
+            assert_eq!(orient_tick(tick, false).unwrap(), -tick);
         }
     }
 
     #[test]
-    fn positive_tick_directionality_matches_token_order() {
-        let one_weth = U256::from(1_000_000_000_000_000_000u128);
-        assert!(quote_x_per_weth_from_tick(1, true).unwrap() > one_weth);
-        assert!(quote_x_per_weth_from_tick(1, false).unwrap() < one_weth);
-    }
-
-    #[test]
-    fn quotes_preserve_smallest_units_across_token_orders() {
-        // Decimal reference values: ~2063 USDC/WETH for a 6-decimal token,
-        // ~2.718 tokens/WETH for an 18-decimal token, and the largest quote.
-        for (directed_tick, expected) in [
-            (-200_000, 2_063_215_670.0),
-            (10_000, 2.718_145_926_825_225e18),
-            (887_272, 3.402_567_868_363_881e56),
-        ] {
+    fn out_of_range_ticks_are_rejected() {
+        for tick in [-887_273, 887_273, i32::MIN, i32::MAX] {
             for weth_is_token0 in [false, true] {
-                let tick = if weth_is_token0 {
-                    directed_tick
-                } else {
-                    -directed_tick
-                };
-                let quote = f64::from(quote_x_per_weth_from_tick(tick, weth_is_token0).unwrap());
-                assert!(
-                    (quote - expected).abs() <= expected * 1e-8,
-                    "tick {tick}, WETH token0 {weth_is_token0}: {quote} vs {expected}"
-                );
+                assert!(matches!(
+                    orient_tick(tick, weth_is_token0),
+                    Err(PriceSourceError::TickOutOfRange(t)) if t == tick
+                ));
             }
         }
     }
diff --git a/sequencer/src/l1/fee_oracle/worker.rs b/sequencer/src/l1/fee_oracle/worker.rs
index 141c6964..222ac4ac 100644
--- a/sequencer/src/l1/fee_oracle/worker.rs
+++ b/sequencer/src/l1/fee_oracle/worker.rs
@@ -11,7 +11,7 @@ use thiserror::Error;
 use tracing::{debug, warn};
 
 use crate::l1::eip1559::{Eip1559Fees, estimate_fees};
-use crate::l1::fee_oracle::math::{MathError, compute_x_units_per_gas, encode_log_gas_price};
+use crate::l1::fee_oracle::math;
 use crate::l1::fee_oracle::uniswap::{PriceSourceError, TokenPriceSource};
 use crate::runtime::process_lock::{ProcessLock, spawn_blocking_with_lock};
 use crate::runtime::shutdown::ShutdownSignal;
@@ -19,7 +19,7 @@ use crate::storage::{Storage, StorageOpenError};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct RefreshResult {
-    pub log_gas_price: u16,
+    pub log_gas_price: i16,
     pub changed: bool,
 }
 
@@ -35,8 +35,6 @@ pub enum FeeOracleError {
     Transient(String),
     #[error("fee-oracle misconfiguration: {0}")]
     Misconfig(String),
-    #[error("fatal fee-oracle arithmetic failure: {0}")]
-    FatalMath(#[from] MathError),
 }
 
 impl FeeOracleError {
@@ -49,7 +47,7 @@ impl FeeOracleError {
             // The oracle's `Join` wraps its internal blocking storage task.
             // During a live worker exit that task can only have panicked;
             // ordinary shutdown cancels the enclosing refresh future instead.
-            Self::FatalMath(_) | Self::Misconfig(_) | Self::Join(_) => true,
+            Self::Misconfig(_) | Self::Join(_) => true,
             // A transient quote/transport failure self-heals.
             Self::Transient(_) => false,
         }
@@ -138,10 +136,9 @@ impl FeeOracle {
             .estimate_gas_fees()
             .await
             .map_err(FeeOracleError::Transient)?;
-        let quote = self.token.quote_x_per_weth().await?;
-        let linear =
-            compute_x_units_per_gas(fees.base_fee_per_gas, fees.max_priority_fee_per_gas, quote)?;
-        let log_gas_price = encode_log_gas_price(linear)?;
+        let directed_tick = self.token.directed_tick().await?;
+        let gas_price_wei = fees.base_fee_per_gas as f64 + fees.max_priority_fee_per_gas as f64;
+        let x_units_per_gas = math::x_units_per_gas(gas_price_wei, directed_tick);
 
         let db_path = self.db_path.clone();
         let process_lock = self.process_lock.clone();
@@ -149,6 +146,8 @@ impl FeeOracle {
             process_lock,
             move || -> Result<RefreshResult, FeeOracleError> {
                 let mut storage = Storage::open_writer(&db_path)?;
+                let log_gas_price =
+                    math::log_gas_price_ceil(x_units_per_gas, storage.log_gas_price_floor()?);
                 let changed = storage.log_gas_price()? != log_gas_price;
                 // Always stamp so operators can observe the last successful quote.
                 storage.set_log_gas_price(log_gas_price)?;
@@ -165,20 +164,18 @@ impl FeeOracle {
             tracing::info!(
                 base_fee = fees.base_fee_per_gas,
                 priority_fee = fees.max_priority_fee_per_gas,
-                quote_x_per_weth = %quote,
-                linear_x_per_gas = %linear,
+                directed_tick,
+                x_units_per_gas,
                 log_gas_price = refresh.log_gas_price,
-                changed = refresh.changed,
                 "refreshed L1 fee oracle",
             );
         } else {
             debug!(
                 base_fee = fees.base_fee_per_gas,
                 priority_fee = fees.max_priority_fee_per_gas,
-                quote_x_per_weth = %quote,
-                linear_x_per_gas = %linear,
+                directed_tick,
+                x_units_per_gas,
                 log_gas_price = refresh.log_gas_price,
-                changed = refresh.changed,
                 "L1 fee oracle price unchanged",
             );
         }
@@ -198,11 +195,8 @@ impl FeeOracle {
                 biased;
                 _ = shutdown.wait_for_shutdown() => return Ok(()),
                 result = self.refresh_once() => match result {
-                    Ok(refresh) => {
-                        if refresh.changed {
-                            debug!(log_gas_price = refresh.log_gas_price, "updated L1 fee oracle price");
-                        }
-                    }
+                    // refresh_once logs a change once, at info.
+                    Ok(_) => {}
                     Err(FeeOracleError::Transient(error)) => {
                         warn!(
                             %error,
@@ -227,13 +221,19 @@ impl FeeOracle {
     }
 }
 
+/// The one classification of a price-source failure, for setup and runtime
+/// alike: source availability (provider/RPC, an unservable observation window)
+/// may self-heal; anything else is deterministic misconfiguration. Setup still
+/// fails on either, since its first quote is mandatory; only the restart class
+/// differs.
 impl From<PriceSourceError> for FeeOracleError {
     fn from(error: PriceSourceError) -> Self {
         match error {
             PriceSourceError::Provider(message) => Self::Transient(message),
-            // Setup proved this window usable. At runtime `OLD` means the
-            // current view cannot serve it; retain the persisted price and let
-            // the input reader's safe-head policy judge shared-endpoint health.
+            // `OLD` means the current view cannot serve the window:
+            // availability, not configuration. At runtime the persisted price
+            // is retained and the input reader's safe-head policy judges
+            // shared-endpoint health; setup retries its first quote.
             error @ PriceSourceError::InsufficientObservations => {
                 Self::Transient(error.to_string())
             }
@@ -245,8 +245,7 @@ impl From<PriceSourceError> for FeeOracleError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::test_helpers::temp_db;
-    use alloy_primitives::U256;
+    use crate::test_support::temp_db;
     use std::sync::atomic::{AtomicUsize, Ordering};
     use std::sync::{Arc, Mutex};
 
@@ -259,11 +258,11 @@ mod tests {
         }
     }
 
-    struct StaticToken(U256);
+    struct StaticToken(i32);
 
     #[async_trait]
     impl TokenPriceSource for StaticToken {
-        async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError> {
+        async fn directed_tick(&self) -> Result<i32, PriceSourceError> {
             Ok(self.0)
         }
     }
@@ -305,12 +304,12 @@ mod tests {
 
     struct FailsAfterFirstToken {
         calls: Mutex<usize>,
-        ok: U256,
+        ok: i32,
     }
 
     #[async_trait]
     impl TokenPriceSource for FailsAfterFirstToken {
-        async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError> {
+        async fn directed_tick(&self) -> Result<i32, PriceSourceError> {
             let mut calls = self.calls.lock().expect("lock");
             *calls += 1;
             if *calls == 1 {
@@ -325,7 +324,7 @@ mod tests {
 
     #[async_trait]
     impl TokenPriceSource for AlwaysFailToken {
-        async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError> {
+        async fn directed_tick(&self) -> Result<i32, PriceSourceError> {
             Err(PriceSourceError::Provider("pool unavailable".into()))
         }
     }
@@ -334,7 +333,7 @@ mod tests {
 
     #[async_trait]
     impl TokenPriceSource for PendingToken {
-        async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError> {
+        async fn directed_tick(&self) -> Result<i32, PriceSourceError> {
             if let Some(entered) = self.0.lock().expect("lock").take() {
                 let _ = entered.send(());
             }
@@ -342,15 +341,6 @@ mod tests {
         }
     }
 
-    struct OverflowToken;
-
-    #[async_trait]
-    impl TokenPriceSource for OverflowToken {
-        async fn quote_x_per_weth(&self) -> Result<U256, PriceSourceError> {
-            Ok(U256::MAX)
-        }
-    }
-
     fn sample_fees() -> Eip1559Fees {
         Eip1559Fees {
             base_fee_per_gas: 19_000_000_000,
@@ -359,15 +349,14 @@ mod tests {
         }
     }
 
-    fn sample_quote() -> U256 {
-        U256::from(1_800_000_000u64)
+    /// About 2063 USDC per WETH.
+    fn sample_tick() -> i32 {
+        -200_000
     }
 
-    fn expected_log_price() -> u16 {
-        encode_log_gas_price(
-            compute_x_units_per_gas(19_000_000_000, 1_000_000_000, sample_quote()).unwrap(),
-        )
-        .unwrap()
+    fn expected_log_price() -> i16 {
+        // The sample price (about 41 units per gas) sits far above any floor.
+        math::log_gas_price_ceil(math::x_units_per_gas(20e9, sample_tick()), i16::MIN)
     }
 
     fn initialize_db(path: &str) {
@@ -390,7 +379,7 @@ mod tests {
         let oracle = oracle_with(
             &db.path,
             Box::new(StaticGas(sample_fees())),
-            Box::new(StaticToken(sample_quote())),
+            Box::new(StaticToken(sample_tick())),
         );
         assert_eq!(
             oracle.refresh_once().await.unwrap(),
@@ -430,7 +419,7 @@ mod tests {
                 calls: Arc::new(AtomicUsize::new(0)),
                 ok: sample_fees(),
             }),
-            Box::new(StaticToken(sample_quote())),
+            Box::new(StaticToken(sample_tick())),
         );
         assert_eq!(
             oracle.refresh_once().await.unwrap().log_gas_price,
@@ -452,7 +441,7 @@ mod tests {
             Box::new(StaticGas(sample_fees())),
             Box::new(FailsAfterFirstToken {
                 calls: Mutex::new(0),
-                ok: sample_quote(),
+                ok: sample_tick(),
             }),
         );
         assert_eq!(
@@ -466,12 +455,9 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn arithmetic_overflow_is_fatal() {
-        let db = temp_db("fatal-fee-oracle");
-        let storage = Storage::open(&db.path).unwrap();
-        assert_eq!(storage.log_gas_price().unwrap(), 0);
-        drop(storage);
-
+    async fn extreme_price_saturates_at_max_exponent() {
+        let db = temp_db("saturating-fee-oracle");
+        initialize_db(&db.path);
         let oracle = oracle_with(
             &db.path,
             Box::new(StaticGas(Eip1559Fees {
@@ -479,15 +465,74 @@ mod tests {
                 max_priority_fee_per_gas: u128::MAX,
                 max_fee_per_gas: u128::MAX,
             })),
-            Box::new(OverflowToken),
+            Box::new(StaticToken(887_272)),
         );
-        let err = oracle.refresh_once().await.expect_err("overflow is fatal");
-        assert!(matches!(
-            err,
-            FeeOracleError::FatalMath(MathError::Overflow)
-        ));
-        let storage = Storage::open_read_only(&db.path).unwrap();
-        assert_eq!(storage.log_gas_price().unwrap(), 0);
+        let max = i16::try_from(sequencer_core::fee::MAX_EXPONENT).unwrap();
+        assert_eq!(oracle.refresh_once().await.unwrap().log_gas_price, max);
+        assert_eq!(
+            Storage::open_read_only(&db.path)
+                .unwrap()
+                .log_gas_price()
+                .unwrap(),
+            max
+        );
+    }
+
+    #[tokio::test]
+    async fn sub_two_unit_price_is_charged_in_log_space() {
+        // 0.5 gwei with USDC at about $2500 is about 1.25 units per gas; the
+        // former whole-unit ceil charged 2 units (exponent 90).
+        let db = temp_db("sub-two-unit-fee-oracle");
+        initialize_db(&db.path);
+        let oracle = oracle_with(
+            &db.path,
+            Box::new(StaticGas(Eip1559Fees {
+                base_fee_per_gas: 500_000_000,
+                max_priority_fee_per_gas: 0,
+                max_fee_per_gas: 500_000_000,
+            })),
+            Box::new(StaticToken(-198_080)),
+        );
+        assert_eq!(oracle.refresh_once().await.unwrap().log_gas_price, 29);
+    }
+
+    #[tokio::test]
+    async fn sub_unit_gas_price_goes_below_exponent_zero() {
+        // 0.1 gwei with USDC at about $2500 is about 0.25 units per gas; flooring
+        // at exponent 0 would overcharge 4x.
+        let db = temp_db("sub-unit-fee-oracle");
+        initialize_db(&db.path);
+        let oracle = oracle_with(
+            &db.path,
+            Box::new(StaticGas(Eip1559Fees {
+                base_fee_per_gas: 100_000_000,
+                max_priority_fee_per_gas: 0,
+                max_fee_per_gas: 100_000_000,
+            })),
+            Box::new(StaticToken(-198_080)),
+        );
+        assert_eq!(oracle.refresh_once().await.unwrap().log_gas_price, -178);
+        let mut storage = Storage::open(&db.path).unwrap();
+        assert_eq!(storage.batch_policy().unwrap().recommended_fee, 1356 - 178);
+    }
+
+    #[tokio::test]
+    async fn zero_gas_price_clamps_to_the_derived_fee_floor() {
+        let db = temp_db("zero-gas-fee-oracle");
+        initialize_db(&db.path);
+        let oracle = oracle_with(
+            &db.path,
+            Box::new(StaticGas(Eip1559Fees {
+                base_fee_per_gas: 0,
+                max_priority_fee_per_gas: 0,
+                max_fee_per_gas: 0,
+            })),
+            Box::new(StaticToken(0)),
+        );
+        let mut storage = Storage::open(&db.path).unwrap();
+        let floor = storage.log_gas_price_floor().unwrap();
+        assert_eq!(oracle.refresh_once().await.unwrap().log_gas_price, floor);
+        assert_eq!(storage.batch_policy().unwrap().recommended_fee, 0);
     }
 
     #[tokio::test]
@@ -530,7 +575,7 @@ mod tests {
                 calls: Arc::clone(&gas_calls),
                 ok: sample_fees(),
             }),
-            Box::new(StaticToken(sample_quote())),
+            Box::new(StaticToken(sample_tick())),
         );
         let shutdown = ShutdownSignal::default();
         let mut handle = oracle.start(shutdown.clone());
@@ -584,7 +629,7 @@ mod tests {
                 calls: Mutex::new(0),
                 ok: sample_fees(),
             }),
-            Box::new(StaticToken(sample_quote())),
+            Box::new(StaticToken(sample_tick())),
         );
         let shutdown = ShutdownSignal::default();
         let mut handle = oracle.start(shutdown.clone());
@@ -685,4 +730,14 @@ mod tests {
         assert!(matches!(&error, FeeOracleError::Transient(_)));
         assert!(!error.is_terminal_invariant());
     }
+
+    #[test]
+    fn source_availability_is_transient_and_the_rest_is_misconfig() {
+        let error = FeeOracleError::from(PriceSourceError::Provider("timeout".into()));
+        assert!(matches!(&error, FeeOracleError::Transient(m) if m == "timeout"));
+        assert!(!error.is_terminal_invariant());
+        let error = FeeOracleError::from(PriceSourceError::WrongTokenPair);
+        assert!(matches!(&error, FeeOracleError::Misconfig(_)));
+        assert!(error.is_terminal_invariant());
+    }
 }
diff --git a/sequencer/src/l1/mod.rs b/sequencer/src/l1/mod.rs
index d0f3cb17..295f3ce6 100644
--- a/sequencer/src/l1/mod.rs
+++ b/sequencer/src/l1/mod.rs
@@ -13,26 +13,13 @@ pub mod reader;
 pub mod submitter;
 pub mod watermark;
 
-/// The L1 bundle handed whole to the entry points that reach L1 with the
-/// submitter key: the batch-submitter provider builder and the
-/// preemptive-recovery flush. Built once in `run` from the pinned
-/// [`DeploymentIdentity`](crate::storage::DeploymentIdentity) plus the
-/// command config; the identity is carried verbatim, never re-copied field
-/// by field, so every consumer reads the pinned values through one route.
-///
-/// It is not a funnel: the per-component configs (`InputReaderConfig`,
-/// `BatchPosterConfig`, `UniswapConfig`) are built directly from the same
-/// two sources — `identity` carries deployment values, and `RunConfig`
-/// carries the per-client tuning knobs (`long_block_range_error_codes`,
-/// poll intervals, confirmation depth) that belong to each client, not to
-/// the L1 endpoint. Homed here (not with the command configs): L1-domain
-/// identity consumed by mechanisms below the command layer.
+/// The L1 bundle for the entry points that reach L1 with the submitter key (the
+/// batch-submitter providers and the startup-recovery flush). Built once in `run`;
+/// the pinned identity is carried whole so every consumer reads it through one
+/// route. Per-component configs are built from the identity and `RunConfig`.
 #[derive(Debug, Clone)]
 pub struct L1Config {
-    /// The pinned deployment identity, verbatim from the DB. Carried whole so
-    /// keyed-write paths (e.g. the preemptive-recovery flush) can re-confirm
-    /// the RPC's chain id right before signing via
-    /// [`crate::l1::provider::create_verified_signer_provider`].
+    /// The pinned deployment identity, verbatim from the DB.
     pub identity: crate::storage::DeploymentIdentity,
     pub eth_rpc_url: String,
     pub batch_submitter_private_key: SubmitterKey,
diff --git a/sequencer/src/l1/partition.rs b/sequencer/src/l1/partition.rs
index f6b6697d..da91e00b 100644
--- a/sequencer/src/l1/partition.rs
+++ b/sequencer/src/l1/partition.rs
@@ -1,35 +1,16 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Block-range partition retry: when a log query fails with a "long block range" RPC error,
-//! split the range in half and retry. Shared by the input reader (safe-head advancement)
-//! and the batch submitter (latest batch submitted scan).
-//!
-//! This module is stateless: callers pass the retry error codes explicitly. There is no
-//! global mutable state; `RunConfig` owns the codes and passes them down via configs.
-
-/// Default RPC error codes that trigger partition retry (e.g. Infura -32005,
-/// Alchemy -32600/-32602, QuickNode -32616, Goldsky / some JSON-RPC proxies
-/// -32012).
-///
-/// **Overloaded codes (accepted).** `-32005` and `-32012` are not range-only
-/// across providers: Alloy's transport also treats bare `-32005` as Infura
-/// rate-limit, and `-32012` + `"credits"` as QuickNode credit rate-limit.
-/// We still match on the bare code — the same policy already used for
-/// `-32005` — because range-error messages are not stable across proxies
-/// (Goldsky vs custom gateways). A persistent QuickNode credits limit that
-/// survives Alloy's own retries can therefore fan an N-block scan into
-/// `2N−1` partition queries before failing; operators on QuickNode can drop
-/// `-32012` from `CARTESI_SEQUENCER_LONG_BLOCK_RANGE_ERROR_CODES` if that
-/// matters. We deliberately do **not** add message-marker heuristics here.
-pub const DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES: &[&str] =
-    &["-32005", "-32012", "-32600", "-32602", "-32616"];
-
-use alloy::contract::Error as ContractError;
-use alloy::contract::Event;
+//! Range-partitioned `InputAdded` fetch, shared by the input reader and the
+//! batch poster: a range's logs come back whole or not at all, in L1 order,
+//! decoded.
+
+use std::future::Future;
+
 use alloy::providers::Provider;
-use alloy::sol_types::SolCall;
-use alloy::sol_types::SolEvent;
+use alloy::rpc::types::{Filter, Log};
+use alloy::sol_types::{SolCall, SolEvent};
+use alloy::transports::TransportError;
 use alloy_primitives::{Address, B256};
 use cartesi_rollups_contracts::input_box::InputBox::InputAdded;
 use cartesi_rollups_contracts::inputs::Inputs::EvmAdvanceCall;
@@ -37,199 +18,157 @@ use cartesi_rollups_contracts::inputs::Inputs::EvmAdvanceCall;
 /// Failure of the partitioned `InputAdded` fetch.
 #[derive(Debug, thiserror::Error)]
 pub(crate) enum GetLogsError {
-    /// The first RPC failure the bisect could not (or may not) split away.
-    /// The scan short-circuits on it — matching the watchdog — so sub-ranges
-    /// after the failing one are never queried.
-    #[error(transparent)]
-    Rpc(#[from] ContractError),
-    /// A returned log carried no block number. `eth_getLogs` over a mined
-    /// range cannot produce this from a consistent node, and the L1 order
-    /// every consumer depends on cannot be established without it (the
-    /// watchdog hard-errors on the same condition).
+    /// `eth_getLogs` failed on a single block, which no split can narrow.
+    #[error("eth_getLogs failed at block {block}: {source}")]
+    Rpc {
+        block: u64,
+        #[source]
+        source: TransportError,
+    },
+    /// A returned log lacks a position field. A mined log always carries all
+    /// three, and the L1 order every consumer depends on needs them.
     #[error(
-        "InputAdded log missing block_number (tx {transaction_hash:?}, log_index {log_index:?})"
+        "InputAdded log missing {field} (tx {transaction_hash:?}, block {block_number:?}, \
+         log_index {log_index:?})"
     )]
-    MissingBlockNumber {
+    MissingLogPosition {
+        field: &'static str,
         transaction_hash: Option<B256>,
+        block_number: Option<u64>,
         log_index: Option<u64>,
     },
+    /// A log the topic filter matched does not decode as `InputAdded`.
+    #[error(
+        "undecodable InputAdded log (tx {transaction_hash:?}, log_index {log_index:?}): {source}"
+    )]
+    Decode {
+        transaction_hash: Option<B256>,
+        log_index: Option<u64>,
+        #[source]
+        source: Box<alloy::sol_types::Error>,
+    },
 }
 
-/// Fetch every `InputAdded` log for `app_address_filter`, splitting the range
-/// on RPC long-range errors. The result is in **RPC-return order** — partition
-/// sub-ranges are concatenated and a single `eth_getLogs` may itself reorder —
-/// so consumers go through [`get_input_added_events_ordered`], which folds the
-/// L1-order sort in; this raw form is the partition primitive.
-///
-/// Depth-first, left-first worklist (push right, then push left): the query
-/// order and the concatenation order match the watchdog's recursive `go` and
-/// [`simulate_partitioned_get_logs`] exactly. A terminal error short-circuits
-/// — once one sub-range fails for good, the ranges after it are not queried.
-async fn get_input_added_events(
+/// Every `InputAdded` log for `app_address` in `[start_block, end_block]`,
+/// sorted into L1 order `(block, tx index, log index)` and decoded. The
+/// reader's dense-index contiguity witness and the poster's batch-nonce fold
+/// both need that order, and a single `eth_getLogs` response does not
+/// guarantee it. Decoding follows the sort, so an undecodable log is reported
+/// as such rather than split like a range failure.
+pub(crate) async fn get_input_added_events_ordered(
     provider: &impl Provider,
-    app_address_filter: Address,
+    app_address: Address,
     input_box_address: &Address,
     start_block: u64,
     end_block: u64,
-    long_block_range_error_codes: &[String],
-) -> Result<Vec<(InputAdded, alloy::rpc::types::Log)>, ContractError> {
-    let mut logs = Vec::new();
-    let mut ranges = vec![(start_block, end_block)];
-    while let Some((from, to)) = ranges.pop() {
-        let event = Event::new_sol(provider, input_box_address)
-            .from_block(from)
-            .to_block(to)
-            .event(InputAdded::SIGNATURE)
-            .topic1(app_address_filter.into_word());
-
-        match event.query().await {
-            Ok(chunk) => logs.extend(chunk),
-            Err(e)
-                if from < to && should_retry_with_partition(&e, long_block_range_error_codes) =>
-            {
-                let middle = from + (to - from) / 2;
-                ranges.push((middle + 1, to));
-                ranges.push((from, middle));
-            }
-            Err(e) => return Err(e),
-        }
-    }
-    Ok(logs)
-}
-
-fn should_retry_with_partition(err: &ContractError, codes: &[String]) -> bool {
-    error_message_matches_retry_codes(&format!("{err:?}"), codes)
-}
-
-fn error_message_matches_retry_codes(error_message: &str, codes: &[String]) -> bool {
-    codes.iter().any(|c| error_message.contains(c))
+) -> Result<Vec<(InputAdded, Log)>, GetLogsError> {
+    let filter = Filter::new()
+        .address(*input_box_address)
+        .event_signature(InputAdded::SIGNATURE_HASH)
+        .topic1(app_address.into_word());
+    let logs = bisect(start_block, end_block, |from, to| {
+        let ranged = filter.clone().from_block(from).to_block(to);
+        async move { provider.get_logs(&ranged).await }
+    })
+    .await
+    .map_err(|(block, source)| GetLogsError::Rpc { block, source })?;
+
+    into_l1_order(logs)?
+        .into_iter()
+        .map(|log| {
+            let event = InputAdded::decode_log_data(&log.inner.data).map_err(|source| {
+                GetLogsError::Decode {
+                    transaction_hash: log.transaction_hash,
+                    log_index: log.log_index,
+                    source: Box::new(source),
+                }
+            })?;
+            Ok((event, log))
+        })
+        .collect()
 }
 
-/// Simulates partitioned `eth_getLogs` bisect (same rules as `watchdog/l1_reader.lua`).
-/// `get_logs` returns `Ok` for a successful leaf query or `Err(message)` on RPC failure.
-/// Records every attempted `(from_block, to_block)` in call order.
+/// Fetches `[start, end]`, splitting a range wider than one block in half on
+/// any failure and retrying, left half first, so results concatenate in block
+/// order. A single block's failure fails the whole call: callers never see a
+/// prefix. Depth-first, left-first worklist: a failure that cannot split
+/// short-circuits, so ranges after it are never queried, matching `scan` in
+/// `watchdog/l1.lua`.
 ///
-/// Test-only parity model of [`get_input_added_events`]: the fixture
-/// (`tests/fixtures/l1_partition_vector.json`) drives this model on the Rust
-/// side and the *production* `for_each_log_chunk_partitioned` on the Lua side.
-#[cfg(test)]
-fn simulate_partitioned_get_logs<F>(
-    start_block: u64,
-    end_block: u64,
-    long_block_range_error_codes: &[String],
-    mut get_logs: F,
-) -> (Vec<(u64, u64)>, Result<(), String>)
+/// Providers cap ranges, result counts and response sizes under error codes
+/// that vary and overlap with rate limits, and a timeout carries no code, so
+/// every failure narrows. This protects liveness only: completeness is the
+/// reader's index-contiguity and count witnesses, whatever ranges were asked.
+/// Assumes one block's logs fit one response; revisit if a single-block query
+/// fails persistently on a healthy provider. A persistent failure costs one
+/// left spine, `ceil(log2 width) + 1` sequential queries, each sent up to three
+/// times when the client resends a rate limit (`l1/provider.rs`). The watchdog's
+/// `reader:inputs` (`watchdog/l1.lua`) applies the same rule, and
+/// `tests/fixtures/l1_partition_vector.json` pins both.
+async fn bisect<T, E, F, Fut>(start: u64, end: u64, mut fetch: F) -> Result<Vec<T>, (u64, E)>
 where
-    F: FnMut(u64, u64) -> Result<(), String>,
+    E: std::error::Error + 'static,
+    F: FnMut(u64, u64) -> Fut,
+    Fut: Future<Output = Result<Vec<T>, E>>,
 {
-    if end_block < start_block {
-        return (Vec::new(), Ok(()));
+    let mut out = Vec::new();
+    if start > end {
+        return Ok(out);
     }
-
-    fn go<F>(
-        start_block: u64,
-        end_block: u64,
-        long_block_range_error_codes: &[String],
-        get_logs: &mut F,
-        calls: &mut Vec<(u64, u64)>,
-    ) -> Result<(), String>
-    where
-        F: FnMut(u64, u64) -> Result<(), String>,
-    {
-        calls.push((start_block, end_block));
-        match get_logs(start_block, end_block) {
-            Ok(()) => Ok(()),
-            Err(err) => {
-                if start_block < end_block
-                    && error_message_matches_retry_codes(&err, long_block_range_error_codes)
-                {
-                    let middle = start_block + (end_block - start_block) / 2;
-                    go(
-                        start_block,
-                        middle,
-                        long_block_range_error_codes,
-                        get_logs,
-                        calls,
-                    )?;
-                    go(
-                        middle + 1,
-                        end_block,
-                        long_block_range_error_codes,
-                        get_logs,
-                        calls,
-                    )?;
-                    Ok(())
-                } else {
-                    Err(err)
-                }
+    let mut ranges = vec![(start, end)];
+    while let Some((from, to)) = ranges.pop() {
+        match fetch(from, to).await {
+            Ok(chunk) => out.extend(chunk),
+            Err(error) if from < to => {
+                tracing::debug!(
+                    from,
+                    to,
+                    error = %crate::l1::provider::error_chain(&error),
+                    "eth_getLogs failed; splitting the range"
+                );
+                let middle = from + (to - from) / 2;
+                ranges.push((middle + 1, to));
+                ranges.push((from, middle));
             }
+            Err(error) => return Err((from, error)),
         }
     }
-
-    let mut calls = Vec::new();
-    let result = go(
-        start_block,
-        end_block,
-        long_block_range_error_codes,
-        &mut get_logs,
-        &mut calls,
-    );
-    (calls, result)
+    Ok(out)
 }
 
-/// Total order for merged logs `(block, tx index, log index)` — matches Lua
-/// `sort_logs`.
-fn sort_logs_by_l1_order<T>(logs: &mut [T], key: impl FnMut(&T) -> (u64, u64, u64)) {
-    logs.sort_by_key(key);
+/// Sorts logs into L1 order `(block, tx index, log index)`, refusing a log whose
+/// block, tx index or log index is absent or null. `sort_logs` in
+/// `watchdog/l1.lua` applies the same rule, and the log-sort vector in
+/// `tests/fixtures/l1_partition_vector.json` pins both. A present but malformed
+/// value never reaches here: it fails `Log` deserialization and is split like a
+/// transport failure.
+fn into_l1_order(logs: Vec<Log>) -> Result<Vec<Log>, GetLogsError> {
+    let mut positioned = logs
+        .into_iter()
+        .map(|log| Ok((l1_position(&log)?, log)))
+        .collect::<Result<Vec<_>, GetLogsError>>()?;
+    positioned.sort_by_key(|(position, _)| *position);
+    Ok(positioned.into_iter().map(|(_, log)| log).collect())
 }
 
-/// [`get_input_added_events`] with the logs returned in canonical L1 order
-/// `(block, tx_index, log_index)`. The single fetch path for every consumer that
-/// depends on L1 ordering — the reader's dense-index contiguity witness and the
-/// submitter's batch-nonce fold both require it — so the sort lives here once
-/// instead of being duplicated (and forgettable) at each call site. Matches the
-/// order the watchdog applies on its side.
-pub(crate) async fn get_input_added_events_ordered(
-    provider: &impl Provider,
-    app_address_filter: Address,
-    input_box_address: &Address,
-    start_block: u64,
-    end_block: u64,
-    long_block_range_error_codes: &[String],
-) -> Result<Vec<(InputAdded, alloy::rpc::types::Log)>, GetLogsError> {
-    let mut events = get_input_added_events(
-        provider,
-        app_address_filter,
-        input_box_address,
-        start_block,
-        end_block,
-        long_block_range_error_codes,
-    )
-    .await?;
-    // L1 order needs provenance: a mined log always carries its block number,
-    // so refuse to sort (and mis-place) one that lacks it. The tx/log indices
-    // may default to 0 — watchdog parity (Lua: `transactionIndex or "0x0"`,
-    // but a missing `blockNumber` hard-errors there too).
-    if let Some((_, log)) = events.iter().find(|(_, log)| log.block_number.is_none()) {
-        return Err(GetLogsError::MissingBlockNumber {
-            transaction_hash: log.transaction_hash,
-            log_index: log.log_index,
-        });
-    }
-    sort_logs_by_l1_order(&mut events, |(_, log)| {
-        (
-            log.block_number
-                .expect("guarded above: every log has a block number"),
-            log.transaction_index.unwrap_or(0),
-            log.log_index.unwrap_or(0),
-        )
-    });
-    Ok(events)
+fn l1_position(log: &Log) -> Result<(u64, u64, u64), GetLogsError> {
+    let missing = |field| GetLogsError::MissingLogPosition {
+        field,
+        transaction_hash: log.transaction_hash,
+        block_number: log.block_number,
+        log_index: log.log_index,
+    };
+    Ok((
+        log.block_number.ok_or_else(|| missing("block_number"))?,
+        log.transaction_index
+            .ok_or_else(|| missing("transaction_index"))?,
+        log.log_index.ok_or_else(|| missing("log_index"))?,
+    ))
 }
 
 /// Decode the `EvmAdvance` calldata carried in `InputAdded.input` — the shared
 /// decode entry point (parity counterpart of the watchdog's
-/// `abi.decode_evm_advance_call`). Returns the typed decode error; callers
+/// `abi.decode_evm_advance`). Returns the typed decode error; callers
 /// attach the log context (tx hash, index) only they have.
 pub(crate) fn decode_evm_advance_input(
     input: &[u8],
@@ -239,17 +178,14 @@ pub(crate) fn decode_evm_advance_input(
 
 #[cfg(test)]
 mod tests {
-    use std::collections::HashMap;
+    use std::collections::HashSet;
 
-    use alloy_primitives::{U256, address};
-    use alloy_sol_types::SolCall;
-    use cartesi_rollups_contracts::inputs::Inputs::EvmAdvanceCall;
+    use alloy::providers::ProviderBuilder;
+    use alloy::transports::mock::Asserter;
+    use alloy_primitives::{Bytes, U256, address};
     use serde::Deserialize;
 
-    use super::{
-        DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES, decode_evm_advance_input,
-        error_message_matches_retry_codes, simulate_partitioned_get_logs, sort_logs_by_l1_order,
-    };
+    use super::*;
 
     const PARTITION_VECTOR: &str = include_str!(concat!(
         env!("CARGO_MANIFEST_DIR"),
@@ -260,7 +196,6 @@ mod tests {
     struct FailRange {
         from: u64,
         to: u64,
-        message: String,
     }
 
     #[derive(Debug, Deserialize)]
@@ -274,75 +209,117 @@ mod tests {
     }
 
     #[derive(Debug, Deserialize)]
-    struct LogSortFixture {
-        unsorted: Vec<LogSortEntry>,
-        expect_block_order: Vec<String>,
-        expect_log_index_order: Vec<String>,
+    #[serde(rename_all = "camelCase")]
+    struct LogPosition {
+        block_number: Option<String>,
+        transaction_index: Option<String>,
+        log_index: Option<String>,
+    }
+
+    #[derive(Debug, Deserialize)]
+    struct RefuseCase {
+        missing: String,
+        log: LogPosition,
     }
 
     #[derive(Debug, Deserialize)]
-    struct LogSortEntry {
-        #[serde(rename = "blockNumber")]
-        block_number: String,
-        #[serde(rename = "transactionIndex", default)]
-        transaction_index: String,
-        #[serde(rename = "logIndex", default)]
-        log_index: String,
+    struct LogSortVector {
+        unsorted: Vec<LogPosition>,
+        expect_sorted: Vec<LogPosition>,
+        refuse: Vec<RefuseCase>,
     }
 
     #[derive(Debug, Deserialize)]
     struct PartitionVector {
-        long_block_range_error_codes: Vec<String>,
         scenarios: Vec<PartitionScenario>,
-        log_sort: LogSortFixture,
+        log_sort: LogSortVector,
     }
 
-    fn load_partition_vector() -> PartitionVector {
-        serde_json::from_str(PARTITION_VECTOR).expect("parse l1_partition_vector.json")
+    fn parse_hex_quantity(value: &Option<String>) -> Option<u64> {
+        value
+            .as_deref()
+            .map(|hex| u64::from_str_radix(hex.trim_start_matches("0x"), 16).expect("hex quantity"))
     }
 
-    fn fail_map(fail_ranges: &[FailRange]) -> HashMap<(u64, u64), String> {
-        fail_ranges
-            .iter()
-            .map(|r| ((r.from, r.to), r.message.clone()))
-            .collect()
+    fn positioned_log(position: &LogPosition) -> Log {
+        Log {
+            block_number: parse_hex_quantity(&position.block_number),
+            transaction_index: parse_hex_quantity(&position.transaction_index),
+            log_index: parse_hex_quantity(&position.log_index),
+            ..Default::default()
+        }
+    }
+
+    fn position_of(log: &Log) -> (Option<u64>, Option<u64>, Option<u64>) {
+        (log.block_number, log.transaction_index, log.log_index)
     }
 
+    /// The vector's log-sort section, which the watchdog's `tests/run.lua`
+    /// replays against its `sort_logs`. Its entries are distinct triples, because
+    /// Lua's `table.sort` is not stable.
     #[test]
-    fn fixture_default_codes_match_rust_defaults() {
-        let vector = load_partition_vector();
-        let expected: Vec<String> = DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES
+    fn log_sort_vector_matches_watchdog() {
+        let vector: PartitionVector =
+            serde_json::from_str(PARTITION_VECTOR).expect("parse l1_partition_vector.json");
+        let log_sort = vector.log_sort;
+
+        let sorted = into_l1_order(log_sort.unsorted.iter().map(positioned_log).collect())
+            .expect("every unsorted log is fully positioned");
+        let expected: Vec<_> = log_sort
+            .expect_sorted
             .iter()
-            .map(|c| (*c).to_string())
+            .map(|position| position_of(&positioned_log(position)))
             .collect();
-        assert_eq!(vector.long_block_range_error_codes, expected);
+        assert_eq!(sorted.iter().map(position_of).collect::<Vec<_>>(), expected);
+
+        for case in log_sort.refuse {
+            let field = match case.missing.as_str() {
+                "blockNumber" => "block_number",
+                "transactionIndex" => "transaction_index",
+                "logIndex" => "log_index",
+                other => panic!("unknown refuse field {other}"),
+            };
+            let error = into_l1_order(vec![positioned_log(&case.log)])
+                .expect_err("a log missing a position field is refused");
+            assert!(
+                matches!(error, GetLogsError::MissingLogPosition { field: f, .. } if f == field),
+                "{field}: got {error:?}"
+            );
+        }
     }
 
-    #[test]
-    fn partition_vector_simulation_matches_watchdog() {
-        let vector = load_partition_vector();
+    /// The vector the watchdog's `tests/run.lua` replays against its own
+    /// `reader:inputs`; here it drives the production worklist.
+    #[tokio::test]
+    async fn partition_vector_matches_watchdog() {
+        let vector: PartitionVector =
+            serde_json::from_str(PARTITION_VECTOR).expect("parse l1_partition_vector.json");
         for scenario in vector.scenarios {
-            let fails = fail_map(&scenario.fail_ranges);
-            let codes = vector.long_block_range_error_codes.clone();
-            let (calls, result) = simulate_partitioned_get_logs(
-                scenario.start_block,
-                scenario.end_block,
-                &codes,
-                |from, to| {
-                    if let Some(message) = fails.get(&(from, to)) {
-                        Err(message.clone())
+            let fails: HashSet<(u64, u64)> = scenario
+                .fail_ranges
+                .iter()
+                .map(|range| (range.from, range.to))
+                .collect();
+            let mut calls = Vec::new();
+            let result = bisect(scenario.start_block, scenario.end_block, |from, to| {
+                calls.push((from, to));
+                let failed = fails.contains(&(from, to));
+                async move {
+                    if failed {
+                        Err(std::io::Error::other("injected failure"))
                     } else {
-                        Ok(())
+                        Ok(Vec::<()>::new())
                     }
-                },
-            );
+                }
+            })
+            .await;
 
-            let expected_calls: Vec<(u64, u64)> = scenario
+            let expected: Vec<(u64, u64)> = scenario
                 .expect_calls
                 .iter()
                 .map(|pair| (pair[0], pair[1]))
                 .collect();
-            assert_eq!(calls, expected_calls, "scenario {}", scenario.name);
+            assert_eq!(calls, expected, "scenario {}", scenario.name);
             assert_eq!(
                 result.is_ok(),
                 scenario.expect_ok,
@@ -352,89 +329,86 @@ mod tests {
         }
     }
 
-    #[test]
-    fn log_sort_vector_matches_watchdog_order() {
-        let vector = load_partition_vector();
-        let mut logs = vector.log_sort.unsorted;
-        sort_logs_by_l1_order(&mut logs, |e| {
-            (
-                parse_hex_quantity(&e.block_number),
-                parse_hex_quantity(&e.transaction_index),
-                parse_hex_quantity(&e.log_index),
-            )
-        });
-        let blocks: Vec<String> = logs.iter().map(|e| e.block_number.clone()).collect();
-        let indices: Vec<String> = logs.iter().map(|e| e.log_index.clone()).collect();
-        assert_eq!(blocks, vector.log_sort.expect_block_order);
-        assert_eq!(indices, vector.log_sort.expect_log_index_order);
-    }
-
-    fn parse_hex_quantity(value: &str) -> u64 {
-        u64::from_str_radix(value.strip_prefix("0x").unwrap_or(value), 16).expect("hex quantity")
-    }
-
-    #[test]
-    fn error_message_matches_retry_codes_returns_true_when_message_contains_code() {
-        assert!(error_message_matches_retry_codes(
-            "RPC error: block range too large",
-            &["block range".to_string(), "timeout".to_string()]
-        ));
-        assert!(error_message_matches_retry_codes(
-            "timeout after 30s",
-            &["timeout".to_string()]
-        ));
+    fn input_added_log(
+        index: u64,
+        data: Option<Bytes>,
+        position: (Option<u64>, Option<u64>, Option<u64>),
+    ) -> Log {
+        let event = InputAdded {
+            appContract: Address::ZERO,
+            index: U256::from(index),
+            input: Bytes::new(),
+        };
+        let mut log_data = event.encode_log_data();
+        if let Some(data) = data {
+            log_data = alloy_primitives::LogData::new_unchecked(log_data.topics().to_vec(), data);
+        }
+        Log {
+            inner: alloy_primitives::Log {
+                address: Address::ZERO,
+                data: log_data,
+            },
+            block_number: position.0,
+            transaction_index: position.1,
+            log_index: position.2,
+            transaction_hash: Some(B256::repeat_byte(0xcc)),
+            ..Default::default()
+        }
     }
 
-    #[test]
-    fn error_message_matches_retry_codes_returns_false_when_no_match() {
-        assert!(!error_message_matches_retry_codes(
-            "connection refused",
-            &["block range".to_string(), "timeout".to_string()]
-        ));
-        assert!(!error_message_matches_retry_codes("ok", &[]));
+    async fn fetch_one_response(logs: Vec<Log>) -> Result<Vec<(InputAdded, Log)>, GetLogsError> {
+        let asserter = Asserter::new();
+        asserter.push_success(&logs);
+        let provider = ProviderBuilder::new().connect_mocked_client(asserter.clone());
+        let result =
+            get_input_added_events_ordered(&provider, Address::ZERO, &Address::ZERO, 1, 4).await;
+        assert!(asserter.read_q().is_empty(), "one eth_getLogs, no split");
+        result
     }
 
-    #[test]
-    fn default_codes_include_proxy_range_exceeded() {
-        assert!(
-            DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES.contains(&"-32012"),
-            "default codes must include -32012 (JSON-RPC proxy range limit)"
-        );
+    #[tokio::test]
+    async fn a_reordered_response_comes_back_in_l1_order() {
+        let events = fetch_one_response(vec![
+            input_added_log(3, None, (Some(4), Some(0), Some(0))),
+            input_added_log(1, None, (Some(2), Some(1), Some(4))),
+            input_added_log(2, None, (Some(2), Some(1), Some(5))),
+            input_added_log(0, None, (Some(2), Some(0), Some(9))),
+        ])
+        .await
+        .expect("a consistent response");
+        let indices: Vec<u64> = events.iter().map(|(event, _)| event.index.to()).collect();
+        assert_eq!(indices, [0, 1, 2, 3]);
     }
 
-    #[test]
-    fn proxy_range_exceeded_error_triggers_retry() {
-        let msg = r#"-32012: getLogs request exceeded max allowed range, data: {"code":"ErrGetLogsExceededMaxAllowedRange"}"#;
-        let codes: Vec<String> = DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES
-            .iter()
-            .map(|c| (*c).to_string())
-            .collect();
-        assert!(
-            error_message_matches_retry_codes(msg, &codes),
-            "proxy -32012 error must match retry codes"
-        );
+    #[tokio::test]
+    async fn a_log_without_a_position_fails_loud() {
+        for (field, position) in [
+            ("block_number", (None, Some(0), Some(0))),
+            ("transaction_index", (Some(2), None, Some(0))),
+            ("log_index", (Some(2), Some(0), None)),
+        ] {
+            let error = fetch_one_response(vec![input_added_log(0, None, position)])
+                .await
+                .expect_err("a mined log carries its full position");
+            assert!(
+                matches!(error, GetLogsError::MissingLogPosition { field: f, .. } if f == field),
+                "{field}: got {error:?}"
+            );
+        }
     }
 
-    #[test]
-    fn real_alloy_range_error_matches_retry_codes() {
-        // The bisect classifier reads the JSON-RPC code out of ContractError's
-        // *Debug* output — an unstable cross-crate coupling. This pins it
-        // against a real alloy error so an alloy Debug-format change fails
-        // here at upgrade time instead of silently disabling partition retry.
-        let payload = alloy::rpc::json_rpc::ErrorPayload {
-            code: -32005,
-            message: "query returned more than 10000 results".into(),
-            data: None,
-        };
-        let err =
-            super::ContractError::TransportError(alloy::transports::RpcError::ErrorResp(payload));
-        let codes: Vec<String> = DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES
-            .iter()
-            .map(|c| (*c).to_string())
-            .collect();
+    #[tokio::test]
+    async fn an_undecodable_log_is_reported_not_split() {
+        let error = fetch_one_response(vec![input_added_log(
+            0,
+            Some(Bytes::from_static(&[0x01])),
+            (Some(2), Some(0), Some(0)),
+        )])
+        .await
+        .expect_err("garbage data must not decode");
         assert!(
-            super::should_retry_with_partition(&err, &codes),
-            "a real -32005 ErrorResp must classify as partition-retryable"
+            matches!(error, GetLogsError::Decode { .. }),
+            "got {error:?}"
         );
     }
 
@@ -460,4 +434,73 @@ mod tests {
         assert_eq!(decoded.blockNumber, U256::from(99_u64));
         assert_eq!(decoded.payload.as_ref(), &[0xaa, 0xbb]);
     }
+
+    const CONSENSUS_VECTORS: &str = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../tests/fixtures/consensus_vectors_v1.json"
+    ));
+
+    #[derive(Debug, Deserialize)]
+    struct EvmAdvanceFields {
+        chain_id: U256,
+        app_contract: Address,
+        msg_sender: Address,
+        block_number: U256,
+        block_timestamp: U256,
+        prev_randao: U256,
+        index: U256,
+        payload: Bytes,
+    }
+
+    #[derive(Debug, Deserialize)]
+    struct EvmAdvanceVariant {
+        name: String,
+        calldata: Bytes,
+        accepted: bool,
+    }
+
+    #[derive(Debug, Deserialize)]
+    struct EvmAdvanceVector {
+        calldata: Bytes,
+        fields: EvmAdvanceFields,
+        variants: Vec<EvmAdvanceVariant>,
+    }
+
+    #[derive(Debug, Deserialize)]
+    struct ConsensusVectors {
+        evm_advance: EvmAdvanceVector,
+    }
+
+    fn assert_fields(decoded: &EvmAdvanceCall, fields: &EvmAdvanceFields, case: &str) {
+        assert_eq!(decoded.chainId, fields.chain_id, "{case}");
+        assert_eq!(decoded.appContract, fields.app_contract, "{case}");
+        assert_eq!(decoded.msgSender, fields.msg_sender, "{case}");
+        assert_eq!(decoded.blockNumber, fields.block_number, "{case}");
+        assert_eq!(decoded.blockTimestamp, fields.block_timestamp, "{case}");
+        assert_eq!(decoded.prevRandao, fields.prev_randao, "{case}");
+        assert_eq!(decoded.index, fields.index, "{case}");
+        assert_eq!(decoded.payload, fields.payload, "{case}");
+    }
+
+    /// Pinned in `consensus_vectors_v1.json`, never regenerated. The variants
+    /// pin today's lenient decode: trailing bytes and dirty padding decode to
+    /// the canonical fields. A flip to strict decoding changes `accepted`,
+    /// which is a finding, not a fixture update.
+    #[test]
+    fn evm_advance_decode_matches_the_pinned_vector() {
+        let vector = serde_json::from_str::<ConsensusVectors>(CONSENSUS_VECTORS)
+            .expect("parse consensus_vectors_v1.json")
+            .evm_advance;
+        let decoded = decode_evm_advance_input(&vector.calldata).expect("decode pinned calldata");
+        assert_fields(&decoded, &vector.fields, "canonical");
+        assert_eq!(decoded.abi_encode(), vector.calldata.as_ref());
+
+        for variant in &vector.variants {
+            let decoded = decode_evm_advance_input(&variant.calldata);
+            assert_eq!(decoded.is_ok(), variant.accepted, "{}", variant.name);
+            if let Ok(decoded) = decoded {
+                assert_fields(&decoded, &vector.fields, &variant.name);
+            }
+        }
+    }
 }
diff --git a/sequencer/src/l1/provider.rs b/sequencer/src/l1/provider.rs
index 702f2458..76082133 100644
--- a/sequencer/src/l1/provider.rs
+++ b/sequencer/src/l1/provider.rs
@@ -1,28 +1,59 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
+//! RPC clients for the one configured L1 endpoint: read providers for every
+//! query, and keyed writers that also hold a submit provider for signed sends.
+//! Every client shares the https rule, URL redaction and the rate-limit-only
+//! retry.
+
 use std::str::FromStr;
+use std::sync::Arc;
+use std::task::{Context, Poll};
 use std::time::Duration;
 
 use alloy::{
+    primitives::TxHash,
     providers::{DynProvider, Provider, ProviderBuilder},
-    rpc::client::RpcClient,
+    rpc::types::TransactionRequest,
+    rpc::{
+        client::RpcClient,
+        json_rpc::{RequestPacket, ResponsePacket},
+    },
     signers::local::PrivateKeySigner,
     transports::http::{Http, reqwest, reqwest::Url},
 };
-use alloy_transport::layers::RetryBackoffLayer;
-use url::Host;
-
-// Public Ethereum providers (Infura, Alchemy) commonly take 30–60s on heavy
-// `eth_getLogs` queries under load. The partition-retry helper in
-// `l1/partition.rs` only kicks on RPC error codes (e.g. -32005), not on
-// transport timeouts — a request that silently chews past the timeout slips
-// past partitioning. 60s is long enough that hitting it signals a genuine
-// problem rather than a slow query.
-const REQUEST_TIMEOUT: Duration = Duration::from_secs(60);
-const MAX_RATE_LIMIT_RETRIES: u32 = 5;
-const INITIAL_BACKOFF_MS: u64 = 200;
-const COMPUTE_UNITS_PER_SEC: u64 = 500;
+use alloy_transport::layers::{RateLimitRetryPolicy, RetryBackoffLayer, RetryPolicy};
+use alloy_transport::{
+    HttpError, IntoBoxTransport, RpcError, TransportError, TransportErrorKind, TransportFut,
+};
+use url::{Host, Position};
+
+/// Per-attempt HTTP deadline, connect through body, shared by every L1 client.
+/// alloy never resends a timeout, and the `eth_getLogs` partition
+/// (`l1/partition.rs`) splits on it like on any failure, so a query too heavy
+/// to answer in time narrows until it fits. 35 s is geth's default server cap
+/// (a 30 s write timeout, answered with `-32002` at 29.9 s) plus room for
+/// connect, TLS and transfer: every answer a default geth gives arrives, and a
+/// hung request costs at most this. An anchor, not a measurement: on a server
+/// with a longer cap (Erigon's is 30 min), a filtered `eth_getLogs` slower
+/// than 35 s is split instead of awaited. Revisit with measured latencies of
+/// our filtered query on hosted providers, or on seeing healthy queries split.
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(35);
+/// Resends of one request that [`RateLimitOnly`] lets through, a second apart
+/// (alloy's backoff is not exponential) unless the server asks for a wait of up
+/// to [`MAX_RETRY_WAIT`], so a resend lands in a fresh window of a per-second
+/// cap.
+const MAX_RESENDS: u32 = 2;
+const RESEND_BACKOFF_MS: u64 = 1_000;
+/// The longest server-requested wait a resend honors.
+const MAX_RETRY_WAIT: Duration = Duration::from_secs(5);
+/// `-32005` ("limit exceeded") rejections that only a narrower `eth_getLogs`
+/// range clears; alloy resends every `-32005` as an Infura rate limit.
+const NARROWING_ONLY_REJECTIONS: &[&str] = &[
+    "query returned more than",        // Infura result-count cap
+    "Too many logs requested",         // Nethermind JsonRpc.MaxLogsPerResponse
+    "exceeds maximum RPC range limit", // Besu --rpc-max-logs-range
+];
 
 fn create_client(url: &str, allow_insecure: bool) -> Result<RpcClient, String> {
     let url = Url::parse(url).map_err(|e| format!("invalid RPC URL: {e}"))?;
@@ -44,28 +75,97 @@ fn create_client(url: &str, allow_insecure: bool) -> Result<RpcClient, String> {
     }
     if remote_plaintext {
         tracing::warn!(
-            url = %url,
+            eth_rpc_origin = %url.origin().ascii_serialization(),
             "insecure plaintext RPC to a non-loopback host — explicitly allowed via allow-insecure-rpc"
         );
     }
 
+    // Otherwise reqwest's defaults: a 90 s idle pool and TCP keepalive (each
+    // worker reuses its connection within seconds, and hyper drops one the
+    // server closed while idle), and no connect or read timeout (the attempt
+    // deadline bounds both). HTTP/1.1 because every worker keeps one request in
+    // flight, and a timed-out HTTP/1.1 request closes its own connection; over
+    // HTTP/2 a dead shared connection would need keep-alive PINGs to be
+    // evicted. Pinned here, since any crate enabling reqwest's `http2` feature
+    // would otherwise turn it on for this client too. No redirects: a JSON-RPC
+    // endpoint has no reason to send one, and following it could downgrade an
+    // https endpoint to plaintext past the rule above.
     let http_client = reqwest::Client::builder()
         .timeout(REQUEST_TIMEOUT)
+        .http1_only()
+        .redirect(reqwest::redirect::Policy::none())
         .build()
-        .map_err(|e| format!("failed to build HTTP client: {e}"))?;
+        .map_err(|e| {
+            format!(
+                "failed to build the HTTP client (on Linux it needs the system's CA \
+                 certificates): {}",
+                error_chain(&e)
+            )
+        })?;
 
-    let transport = Http::with_client(http_client, url);
+    let transport = Http::with_client(http_client, url.clone());
     let is_local = transport.guess_local();
+    Ok(layered_client(transport, &url, is_local))
+}
 
-    let retry = RetryBackoffLayer::new(
-        MAX_RATE_LIMIT_RETRIES,
-        INITIAL_BACKOFF_MS,
-        COMPUTE_UNITS_PER_SEC,
-    );
+/// The layers every L1 client stacks over its transport. The first layer added
+/// is outermost: retry sees only redacted errors, including in the "Max
+/// retries exceeded {err}" text it builds from them.
+fn layered_client<T: IntoBoxTransport>(transport: T, url: &Url, is_local: bool) -> RpcClient {
+    RpcClient::builder()
+        .layer(retry_layer())
+        .layer(RedactUrlLayer::new(url))
+        .transport(transport, is_local)
+}
 
-    Ok(RpcClient::builder()
-        .layer(retry)
-        .transport(transport, is_local))
+/// The retry layer every L1 client shares. `u64::MAX` compute units per second
+/// turns off alloy's compute-unit queueing, which models a provider plan we do
+/// not know: each worker builds its own client and keeps about one request in
+/// flight.
+fn retry_layer() -> RetryBackoffLayer<RateLimitOnly> {
+    RetryBackoffLayer::new_with_policy(
+        MAX_RESENDS,
+        RESEND_BACKOFF_MS,
+        u64::MAX,
+        RateLimitOnly::default(),
+    )
+}
+
+/// alloy's rate-limit policy minus the resends that cannot help: a
+/// server-requested wait over [`MAX_RETRY_WAIT`] (alloy honors up to 300 s per
+/// resend and logs it only at TRACE), and a [`NARROWING_ONLY_REJECTIONS`]
+/// `-32005`, which would cost each failing `eth_getLogs` split two more full
+/// queries. A refused error reaches the caller at once instead of sleeping:
+/// worker loops retry on their next tick, the `eth_getLogs` partition narrows
+/// the range at once (`l1/partition.rs`), and a one-shot command fails.
+///
+/// Liveness and visibility only: which inputs are accepted is decided by the
+/// reader's witnesses, whatever was resent. Assumes the listed wordings; a
+/// reworded rejection is resent like any other `-32005`, wasteful but never
+/// stuck. Revisit
+/// when a crawl is seen failing on refused waits, or when alloy changes its
+/// `-32005` rule or its hint clamp.
+#[derive(Clone, Copy, Debug, Default)]
+struct RateLimitOnly(RateLimitRetryPolicy);
+
+impl RetryPolicy for RateLimitOnly {
+    fn should_retry(&self, error: &TransportError) -> bool {
+        let narrowing_only = error.as_error_resp().is_some_and(|payload| {
+            payload.code == -32005
+                && NARROWING_ONLY_REJECTIONS
+                    .iter()
+                    .any(|wording| payload.message.contains(wording))
+        });
+        let long_wait = self
+            .0
+            .backoff_hint(error)
+            .is_some_and(|wait| wait > MAX_RETRY_WAIT);
+        !narrowing_only && !long_wait && self.0.should_retry(error)
+    }
+
+    fn backoff_hint(&self, error: &TransportError) -> Option<Duration> {
+        self.0.backoff_hint(error)
+    }
 }
 
 /// Whether a parsed URL host refers to a loopback address.
@@ -85,35 +185,296 @@ fn is_loopback_host(host: Option<Host<&str>>) -> bool {
     }
 }
 
-/// Create a read-only provider with retry and timeout. `allow_insecure` opts
-/// into plaintext RPC against a non-loopback host — see [`create_client`].
-pub fn create_provider(url: &str, allow_insecure: bool) -> Result<DynProvider, String> {
-    let client = create_client(url, allow_insecure)?;
-    let provider = ProviderBuilder::new().connect_client(client);
-    Ok(provider.erased())
+/// What logs may show of an RPC endpoint: its scheme, host and port. Its path,
+/// query and userinfo can carry an API key or a password. Assumes the host is
+/// not itself the credential.
+pub(crate) fn rpc_endpoint_origin(url: &str) -> String {
+    Url::parse(url).map_or_else(
+        |_| "<invalid url>".to_owned(),
+        |url| url.origin().ascii_serialization(),
+    )
+}
+
+/// Longest rendering of one cause in [`error_chain`], before its cut marker.
+/// Per cause, not per line, so a long body never cuts off the root cause at
+/// the end of the chain.
+const ERROR_SEGMENT_MAX_BYTES: usize = 256;
+
+/// An error with its source chain, for logs and string-carrying error
+/// variants. reqwest's `Display` names only the request kind ("error sending
+/// request"); the cause (timeout, refused connection, DNS, TLS) lives in
+/// `source()`, under alloy wrappers that are transparent. A cause whose text
+/// the line already holds is skipped.
+///
+/// The result is one line: each cause has its control characters escaped, so
+/// a provider's text cannot split or forge log lines, and is cut at
+/// [`ERROR_SEGMENT_MAX_BYTES`], because a provider can put a whole HTML page
+/// or a multi-line result into an error. Every L1 error becomes text here.
+pub(crate) fn error_chain(error: &(dyn std::error::Error + 'static)) -> String {
+    let mut seen = error.to_string();
+    let mut line = one_line(&seen);
+    let mut cause = error.source();
+    while let Some(next) = cause {
+        let text = next.to_string();
+        if !seen.contains(&text) {
+            seen.push_str(": ");
+            seen.push_str(&text);
+            line.push_str(": ");
+            line.push_str(&one_line(&text));
+        }
+        cause = next.source();
+    }
+    line
+}
+
+/// `text` with control characters escaped (a newline becomes `\n`), cut once
+/// it reaches [`ERROR_SEGMENT_MAX_BYTES`].
+fn one_line(text: &str) -> String {
+    use std::fmt::Write as _;
+
+    let mut out = String::with_capacity(text.len().min(ERROR_SEGMENT_MAX_BYTES + 32));
+    for (at, c) in text.char_indices() {
+        if out.len() >= ERROR_SEGMENT_MAX_BYTES {
+            let _ = write!(out, "...[{} bytes cut]", text.len() - at);
+            break;
+        }
+        if c.is_control() {
+            out.extend(c.escape_default());
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
+
+/// Keeps the endpoint URL out of every transport error before any caller logs
+/// one: a hosted provider's URL carries its API key in the path or query.
+/// reqwest quotes the URL it sent (userinfo moved into an `Authorization`
+/// header) in its send, timeout and body errors; alloy wraps those as
+/// `Custom`, and on a non-2xx status copies a failed body read's text into an
+/// HTTP error. Transport-level bodies, an HTTP error's and a non-JSON 2xx
+/// answer's, are scrubbed of the URL, its request target and its query. The
+/// error kind is kept, so retry decisions and the callers' classification see
+/// the same error.
+///
+/// Not covered: a JSON-RPC error's message or data and a bad field in a valid
+/// JSON result, both built in alloy's call layer above this one; a body that
+/// quotes only part of the path or a different URL carrying the key, such as a
+/// redirect target on another path, since the scrub replaces exact strings;
+/// and alloy's DEBUG-level `alloy_transport_http` span, which records the full
+/// URL.
+/// [`error_chain`]'s cut bounds their size but does not redact them. Revisit
+/// when bumping alloy-transport-http, whose `reqwest_transport.rs` decides how
+/// reqwest errors and bodies are wrapped.
+#[derive(Clone, Debug)]
+struct RedactUrlLayer {
+    /// The URL as configured and, when it has userinfo, as reqwest quotes it;
+    /// then its request target, path and query. A string comes before its
+    /// parts, since the scrub replaces in order.
+    needles: Arc<[String]>,
+}
+
+impl RedactUrlLayer {
+    fn new(url: &Url) -> Self {
+        let mut needles = vec![url.to_string()];
+        let mut sent = url.clone();
+        if sent.set_username("").is_ok() && sent.set_password(None).is_ok() && sent != *url {
+            needles.push(sent.to_string());
+        }
+        // A server may echo only the request target, as an HTML 404 page does.
+        // A bare "/" is never a needle.
+        let target = &url[Position::BeforePath..Position::AfterQuery];
+        if target != "/" {
+            needles.push(target.to_owned());
+        }
+        if url.path() != "/" && url.query().is_some() {
+            needles.push(url.path().to_owned());
+        }
+        if let Some(query) = url.query().filter(|query| !query.is_empty()) {
+            needles.push(query.to_owned());
+        }
+        Self {
+            needles: needles.into(),
+        }
+    }
+}
+
+impl<S> tower::Layer<S> for RedactUrlLayer {
+    type Service = RedactUrl<S>;
+
+    fn layer(&self, inner: S) -> Self::Service {
+        RedactUrl {
+            inner,
+            needles: Arc::clone(&self.needles),
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+struct RedactUrl<S> {
+    inner: S,
+    needles: Arc<[String]>,
+}
+
+impl<S> tower::Service<RequestPacket> for RedactUrl<S>
+where
+    S: tower::Service<
+            RequestPacket,
+            Response = ResponsePacket,
+            Error = TransportError,
+            Future = TransportFut<'static>,
+        >,
+{
+    type Response = ResponsePacket;
+    type Error = TransportError;
+    type Future = TransportFut<'static>;
+
+    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), TransportError>> {
+        let needles = &self.needles;
+        self.inner
+            .poll_ready(cx)
+            .map_err(|error| redact_url(error, needles))
+    }
+
+    fn call(&mut self, request: RequestPacket) -> Self::Future {
+        let response = self.inner.call(request);
+        let needles = Arc::clone(&self.needles);
+        Box::pin(async move { response.await.map_err(|error| redact_url(error, &needles)) })
+    }
+}
+
+/// `reqwest` is alloy's re-export, the version the transport uses: a downcast
+/// to another version never matches.
+fn redact_url(error: TransportError, needles: &[String]) -> TransportError {
+    let scrub = |body: String| {
+        needles.iter().fold(body, |body, needle| {
+            body.replace(needle.as_str(), "<rpc url>")
+        })
+    };
+    match error {
+        RpcError::Transport(TransportErrorKind::Custom(inner)) => {
+            match inner.downcast::<reqwest::Error>() {
+                Ok(error) => TransportErrorKind::custom(error.without_url()),
+                Err(inner) => RpcError::Transport(TransportErrorKind::Custom(inner)),
+            }
+        }
+        RpcError::Transport(TransportErrorKind::NonRetryable(inner)) => {
+            match inner.downcast::<reqwest::Error>() {
+                Ok(error) => TransportErrorKind::non_retryable(error.without_url()),
+                Err(inner) => RpcError::Transport(TransportErrorKind::NonRetryable(inner)),
+            }
+        }
+        RpcError::Transport(TransportErrorKind::HttpError(HttpError { status, body })) => {
+            TransportErrorKind::http_error(status, scrub(body))
+        }
+        RpcError::Transport(TransportErrorKind::HttpErrorWithRetryAfter {
+            error: HttpError { status, body },
+            retry_after,
+        }) => {
+            TransportErrorKind::http_error_with_retry_after(status, scrub(body), Some(retry_after))
+        }
+        // A 2xx body that is not JSON, quoted whole in the error.
+        RpcError::DeserError { err, text } => RpcError::DeserError {
+            err,
+            text: scrub(text),
+        },
+        other => other,
+    }
+}
+
+/// A read provider: every L1 query, with no transaction fillers.
+/// `allow_insecure` opts into plaintext RPC against a non-loopback host — see
+/// [`create_client`].
+pub fn create_read_provider(url: &str, allow_insecure: bool) -> Result<DynProvider, String> {
+    Ok(read_provider(create_client(url, allow_insecure)?))
+}
+
+fn read_provider(client: RpcClient) -> DynProvider {
+    ProviderBuilder::new()
+        .disable_recommended_fillers()
+        .connect_client(client)
+        .erased()
+}
+
+/// The providers of a keyed L1 writer (the batch poster, the mempool flusher).
+/// `read` serves all of its queries: the chain-id gate, fees, wallet nonces,
+/// gas estimates and confirmation watches. `submit` only broadcasts transactions
+/// the writer fully specified, signed for the pinned chain. Both ride one
+/// client while the sequencer has one endpoint; a separate submit endpoint (a
+/// private relay) would change only [`create_keyed_providers`].
+#[derive(Clone, Debug)]
+pub struct KeyedProviders {
+    pub read: DynProvider,
+    pub submit: Submitter,
+}
+
+/// Signs and broadcasts transactions, and nothing else. Its provider fills only
+/// the pinned chain id and the signature, so the wallet nonce, gas and fees
+/// always come from the caller: nothing allocates a wallet nonce outside
+/// write-before-broadcast, and the endpoint's own chain id never reaches a
+/// signature.
+#[derive(Clone, Debug)]
+pub struct Submitter(DynProvider);
+
+/// Why [`Submitter::send`] failed.
+#[derive(Debug, thiserror::Error)]
+pub enum SendError {
+    /// The transaction could not be signed locally — a field the caller must
+    /// set is missing. A defect in the caller, never a transient condition.
+    #[error("transaction not signable: {0}")]
+    Unsignable(String),
+    /// The endpoint did not accept the broadcast.
+    #[error(transparent)]
+    Rpc(TransportError),
+}
+
+impl Submitter {
+    /// Sign `tx` and send it with `eth_sendRawTransaction`, returning its hash.
+    /// Resending the same signed bytes is chain-idempotent: at most one copy
+    /// mines, and a resend after an accepted send is answered "already known".
+    pub async fn send(&self, tx: TransactionRequest) -> Result<TxHash, SendError> {
+        match self.0.send_transaction(tx).await {
+            Ok(pending) => Ok(*pending.tx_hash()),
+            Err(RpcError::LocalUsageError(error)) => Err(SendError::Unsignable(error.to_string())),
+            Err(error) => Err(SendError::Rpc(error)),
+        }
+    }
 }
 
-/// Create a provider with a wallet signer, retry, and timeout. `allow_insecure`
+fn keyed_providers(client: RpcClient, signer: PrivateKeySigner, chain_id: u64) -> KeyedProviders {
+    let submit = ProviderBuilder::new()
+        .disable_recommended_fillers()
+        .with_chain_id(chain_id)
+        .wallet(signer)
+        .connect_client(client.clone())
+        .erased();
+    KeyedProviders {
+        read: read_provider(client),
+        submit: Submitter(submit),
+    }
+}
+
+/// Create a keyed writer's providers, signing for `chain_id`. `allow_insecure`
 /// opts into plaintext RPC against a non-loopback host — see [`create_client`].
-pub fn create_signer_provider(
+pub fn create_keyed_providers(
     url: &str,
     private_key: &str,
+    chain_id: u64,
     allow_insecure: bool,
-) -> Result<DynProvider, String> {
+) -> Result<KeyedProviders, String> {
     let client = create_client(url, allow_insecure)?;
     let signer =
         PrivateKeySigner::from_str(private_key).map_err(|_| "invalid private key".to_string())?;
-    let provider = ProviderBuilder::new().wallet(signer).connect_client(client);
-    Ok(provider.erased())
+    Ok(keyed_providers(client, signer, chain_id))
 }
 
-/// Failure modes of [`create_verified_signer_provider`], split so callers can
+/// Failure modes of [`create_verified_keyed_providers`], split so callers can
 /// project them onto the right exit class: a chain mismatch is a terminal
 /// operator misconfig, an RPC failure is retryable, a build failure is a bad
 /// URL/key.
 #[derive(Debug, thiserror::Error)]
 pub enum VerifiedSignerProviderError {
-    /// The signing provider could not be built (bad URL or private key).
+    /// The providers could not be built (bad URL or private key).
     #[error("{0}")]
     Create(String),
     /// The chain-id query itself failed — the RPC is unreachable (retryable).
@@ -124,38 +485,434 @@ pub enum VerifiedSignerProviderError {
     ChainIdMismatch { rpc: u64, expected: u64 },
 }
 
-/// Create a signing provider, but only after confirming the RPC serves
-/// `expected_chain_id`. The guarded constructor for **keyed L1 writers**: it
-/// folds the wrong-chain check and the signer build into one call so a keyed
-/// path cannot broadcast onto the wrong chain by forgetting to validate first.
-/// The chain id is queried on the very provider that will sign, immediately
-/// before it is returned and before any transaction is sent — so it also closes
-/// the window where a long-lived process's earlier (boot-time / one-shot) check
-/// has gone stale because a load-balanced RPC failed over to another chain.
-pub async fn create_verified_signer_provider(
+/// [`create_keyed_providers`], but only after confirming the endpoint serves
+/// `expected_chain_id`. Signatures carry the pinned id whatever the endpoint
+/// says; this check, made right before a one-shot flush starts, keeps another
+/// chain's wallet nonces and fees out of it. The flush itself does not recheck, so a
+/// chain swap behind the same URL during a flush is the residual the threat
+/// model accepts for the reader.
+pub async fn create_verified_keyed_providers(
     url: &str,
     private_key: &str,
     expected_chain_id: u64,
     allow_insecure: bool,
-) -> Result<DynProvider, VerifiedSignerProviderError> {
-    let provider = create_signer_provider(url, private_key, allow_insecure)
+) -> Result<KeyedProviders, VerifiedSignerProviderError> {
+    let providers = create_keyed_providers(url, private_key, expected_chain_id, allow_insecure)
         .map_err(VerifiedSignerProviderError::Create)?;
-    let rpc_chain_id = provider
+    let rpc_chain_id = providers
+        .read
         .get_chain_id()
         .await
-        .map_err(|e| VerifiedSignerProviderError::ChainIdRpc(e.to_string()))?;
+        .map_err(|e| VerifiedSignerProviderError::ChainIdRpc(error_chain(&e)))?;
     if rpc_chain_id != expected_chain_id {
         return Err(VerifiedSignerProviderError::ChainIdMismatch {
             rpc: rpc_chain_id,
             expected: expected_chain_id,
         });
     }
-    Ok(provider)
+    Ok(providers)
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use alloy::rpc::json_rpc::ErrorPayload;
+    use alloy::transports::mock::{Asserter, MockTransport};
+    use alloy_transport::{RpcError, TransportErrorKind};
+
+    fn error_response(code: i64, message: &'static str) -> TransportError {
+        RpcError::ErrorResp(ErrorPayload {
+            code,
+            message: message.into(),
+            data: None,
+        })
+    }
+
+    // ── Retry policy: resend rate limits only, briefly ────────
+
+    #[test]
+    fn the_retry_policy_resends_rate_limits_only() {
+        let policy = RateLimitOnly::default();
+        for retried in [
+            error_response(429, "Too Many Requests"),
+            error_response(-32005, "Rate limit exceeded"),
+            error_response(-32005, "project ID request rate exceeded"),
+            TransportErrorKind::http_error(503, String::new()),
+            TransportErrorKind::http_error_with_retry_after(
+                429,
+                "Too Many Requests".into(),
+                Some(Duration::from_secs(2)),
+            ),
+        ] {
+            assert!(policy.should_retry(&retried), "{retried}");
+        }
+        let backoff = serde_json::value::to_raw_value(
+            &serde_json::json!({ "rate": { "backoff_seconds": 30 } }),
+        )
+        .unwrap();
+        for sent_once in [
+            // Log caps that only a narrower range clears.
+            error_response(
+                -32005,
+                "query returned more than 10000 results. Try with this block range [0x15ef3c0, 0x15ef4ff].",
+            ),
+            error_response(
+                -32005,
+                "Too many logs requested. Max logs per response is 20000.",
+            ),
+            error_response(-32005, "Requested range exceeds maximum RPC range limit"),
+            // A longer wait is the caller's next tick.
+            TransportErrorKind::http_error_with_retry_after(
+                429,
+                "Too Many Requests".into(),
+                Some(Duration::from_secs(30)),
+            ),
+            RpcError::ErrorResp(ErrorPayload {
+                code: -32005,
+                message: "project ID request rate exceeded".into(),
+                data: Some(backoff),
+            }),
+            // A hang or a dead endpoint is never resent.
+            TransportErrorKind::custom_str("operation timed out"),
+        ] {
+            assert!(!policy.should_retry(&sent_once), "{sent_once}");
+        }
+    }
+
+    fn mocked_client(asserter: &Asserter) -> RpcClient {
+        RpcClient::builder()
+            .layer(retry_layer())
+            .transport(MockTransport::new(asserter.clone()), true)
+    }
+
+    #[tokio::test]
+    async fn a_rate_limit_is_sent_three_times() {
+        let asserter = Asserter::new();
+        for _ in 0..3 {
+            asserter.push_failure(ErrorPayload {
+                code: 429,
+                message: "Too Many Requests".into(),
+                data: None,
+            });
+        }
+        let error = mocked_client(&asserter)
+            .request_noparams::<alloy_primitives::U64>("eth_blockNumber")
+            .await
+            .unwrap_err();
+        assert!(
+            error.to_string().contains("Max retries exceeded"),
+            "{error}"
+        );
+        assert!(asserter.read_q().is_empty());
+    }
+
+    // ── Endpoint redaction: no error or log quotes the URL ───
+
+    const URL_SECRETS: [&str; 3] = ["hunter2", "not-a-real-api-key", "query-secret"];
+
+    #[tokio::test]
+    async fn request_errors_do_not_quote_the_rpc_url_but_keep_the_cause() {
+        let client = create_client(
+            "http://user:hunter2@127.0.0.1:1/v2/not-a-real-api-key?key=query-secret",
+            false,
+        )
+        .expect("loopback http is accepted");
+        let error = client
+            .request_noparams::<alloy_primitives::U64>("eth_blockNumber")
+            .await
+            .expect_err("nothing listens on port 1");
+        let chain = error_chain(&error);
+        for rendered in [chain.as_str(), &format!("{error:?}")] {
+            for secret in URL_SECRETS {
+                assert!(!rendered.contains(secret), "{rendered}");
+            }
+        }
+        assert!(chain.starts_with("error sending request"), "{chain}");
+        assert!(chain.contains("Connect"), "the cause survives: {chain}");
+        assert_eq!(chain.matches("error sending request").count(), 1, "{chain}");
+        assert!(
+            matches!(error, RpcError::Transport(TransportErrorKind::Custom(_))),
+            "the error kind is kept: {error:?}"
+        );
+
+        let error = create_verified_keyed_providers(
+            "http://user:hunter2@127.0.0.1:1/v2/not-a-real-api-key?key=query-secret",
+            ANVIL_KEY_0,
+            1,
+            false,
+        )
+        .await
+        .expect_err("nothing listens on port 1");
+        assert!(
+            matches!(&error, VerifiedSignerProviderError::ChainIdRpc(_)),
+            "{error:?}"
+        );
+        let text = error.to_string();
+        for secret in URL_SECRETS {
+            assert!(!text.contains(secret), "{text}");
+        }
+        assert!(text.contains("Connect"), "the cause survives: {text}");
+    }
+
+    #[test]
+    fn http_error_bodies_lose_the_rpc_url() {
+        let url =
+            Url::parse("https://user:hunter2@rpc.example/v2/not-a-real-api-key?key=query-secret")
+                .unwrap();
+        let layer = RedactUrlLayer::new(&url);
+        // reqwest quotes the URL it sent, without the userinfo.
+        let body = "<failed to read response body: error decoding response body for url \
+                    (https://rpc.example/v2/not-a-real-api-key?key=query-secret)>"
+            .to_owned();
+        let error = redact_url(
+            TransportErrorKind::http_error(502, body.clone()),
+            &layer.needles,
+        );
+        assert_eq!(
+            error.to_string(),
+            "HTTP error 502 with body: <failed to read response body: error decoding \
+             response body for url (<rpc url>)>"
+        );
+        // alloy retries a plain HTTP error only on 429 and 503; redaction keeps that.
+        let unavailable = redact_url(
+            TransportErrorKind::http_error(503, body.clone()),
+            &layer.needles,
+        );
+        assert!(
+            matches!(&unavailable, RpcError::Transport(kind) if kind.is_retry_err()),
+            "a 503 stays retryable: {unavailable:?}"
+        );
+
+        // A server that echoes only the request target, its path, or its query.
+        for echo in [
+            "<html>Cannot POST /v2/not-a-real-api-key?key=query-secret</html>",
+            "<html>Cannot POST /v2/not-a-real-api-key</html>",
+            "invalid key=query-secret",
+        ] {
+            let echoed = redact_url(
+                TransportErrorKind::http_error(404, echo.into()),
+                &layer.needles,
+            )
+            .to_string();
+            for secret in URL_SECRETS {
+                assert!(!echoed.contains(secret), "{echoed}");
+            }
+        }
+
+        let delay = Duration::from_secs(3);
+        match redact_url(
+            TransportErrorKind::http_error_with_retry_after(
+                429,
+                format!("{body} {url}"),
+                Some(delay),
+            ),
+            &layer.needles,
+        ) {
+            RpcError::Transport(TransportErrorKind::HttpErrorWithRetryAfter {
+                error,
+                retry_after,
+            }) => {
+                assert_eq!(error.status, 429);
+                assert_eq!(retry_after, delay);
+                for secret in URL_SECRETS {
+                    assert!(!error.body.contains(secret), "{}", error.body);
+                }
+            }
+            other => panic!("unexpected error: {other:?}"),
+        }
+    }
+
+    /// The transport-level answer to a 2xx body that is not JSON quotes the
+    /// body whole.
+    #[test]
+    fn deser_error_bodies_lose_the_rpc_url() {
+        let url =
+            Url::parse("https://user:hunter2@rpc.example/v2/not-a-real-api-key?key=query-secret")
+                .unwrap();
+        let layer = RedactUrlLayer::new(&url);
+        let error = redact_url(
+            TransportError::deser_err(
+                serde_json::from_str::<serde_json::Value>("<").unwrap_err(),
+                "<html>Cannot POST /v2/not-a-real-api-key?key=query-secret</html>",
+            ),
+            &layer.needles,
+        );
+        assert!(
+            matches!(error, RpcError::DeserError { .. }),
+            "the kind is kept: {error:?}"
+        );
+        let text = error.to_string();
+        for secret in URL_SECRETS {
+            assert!(!text.contains(secret), "{text}");
+        }
+    }
+
+    /// Swapping the two layers would let retry quote an unredacted body in
+    /// its "Max retries exceeded" text, which no later layer scrubs.
+    #[tokio::test]
+    async fn retried_errors_are_redacted_before_retry_wraps_them() {
+        #[derive(Clone)]
+        struct Failing(String);
+        impl tower::Service<RequestPacket> for Failing {
+            type Response = ResponsePacket;
+            type Error = TransportError;
+            type Future = TransportFut<'static>;
+            fn poll_ready(&mut self, _: &mut Context<'_>) -> Poll<Result<(), TransportError>> {
+                Poll::Ready(Ok(()))
+            }
+            fn call(&mut self, _: RequestPacket) -> Self::Future {
+                let body = self.0.clone();
+                Box::pin(async move {
+                    Err(TransportErrorKind::http_error_with_retry_after(
+                        429,
+                        body,
+                        Some(Duration::ZERO),
+                    ))
+                })
+            }
+        }
+
+        let url =
+            Url::parse("https://user:hunter2@rpc.example/v2/not-a-real-api-key?key=query-secret")
+                .unwrap();
+        let body = format!("upstream refused {url}");
+        let error = layered_client(Failing(body), &url, false)
+            .request_noparams::<alloy_primitives::U64>("eth_blockNumber")
+            .await
+            .expect_err("every attempt fails");
+        let chain = error_chain(&error);
+        assert!(chain.contains("Max retries exceeded"), "{chain}");
+        for secret in URL_SECRETS {
+            assert!(!chain.contains(secret), "{chain}");
+        }
+    }
+
+    #[test]
+    fn logs_show_only_the_endpoint_origin() {
+        assert_eq!(
+            rpc_endpoint_origin(
+                "https://user:hunter2@rpc.example:8443/v2/not-a-real-api-key?key=query-secret"
+            ),
+            "https://rpc.example:8443"
+        );
+        assert_eq!(
+            rpc_endpoint_origin("https://rpc.example/v2/k"),
+            "https://rpc.example"
+        );
+        assert_eq!(
+            rpc_endpoint_origin("http://127.0.0.1:8545"),
+            "http://127.0.0.1:8545"
+        );
+        assert_eq!(
+            rpc_endpoint_origin("http://[::1]:8545/"),
+            "http://[::1]:8545"
+        );
+        assert_eq!(
+            rpc_endpoint_origin("https://rpc.example:8443/v2/k#fragment"),
+            "https://rpc.example:8443"
+        );
+        assert_eq!(rpc_endpoint_origin("not-a-valid-url"), "<invalid url>");
+    }
+
+    /// The endpoint answers 308 to a second server that would answer the call:
+    /// a followed redirect succeeds, a refused one fails with the 308.
+    #[tokio::test]
+    async fn no_client_follows_a_redirect() {
+        use crate::test_support::answer_once;
+
+        let target = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let target_address = target.local_addr().unwrap();
+        let body = r#"{"jsonrpc":"2.0","id":0,"result":"0x1"}"#;
+        tokio::spawn(answer_once(
+            target,
+            format!(
+                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\
+                 Connection: close\r\n\r\n{body}",
+                body.len()
+            ),
+        ));
+        let endpoint = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint_address = endpoint.local_addr().unwrap();
+        tokio::spawn(answer_once(
+            endpoint,
+            format!(
+                "HTTP/1.1 308 Permanent Redirect\r\nLocation: http://{target_address}/\r\n\
+                 Content-Length: 0\r\nConnection: close\r\n\r\n"
+            ),
+        ));
+
+        let error = create_client(&format!("http://{endpoint_address}/"), false)
+            .unwrap()
+            .request_noparams::<alloy_primitives::U64>("eth_chainId")
+            .await
+            .expect_err("the redirect must not be followed");
+        assert!(
+            matches!(
+                &error,
+                RpcError::Transport(TransportErrorKind::HttpError(HttpError { status: 308, .. }))
+            ),
+            "{error:?}"
+        );
+    }
+
+    #[test]
+    fn error_chain_appends_each_new_cause_once() {
+        #[derive(Debug, thiserror::Error)]
+        #[error("leaf failure")]
+        struct Leaf;
+        #[derive(Debug, thiserror::Error)]
+        #[error("{0}")]
+        struct Echo(#[source] Leaf);
+        #[derive(Debug, thiserror::Error)]
+        #[error("request failed")]
+        struct Outer(#[source] Echo);
+
+        assert_eq!(
+            error_chain(&Outer(Echo(Leaf))),
+            "request failed: leaf failure"
+        );
+    }
+
+    #[test]
+    fn error_chain_is_one_capped_line_per_cause() {
+        #[derive(Debug, thiserror::Error)]
+        #[error("line one\nline two{0}")]
+        struct Leaf(String);
+        #[derive(Debug, thiserror::Error)]
+        #[error("request failed")]
+        struct Outer(#[source] Leaf);
+
+        // Multibyte at the cut, so a cut inside a character would panic.
+        let chain = error_chain(&Outer(Leaf("\u{e9}".repeat(400))));
+        assert!(!chain.contains('\n'), "{chain}");
+        assert!(chain.contains("line one\\nline two"), "{chain}");
+        assert!(chain.ends_with("bytes cut]"), "{chain}");
+        assert!(
+            chain.len() < "request failed: ".len() + ERROR_SEGMENT_MAX_BYTES + 32,
+            "{}",
+            chain.len()
+        );
+    }
+
+    #[tokio::test]
+    async fn a_narrowing_only_rejection_reaches_the_caller_unretried() {
+        let asserter = Asserter::new();
+        asserter.push_failure(ErrorPayload {
+            code: -32005,
+            message: "query returned more than 10000 results".into(),
+            data: None,
+        });
+        // A resend would find the queue empty and fail differently.
+        let error = mocked_client(&asserter)
+            .request_noparams::<alloy_primitives::U64>("eth_getLogs")
+            .await
+            .unwrap_err();
+        assert_eq!(
+            error.as_error_resp().map(|payload| payload.code),
+            Some(-32005)
+        );
+        assert!(asserter.read_q().is_empty());
+    }
 
     // ── Regression: URL scheme enforcement ────────────────
 
@@ -234,14 +991,14 @@ mod tests {
     // ── Regression: private-key parse error must not echo bytes ────
 
     #[test]
-    fn create_signer_provider_does_not_echo_key_bytes_on_invalid_hex() {
+    fn keyed_providers_do_not_echo_key_bytes_on_invalid_hex() {
         // A malformed key that would otherwise cause alloy's error Display to
         // embed a character from the input. The fix replaced {e} with a fixed
         // string. Assert the error is the fixed string exactly — not a prefix
         // match — so a future change that re-adds interpolation is caught.
         let bad_key =
             "0xZZZZ_zzzz_ffff_ffff_ffff_ffff_ffff_ffff_ffff_ffff_ffff_ffff_ffff_ffff_ffff";
-        let err = create_signer_provider("http://127.0.0.1:8545", bad_key, false)
+        let err = create_keyed_providers("http://127.0.0.1:8545", bad_key, 31337, false)
             .expect_err("malformed hex key must be rejected");
         assert_eq!(
             err, "invalid private key",
@@ -255,23 +1012,23 @@ mod tests {
     }
 
     #[test]
-    fn create_signer_provider_does_not_echo_key_bytes_on_odd_length() {
+    fn keyed_providers_do_not_echo_key_bytes_on_odd_length() {
         // Odd-length hex would trigger a different error variant. Same
         // invariant: fixed error message, no key bytes leaked.
         let bad_key = "0xabc";
-        let err = create_signer_provider("http://127.0.0.1:8545", bad_key, false)
+        let err = create_keyed_providers("http://127.0.0.1:8545", bad_key, 31337, false)
             .expect_err("odd-length hex key must be rejected");
         assert_eq!(err, "invalid private key");
     }
 
     #[test]
-    fn create_signer_provider_accepts_valid_key() {
+    fn keyed_providers_accept_a_valid_key() {
         let good_key = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
-        create_signer_provider("http://127.0.0.1:8545", good_key, false)
+        create_keyed_providers("http://127.0.0.1:8545", good_key, 31337, false)
             .expect("valid key must be accepted");
     }
 
-    // ── Keyed-write chain-id gate (review): the guarded constructor must
+    // ── Keyed-write chain-id gate: the guarded constructor must
     //    confirm the served chain matches the pinned one before signing ─
 
     fn require_anvil() {
@@ -290,7 +1047,7 @@ mod tests {
     const ANVIL_KEY_0: &str = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
 
     #[tokio::test]
-    async fn verified_signer_provider_gates_on_chain_id() {
+    async fn verified_keyed_providers_gate_on_chain_id() {
         use alloy::node_bindings::Anvil;
 
         require_anvil();
@@ -298,14 +1055,14 @@ mod tests {
         let chain_id = anvil.chain_id();
 
         // Matching chain id → a usable signing provider.
-        create_verified_signer_provider(&anvil.endpoint(), ANVIL_KEY_0, chain_id, false)
+        create_verified_keyed_providers(&anvil.endpoint(), ANVIL_KEY_0, chain_id, false)
             .await
-            .expect("matching chain id yields a verified signer provider");
+            .expect("matching chain id yields verified keyed providers");
 
         // Wrong pinned chain id → terminal ChainIdMismatch, before any signing,
         // surfacing the served id vs the pinned one.
         let err =
-            create_verified_signer_provider(&anvil.endpoint(), ANVIL_KEY_0, chain_id + 1, false)
+            create_verified_keyed_providers(&anvil.endpoint(), ANVIL_KEY_0, chain_id + 1, false)
                 .await
                 .expect_err("a mismatched pinned chain id must be rejected before signing");
         assert!(
@@ -318,4 +1075,109 @@ mod tests {
             chain_id + 1
         );
     }
+
+    // ── Read and submit providers ─────────────────────────────
+
+    /// A transport answering from `asserter` that records each request's
+    /// method and params.
+    fn recording_client(
+        asserter: &Asserter,
+    ) -> (RpcClient, Arc<std::sync::Mutex<Vec<serde_json::Value>>>) {
+        #[derive(Clone)]
+        struct Recording {
+            inner: MockTransport,
+            requests: Arc<std::sync::Mutex<Vec<serde_json::Value>>>,
+        }
+        impl tower::Service<RequestPacket> for Recording {
+            type Response = ResponsePacket;
+            type Error = TransportError;
+            type Future = TransportFut<'static>;
+            fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), TransportError>> {
+                self.inner.poll_ready(cx)
+            }
+            fn call(&mut self, request: RequestPacket) -> Self::Future {
+                self.requests
+                    .lock()
+                    .expect("request log")
+                    .push(serde_json::to_value(&request).expect("request serializes"));
+                self.inner.call(request)
+            }
+        }
+        let requests = Arc::default();
+        let transport = Recording {
+            inner: MockTransport::new(asserter.clone()),
+            requests: Arc::clone(&requests),
+        };
+        (RpcClient::new(transport, true), requests)
+    }
+
+    fn complete_transfer(from: alloy_primitives::Address) -> TransactionRequest {
+        use alloy::network::TransactionBuilder;
+        TransactionRequest::default()
+            .with_from(from)
+            .with_to(from)
+            .with_value(alloy_primitives::U256::ZERO)
+            .with_gas_limit(21_000)
+            .with_nonce(7)
+            .with_max_fee_per_gas(2_000_000_000)
+            .with_max_priority_fee_per_gas(1_000_000_000)
+    }
+
+    #[tokio::test]
+    async fn the_submitter_sends_one_raw_transaction_signed_for_the_pinned_chain() {
+        use alloy::consensus::TxEnvelope;
+        use alloy::eips::eip2718::Decodable2718;
+
+        let signer = PrivateKeySigner::from_str(ANVIL_KEY_0).unwrap();
+        let from = signer.address();
+        let asserter = Asserter::new();
+        asserter.push_success(&alloy_primitives::B256::repeat_byte(0x01));
+        let (client, requests) = recording_client(&asserter);
+        let providers = keyed_providers(client, signer, 4242);
+
+        providers
+            .submit
+            .send(complete_transfer(from))
+            .await
+            .expect("a complete transaction is sent");
+
+        let requests = requests.lock().unwrap();
+        assert_eq!(requests.len(), 1, "{requests:?}");
+        assert_eq!(requests[0]["method"], "eth_sendRawTransaction");
+        let raw: alloy_primitives::Bytes =
+            serde_json::from_value(requests[0]["params"][0].clone()).unwrap();
+        let envelope = TxEnvelope::decode_2718(&mut raw.as_ref()).expect("a signed envelope");
+        let TxEnvelope::Eip1559(signed) = envelope else {
+            panic!("an EIP-1559 transaction, got {envelope:?}");
+        };
+        assert_eq!(
+            signed.tx().chain_id,
+            4242,
+            "the pinned id, never the endpoint's"
+        );
+        assert_eq!(signed.tx().nonce, 7);
+        let signer_address = signed
+            .signature()
+            .recover_address_from_prehash(&signed.signature_hash())
+            .expect("a recoverable signature");
+        assert_eq!(signer_address, from);
+    }
+
+    #[tokio::test]
+    async fn the_submitter_refuses_an_incomplete_transaction_without_rpc() {
+        let signer = PrivateKeySigner::from_str(ANVIL_KEY_0).unwrap();
+        let from = signer.address();
+        let (client, requests) = recording_client(&Asserter::new());
+        let providers = keyed_providers(client, signer, 4242);
+
+        let mut incomplete = complete_transfer(from);
+        incomplete.nonce = None;
+        let error = providers
+            .submit
+            .send(incomplete)
+            .await
+            .expect_err("no filler may pick a nonce");
+        assert!(matches!(error, SendError::Unsignable(_)), "{error:?}");
+        assert!(requests.lock().unwrap().is_empty());
+    }
 }
diff --git a/sequencer/src/l1/reader.rs b/sequencer/src/l1/reader.rs
index ceca7e8a..91b4f2b6 100644
--- a/sequencer/src/l1/reader.rs
+++ b/sequencer/src/l1/reader.rs
@@ -13,11 +13,12 @@ use cartesi_rollups_contracts::i_application::IApplication;
 use cartesi_rollups_contracts::input_box::InputBox;
 use cartesi_rollups_contracts::input_box::InputBox::InputAdded;
 use tokio::task::JoinHandle;
-use tracing::{debug, info};
+use tracing::{debug, info, warn};
 
 use crate::l1::partition::{
     GetLogsError, decode_evm_advance_input, get_input_added_events_ordered,
 };
+use crate::l1::provider::error_chain;
 use crate::runtime::process_lock::{ProcessLock, spawn_blocking_with_lock};
 use crate::runtime::shutdown::ShutdownSignal;
 use crate::storage::{FrontierMode, IngestedSafeInput, Storage, StorageOpenError};
@@ -33,8 +34,6 @@ pub struct InputReaderConfig {
     pub allow_insecure_rpc: bool,
     pub app_address: Address,
     pub poll_interval: Duration,
-    /// Error codes that trigger `get_logs` retries with a shorter block range.
-    pub long_block_range_error_codes: Vec<String>,
     /// The chain id `setup` pinned (`run`) / is pinning (`setup`). The reader
     /// verifies the provider actually serves this chain on its first successful
     /// contact — the RPC URL is an operator CLI/env arg that may be repointed
@@ -51,12 +50,14 @@ pub enum InputReaderError {
     /// loop logs and re-ticks.
     #[error("provider/transport: {0}")]
     Provider(String),
-    /// The provider answered, but with data that contradicts itself or the
-    /// InputBox's own accounting: an index gap or count mismatch, missing log
-    /// provenance, an undecodable or self-inconsistent `EvmAdvance` payload.
-    /// Retryable — a consistent node returns a coherent
-    /// set on the next tick — but logged as its own alarm: a *persistent* one
-    /// means the endpoint is broken or lying, not slow.
+    /// The provider answered, but with data that contradicts itself, the
+    /// InputBox's own accounting, the pinned identity, or the stored inputs:
+    /// an index gap or count mismatch, missing log provenance, an undecodable
+    /// or self-inconsistent `EvmAdvance` payload, one for another chain or
+    /// application, or an on-chain count below the stored one. Retryable — a
+    /// consistent node returns a coherent set on the next tick — but logged as
+    /// its own alarm: a *persistent* one means the endpoint is broken or lying,
+    /// or, for a count below the stored one, local state may be.
     #[error("inconsistent L1 response: {0}")]
     InconsistentL1Response(String),
     /// The provider serves a different chain than the pinned identity.
@@ -90,7 +91,9 @@ impl InputReaderError {
             // provenance.
             Self::ChainIdMismatch { .. } | Self::StorageTaskPanicked { .. } => true,
             // Transport/L1-consistency errors self-heal on a healthy
-            // endpoint; `Bootstrap` is a preflight-phase fact (a live-worker
+            // endpoint, except a count below the stored one, which may be
+            // local state and is retried as an alarm (see the variant doc);
+            // `Bootstrap` is a preflight-phase fact (a live-worker
             // appearance restarts unclassified rather than poisoning); a
             // non-panic inner-task join is shutdown-path cancellation.
             Self::Provider(_)
@@ -99,6 +102,36 @@ impl InputReaderError {
             | Self::Join(_) => false,
         }
     }
+
+    /// Whether a failure in a startup phase is worth retrying: setup's
+    /// discovery and initial sync, and run's `InitialSync` and
+    /// `PostFlushSync` (both through `sync_to_current_safe_head`).
+    /// `ChainIdMismatch` and `StorageTaskPanicked` are refused at startup and
+    /// terminal in the live worker alike. Two variants are phase-dependent by
+    /// design and differ from [`Self::is_terminal_invariant`]:
+    ///
+    /// - `Bootstrap` at startup is a deterministic configuration failure,
+    ///   refused because re-running re-fails identically: the configured RPC
+    ///   URL (parse, the plaintext-remote rule, client build) or, in setup's
+    ///   discovery ([`InputReader::new`]), a wrong contract or a pre-v3
+    ///   InputBox. In the live loop the same URL was already proven by this
+    ///   boot's initial sync, so a live `Bootstrap` restarts unclassified
+    ///   rather than poisoning the data directory.
+    /// - `Join` (a non-panic loss of a storage task) is shutdown-path
+    ///   cancellation in the live loop. During startup the runtime that would
+    ///   cancel it is the one driving this boot, so an unexplained loss is
+    ///   refused rather than retried blind.
+    pub(crate) fn is_retryable_at_startup(&self) -> bool {
+        match self {
+            Self::Provider(_) | Self::InconsistentL1Response(_) => true,
+            Self::OpenStorage(source) => !crate::storage::is_persistent_storage_open_error(source),
+            Self::Storage(source) => !crate::storage::is_persistent_storage_error(source),
+            Self::ChainIdMismatch { .. }
+            | Self::Bootstrap(_)
+            | Self::StorageTaskPanicked { .. }
+            | Self::Join(_) => false,
+        }
+    }
 }
 
 impl InputReaderError {
@@ -124,16 +157,18 @@ pub struct InputReader {
     /// The application's deployment block — the first block that can contain
     /// an `InputAdded` event for this app. Sound as the scan floor because the
     /// v3 InputBox reverts `addInput` for an app contract that does not exist
-    /// yet (`ApplicationNotDeployed`); [`Self::new`] verifies the InputBox is
-    /// v3+ before trusting this bound.
+    /// yet (`ApplicationNotDeployed`) and setup pins it only once it is at or
+    /// below a safe head, so no reorg can move the deployment earlier. The
+    /// first scan from an empty store proves the floor: indices contiguous from
+    /// 0 and the InputBox count at the scanned safe head.
     app_deployment_block: u64,
     db_path: String,
     /// Scheduler-acceptance identity — passed into
-    /// [`Storage::append_safe_inputs`] so the persisted scheduler-accepted
-    /// frontier filters by the right sender.
+    /// `Storage::append_ingested_safe_inputs_with_timestamp` so the persisted
+    /// scheduler-accepted frontier filters by the right sender.
     batch_submitter: Address,
     /// Protocol timing used to keep `safe_accepted_batches` consistent with
-    /// every `append_safe_inputs` write.
+    /// every safe-input write.
     timing: ProtocolTiming,
     /// Whether each sync also populates the scheduler-accepted frontier
     /// ([`FrontierMode::Populate`] normally; `setup --recovery` defers it — see
@@ -159,26 +194,28 @@ impl InputReader {
         process_lock: ProcessLock,
     ) -> Result<Self, InputReaderError> {
         let provider =
-            crate::l1::provider::create_provider(&config.rpc_url, config.allow_insecure_rpc)
+            crate::l1::provider::create_read_provider(&config.rpc_url, config.allow_insecure_rpc)
                 .map_err(InputReaderError::Bootstrap)?;
         let application = IApplication::new(config.app_address, &provider);
         let input_box_address = application
             .getInputBox()
             .call()
             .await
-            .map_err(map_contract_bootstrap_error)?;
+            .map_err(|err| map_contract_bootstrap_error("IApplication.getInputBox", err))?;
 
         // The scan genesis is the *application's* deployment block, not the
         // InputBox's: the InputBox usually predates the app by a large block
         // gap, and scanning that gap degenerates into a long paginated
         // `get_logs` crawl on range-capped providers. Skipping it is sound
-        // only because the v3 InputBox refuses inputs for apps that do not
-        // exist yet — witnessed below via `version()`.
+        // because the v3 InputBox refuses inputs for apps that do not exist
+        // yet; `version()` below refuses an older box before any scan.
         let app_deployment_block = application
             .getDeploymentBlockNumber()
             .call()
             .await
-            .map_err(map_contract_bootstrap_error)?
+            .map_err(|err| {
+                map_contract_bootstrap_error("IApplication.getDeploymentBlockNumber", err)
+            })?
             .try_into()
             .map_err(|_| {
                 InputReaderError::Bootstrap(
@@ -271,7 +308,7 @@ impl InputReader {
     }
 
     pub(crate) async fn sync_to_current_safe_head(&mut self) -> Result<(), InputReaderError> {
-        let provider = crate::l1::provider::create_provider(
+        let provider = crate::l1::provider::create_read_provider(
             &self.config.rpc_url,
             self.config.allow_insecure_rpc,
         )
@@ -280,7 +317,7 @@ impl InputReader {
     }
 
     async fn run_forever(self, shutdown: ShutdownSignal) -> Result<(), InputReaderError> {
-        let provider = crate::l1::provider::create_provider(
+        let provider = crate::l1::provider::create_read_provider(
             &self.config.rpc_url,
             self.config.allow_insecure_rpc,
         )
@@ -309,14 +346,14 @@ impl InputReader {
             match result {
                 Ok(()) => {}
                 Err(err @ InputReaderError::InconsistentL1Response(_)) => {
-                    tracing::error!(
+                    tracing::warn!(
                         error = %err,
-                        "L1 provider served an inconsistent response — will retry; \
-                         if persistent, the RPC endpoint is the suspect"
+                        "inconsistent L1 response — will retry; if persistent, suspect \
+                         the RPC endpoint first, then local state"
                     );
                 }
                 Err(err) if err.is_retryable() => {
-                    tracing::error!(error = %err, "L1 provider error in input reader — will retry");
+                    tracing::warn!(error = %err, "L1 provider error in input reader — will retry");
                 }
                 Err(err) => return Err(err),
             }
@@ -338,13 +375,19 @@ impl InputReader {
         Ok(())
     }
 
+    /// Reads `[cursor, safe]` as one span for one commit, with the InputBox
+    /// count at `safe` as its completeness witness: a commit at a lower head
+    /// would rest on index contiguity alone, which a dropped tail input passes
+    /// (I6). In `run` the span stays under about `l1_read_stale_after_blocks`,
+    /// since the danger detector stops `run` first; setup, rebuild and startup
+    /// syncs read the whole gap, from the app's deployment on a fresh database.
+    /// Bounding those is a known optimization in `docs/review/register.md`.
     async fn read_safe_inputs(
         &mut self,
         provider: &impl Provider,
     ) -> Result<Option<SafeInputUpdate>, InputReaderError> {
-        // Verify the provider serves the pinned chain before reading anything
-        // from it — a wrong-chain RPC's address-filtered logs would otherwise
-        // flow into `safe_inputs`.
+        // First contact only (see `verify_chain_id`): a wrong-chain RPC's
+        // address-filtered logs would otherwise flow into `safe_inputs`.
         self.verify_chain_id(provider).await?;
 
         let current_safe_head = latest_safe_head(provider).await?;
@@ -353,8 +396,9 @@ impl InputReader {
 
         // The next block to scan: one past the persisted safe head, never
         // earlier than the app's deployment block (no input can exist before
-        // it). The persisted head itself may sit below that block: setup
-        // right after deployment observes a safe head that still trails it.
+        // it). The persisted head sits below that block only when a provider's
+        // safe head trails the one setup sampled, since setup pins the
+        // deployment block only once it is safe.
         let start_block = previous_safe_block
             .map_or(self.app_deployment_block, |b| b + 1)
             .max(self.app_deployment_block);
@@ -365,6 +409,19 @@ impl InputReader {
         // advancing. Neither consults the InputBox, which on a fresh chain may
         // not exist yet at that height.
         if current_safe_block < start_block {
+            // A head behind the persisted one is environmental (a lagging,
+            // resyncing or repointed endpoint) and is held as no progress; log
+            // it, or only the stale-view danger check surfaces it, hours later.
+            if let Some(persisted_safe_block) = previous_safe_block
+                && current_safe_block < persisted_safe_block
+            {
+                warn!(
+                    provider_safe_block = current_safe_block,
+                    persisted_safe_block,
+                    "L1 provider safe head is behind the persisted safe head — \
+                     endpoint lagging or repointed; holding the persisted head"
+                );
+            }
             let advanced = previous_safe_block.is_none_or(|b| current_safe_block > b);
             return Ok(advanced.then_some(SafeInputUpdate {
                 head: current_safe_head,
@@ -386,13 +443,23 @@ impl InputReader {
         )
         .await?;
 
+        // The InputBox count at a block past the persisted head cannot be below
+        // what storage already holds. No `get_logs` answer can heal that, and
+        // the endpoint is not the only suspect, so fail before scanning.
+        if onchain_count < expected_start {
+            return Err(InputReaderError::InconsistentL1Response(format!(
+                "InputBox input count at block {current_safe_block} is {onchain_count}, below \
+                 the {expected_start} inputs already stored: L1 disagrees with local state \
+                 (endpoint on another fork, reorg below the safe head, or corrupt local \
+                 storage), not a get_logs omission"
+            )));
+        }
+
         // No new inputs in `[start_block, current_safe_block]` — advance the
         // safe head without scanning. On range-capped providers the skipped
         // `get_logs` crawl is hundreds of paginated queries for a long span
         // (first sync of a quiet app, restart after downtime), while the count
-        // above is a single call. Strict equality only: a count *below* what we
-        // hold is an impossible overcount and must fall through to the
-        // completeness check, which fails loud on it.
+        // above is a single call.
         if onchain_count == expected_start {
             debug!(
                 block_range = %format!("{}..={}", start_block, current_safe_block),
@@ -415,15 +482,12 @@ impl InputReader {
             &self.input_box_address,
             start_block,
             current_safe_block,
-            self.config.long_block_range_error_codes.as_slice(),
         )
         .await
         .map_err(|err| match err {
-            GetLogsError::Rpc(e) => {
-                InputReaderError::Provider(format!("get_input_added_events: {e}"))
-            }
-            inconsistent @ GetLogsError::MissingBlockNumber { .. } => {
-                InputReaderError::InconsistentL1Response(inconsistent.to_string())
+            GetLogsError::Rpc { .. } => InputReaderError::Provider(error_chain(&err)),
+            GetLogsError::MissingLogPosition { .. } | GetLogsError::Decode { .. } => {
+                InputReaderError::InconsistentL1Response(err.to_string())
             }
         })?;
 
@@ -438,7 +502,12 @@ impl InputReader {
         let mut batch = Vec::with_capacity(events.len());
         let mut onchain_indices = Vec::with_capacity(events.len());
         for (event, log) in events {
-            let (onchain_index, input) = ingest_input_added(&event, &log)?;
+            let (onchain_index, input) = ingest_input_added(
+                &event,
+                &log,
+                self.config.app_address,
+                self.config.expected_chain_id,
+            )?;
             onchain_indices.push(onchain_index);
             batch.push(input);
         }
@@ -455,14 +524,11 @@ impl InputReader {
         // deposit `≤` the safe head would be persisted as complete and only
         // caught on the *next* input, after the lane may have stamped frames
         // past it (divergence).
-        let received_count = u64::try_from(batch.len()).map_err(|_| {
-            InputReaderError::Provider("InputAdded result count exceeds u64".to_string())
-        })?;
-        let received_total = expected_start.checked_add(received_count).ok_or_else(|| {
-            InputReaderError::Provider(
-                "InputAdded result count overflows the safe-input index space".to_string(),
-            )
-        })?;
+        let received_count = u64::try_from(batch.len())
+            .expect("InputAdded result count exceeds u64: contract-impossible");
+        let received_total = expected_start
+            .checked_add(received_count)
+            .expect("safe-input index space overflow: contract-impossible");
         check_input_count_complete(current_safe_block, received_total, onchain_count)?;
 
         info!(
@@ -492,7 +558,7 @@ impl InputReader {
         let rpc_chain_id = provider
             .get_chain_id()
             .await
-            .map_err(|e| InputReaderError::Provider(e.to_string()))?;
+            .map_err(|e| provider_error("eth_chainId", e))?;
         if rpc_chain_id != self.config.expected_chain_id {
             return Err(InputReaderError::ChainIdMismatch {
                 rpc: rpc_chain_id,
@@ -575,6 +641,14 @@ fn map_storage_task_join(err: tokio::task::JoinError, operation: &'static str) -
     }
 }
 
+/// Label a provider failure with the call that failed.
+fn provider_error(
+    operation: impl std::fmt::Display,
+    err: impl std::error::Error + 'static,
+) -> InputReaderError {
+    InputReaderError::Provider(format!("{operation}: {}", error_chain(&err)))
+}
+
 /// Bootstrap-time `eth_call` classification. Retryable when we could not
 /// reach the node, or when the node answered with a *transient* JSON-RPC
 /// error (rate limit / credit limit — alloy's own retry policy recognizes
@@ -584,7 +658,10 @@ fn map_storage_task_join(err: tokio::task::JoinError, operation: &'static str) -
 /// against the same address re-fails identically. (A contract revert arrives
 /// as `TransportError(RpcError::ErrorResp)`, so matching on the outer
 /// variant alone would misfile "wrong contract" as "L1 unreachable".)
-fn map_contract_bootstrap_error(err: alloy::contract::Error) -> InputReaderError {
+/// Classify with alloy's full `RateLimitRetryPolicy`, not the client's
+/// narrower resend policy (`l1/provider.rs`): a rate limit the client declined
+/// to resend is still transient.
+fn map_contract_bootstrap_error(what: &str, err: alloy::contract::Error) -> InputReaderError {
     use alloy::transports::RpcError;
     use alloy::transports::layers::{RateLimitRetryPolicy, RetryPolicy};
     match &err {
@@ -592,15 +669,18 @@ fn map_contract_bootstrap_error(err: alloy::contract::Error) -> InputReaderError
             if matches!(rpc, RpcError::Transport(_) | RpcError::NullResp)
                 || RateLimitRetryPolicy::default().should_retry(rpc) =>
         {
-            InputReaderError::Provider(err.to_string())
+            InputReaderError::Provider(format!("{what}: {}", error_chain(&err)))
         }
-        _ => InputReaderError::Bootstrap(err.to_string()),
+        _ => InputReaderError::Bootstrap(format!("{what}: {}", error_chain(&err))),
     }
 }
 
 /// Why the reader refuses pre-v3 InputBoxes: the scan genesis is the app's
 /// deployment block, sound only under v3's "no inputs for a not-yet-deployed
-/// app" rule.
+/// app" rule. With one consistent node the first scan would also catch an
+/// older box's earlier inputs, but only as a retryable inconsistent response
+/// that blames the provider; this check names the cause and refuses
+/// terminally, and still holds if the provider is not one consistent node.
 const INPUT_BOX_V3_REQUIRED: &str = "rollups-contracts v3+ InputBox required \
      (v2 accepts inputs for not-yet-deployed apps, which would invalidate the \
      app-deployment scan genesis)";
@@ -615,7 +695,7 @@ async fn verify_input_box_v3<P: Provider>(
     let input_box_address = *input_box.address();
     let version =
         input_box.version().call().await.map_err(|err| {
-            match map_contract_bootstrap_error(err) {
+            match map_contract_bootstrap_error("InputBox.version", err) {
                 retryable @ InputReaderError::Provider(_) => retryable,
                 terminal => InputReaderError::Bootstrap(format!(
                     "InputBox at {input_box_address} does not report a version() — \
@@ -670,14 +750,18 @@ fn u256_to_u64(value: U256, what: &str) -> Result<u64, InputReaderError> {
 
 /// Decode one `InputAdded` log into the row we persist, plus the on-chain
 /// index the contiguity witness checks. Pure — unit tests drive it with
-/// synthetic `(InputAdded, Log)` pairs, no provider required. Mirrors the
-/// watchdog's `decode_and_validate_log`: the row mixes provenances (block
-/// number and tx hash from the log, everything else from the `EvmAdvance`
-/// payload), so the two fields both sides carry — block number and index —
-/// are cross-checked here.
+/// synthetic `(InputAdded, Log)` pairs, no provider required. The row mixes
+/// provenances (block number and tx hash from the log, everything else from
+/// the `EvmAdvance` payload), so the fields both sides carry — block number
+/// and index — are cross-checked. The payload's chain and application must be
+/// the pinned ones too: the canonical scheduler derives its signing domain from
+/// them, while the sequencer substitutes the pinned identity. The watchdog's
+/// `reader:inputs` (`watchdog/l1.lua`) checks the same fields.
 fn ingest_input_added(
     event: &InputAdded,
     log: &alloy::rpc::types::Log,
+    app_address: Address,
+    chain_id: u64,
 ) -> Result<(u64, IngestedSafeInput), InputReaderError> {
     let onchain_index = u256_to_u64(event.index, "InputAdded index")?;
 
@@ -709,6 +793,20 @@ fn ingest_input_added(
             event.index, evm_advance.index
         )));
     }
+    if evm_advance.chainId != U256::from(chain_id) {
+        return Err(InputReaderError::InconsistentL1Response(format!(
+            "InputAdded index {} carries chain id {} in its EvmAdvance payload, but the \
+             pinned chain is {chain_id}",
+            event.index, evm_advance.chainId
+        )));
+    }
+    if evm_advance.appContract != app_address {
+        return Err(InputReaderError::InconsistentL1Response(format!(
+            "InputAdded index {} is for application {} in its EvmAdvance payload, but the \
+             pinned application is {app_address}",
+            event.index, evm_advance.appContract
+        )));
+    }
     let block_timestamp = u256_to_u64(evm_advance.blockTimestamp, "EvmAdvance block timestamp")?;
 
     Ok((
@@ -730,7 +828,9 @@ fn ingest_input_added(
 /// gap means the provider returned an incomplete `get_logs` set (a clamped or
 /// lagging-replica response — see `docs/threat-model/README.md`); the
 /// retryable [`InconsistentL1Response`] refuses to persist the hole — a
-/// consistent provider returns the full set on the next tick.
+/// consistent provider returns the full set on the next tick. `expected_start`
+/// is a stored count (at most `i64::MAX`), so the index arithmetic cannot
+/// overflow.
 ///
 /// [`InconsistentL1Response`]: InputReaderError::InconsistentL1Response
 fn check_input_index_contiguity(
@@ -738,14 +838,11 @@ fn check_input_index_contiguity(
     onchain_indices: &[u64],
 ) -> Result<(), InputReaderError> {
     for (offset, &index) in onchain_indices.iter().enumerate() {
-        let offset = u64::try_from(offset).map_err(|_| {
-            InputReaderError::Provider("InputAdded result offset exceeds u64".to_string())
-        })?;
-        let expected = expected_start.checked_add(offset).ok_or_else(|| {
-            InputReaderError::Provider(
-                "InputAdded indices overflow the safe-input index space".to_string(),
-            )
-        })?;
+        let offset = u64::try_from(offset)
+            .expect("InputAdded result offset exceeds u64: contract-impossible");
+        let expected = expected_start
+            .checked_add(offset)
+            .expect("InputAdded expected index overflow: contract-impossible");
         if index != expected {
             return Err(InputReaderError::InconsistentL1Response(format!(
                 "non-contiguous InputBox index: expected {expected}, got {index} — \
@@ -795,16 +892,35 @@ async fn input_count_at_block(
         .block(alloy::eips::BlockId::number(block))
         .call()
         .await
-        .map_err(|e| InputReaderError::Provider(e.to_string()))?;
+        .map_err(|e| {
+            provider_error(
+                format_args!("InputBox.getNumberOfInputs at block {block}"),
+                e,
+            )
+        })?;
     u256_to_u64(count, "InputBox getNumberOfInputs")
 }
 
+/// The L1 safe block, sampled by setup before discovery reads the deployment
+/// block at latest: a deployment at or below it cannot reorg to an earlier
+/// block.
+pub(crate) async fn sample_safe_block(
+    rpc_url: &str,
+    allow_insecure_rpc: bool,
+) -> Result<u64, InputReaderError> {
+    let provider = crate::l1::provider::create_read_provider(rpc_url, allow_insecure_rpc)
+        .map_err(InputReaderError::Bootstrap)?;
+    Ok(latest_safe_head(&provider).await?.block_number)
+}
+
 async fn latest_safe_head(provider: &impl Provider) -> Result<SafeHead, InputReaderError> {
     let block = provider
         .get_block(Safe.into())
         .await
-        .map_err(|e| InputReaderError::Provider(e.to_string()))?
-        .ok_or_else(|| InputReaderError::Provider("get_block returned None".to_string()))?;
+        .map_err(|e| provider_error("eth_getBlockByNumber(safe)", e))?
+        .ok_or_else(|| {
+            InputReaderError::Provider("eth_getBlockByNumber(safe) returned no block".to_string())
+        })?;
     Ok(SafeHead {
         block_number: block.header.number,
         block_timestamp: block.header.timestamp,
@@ -814,17 +930,13 @@ async fn latest_safe_head(provider: &impl Provider) -> Result<SafeHead, InputRea
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::test_support::l1::input_added_pair;
     use alloy::node_bindings::Anvil;
     use alloy::sol_types::SolCall;
     use tempfile::NamedTempFile;
 
     fn test_timing() -> ProtocolTiming {
-        ProtocolTiming {
-            max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        }
+        crate::storage::test_helpers::default_protocol_timing()
     }
 
     fn test_reader(
@@ -839,7 +951,6 @@ mod tests {
                 allow_insecure_rpc: false,
                 app_address: Address::ZERO,
                 poll_interval,
-                long_block_range_error_codes: Vec::new(),
                 // Anvil's default chain id — tests that drive a real provider go
                 // through the chain-id check in `advance_once`.
                 expected_chain_id: 31337,
@@ -965,7 +1076,6 @@ mod tests {
                 allow_insecure_rpc: false,
                 app_address: Address::ZERO,
                 poll_interval: Duration::from_secs(1),
-                long_block_range_error_codes: Vec::new(),
                 expected_chain_id: 999_999,
             },
             Address::ZERO,
@@ -1029,7 +1139,13 @@ mod tests {
 
         let result = reader.sync_to_current_safe_head().await;
 
-        assert!(matches!(result, Err(InputReaderError::Provider(_))));
+        // The first call names itself and keeps the transport cause.
+        assert!(
+            matches!(&result, Err(InputReaderError::Provider(message))
+                if message.starts_with("eth_chainId: error sending request")
+                    && message.contains("Connect")),
+            "got {result:?}"
+        );
 
         let mut storage =
             Storage::open(db_file.path().to_string_lossy().as_ref()).expect("open storage");
@@ -1051,7 +1167,6 @@ mod tests {
                 allow_insecure_rpc: false,
                 app_address: Address::ZERO,
                 poll_interval: Duration::from_secs(1),
-                long_block_range_error_codes: Vec::new(),
                 expected_chain_id: 31337,
             },
             Address::ZERO,
@@ -1067,11 +1182,11 @@ mod tests {
         }
     }
 
-    /// Setup right after app deployment persists a safe head that trails the
-    /// deployment block. Later syncs must keep advancing the head without
-    /// scanning or consulting the InputBox below the deployment block — on a
-    /// fresh devnet the InputBox itself may not exist at those heights (here
-    /// it has no code at all, so any count call would fail).
+    /// A safe head below the deployment block (a provider trailing the head
+    /// setup sampled, or an identity seeded ahead of the chain) keeps
+    /// advancing without scanning or consulting the InputBox — on a fresh
+    /// devnet the InputBox itself may not exist at those heights (here it has
+    /// no code at all, so any count call would fail).
     #[tokio::test]
     async fn advance_once_below_app_deployment_block_skips_input_box() {
         require_anvil();
@@ -1201,11 +1316,17 @@ mod tests {
     }
 
     #[test]
-    fn input_index_contiguity_rejects_index_space_overflow() {
-        let err = check_input_index_contiguity(u64::MAX, &[u64::MAX, u64::MAX])
-            .expect_err("the expected index must not saturate at u64::MAX");
+    #[should_panic(expected = "contract-impossible")]
+    fn input_index_contiguity_never_saturates_the_index_space() {
+        let _ = check_input_index_contiguity(u64::MAX, &[u64::MAX, u64::MAX]);
+    }
+
+    #[test]
+    fn input_index_contiguity_rejects_a_duplicated_input() {
+        let err = check_input_index_contiguity(7, &[7, 7, 8])
+            .expect_err("a repeated index must be rejected");
         assert!(
-            matches!(&err, InputReaderError::Provider(m) if m.contains("overflow")),
+            matches!(&err, InputReaderError::InconsistentL1Response(m) if m.contains("expected 8, got 7")),
             "got {err:?}"
         );
     }
@@ -1233,9 +1354,13 @@ mod tests {
     }
 
     #[test]
-    fn input_count_complete_rejects_an_impossible_overcount() {
-        // We somehow hold more than the chain reports — also fail loud.
-        assert!(check_input_count_complete(100, 11, 10).is_err());
+    fn input_count_complete_rejects_logs_beyond_the_count() {
+        // The scan returned more inputs than the count pinned at the same
+        // block — also fail loud.
+        assert!(matches!(
+            check_input_count_complete(100, 11, 10),
+            Err(InputReaderError::InconsistentL1Response(_))
+        ));
     }
 
     #[test]
@@ -1253,12 +1378,34 @@ mod tests {
         // A JSON-RPC-level rate limit (Infura -32005) is transient: setup must
         // surface it as retryable (FirstBootRequiresL1), not as a terminal
         // Bootstrap misconfig.
-        let err = map_contract_bootstrap_error(error_resp(-32005, "exceeded project rate limit"));
+        let err = map_contract_bootstrap_error(
+            "test call",
+            error_resp(-32005, "exceeded project rate limit"),
+        );
+        assert!(matches!(err, InputReaderError::Provider(_)), "got {err:?}");
+
+        // One whose requested wait the client refused to sleep through stays
+        // transient too.
+        let err = map_contract_bootstrap_error(
+            "test call",
+            alloy::contract::Error::TransportError(alloy::transports::RpcError::ErrorResp(
+                alloy::rpc::json_rpc::ErrorPayload {
+                    code: -32005,
+                    message: "project ID request rate exceeded".into(),
+                    data: Some(
+                        serde_json::value::to_raw_value(
+                            &serde_json::json!({ "rate": { "backoff_seconds": 30 } }),
+                        )
+                        .expect("raw json"),
+                    ),
+                },
+            )),
+        );
         assert!(matches!(err, InputReaderError::Provider(_)), "got {err:?}");
 
         // A contract revert also arrives as ErrorResp — that one IS terminal:
         // re-running against the same (wrong) address re-fails identically.
-        let err = map_contract_bootstrap_error(error_resp(3, "execution reverted"));
+        let err = map_contract_bootstrap_error("test call", error_resp(3, "execution reverted"));
         assert!(matches!(err, InputReaderError::Bootstrap(_)), "got {err:?}");
     }
 
@@ -1283,55 +1430,31 @@ mod tests {
     // ── ingest_input_added: pure decode of one (InputAdded, Log) pair ──
 
     fn evm_advance_payload(block_number: u64, index: u64) -> Vec<u8> {
-        use alloy::sol_types::SolCall;
-        cartesi_rollups_contracts::inputs::Inputs::EvmAdvanceCall {
-            chainId: U256::from(31337_u64),
-            appContract: Address::ZERO,
-            msgSender: Address::repeat_byte(0x11),
-            blockNumber: U256::from(block_number),
-            blockTimestamp: U256::from(1_700_000_000_u64),
-            prevRandao: U256::ZERO,
-            index: U256::from(index),
-            payload: vec![0xaa, 0xbb].into(),
-        }
-        .abi_encode()
-    }
-
-    fn input_added_pair(
-        topic_index: u64,
-        payload: Vec<u8>,
-        block_number: Option<u64>,
-        transaction_hash: Option<alloy_primitives::B256>,
-    ) -> (InputAdded, alloy::rpc::types::Log) {
-        let event = InputAdded {
-            appContract: Address::ZERO,
-            index: U256::from(topic_index),
-            input: payload.into(),
-        };
-        let log = alloy::rpc::types::Log {
-            inner: alloy_primitives::Log {
-                address: Address::ZERO,
-                data: alloy_primitives::LogData::new_unchecked(
-                    Vec::new(),
-                    alloy_primitives::Bytes::new(),
-                ),
-            },
-            block_hash: None,
+        evm_advance_payload_for(31337, Address::ZERO, block_number, index)
+    }
+
+    fn evm_advance_payload_for(
+        chain_id: u64,
+        app_contract: Address,
+        block_number: u64,
+        index: u64,
+    ) -> Vec<u8> {
+        crate::test_support::l1::evm_advance_input(
+            chain_id,
+            app_contract,
+            Address::repeat_byte(0x11),
             block_number,
-            block_timestamp: None,
-            transaction_hash,
-            transaction_index: Some(0),
-            log_index: Some(0),
-            removed: false,
-        };
-        (event, log)
+            index,
+            &[0xaa, 0xbb],
+        )
     }
 
     #[test]
     fn ingest_input_added_accepts_a_consistent_pair() {
         let tx = alloy_primitives::B256::repeat_byte(0xcc);
         let (event, log) = input_added_pair(5, evm_advance_payload(90, 5), Some(90), Some(tx));
-        let (onchain_index, input) = ingest_input_added(&event, &log).expect("consistent pair");
+        let (onchain_index, input) =
+            ingest_input_added(&event, &log, Address::ZERO, 31337).expect("consistent pair");
         assert_eq!(onchain_index, 5);
         assert_eq!(input.block_number, 90);
         assert_eq!(input.block_timestamp, 1_700_000_000);
@@ -1344,14 +1467,16 @@ mod tests {
     fn ingest_input_added_rejects_missing_log_provenance() {
         let tx = alloy_primitives::B256::repeat_byte(0xcc);
         let (event, log) = input_added_pair(5, evm_advance_payload(90, 5), None, Some(tx));
-        let err = ingest_input_added(&event, &log).expect_err("missing block_number");
+        let err = ingest_input_added(&event, &log, Address::ZERO, 31337)
+            .expect_err("missing block_number");
         assert!(
             matches!(&err, InputReaderError::InconsistentL1Response(m) if m.contains("block_number")),
             "got {err:?}"
         );
 
         let (event, log) = input_added_pair(5, evm_advance_payload(90, 5), Some(90), None);
-        let err = ingest_input_added(&event, &log).expect_err("missing transaction_hash");
+        let err = ingest_input_added(&event, &log, Address::ZERO, 31337)
+            .expect_err("missing transaction_hash");
         assert!(
             matches!(&err, InputReaderError::InconsistentL1Response(m) if m.contains("transaction_hash")),
             "got {err:?}"
@@ -1362,9 +1487,10 @@ mod tests {
     fn ingest_input_added_rejects_log_payload_block_number_mismatch() {
         let tx = alloy_primitives::B256::repeat_byte(0xcc);
         // Payload claims block 91, the log says 90 — the same self-contradiction
-        // the watchdog's `decode_and_validate_log` raises (and retries) on.
+        // the watchdog's `reader:inputs` (`watchdog/l1.lua`) raises, transiently.
         let (event, log) = input_added_pair(5, evm_advance_payload(91, 5), Some(90), Some(tx));
-        let err = ingest_input_added(&event, &log).expect_err("block number mismatch");
+        let err = ingest_input_added(&event, &log, Address::ZERO, 31337)
+            .expect_err("block number mismatch");
         assert!(
             matches!(&err, InputReaderError::InconsistentL1Response(m)
                 if m.contains("block number mismatch")),
@@ -1378,7 +1504,8 @@ mod tests {
         // The input-completeness witness reads the index from the topic; the watchdog reads it
         // from the payload. The cross-check keeps the two provably aligned.
         let (event, log) = input_added_pair(5, evm_advance_payload(90, 6), Some(90), Some(tx));
-        let err = ingest_input_added(&event, &log).expect_err("index mismatch");
+        let err =
+            ingest_input_added(&event, &log, Address::ZERO, 31337).expect_err("index mismatch");
         assert!(
             matches!(&err, InputReaderError::InconsistentL1Response(m)
                 if m.contains("index mismatch")),
@@ -1386,11 +1513,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ingest_input_added_rejects_a_payload_for_another_chain_or_application() {
+        let tx = alloy_primitives::B256::repeat_byte(0xcc);
+        let (event, log) = input_added_pair(
+            5,
+            evm_advance_payload_for(1, Address::ZERO, 90, 5),
+            Some(90),
+            Some(tx),
+        );
+        let err = ingest_input_added(&event, &log, Address::ZERO, 31337)
+            .expect_err("a payload for another chain");
+        assert!(
+            matches!(&err, InputReaderError::InconsistentL1Response(m)
+                if m.contains("chain id 1") && m.contains("pinned chain is 31337")),
+            "got {err:?}"
+        );
+
+        let other_app = Address::repeat_byte(0x22);
+        let (event, log) = input_added_pair(
+            5,
+            evm_advance_payload_for(31337, other_app, 90, 5),
+            Some(90),
+            Some(tx),
+        );
+        let err = ingest_input_added(&event, &log, Address::ZERO, 31337)
+            .expect_err("a payload for another application");
+        assert!(
+            matches!(&err, InputReaderError::InconsistentL1Response(m)
+                if m.contains(&other_app.to_string())),
+            "got {err:?}"
+        );
+    }
+
     #[test]
     fn ingest_input_added_rejects_undecodable_payload() {
         let tx = alloy_primitives::B256::repeat_byte(0xcc);
         let (event, log) = input_added_pair(5, vec![0xde, 0xad], Some(90), Some(tx));
-        let err = ingest_input_added(&event, &log).expect_err("undecodable payload");
+        let err = ingest_input_added(&event, &log, Address::ZERO, 31337)
+            .expect_err("undecodable payload");
         assert!(
             matches!(&err, InputReaderError::InconsistentL1Response(m)
                 if m.contains("decode EvmAdvance")),
@@ -1589,6 +1750,42 @@ mod tests {
         assert_eq!(storage.safe_input_end_exclusive().expect("count"), 0);
     }
 
+    #[tokio::test]
+    async fn a_log_without_a_position_is_an_inconsistent_response() {
+        let db_file = NamedTempFile::new().expect("temp file");
+        let mut reader = test_reader(
+            db_file.path().to_string_lossy().into_owned(),
+            "http://127.0.0.1:0".to_string(),
+            3,
+            Duration::from_secs(1),
+        );
+
+        // A mined log always carries its position: one without its tx index is
+        // the node's inconsistency, retried like any other.
+        let asserter = alloy::transports::mock::Asserter::new();
+        asserter.push_success(&alloy_primitives::U64::from(31337_u64));
+        asserter.push_success(&mock_safe_block(7));
+        asserter.push_success(&abi_u256(1));
+        let log: alloy::rpc::types::Log = alloy::rpc::types::Log {
+            block_number: Some(7),
+            log_index: Some(0),
+            ..Default::default()
+        };
+        asserter.push_success(&vec![log]);
+        let provider = alloy::providers::ProviderBuilder::new().connect_mocked_client(asserter);
+
+        let err = reader
+            .advance_once(&provider)
+            .await
+            .expect_err("a log without its tx index must not be ordered");
+        assert!(
+            matches!(&err, InputReaderError::InconsistentL1Response(m)
+                if m.contains("transaction_index")),
+            "got {err:?}"
+        );
+        assert!(err.is_retryable(), "{err:?}");
+    }
+
     #[tokio::test]
     async fn advance_once_falls_through_and_fails_completeness_when_count_exceeds_stored() {
         let db_file = NamedTempFile::new().expect("temp file");
@@ -1624,4 +1821,205 @@ mod tests {
             "a failed completeness witness must not persist a safe head"
         );
     }
+
+    #[tokio::test]
+    async fn advance_once_refuses_an_onchain_count_below_stored_without_scanning() {
+        let db_file = NamedTempFile::new().expect("temp file");
+        let db_path = db_file.path().to_string_lossy().into_owned();
+        let mut storage = Storage::open(&db_path).expect("open storage");
+        storage
+            .append_safe_inputs(
+                5,
+                &[crate::storage::StoredSafeInput {
+                    sender: Address::repeat_byte(0x11),
+                    payload: vec![0xaa],
+                    block_number: 5,
+                }],
+                Address::ZERO,
+                &test_timing(),
+            )
+            .expect("seed one stored direct input");
+        drop(storage);
+        let mut reader = test_reader(
+            db_path,
+            "http://127.0.0.1:0".to_string(),
+            3,
+            Duration::from_secs(1),
+        );
+
+        // chainId, safe head 7, count 0 at block 7 — nothing queued for
+        // eth_getLogs, so a scan would surface as a Provider error instead.
+        let asserter = alloy::transports::mock::Asserter::new();
+        asserter.push_success(&alloy_primitives::U64::from(31337_u64));
+        asserter.push_success(&mock_safe_block(7));
+        asserter.push_success(&abi_u256(0));
+        let provider = alloy::providers::ProviderBuilder::new().connect_mocked_client(asserter);
+
+        let err = reader
+            .advance_once(&provider)
+            .await
+            .expect_err("a count below the stored total must fail loud");
+        assert!(
+            matches!(&err, InputReaderError::InconsistentL1Response(m)
+                if m.contains("below the 1 inputs already stored")),
+            "got {err:?}"
+        );
+        assert_eq!(reader.current_safe_block().await.expect("read"), Some(5));
+    }
+
+    /// A mocked provider that records every JSON-RPC request, for tests that
+    /// pin which block a read targets (the asserter answers by position only).
+    fn recording_provider(
+        asserter: &alloy::transports::mock::Asserter,
+    ) -> (
+        alloy::providers::DynProvider,
+        std::sync::Arc<std::sync::Mutex<Vec<serde_json::Value>>>,
+    ) {
+        use alloy::providers::Provider;
+        use alloy::rpc::json_rpc::{RequestPacket, ResponsePacket};
+        use alloy::transports::{TransportError, TransportFut, mock::MockTransport};
+
+        #[derive(Clone)]
+        struct Recording {
+            inner: MockTransport,
+            requests: std::sync::Arc<std::sync::Mutex<Vec<serde_json::Value>>>,
+        }
+        impl tower::Service<RequestPacket> for Recording {
+            type Response = ResponsePacket;
+            type Error = TransportError;
+            type Future = TransportFut<'static>;
+            fn poll_ready(
+                &mut self,
+                cx: &mut std::task::Context<'_>,
+            ) -> std::task::Poll<Result<(), TransportError>> {
+                self.inner.poll_ready(cx)
+            }
+            fn call(&mut self, request: RequestPacket) -> Self::Future {
+                self.requests
+                    .lock()
+                    .expect("request log")
+                    .push(serde_json::to_value(&request).expect("request serializes"));
+                self.inner.call(request)
+            }
+        }
+
+        let requests = std::sync::Arc::default();
+        let transport = Recording {
+            inner: MockTransport::new(asserter.clone()),
+            requests: std::sync::Arc::clone(&requests),
+        };
+        let provider = alloy::providers::ProviderBuilder::new()
+            .connect_client(alloy::rpc::client::RpcClient::new(transport, true))
+            .erased();
+        (provider, requests)
+    }
+
+    fn requests_for<'a>(
+        requests: &'a [serde_json::Value],
+        method: &str,
+    ) -> Vec<&'a serde_json::Value> {
+        requests
+            .iter()
+            .filter(|request| request["method"] == method)
+            .collect()
+    }
+
+    /// A count read anywhere but the sampled safe block would let the skip
+    /// advance the head past inputs it never scanned.
+    #[tokio::test]
+    async fn advance_once_pins_the_count_and_the_scan_to_the_sampled_safe_block() {
+        use alloy::sol_types::SolEvent;
+
+        let db_file = NamedTempFile::new().expect("temp file");
+        let db_path = db_file.path().to_string_lossy().into_owned();
+        let mut storage = Storage::open(&db_path).expect("open storage");
+        storage
+            .append_safe_inputs(9, &[], Address::ZERO, &test_timing())
+            .expect("seed a persisted safe head");
+        drop(storage);
+
+        // Count 1 at the safe head: the scan runs over [10, 20].
+        let mut reader = test_reader(
+            db_path.clone(),
+            "http://127.0.0.1:0".into(),
+            3,
+            Duration::from_secs(1),
+        );
+        let asserter = alloy::transports::mock::Asserter::new();
+        let (event, mut log) = input_added_pair(
+            0,
+            evm_advance_payload(15, 0),
+            Some(15),
+            Some(alloy_primitives::B256::repeat_byte(0xaa)),
+        );
+        log.inner.data = event.encode_log_data();
+        asserter.push_success(&alloy_primitives::U64::from(31337_u64));
+        asserter.push_success(&mock_safe_block(20));
+        asserter.push_success(&abi_u256(1));
+        asserter.push_success(&vec![log]);
+        let (provider, requests) = recording_provider(&asserter);
+        reader.advance_once(&provider).await.expect("advance_once");
+        {
+            let requests = requests.lock().expect("request log");
+            let calls = requests_for(&requests, "eth_call");
+            assert_eq!(calls.len(), 1);
+            assert_eq!(calls[0]["params"][1], serde_json::json!("0x14"));
+            let scans = requests_for(&requests, "eth_getLogs");
+            assert_eq!(scans.len(), 1);
+            assert_eq!(scans[0]["params"][0]["fromBlock"], serde_json::json!("0xa"));
+            assert_eq!(scans[0]["params"][0]["toBlock"], serde_json::json!("0x14"));
+        }
+
+        // Count equal to the stored total at the next safe head: no scan.
+        let asserter = alloy::transports::mock::Asserter::new();
+        asserter.push_success(&mock_safe_block(30));
+        asserter.push_success(&abi_u256(1));
+        let (provider, requests) = recording_provider(&asserter);
+        reader.advance_once(&provider).await.expect("advance_once");
+        let requests = requests.lock().expect("request log");
+        let calls = requests_for(&requests, "eth_call");
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0]["params"][1], serde_json::json!("0x1e"));
+        assert!(requests_for(&requests, "eth_getLogs").is_empty());
+    }
+
+    #[tokio::test]
+    async fn advance_once_ingests_a_reordered_response_in_l1_order() {
+        use alloy::sol_types::SolEvent;
+
+        let db_file = NamedTempFile::new().expect("temp file");
+        let db_path = db_file.path().to_string_lossy().into_owned();
+        let mut reader = test_reader(
+            db_path.clone(),
+            "http://127.0.0.1:0".into(),
+            3,
+            Duration::from_secs(1),
+        );
+        let logs: Vec<_> = [(1_u64, 16_u64), (0, 15)]
+            .into_iter()
+            .map(|(index, block)| {
+                let (event, mut log) = input_added_pair(
+                    index,
+                    evm_advance_payload(block, index),
+                    Some(block),
+                    Some(alloy_primitives::B256::repeat_byte(0xaa)),
+                );
+                log.inner.data = event.encode_log_data();
+                log
+            })
+            .collect();
+        let asserter = alloy::transports::mock::Asserter::new();
+        asserter.push_success(&alloy_primitives::U64::from(31337_u64));
+        asserter.push_success(&mock_safe_block(20));
+        asserter.push_success(&abi_u256(2));
+        asserter.push_success(&logs);
+        let provider = alloy::providers::ProviderBuilder::new().connect_mocked_client(asserter);
+
+        reader
+            .advance_once(&provider)
+            .await
+            .expect("a reordered response is complete");
+        let mut storage = Storage::open(&db_path).expect("open storage");
+        assert_eq!(storage.safe_input_end_exclusive().expect("count"), 2);
+    }
 }
diff --git a/sequencer/src/l1/submitter/mod.rs b/sequencer/src/l1/submitter/mod.rs
index 36bf9df0..d2c76a86 100644
--- a/sequencer/src/l1/submitter/mod.rs
+++ b/sequencer/src/l1/submitter/mod.rs
@@ -1,14 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Batch submitter: posts closed batches to L1 with at-least-once semantics.
-//!
-//! Each valid closed batch has a structural nonce (`batches.nonce`, set at
-//! creation time as `parent.nonce + 1`). The scheduler accepts a batch only at
-//! its exact expected nonce and rejects mismatches *without consuming the
-//! nonce* (the staleness "skip" is a separate path) — at-least-once submission
-//! is safe precisely because duplicates and replays arrive at already-consumed
-//! nonces and are rejected. See `worker` for the tick loop.
+//! Batch submitter: posts closed batches to L1 at least once. Duplicates are safe
+//! because the scheduler accepts a batch only at its exact expected nonce and
+//! rejects others without consuming it (`docs/protocol/scheduler-semantics.md`).
+//! The tick loop is in `worker`.
 
 mod config;
 mod poster;
@@ -20,4 +16,4 @@ pub use poster::{
     BatchPosterConfig, BatchPosterError, EthereumBatchPoster, SubmitBatchesOutcome, TxHash,
 };
 pub(crate) use worker::BatchSubmitter;
-pub use worker::{BatchSubmitterError, SubmitterExit};
+pub use worker::BatchSubmitterError;
diff --git a/sequencer/src/l1/submitter/poster.rs b/sequencer/src/l1/submitter/poster.rs
index 6db3ef6f..a84f5a58 100644
--- a/sequencer/src/l1/submitter/poster.rs
+++ b/sequencer/src/l1/submitter/poster.rs
@@ -5,22 +5,21 @@
 //! Re-estimates fees each tick without carrying a fee floor from earlier attempts.
 //! Fee policy, accepted liveness limits, and revisit criteria: `docs/l1-fee-policy.md`.
 
-use alloy::providers::{
-    DynProvider, PendingTransactionBuilder, PendingTransactionConfig, PendingTransactionError,
-    Provider,
-};
+use alloy::providers::{PendingTransactionConfig, PendingTransactionError, Provider};
 use alloy::rpc::types::BlockNumberOrTag;
+use alloy::rpc::types::Log;
+use alloy_primitives::{Address, U256};
 use async_trait::async_trait;
 use cartesi_rollups_contracts::input_box::InputBox;
+use cartesi_rollups_contracts::input_box::InputBox::InputAdded;
 use sequencer_core::batch::Batch;
-use std::future::Future;
 use thiserror::Error;
 use tracing::{debug, info, warn};
 
 use crate::l1::eip1559::{Eip1559Fees, estimate_fees, pad_gas_estimate};
 use crate::l1::partition::{decode_evm_advance_input, get_input_added_events_ordered};
+use crate::l1::provider::{KeyedProviders, SendError, error_chain};
 use crate::l1::watermark::{WalletNonceWatermarkError, WalletNonceWatermarkSink};
-use crate::runtime::shutdown::RuntimeScope;
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
@@ -41,13 +40,7 @@ pub struct BatchPosterConfig {
     /// Assumed L1 block time in seconds, used to derive a conservative
     /// confirmation timeout for watched batch-submission txs.
     pub seconds_per_block: u64,
-    /// Error codes that trigger `get_logs` retries with a shorter block range.
-    pub long_block_range_error_codes: Vec<String>,
-    /// The pinned deployment chain id. Re-confirmed against the RPC immediately
-    /// before every productive send (`submit_batches`), so a long-lived
-    /// submitter whose load-balanced RPC fails over to another chain refuses to
-    /// burn nonce slots on it rather than relying only on the one-shot boot /
-    /// reader checks.
+    /// The pinned chain id; `submit_batches` rechecks it before every productive send.
     pub expected_chain_id: u64,
 }
 
@@ -58,15 +51,32 @@ pub enum BatchPosterError {
     #[error("rpc chain id {rpc} does not match pinned chain id {expected}")]
     ChainIdMismatch { rpc: u64, expected: u64 },
     #[error(
-        "wallet nonce range starting at {first_nonce} for {batch_count} batches \
+        "wallet nonce range starting at {first_wallet_nonce} for {batch_count} batches \
          cannot be represented durably"
     )]
     WalletNonceRangeUnrepresentable {
-        first_nonce: u64,
+        first_wallet_nonce: u64,
         batch_count: usize,
     },
-    #[error("runtime shutdown cancelled L1 submission")]
-    Shutdown,
+    /// The submit provider could not sign a batch transaction this poster
+    /// built: a field is missing. A defect, not a condition a retry heals.
+    #[error("batch transaction not signable: {0}")]
+    UnsignableTransaction(String),
+    /// A batch from our own submitter key that does not decode. This key sends
+    /// only batches this sequencer encoded, so the landing is evidence of a
+    /// leaked key or an encoder bug to investigate under self-trust, not a
+    /// provider fault. It stays in the scan window, and re-fails a restart,
+    /// until its block is safe.
+    #[error(
+        "undecodable batch from our submitter key at InputAdded index {input_index} \
+         (tx {transaction_hash:?}): {reason}; a leaked key or an encoder bug: investigate \
+         before restarting (a restart re-fails until the landing's block is safe)"
+    )]
+    UndecodableOwnBatch {
+        input_index: U256,
+        transaction_hash: Option<TxHash>,
+        reason: String,
+    },
     #[error(transparent)]
     Watermark(#[from] WalletNonceWatermarkError),
 }
@@ -76,9 +86,12 @@ impl BatchPosterError {
         // Exhaustive on purpose: a new variant must decide its terminality
         // here, not silently default to restartable.
         match self {
-            Self::ChainIdMismatch { .. } | Self::WalletNonceRangeUnrepresentable { .. } => true,
+            Self::ChainIdMismatch { .. }
+            | Self::WalletNonceRangeUnrepresentable { .. }
+            | Self::UnsignableTransaction(_)
+            | Self::UndecodableOwnBatch { .. } => true,
             Self::Watermark(source) => source.is_persistent_invariant(),
-            Self::Provider(_) | Self::Shutdown => false,
+            Self::Provider(_) => false,
         }
     }
 }
@@ -87,8 +100,8 @@ impl BatchPosterError {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum SubmitBatchesOutcome {
     /// Every payload was broadcast this tick and confirmed to depth: one hash
-    /// per payload, in nonce order. The worker re-enters at once to pick up
-    /// newly closed batches.
+    /// per payload, in wallet-nonce order. The worker re-enters at once to
+    /// pick up newly closed batches.
     Submitted(Vec<TxHash>),
     /// A re-broadcast met a mempool conflict or a confirmation watch timed
     /// out. The worker sleeps before re-estimating; this outcome makes no
@@ -100,7 +113,7 @@ pub enum SubmitBatchesOutcome {
 #[async_trait]
 pub(crate) trait BatchPoster: Send + Sync {
     /// Broadcast the payloads as L1 txs at consecutive wallet nonces.
-    /// Implementations must raise `watermark` to the highest nonce they
+    /// Implementations must raise `watermark` to the highest wallet nonce they
     /// are about to use *before* the first send (write-before-broadcast).
     async fn submit_batches(
         &self,
@@ -145,7 +158,7 @@ impl PendingSince {
 
 #[derive(Clone)]
 pub struct EthereumBatchPoster {
-    provider: DynProvider,
+    providers: KeyedProviders,
     config: BatchPosterConfig,
     /// Wallet nonces this process has attempted that Latest has not yet
     /// passed. Observability only — nothing reads it to decide a price. Pruned
@@ -153,20 +166,17 @@ pub struct EthereumBatchPoster {
     /// clock measures how long the slot has been unresolved, whatever the
     /// cause.
     pending: Arc<Mutex<BTreeMap<u64, PendingSince>>>,
-    /// Test-only: next `send_batch_at_nonce` returns this error string without
-    /// broadcasting, so tests can drive the error-classification paths.
+    /// Test-only: next `send_batch_at_wallet_nonce` returns this error string
+    /// without broadcasting, so tests can drive the error-classification paths.
     #[cfg(test)]
     fail_next_send: Arc<Mutex<Option<String>>>,
-    /// Cancels pending keyed sends during ordinary shutdown.
-    shutdown: RuntimeScope,
 }
 
 impl EthereumBatchPoster {
-    pub fn new(provider: DynProvider, config: BatchPosterConfig, shutdown: RuntimeScope) -> Self {
+    pub fn new(providers: KeyedProviders, config: BatchPosterConfig) -> Self {
         Self {
-            provider,
+            providers,
             config,
-            shutdown,
             pending: Arc::new(Mutex::new(BTreeMap::new())),
             #[cfg(test)]
             fail_next_send: Arc::new(Mutex::new(None)),
@@ -179,7 +189,7 @@ impl EthereumBatchPoster {
     }
 
     #[cfg(test)]
-    pub(crate) fn pending_nonces_for_test(&self) -> Vec<u64> {
+    pub(crate) fn pending_wallet_nonces_for_test(&self) -> Vec<u64> {
         self.pending
             .lock()
             .expect("pending lock")
@@ -198,18 +208,18 @@ impl EthereumBatchPoster {
         )
     }
 
-    /// Record an attempt at `nonce` (first attempt starts its clock) and warn
-    /// if it has been unresolved for too long.
-    fn track_pending(&self, nonce: u64) {
+    /// Record an attempt at `wallet_nonce` (first attempt starts its clock) and
+    /// warn if it has been unresolved for too long.
+    fn track_pending(&self, wallet_nonce: u64) {
         let now = Instant::now();
         let mut pending = self.pending.lock().expect("pending lock");
         let entry = pending
-            .entry(nonce)
+            .entry(wallet_nonce)
             .or_insert_with(|| PendingSince::new(now));
         if entry.should_warn(now) {
             entry.last_warned = Some(now);
             warn!(
-                tx_nonce = nonce,
+                wallet_nonce,
                 pending_secs = now.duration_since(entry.since).as_secs(),
                 "batch tx at this wallet nonce has been unresolved longer than expected \
                  (see docs/l1-fee-policy.md)"
@@ -217,36 +227,37 @@ impl EthereumBatchPoster {
         }
     }
 
-    /// Mark a refused re-broadcast at `nonce`; true the first time.
-    fn note_refused(&self, nonce: u64) -> bool {
+    /// Mark a refused re-broadcast at `wallet_nonce`; true the first time.
+    fn note_refused(&self, wallet_nonce: u64) -> bool {
         let mut pending = self.pending.lock().expect("pending lock");
         let entry = pending
-            .entry(nonce)
+            .entry(wallet_nonce)
             .or_insert_with(|| PendingSince::new(Instant::now()));
         !std::mem::replace(&mut entry.refused_once, true)
     }
 
-    fn prune_pending_below(&self, latest_nonce: u64) {
+    fn prune_pending_below(&self, latest_wallet_nonce: u64) {
         self.pending
             .lock()
             .expect("pending lock")
-            .retain(|&nonce, _| nonce >= latest_nonce);
+            .retain(|&wallet_nonce, _| wallet_nonce >= latest_wallet_nonce);
     }
 
-    async fn latest_account_nonce(&self) -> Result<u64, BatchPosterError> {
-        self.provider
+    async fn latest_wallet_nonce(&self) -> Result<u64, BatchPosterError> {
+        self.providers
+            .read
             .get_transaction_count(self.config.batch_submitter_address)
             .block_id(BlockNumberOrTag::Latest.into())
             .await
-            .map_err(|err| BatchPosterError::Provider(err.to_string()))
+            .map_err(|err| provider_error("eth_getTransactionCount(latest)", err))
     }
 
-    async fn send_batch_at_nonce(
+    async fn send_batch_at_wallet_nonce(
         &self,
         payload: Vec<u8>,
-        nonce: u64,
+        wallet_nonce: u64,
         fees: &Eip1559Fees,
-    ) -> Result<PendingTransactionBuilder<alloy::network::Ethereum>, BatchPosterError> {
+    ) -> Result<TxHash, BatchPosterError> {
         #[cfg(test)]
         {
             if let Some(message) = self
@@ -258,9 +269,10 @@ impl EthereumBatchPoster {
                 return Err(BatchPosterError::Provider(message));
             }
         }
-        let input_box = InputBox::new(self.config.l1_submit_address, &self.provider);
+        let input_box = InputBox::new(self.config.l1_submit_address, &self.providers.read);
         let call = input_box
             .addInput(self.config.app_address, payload.into())
+            .from(self.config.batch_submitter_address)
             .max_fee_per_gas(fees.max_fee_per_gas)
             .max_priority_fee_per_gas(fees.max_priority_fee_per_gas)
             // Estimate at Latest and without the nonce. Anvil applies
@@ -270,20 +282,27 @@ impl EthereumBatchPoster {
             // estimates, so only local/CI runs are affected).
             .block(BlockNumberOrTag::Latest.into());
 
-        // Pin the padded estimate before the send. With gas and both fee
-        // fields set, the GasFiller is Finished, so this estimate replaces
-        // the filler's rather than adding a round-trip.
-        let gas = pad_gas_estimate(
-            call.estimate_gas()
-                .await
-                .map_err(|err| BatchPosterError::Provider(err.to_string()))?,
-        );
+        // The submit provider fills only the pinned chain id and the
+        // signature, so every other field is set here.
+        let gas = pad_gas_estimate(call.estimate_gas().await.map_err(|err| {
+            provider_error(
+                format_args!("eth_estimateGas wallet_nonce={wallet_nonce}"),
+                err,
+            )
+        })?);
 
-        call.gas(gas)
-            .nonce(nonce)
-            .send()
+        let tx = call.gas(gas).nonce(wallet_nonce).into_transaction_request();
+        self.providers
+            .submit
+            .send(tx)
             .await
-            .map_err(|err| BatchPosterError::Provider(err.to_string()))
+            .map_err(|err| match err {
+                SendError::Unsignable(message) => BatchPosterError::UnsignableTransaction(message),
+                SendError::Rpc(err) => provider_error(
+                    format_args!("eth_sendRawTransaction wallet_nonce={wallet_nonce}"),
+                    err,
+                ),
+            })
     }
 
     /// Wait serially for each tx to reach `confirmation_depth + 1`
@@ -297,7 +316,7 @@ impl EthereumBatchPoster {
             let watch = PendingTransactionConfig::new(*tx_hash)
                 .with_required_confirmations(self.config.confirmation_depth.saturating_add(1))
                 .with_timeout(Some(timeout))
-                .with_provider(self.provider.root().clone());
+                .with_provider(self.providers.read.root().clone());
             match watch.watch().await {
                 Ok(_) => {
                     info!(
@@ -318,7 +337,12 @@ impl EthereumBatchPoster {
                     );
                     return Ok(false);
                 }
-                Err(err) => return Err(BatchPosterError::Provider(err.to_string())),
+                Err(err) => {
+                    return Err(provider_error(
+                        format_args!("confirmation watch tx={tx_hash}"),
+                        err,
+                    ));
+                }
             }
         }
 
@@ -326,8 +350,16 @@ impl EthereumBatchPoster {
     }
 }
 
-/// The node already holds our tx at this nonce and this send does not beat
-/// it. Two replies mean that: a byte-identical re-send ("already known" on
+/// Label a provider failure with the call that failed.
+fn provider_error(
+    operation: impl std::fmt::Display,
+    err: impl std::error::Error + 'static,
+) -> BatchPosterError {
+    BatchPosterError::Provider(format!("{operation}: {}", error_chain(&err)))
+}
+
+/// The node already holds our tx at this wallet nonce and this send does not
+/// beat it. Two replies mean that: a byte-identical re-send ("already known" on
 /// geth/erigon, "already imported" on Anvil/reth, "known transaction" on
 /// Besu, "AlreadyKnown" on Nethermind) and a fee-different one that fails the
 /// ≥10% rule on either component ("replacement transaction underpriced" on
@@ -335,10 +367,11 @@ impl EthereumBatchPoster {
 /// Matched case-insensitively on the provider's error text.
 ///
 /// A client that words it differently falls back to the generic
-/// transient-error path — error log, idle-poll retry, and the tick aborted at
-/// that nonce, so newly closed batches behind it wait for it to clear. That
-/// is exactly what every rejected re-broadcast did before this classification
-/// existed; the classified path is what lets the rest of the suffix go out.
+/// transient-error path — warn log, idle-poll retry, and the tick aborted at
+/// that wallet nonce, so newly closed batches behind it wait for it to clear.
+/// That is exactly what every rejected re-broadcast did before this
+/// classification existed; the classified path is what lets the rest of the
+/// suffix go out.
 fn is_pending_tx_conflict(err: &str) -> bool {
     let err = err.to_ascii_lowercase();
     err.contains("replacement transaction underpriced")
@@ -355,31 +388,22 @@ fn derive_confirmation_timeout(confirmation_depth: u64, seconds_per_block: u64)
 }
 
 fn checked_highest_wallet_nonce(
-    first_nonce: u64,
+    first_wallet_nonce: u64,
     batch_count: usize,
 ) -> Result<u64, BatchPosterError> {
     let invalid = || BatchPosterError::WalletNonceRangeUnrepresentable {
-        first_nonce,
+        first_wallet_nonce,
         batch_count,
     };
     let count = u64::try_from(batch_count).map_err(|_| invalid())?;
     let last_offset = count.checked_sub(1).ok_or_else(invalid)?;
-    let highest = first_nonce.checked_add(last_offset).ok_or_else(invalid)?;
+    let highest = first_wallet_nonce
+        .checked_add(last_offset)
+        .ok_or_else(invalid)?;
     i64::try_from(highest).map_err(|_| invalid())?;
     Ok(highest)
 }
 
-async fn externalize_provider_call<T>(
-    shutdown: &RuntimeScope,
-    call: impl Future<Output = Result<T, BatchPosterError>>,
-) -> Result<T, BatchPosterError> {
-    tokio::select! {
-        biased;
-        _ = shutdown.wait_for_shutdown() => Err(BatchPosterError::Shutdown),
-        result = call => result,
-    }
-}
-
 #[async_trait]
 impl BatchPoster for EthereumBatchPoster {
     async fn submit_batches(
@@ -391,20 +415,19 @@ impl BatchPoster for EthereumBatchPoster {
             return Ok(SubmitBatchesOutcome::Submitted(Vec::new()));
         }
 
-        // Keyed-write chain-id gate (review): re-confirm the RPC still serves the
-        // pinned chain immediately before any productive send. The submitter is
-        // long-lived — its signing provider is built once at spawn and the
-        // boot-time / reader chain-id checks are one-shot — so a load-balanced
-        // RPC that fails over to another chain mid-life would otherwise burn
-        // submitter nonce slots on the wrong chain. Reached only when there is
-        // something to send (the empty early-return above), so idle ticks add no
-        // RPC load. A mismatch is terminal (lifted out of the transient bucket by
-        // the submitter run-loop); a transient RPC error retries like any blip.
+        // Recheck the chain id before any productive send. Signatures carry the
+        // pinned id, so nothing lands on another chain, but an endpoint serving
+        // another chain would feed this tick that chain's wallet nonce and fees,
+        // and raise the durable watermark (I14) to that nonce.
+        // The threat model's one-consistent-node rule excludes that; the check
+        // costs one call per productive tick. Revisit when a fallback RPC tier lands.
+        // A mismatch is terminal; an RPC error retries.
         let rpc_chain_id = self
-            .provider
+            .providers
+            .read
             .get_chain_id()
             .await
-            .map_err(|err| BatchPosterError::Provider(err.to_string()))?;
+            .map_err(|err| provider_error("eth_chainId", err))?;
         if rpc_chain_id != self.config.expected_chain_id {
             return Err(BatchPosterError::ChainIdMismatch {
                 rpc: rpc_chain_id,
@@ -413,17 +436,18 @@ impl BatchPoster for EthereumBatchPoster {
         }
 
         // This tick's market price, used as-is for every send.
-        let fees = estimate_fees(&self.provider)
+        let fees = estimate_fees(&self.providers.read)
             .await
             .map_err(BatchPosterError::Provider)?;
-        let first_nonce = self.latest_account_nonce().await?;
-        self.prune_pending_below(first_nonce);
+        let first_wallet_nonce = self.latest_wallet_nonce().await?;
+        self.prune_pending_below(first_wallet_nonce);
 
-        // Write-before-broadcast: durably cover every nonce this
+        // Write-before-broadcast: durably cover every wallet nonce this
         // tick will use before the first send. One raise to the highest
         // covers the whole consecutive range.
-        let highest_nonce = checked_highest_wallet_nonce(first_nonce, payloads.len())?;
-        watermark.raise_to(highest_nonce)?;
+        let highest_wallet_nonce =
+            checked_highest_wallet_nonce(first_wallet_nonce, payloads.len())?;
+        watermark.raise_to(highest_wallet_nonce)?;
 
         let mut broadcast = Vec::with_capacity(payloads.len());
         let mut any_refused = false;
@@ -435,20 +459,17 @@ impl BatchPoster for EthereumBatchPoster {
         for (offset, payload) in payloads.into_iter().enumerate() {
             let offset =
                 u64::try_from(offset).expect("validated wallet-nonce range offset must fit in u64");
-            let nonce = first_nonce
+            let wallet_nonce = first_wallet_nonce
                 .checked_add(offset)
                 .expect("validated wallet-nonce range must not overflow");
-            self.track_pending(nonce);
-            match externalize_provider_call(
-                &self.shutdown,
-                self.send_batch_at_nonce(payload, nonce, &fees),
-            )
-            .await
+            self.track_pending(wallet_nonce);
+            match self
+                .send_batch_at_wallet_nonce(payload, wallet_nonce, &fees)
+                .await
             {
-                Ok(pending) => {
-                    let tx_hash = *pending.tx_hash();
+                Ok(tx_hash) => {
                     debug!(
-                        tx_nonce = nonce,
+                        wallet_nonce,
                         %tx_hash,
                         max_fee_per_gas = fees.max_fee_per_gas,
                         max_priority_fee_per_gas = fees.max_priority_fee_per_gas,
@@ -458,18 +479,18 @@ impl BatchPoster for EthereumBatchPoster {
                     broadcast.push(tx_hash);
                 }
                 Err(BatchPosterError::Provider(ref msg)) if is_pending_tx_conflict(msg) => {
-                    // The mempool already holds our tx at this nonce and this
-                    // tick's estimate does not beat it. Not an error: keep
+                    // The mempool already holds our tx at this wallet nonce and
+                    // this tick's estimate does not beat it. Not an error: keep
                     // going so a longer suffix still gets its fresh sends, and
                     // let the worker sleep before the next estimate.
-                    if self.note_refused(nonce) {
+                    if self.note_refused(wallet_nonce) {
                         info!(
-                            tx_nonce = nonce,
+                            wallet_nonce,
                             reason = %msg,
                             "batch tx already in the mempool at a price this estimate cannot beat; waiting on the fee market"
                         );
                     } else {
-                        debug!(tx_nonce = nonce, reason = %msg, "still waiting on the fee market");
+                        debug!(wallet_nonce, reason = %msg, "still waiting on the fee market");
                     }
                     any_refused = true;
                     head_refused |= broadcast.is_empty();
@@ -495,55 +516,74 @@ impl BatchPoster for EthereumBatchPoster {
         from_block: u64,
     ) -> Result<Vec<u64>, BatchPosterError> {
         let latest = self
-            .provider
+            .providers
+            .read
             .get_block_number()
             .await
-            .map_err(|err| BatchPosterError::Provider(err.to_string()))?;
+            .map_err(|err| provider_error("eth_blockNumber", err))?;
         let start_block = from_block.max(self.config.start_block);
         if start_block > latest {
             return Ok(Vec::new());
         }
 
-        // Ordered fetch: `advance_expected_batch_nonce` folds these nonces
+        // Ordered fetch: `decide_submit_start` folds these nonces
         // assuming L1 event order, so a raw `eth_getLogs` reorder would
         // under-advance the frontier and resubmit an already-mined suffix
         // (wasted gas + InputBox noise). The `_ordered` helper guarantees the
         // canonical (block, tx_index, log_index) order — the same the reader
         // relies on for its contiguity check.
         let events = get_input_added_events_ordered(
-            &self.provider,
+            &self.providers.read,
             self.config.app_address,
             &self.config.l1_submit_address,
             start_block,
             latest,
-            self.config.long_block_range_error_codes.as_slice(),
         )
         .await
-        .map_err(|err| BatchPosterError::Provider(format!("get_input_added_events: {err}")))?;
+        .map_err(|err| BatchPosterError::Provider(error_chain(&err)))?;
 
         let mut observed_nonces = Vec::new();
-        for (event, _log) in events {
-            let evm_advance = decode_evm_advance_input(event.input.as_ref()).map_err(|err| {
-                BatchPosterError::Provider(format!(
-                    "decode EvmAdvance for InputAdded index {}: {err}",
-                    event.index
-                ))
-            })?;
-            if evm_advance.msgSender != self.config.batch_submitter_address {
-                continue;
+        for (event, log) in events {
+            if let Some(nonce) = own_batch_nonce(&event, &log, self.config.batch_submitter_address)?
+            {
+                observed_nonces.push(nonce);
             }
-            // This dedicated key emits our own well-formed batches. A decode
-            // failure is evidence to investigate under self-trust, not an
-            // untrusted direct input to skip (docs/threat-model/README.md).
-            let batch: Batch = ssz::Decode::from_ssz_bytes(evm_advance.payload.as_ref())
-                .map_err(|err| BatchPosterError::Provider(format!("{err:?}")))?;
-            observed_nonces.push(batch.nonce);
         }
 
         Ok(observed_nonces)
     }
 }
 
+/// The batch nonce of an `InputAdded` sent by `submitter`; `None` for any
+/// other sender.
+fn own_batch_nonce(
+    event: &InputAdded,
+    log: &Log,
+    submitter: Address,
+) -> Result<Option<u64>, BatchPosterError> {
+    let evm_advance = decode_evm_advance_input(event.input.as_ref()).map_err(|err| {
+        BatchPosterError::Provider(format!(
+            "decode EvmAdvance for InputAdded index {}: {err}",
+            event.index
+        ))
+    })?;
+    if evm_advance.msgSender != submitter {
+        return Ok(None);
+    }
+    // This dedicated key emits our own well-formed batches. A decode
+    // failure is evidence to investigate under self-trust, not an
+    // untrusted direct input to skip (docs/threat-model/README.md).
+    let batch: Batch =
+        ssz::Decode::from_ssz_bytes(evm_advance.payload.as_ref()).map_err(|err| {
+            BatchPosterError::UndecodableOwnBatch {
+                input_index: event.index,
+                transaction_hash: log.transaction_hash,
+                reason: format!("{err:?}"),
+            }
+        })?;
+    Ok(Some(batch.nonce))
+}
+
 #[cfg(test)]
 pub(crate) mod mock {
     use super::{Batch, BatchPoster, BatchPosterError, SubmitBatchesOutcome, TxHash};
@@ -662,11 +702,24 @@ mod tests {
     use super::{
         BatchPoster, BatchPosterConfig, BatchPosterError, EthereumBatchPoster,
         PENDING_WAIT_WARN_AFTER, PendingSince, SubmitBatchesOutcome, checked_highest_wallet_nonce,
-        derive_confirmation_timeout, externalize_provider_call, is_pending_tx_conflict,
-        mock::MockBatchPoster,
+        derive_confirmation_timeout, is_pending_tx_conflict, mock::MockBatchPoster,
     };
+
+    #[test]
+    fn pending_tx_conflict_survives_operation_label() {
+        let BatchPosterError::Provider(message) = super::provider_error(
+            format_args!("eth_sendRawTransaction wallet_nonce=3"),
+            std::io::Error::other("replacement transaction underpriced"),
+        ) else {
+            panic!("provider_error builds a Provider error");
+        };
+        assert!(
+            message.starts_with("eth_sendRawTransaction wallet_nonce=3: "),
+            "{message}"
+        );
+        assert!(super::is_pending_tx_conflict(&message), "{message}");
+    }
     use crate::l1::watermark::{WalletNonceWatermarkError, WalletNonceWatermarkSink};
-    use crate::runtime::shutdown::RuntimeScope;
     use alloy::node_bindings::Anvil;
     use alloy::providers::Provider;
     use alloy::rpc::types::BlockNumberOrTag;
@@ -679,6 +732,55 @@ mod tests {
         }
     }
 
+    #[test]
+    fn own_batch_nonce_refuses_an_undecodable_own_batch() {
+        use crate::test_support::l1::{evm_advance_input, input_added_pair};
+        use alloy_primitives::{Address, B256, U256};
+
+        let tx = B256::repeat_byte(0xcc);
+        let landing = |sender, payload: &[u8]| {
+            input_added_pair(
+                7,
+                evm_advance_input(31337, Address::ZERO, sender, 90, 7, payload),
+                Some(90),
+                Some(tx),
+            )
+        };
+
+        let (event, log) = landing(SUBMITTER, &[0xde, 0xad]);
+        let error = super::own_batch_nonce(&event, &log, SUBMITTER)
+            .expect_err("our key never sends undecodable bytes");
+        assert!(
+            matches!(
+                &error,
+                BatchPosterError::UndecodableOwnBatch {
+                    input_index,
+                    transaction_hash: Some(hash),
+                    ..
+                } if *input_index == U256::from(7) && *hash == tx
+            ),
+            "{error:?}"
+        );
+        assert!(error.is_terminal_invariant());
+
+        // Another sender's bytes are not ours to decode.
+        let (event, log) = landing(Address::repeat_byte(0x99), &[0xde, 0xad]);
+        assert_eq!(
+            super::own_batch_nonce(&event, &log, SUBMITTER).expect("not ours"),
+            None
+        );
+
+        let batch = ssz::Encode::as_ssz_bytes(&super::Batch {
+            nonce: 3,
+            frames: Vec::new(),
+        });
+        let (event, log) = landing(SUBMITTER, &batch);
+        assert_eq!(
+            super::own_batch_nonce(&event, &log, SUBMITTER).expect("our batch"),
+            Some(3)
+        );
+    }
+
     #[test]
     fn wallet_nonce_range_is_checked_before_watermark_or_broadcast() {
         assert_eq!(
@@ -695,30 +797,6 @@ mod tests {
         ));
     }
 
-    #[tokio::test]
-    async fn ordinary_shutdown_cancels_provider_send_without_terminal_classification() {
-        let shutdown = RuntimeScope::default();
-        let (started_tx, started_rx) = tokio::sync::oneshot::channel();
-        let send = tokio::spawn({
-            let shutdown = shutdown.clone();
-            async move {
-                externalize_provider_call(&shutdown, async move {
-                    started_tx.send(()).expect("mark provider send started");
-                    std::future::pending::<Result<(), BatchPosterError>>().await
-                })
-                .await
-            }
-        });
-        started_rx.await.expect("provider send acquired the gate");
-
-        shutdown.request_shutdown();
-
-        assert!(matches!(
-            send.await.expect("provider send task"),
-            Err(BatchPosterError::Shutdown)
-        ));
-    }
-
     fn require_anvil() {
         assert!(
             std::process::Command::new("anvil")
@@ -763,8 +841,14 @@ mod tests {
         fn raise_to(&self, highest: u64) -> Result<(), WalletNonceWatermarkError> {
             self.calls.lock().expect("lock").push(highest);
             if self.fail {
-                Err(WalletNonceWatermarkError::Other(
-                    "recording sink: forced failure".to_string(),
+                Err(WalletNonceWatermarkError::Storage(
+                    rusqlite::Error::SqliteFailure(
+                        rusqlite::ffi::Error {
+                            code: rusqlite::ffi::ErrorCode::DatabaseBusy,
+                            extended_code: 5,
+                        },
+                        None,
+                    ),
                 ))
             } else {
                 Ok(())
@@ -787,7 +871,6 @@ mod tests {
             // keep it short so --no-mining ticks return promptly on timeout.
             confirmation_depth: 0,
             seconds_per_block: 1,
-            long_block_range_error_codes: vec![],
             expected_chain_id: anvil.chain_id(),
         }
     }
@@ -805,16 +888,17 @@ mod tests {
     async fn submit_batches_raises_watermark_before_any_send() {
         require_anvil();
         let anvil = Anvil::default().spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
-        let poster = EthereumBatchPoster::new(
-            provider.clone(),
-            poster_config(&anvil),
-            RuntimeScope::default(),
-        );
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let provider = providers.read.clone();
+        let poster = EthereumBatchPoster::new(providers, poster_config(&anvil));
 
-        let base_nonce = provider
+        let base_wallet_nonce = provider
             .get_transaction_count(SUBMITTER)
             .await
             .expect("base nonce");
@@ -827,7 +911,7 @@ mod tests {
             matches!(
                 result,
                 Err(BatchPosterError::Watermark(
-                    WalletNonceWatermarkError::Other(_)
+                    WalletNonceWatermarkError::Storage(_)
                 ))
             ),
             "a failing watermark sink must abort submit_batches, got {result:?}"
@@ -835,8 +919,8 @@ mod tests {
         // (a) raised exactly once, (b) to the highest nonce of the range.
         assert_eq!(
             sink.calls(),
-            vec![base_nonce + 2],
-            "raise_to must be called once with base_nonce + payloads.len() - 1"
+            vec![base_wallet_nonce + 2],
+            "raise_to must be called once with base_wallet_nonce + payloads.len() - 1"
         );
         // (c) before any send — no tx broadcast, so pending nonce is unchanged.
         let pending = provider
@@ -845,7 +929,7 @@ mod tests {
             .await
             .expect("pending nonce");
         assert_eq!(
-            pending, base_nonce,
+            pending, base_wallet_nonce,
             "raise_to must run before any send; a broadcast would have bumped the pending nonce"
         );
     }
@@ -859,18 +943,23 @@ mod tests {
     async fn submit_batches_refuses_on_wrong_chain_before_any_work() {
         require_anvil();
         let anvil = Anvil::default().spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let provider = providers.read.clone();
 
         let wrong_chain_id = anvil.chain_id() + 1;
         let config = BatchPosterConfig {
             expected_chain_id: wrong_chain_id,
             ..poster_config(&anvil)
         };
-        let poster = EthereumBatchPoster::new(provider.clone(), config, RuntimeScope::default());
+        let poster = EthereumBatchPoster::new(providers, config);
 
-        let base_nonce = provider
+        let base_wallet_nonce = provider
             .get_transaction_count(SUBMITTER)
             .await
             .expect("base nonce");
@@ -900,7 +989,7 @@ mod tests {
             .await
             .expect("pending nonce");
         assert_eq!(
-            pending, base_nonce,
+            pending, base_wallet_nonce,
             "no tx may be broadcast on the wrong chain"
         );
     }
@@ -979,17 +1068,18 @@ mod tests {
     async fn submit_batches_waits_when_mempool_already_holds_the_tx() {
         require_anvil();
         let anvil = Anvil::default().arg("--no-mining").timeout(30_000).spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
-        let poster = EthereumBatchPoster::new(
-            provider.clone(),
-            poster_config(&anvil),
-            RuntimeScope::default(),
-        );
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let provider = providers.read.clone();
+        let poster = EthereumBatchPoster::new(providers, poster_config(&anvil));
         let sink = RecordingWatermarkSink::passing();
 
-        let base_nonce = provider
+        let base_wallet_nonce = provider
             .get_transaction_count(SUBMITTER)
             .await
             .expect("base nonce");
@@ -1016,14 +1106,21 @@ mod tests {
                 broadcast: Vec::new()
             }
         );
-        assert_eq!(poster.pending_nonces_for_test(), vec![base_nonce]);
+        assert_eq!(
+            poster.pending_wallet_nonces_for_test(),
+            vec![base_wallet_nonce]
+        );
 
         let pending = provider
             .get_transaction_count(SUBMITTER)
             .block_id(BlockNumberOrTag::Pending.into())
             .await
             .expect("pending nonce");
-        assert_eq!(pending, base_nonce + 1, "still exactly one pending slot");
+        assert_eq!(
+            pending,
+            base_wallet_nonce + 1,
+            "still exactly one pending slot"
+        );
 
         // 3) Mining resumes: the original lands; nothing replaced it.
         let _: serde_json::Value = provider
@@ -1046,17 +1143,18 @@ mod tests {
     async fn submit_batches_reports_submitted_once_confirmed() {
         require_anvil();
         let anvil = Anvil::default().timeout(30_000).spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
-        let poster = EthereumBatchPoster::new(
-            provider.clone(),
-            poster_config(&anvil),
-            RuntimeScope::default(),
-        );
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let provider = providers.read.clone();
+        let poster = EthereumBatchPoster::new(providers, poster_config(&anvil));
         let sink = RecordingWatermarkSink::passing();
 
-        let base_nonce = provider
+        let base_wallet_nonce = provider
             .get_transaction_count(SUBMITTER)
             .await
             .expect("base nonce");
@@ -1070,8 +1168,8 @@ mod tests {
             "confirmed broadcasts are Submitted, got {outcome:?}"
         );
         assert_eq!(
-            poster.pending_nonces_for_test(),
-            vec![base_nonce, base_nonce + 1],
+            poster.pending_wallet_nonces_for_test(),
+            vec![base_wallet_nonce, base_wallet_nonce + 1],
             "attempted nonces stay tracked until the next tick sees Latest pass them"
         );
 
@@ -1080,7 +1178,10 @@ mod tests {
             .await
             .expect("next automined submit");
         assert!(matches!(outcome, SubmitBatchesOutcome::Submitted(ref h) if h.len() == 1));
-        assert_eq!(poster.pending_nonces_for_test(), vec![base_nonce + 2]);
+        assert_eq!(
+            poster.pending_wallet_nonces_for_test(),
+            vec![base_wallet_nonce + 2]
+        );
     }
 
     /// An underpriced-replacement rejection is the other reply that means "the
@@ -1089,16 +1190,17 @@ mod tests {
     async fn submit_batches_waits_on_underpriced_replacement_rejection() {
         require_anvil();
         let anvil = Anvil::default().arg("--no-mining").timeout(30_000).spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
-        let poster = EthereumBatchPoster::new(
-            provider.clone(),
-            poster_config(&anvil),
-            RuntimeScope::default(),
-        );
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let provider = providers.read.clone();
+        let poster = EthereumBatchPoster::new(providers, poster_config(&anvil));
         let sink = RecordingWatermarkSink::passing();
-        let base_nonce = provider
+        let base_wallet_nonce = provider
             .get_transaction_count(SUBMITTER)
             .await
             .expect("base nonce");
@@ -1116,7 +1218,10 @@ mod tests {
                 broadcast: Vec::new()
             }
         );
-        assert_eq!(poster.pending_nonces_for_test(), vec![base_nonce]);
+        assert_eq!(
+            poster.pending_wallet_nonces_for_test(),
+            vec![base_wallet_nonce]
+        );
     }
 
     /// Any other send failure is still a transient provider error for the
@@ -1125,14 +1230,14 @@ mod tests {
     async fn submit_batches_still_errors_on_other_send_failures() {
         require_anvil();
         let anvil = Anvil::default().arg("--no-mining").timeout(30_000).spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
-        let poster = EthereumBatchPoster::new(
-            provider.clone(),
-            poster_config(&anvil),
-            RuntimeScope::default(),
-        );
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let poster = EthereumBatchPoster::new(providers, poster_config(&anvil));
         let sink = RecordingWatermarkSink::passing();
 
         poster.fail_next_send_with_for_test("test-injected send failure");
@@ -1151,17 +1256,18 @@ mod tests {
     async fn submit_batches_keeps_sending_new_payloads_past_a_waiting_nonce() {
         require_anvil();
         let anvil = Anvil::default().arg("--no-mining").timeout(30_000).spawn();
-        let provider =
-            crate::l1::provider::create_signer_provider(&anvil.endpoint(), SUBMITTER_KEY, false)
-                .expect("signer provider");
-        let poster = EthereumBatchPoster::new(
-            provider.clone(),
-            poster_config(&anvil),
-            RuntimeScope::default(),
-        );
+        let providers = crate::l1::provider::create_keyed_providers(
+            &anvil.endpoint(),
+            SUBMITTER_KEY,
+            anvil.chain_id(),
+            false,
+        )
+        .expect("keyed providers");
+        let provider = providers.read.clone();
+        let poster = EthereumBatchPoster::new(providers, poster_config(&anvil));
         let sink = RecordingWatermarkSink::passing();
 
-        let base_nonce = provider
+        let base_wallet_nonce = provider
             .get_transaction_count(SUBMITTER)
             .await
             .expect("base nonce");
@@ -1197,8 +1303,8 @@ mod tests {
             "a broadcast behind a refused head must not be watched for the full timeout"
         );
         assert_eq!(
-            poster.pending_nonces_for_test(),
-            (0..4).map(|i| base_nonce + i).collect::<Vec<_>>()
+            poster.pending_wallet_nonces_for_test(),
+            (0..4).map(|i| base_wallet_nonce + i).collect::<Vec<_>>()
         );
 
         let _: serde_json::Value = provider
@@ -1210,7 +1316,11 @@ mod tests {
             .block_id(BlockNumberOrTag::Latest.into())
             .await
             .expect("latest");
-        assert_eq!(latest, base_nonce + 4, "all four land in nonce order");
+        assert_eq!(
+            latest,
+            base_wallet_nonce + 4,
+            "all four land in nonce order"
+        );
 
         // A tick after inclusion prunes the resolved nonces.
         let outcome = poster
@@ -1220,6 +1330,9 @@ mod tests {
         assert!(
             matches!(outcome, SubmitBatchesOutcome::Waiting { ref broadcast } if broadcast.len() == 1)
         );
-        assert_eq!(poster.pending_nonces_for_test(), vec![base_nonce + 4]);
+        assert_eq!(
+            poster.pending_wallet_nonces_for_test(),
+            vec![base_wallet_nonce + 4]
+        );
     }
 }
diff --git a/sequencer/src/l1/submitter/worker.rs b/sequencer/src/l1/submitter/worker.rs
index b1bfdad7..9771b3ad 100644
--- a/sequencer/src/l1/submitter/worker.rs
+++ b/sequencer/src/l1/submitter/worker.rs
@@ -1,34 +1,16 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Batch submitter worker: stateless, at-least-once submission to L1.
-//!
-//! The submitter never observes danger — that is the [`crate::recovery::DangerDetector`]
-//! worker's job. Each tick here is a pure "what pending work is left?" step:
-//!
-//! 1. Read the scheduler-accepted frontier (safe block + next-expected nonce)
-//!    from SQLite. Shared snapshot maintained by the input reader via
-//!    `append_safe_inputs`.
-//! 2. Query L1 for batch submissions newer than the safe block; fold any
-//!    matching observed nonces to advance the local expected nonce past
-//!    already-mined submissions.
-//! 3. Load every valid closed batch whose nonce is still past the advanced
-//!    frontier and submit them all in one shot.
-//!
-//! The outer loop is uniform: tick, maybe sleep, repeat. A tick that produced
-//! submissions re-enters immediately (no sleep) so the suffix drains quickly;
-//! an idle, transient-error, or waiting tick sleeps `idle_poll_interval`
-//! before the next attempt. Fee-policy limits live in `docs/l1-fee-policy.md`.
-//!
-//! Mid-tick cancellation is crash-safe: storage transactions either commit or
-//! auto-roll-back on drop, and any already-sent L1 transaction is picked up by
-//! the next startup's `observed_submitted_batch_nonces` scan.
+//! Batch submitter worker: stateless, at-least-once submission. Each tick reads
+//! the accepted frontier from SQLite, advances past batch nonces already seen on
+//! L1 above the safe block, and submits every remaining valid closed batch. It
+//! never observes danger; a cancelled tick's sends are found by the next scan.
 
 use std::sync::Arc;
 use std::time::Duration;
 
 use thiserror::Error;
-use tracing::{debug, error};
+use tracing::{debug, warn};
 
 use crate::l1::submitter::{
     BatchPoster, BatchPosterError, BatchSubmitterConfig, SubmitBatchesOutcome,
@@ -66,17 +48,6 @@ impl BatchSubmitterError {
     }
 }
 
-/// How the submitter loop exited.
-///
-/// There is only one deliberate exit path (shutdown). Danger detection lives
-/// in the [`crate::recovery::DangerDetector`] worker; this type does not
-/// concern itself with that signal.
-#[derive(Debug)]
-pub enum SubmitterExit {
-    /// Shutdown signal fired.
-    Shutdown,
-}
-
 /// Outcome of one tick. Drives the outer loop's sleep cadence.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum TickOutcome {
@@ -92,19 +63,22 @@ pub(crate) enum TickOutcome {
     Transient,
 }
 
-/// Pure: given the current submitter frontier and the batch nonces we just
-/// observed on L1 past that frontier, compute the nonce at which we should
-/// start submitting the remaining suffix. When the observed list is empty
-/// (nothing new on L1) the result is just `frontier.accepted_next_nonce`.
+/// Next batch nonce to submit: from the safe-accepted frontier, advance once per
+/// observed nonce equal to the next expected one. The observed nonces are our own
+/// `InputAdded` events past the frontier's safe block up to latest, in event (so
+/// wallet-nonce, so submission) order; matching by equality advances once for a
+/// nonce repeated across recovery generations. A resubmission heuristic, not a
+/// scheduler mirror: it reads unsafe events and applies no staleness rule.
 fn decide_submit_start(frontier: SubmitterFrontier, recently_observed_nonces: &[u64]) -> u64 {
-    // Fold observed nonces over the safe-accepted frontier to derive the next
-    // unresolved nonce. The scan starts at `safe_block + 1` (the submitter
-    // asks the poster for that), so wallet-nonce ordering guarantees the
-    // observed list mirrors our submission order.
-    sequencer_core::protocol::advance_expected_batch_nonce(
-        frontier.accepted_next_nonce,
-        recently_observed_nonces.iter().copied(),
-    )
+    let mut expected = frontier.accepted_next_nonce;
+    for &nonce in recently_observed_nonces {
+        if nonce == expected {
+            expected = expected
+                .checked_add(1)
+                .expect("expected batch nonce overflow: contract-impossible");
+        }
+    }
+    expected
 }
 
 pub(crate) struct BatchSubmitter<P: BatchPoster> {
@@ -144,8 +118,7 @@ impl<P: BatchPoster + 'static> BatchSubmitter<P> {
     pub(crate) fn start(
         self,
         shutdown: RuntimeScope,
-    ) -> Result<tokio::task::JoinHandle<Result<SubmitterExit, BatchSubmitterError>>, StorageOpenError>
-    {
+    ) -> Result<tokio::task::JoinHandle<Result<(), BatchSubmitterError>>, StorageOpenError> {
         self.preflight_storage()?;
         Ok(self.start_preflighted(shutdown))
     }
@@ -161,19 +134,16 @@ impl<P: BatchPoster + 'static> BatchSubmitter<P> {
     pub(crate) fn start_preflighted(
         self,
         shutdown: RuntimeScope,
-    ) -> tokio::task::JoinHandle<Result<SubmitterExit, BatchSubmitterError>> {
+    ) -> tokio::task::JoinHandle<Result<(), BatchSubmitterError>> {
         tokio::spawn(async move { self.run_forever(shutdown).await })
     }
 
     /// Top-level driver. The biased shutdown arm promptly cancels async RPC
     /// work; nested blocking DB jobs retain their own process-lock clone.
-    async fn run_forever(
-        self,
-        shutdown: RuntimeScope,
-    ) -> Result<SubmitterExit, BatchSubmitterError> {
+    async fn run_forever(self, shutdown: RuntimeScope) -> Result<(), BatchSubmitterError> {
         tokio::select! {
             biased;
-            _ = shutdown.wait_for_shutdown() => Ok(SubmitterExit::Shutdown),
+            _ = shutdown.wait_for_shutdown() => Ok(()),
             result = self.run_loop() => result,
         }
     }
@@ -181,7 +151,7 @@ impl<P: BatchPoster + 'static> BatchSubmitter<P> {
     /// Tick → sleep-if-idle → tick. Productive ticks re-enter immediately;
     /// idle, waiting, or transient-error ticks wait `idle_poll_interval`.
     /// Fatal errors propagate.
-    async fn run_loop(&self) -> Result<SubmitterExit, BatchSubmitterError> {
+    async fn run_loop(&self) -> Result<(), BatchSubmitterError> {
         loop {
             let outcome = match self.tick_once().await {
                 Ok(o) => o,
@@ -190,7 +160,14 @@ impl<P: BatchPoster + 'static> BatchSubmitter<P> {
                         let error = BatchSubmitterError::Poster(source);
                         return Err(error);
                     }
-                    error!(error = %source, "L1 provider error — will retry");
+                    match &source {
+                        // A SQLite fault, not the provider.
+                        BatchPosterError::Watermark(watermark) => warn!(
+                            error = %watermark,
+                            "wallet-nonce watermark write failed — will retry"
+                        ),
+                        _ => warn!(error = %source, "L1 provider error — will retry"),
+                    }
                     TickOutcome::Transient
                 }
                 Err(fatal) => return Err(fatal),
@@ -240,29 +217,22 @@ impl<P: BatchPoster + 'static> BatchSubmitter<P> {
             .poster
             .submit_batches(payloads, &self.watermark_sink)
             .await?;
+        // The poster's contract fixes one hash per broadcast payload. A count
+        // off it is a defect in our own code, not a provider fault to retry.
         match outcome {
             SubmitBatchesOutcome::Submitted(tx_hashes) => {
-                if tx_hashes.len() != submitted_count {
-                    return Err(BatchSubmitterError::Poster(BatchPosterError::Provider(
-                        format!(
-                            "poster returned {} tx hashes for {submitted_count} submitted batches",
-                            tx_hashes.len(),
-                        ),
-                    )));
-                }
+                assert_eq!(
+                    tx_hashes.len(),
+                    submitted_count,
+                    "a submitted tick returns one tx hash per payload: contract-impossible"
+                );
                 Ok(TickOutcome::Submitted(submitted_count))
             }
             SubmitBatchesOutcome::Waiting { broadcast } => {
-                // A waiting tick broadcast at most one tx per payload (fewer
-                // when a re-broadcast was refused); more is a poster bug.
-                if broadcast.len() > submitted_count {
-                    return Err(BatchSubmitterError::Poster(BatchPosterError::Provider(
-                        format!(
-                            "waiting poster returned {} tx hashes for {submitted_count} submitted batches",
-                            broadcast.len(),
-                        ),
-                    )));
-                }
+                assert!(
+                    broadcast.len() <= submitted_count,
+                    "a waiting tick broadcasts at most one tx per payload: contract-impossible"
+                );
                 Ok(TickOutcome::Waiting)
             }
         }
@@ -327,8 +297,8 @@ mod tests {
     use crate::l1::watermark::WalletNonceWatermarkSink;
     use crate::runtime::process_lock::ProcessLock;
     use crate::runtime::shutdown::RuntimeScope;
-    use crate::storage::test_helpers::{TestDb, temp_db};
     use crate::storage::{SafeInputRange, Storage, StoredSafeInput, SubmitterFrontier};
+    use crate::test_support::{TestDb, temp_db};
     use sequencer_core::protocol::ProtocolTiming;
 
     const BATCH_SUBMITTER_ADDRESS: Address = Address::repeat_byte(0x11);
@@ -336,12 +306,7 @@ mod tests {
     /// Protocol pinned to `BATCH_SUBMITTER_ADDRESS` — worker tests use that as
     /// their test submitter, so populate sees the seeded safe_inputs.
     fn submitter_test_protocol() -> ProtocolTiming {
-        ProtocolTiming {
-            max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        }
+        crate::storage::test_helpers::default_protocol_timing()
     }
 
     fn default_test_config() -> BatchSubmitterConfig {
@@ -432,12 +397,51 @@ mod tests {
         started_rx.await.expect("tick reached blocked RPC");
 
         shutdown.request_shutdown();
-        let result = tokio::time::timeout(std::time::Duration::from_millis(100), task)
+        tokio::time::timeout(std::time::Duration::from_millis(100), task)
             .await
             .expect("shutdown must not wait for the blocked RPC")
             .expect("submitter task must join")
             .expect("ordinary shutdown is clean");
-        assert!(matches!(result, super::SubmitterExit::Shutdown));
+    }
+
+    /// Returns one hash more than it was given payloads.
+    struct OverReportingPoster;
+
+    #[async_trait]
+    impl BatchPoster for OverReportingPoster {
+        async fn submit_batches(
+            &self,
+            payloads: Vec<Vec<u8>>,
+            _watermark: &dyn WalletNonceWatermarkSink,
+        ) -> Result<SubmitBatchesOutcome, BatchPosterError> {
+            Ok(SubmitBatchesOutcome::Submitted(vec![
+                crate::l1::submitter::TxHash::ZERO;
+                payloads.len() + 1
+            ]))
+        }
+
+        async fn observed_submitted_batch_nonces(
+            &self,
+            _from_block: u64,
+        ) -> Result<Vec<u64>, BatchPosterError> {
+            Ok(Vec::new())
+        }
+    }
+
+    /// A hash count off the poster's contract is our own defect: the tick
+    /// fails loud instead of retrying it as a provider error.
+    #[tokio::test]
+    #[should_panic(expected = "contract-impossible")]
+    async fn tick_once_fails_loud_on_a_hash_count_off_the_poster_contract() {
+        let TestDb { _dir, path } = temp_db("tick-hash-count");
+        seed_two_closed_batches(&path);
+        let submitter = super::BatchSubmitter::new(
+            path,
+            Arc::new(OverReportingPoster),
+            default_test_config(),
+            ProcessLock::test(),
+        );
+        let _ = submitter.tick_once().await;
     }
 
     #[tokio::test]
@@ -648,16 +652,9 @@ mod tests {
 
     #[test]
     fn decide_submit_start_advances_once_per_matching_nonce_across_recovery_generations() {
-        // Post-recovery scenario the `advance_expected_batch_nonce` doc calls
-        // out: batch nonces can repeat across recovery generations because a
-        // cascade re-uses the last valid ancestor's `nonce + 1`. The observed
-        // event stream can therefore contain the same batch nonce twice (once
-        // from the invalidated generation, once from the recovery generation).
-        //
-        // decide_submit_start must advance exactly ONCE per matching nonce —
-        // the second occurrence at a nonce that no longer equals `expected` is
-        // a no-op, as intended. The underlying fold is table-tested below; this
-        // pins the wrapper at the nonce-reuse case explicitly.
+        // Batch nonces repeat across recovery generations (a cascade reuses the
+        // last valid ancestor's `nonce + 1`), so the stream can carry one twice;
+        // only the occurrence that matches `expected` advances.
         let from_nonce = decide_submit_start(
             SubmitterFrontier {
                 safe_block: 10,
@@ -670,4 +667,36 @@ mod tests {
         // expected=3, skip. 3 matches → advance to 4.
         assert_eq!(from_nonce, 4);
     }
+
+    #[test]
+    fn decide_submit_start_advances_only_on_the_expected_nonce() {
+        let cases: [(&[u64], u64); 4] = [
+            (&[1, 2, 3], 0),
+            (&[0, 1, 1, 2], 3),
+            (&[6, 4, 3, 2, 2, 0, 1], 2),
+            (&[0, 2, 1], 2),
+        ];
+        for (observed, expected) in cases {
+            let from_nonce = decide_submit_start(
+                SubmitterFrontier {
+                    safe_block: 10,
+                    accepted_next_nonce: 0,
+                },
+                observed,
+            );
+            assert_eq!(from_nonce, expected, "observed {observed:?}");
+        }
+    }
+
+    #[test]
+    #[should_panic(expected = "expected batch nonce overflow: contract-impossible")]
+    fn decide_submit_start_fails_loud_on_overflow() {
+        decide_submit_start(
+            SubmitterFrontier {
+                safe_block: 10,
+                accepted_next_nonce: u64::MAX,
+            },
+            &[u64::MAX],
+        );
+    }
 }
diff --git a/sequencer/src/l1/watermark.rs b/sequencer/src/l1/watermark.rs
index ee937714..9d4c4ba8 100644
--- a/sequencer/src/l1/watermark.rs
+++ b/sequencer/src/l1/watermark.rs
@@ -1,18 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Write-before-broadcast hook for the wallet-nonce watermark.
-//!
-//! Every component that broadcasts a transaction from the batch-submitter key
-//! — the batch poster and the mempool flusher's no-ops alike — must first
-//! durably commit `watermark = max(watermark, highest_nonce_about_to_send)`
-//! and only then send. One uniform rule, no case analysis: the invariant is
-//! simply "the watermark covers the nonce of everything we ever sent", which
-//! is what lets the flush consume every slot we ever used without trusting
-//! the local node's volatile mempool memory (the zombie counterexample).
-//!
-//! A crash between the commit and the send only over-covers: the flush later
-//! no-ops a never-used slot — one wasted no-op, harmless.
+//! Write-before-broadcast hook (I14): the poster and the flusher durably raise the
+//! wallet-nonce watermark to the highest nonce they are about to send, then send,
+//! so a flush consumes every slot ever used without trusting the node's mempool.
+//! A crash between the two only over-covers.
 
 use thiserror::Error;
 
@@ -22,12 +14,10 @@ use crate::storage::{
 
 #[derive(Debug, Error)]
 pub enum WalletNonceWatermarkError {
-    #[error("watermark sink could not open storage")]
+    #[error("watermark sink could not open storage: {0}")]
     OpenStorage(#[source] StorageOpenError),
-    #[error("watermark sink storage write failed")]
+    #[error("watermark sink storage write failed: {0}")]
     Storage(#[source] rusqlite::Error),
-    #[error("watermark sink failed: {0}")]
-    Other(String),
 }
 
 impl WalletNonceWatermarkError {
@@ -35,17 +25,16 @@ impl WalletNonceWatermarkError {
         match self {
             Self::OpenStorage(source) => is_persistent_storage_open_error(source),
             Self::Storage(source) => is_persistent_storage_error(source),
-            Self::Other(_) => false,
         }
     }
 }
 
 /// Durable raise of the wallet-nonce watermark, called *before* broadcasting.
 /// `raise_to(h)` must commit `watermark = max(watermark, h)` power-loss
-/// durably before returning; the caller may then broadcast txs at nonces
-/// `<= h`.
+/// durably before returning; the caller may then broadcast txs at wallet
+/// nonces `<= h`.
 pub trait WalletNonceWatermarkSink: Send + Sync {
-    fn raise_to(&self, highest: u64) -> Result<(), WalletNonceWatermarkError>;
+    fn raise_to(&self, highest_wallet_nonce: u64) -> Result<(), WalletNonceWatermarkError>;
 }
 
 /// Sink backed by the sequencer DB's `wallet_nonce_watermark` singleton.
@@ -64,11 +53,11 @@ impl StorageWatermarkSink {
 }
 
 impl WalletNonceWatermarkSink for StorageWatermarkSink {
-    fn raise_to(&self, highest: u64) -> Result<(), WalletNonceWatermarkError> {
+    fn raise_to(&self, highest_wallet_nonce: u64) -> Result<(), WalletNonceWatermarkError> {
         let mut storage =
             Storage::open_writer(&self.db_path).map_err(WalletNonceWatermarkError::OpenStorage)?;
         storage
-            .raise_wallet_nonce_watermark(highest)
+            .raise_wallet_nonce_watermark(highest_wallet_nonce)
             .map_err(WalletNonceWatermarkError::Storage)
     }
 }
@@ -93,9 +82,5 @@ mod tests {
             ))
             .is_persistent_invariant()
         );
-        assert!(
-            !WalletNonceWatermarkError::Other("injected operational failure".into())
-                .is_persistent_invariant()
-        );
     }
 }
diff --git a/sequencer/src/lib.rs b/sequencer/src/lib.rs
index 820ee3a3..52a5f2e0 100644
--- a/sequencer/src/lib.rs
+++ b/sequencer/src/lib.rs
@@ -1,22 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Sequencer prototype focused on deterministic inclusion and replay.
-//!
-//! Top-level layout follows the system's data flow:
-//!
-//! - `ingress` — submit API + inclusion lane (write path from external clients)
-//! - `egress` — subscribe API + L2-tx feed (read path to internal indexers)
-//! - `l1` — input reader, batch submitter, L1 helpers
-//! - `storage` — SQLite-backed persistence (organized by writer role)
-//! - `recovery` — cascade invalidation + recovery batch
-//! - `commands` — the operator command brackets (run / setup / flush) plus
-//!   their command-scoped config and error taxonomy
-//! - `runtime` — the runtime authority capabilities (process lock, scope)
-//! - `http` — shared HTTP error type + axum::serve orchestration
-//!
-//! The inclusion lane is the single writer of open-batch state; this is the
-//! invariant the storage layer relies on.
+//! Sequencer library: deterministic inclusion, L1 reconciliation and replay for
+//! one application. App binaries compose it through [`harness`]; the module map
+//! is in AGENTS.md ("Sequencer module layout").
 
 pub(crate) mod clock;
 pub mod commands;
@@ -33,6 +20,8 @@ pub mod storage;
 extern crate self as sequencer;
 #[cfg(test)]
 mod integration_tests;
+#[cfg(test)]
+pub(crate) mod test_support;
 
 pub use commands::config::{FlushConfig, RunConfig, SetupConfig};
 pub use commands::error::CommandError;
diff --git a/sequencer/src/recovery/detector.rs b/sequencer/src/recovery/detector.rs
index 802a7e55..eb4ced36 100644
--- a/sequencer/src/recovery/detector.rs
+++ b/sequencer/src/recovery/detector.rs
@@ -1,23 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Runtime danger detector.
-//!
-//! A tiny background task that, every `poll_interval`, asks [`Storage::check_danger`]
-//! whether recovery or refusal is needed. If so, the task exits with
-//! [`DetectorExit::RecoveryRequired`] — the runtime turns that into a
-//! deliberate non-error process shutdown, the orchestrator respawns, and the
-//! local-first startup recovery procedure takes over.
-//!
-//! This is its own worker (not part of the batch submitter) because the two
-//! concerns are orthogonal: the submitter makes progress on L1, which involves
-//! slow confirmations; the detector just reads the DB + wall clock at a fixed
-//! cadence. Keeping them separate means one never delays the other, and each
-//! stays a ~20-line state machine.
-//!
-//! Detection is eventually consistent with the input reader: a transition into
-//! danger may lag by up to one `poll_interval`. The preemptive margin absorbs
-//! this bounded lag.
+//! Runtime danger detector: every `poll_interval` it reads [`Storage::check_danger`]
+//! and exits with [`DetectorExit::RecoveryRequired`] on any non-`Safe` status. It
+//! is its own worker so slow L1 submission never delays detection; the preemptive
+//! margin absorbs its lag of up to one interval behind the input reader.
 
 use std::time::Duration;
 
@@ -149,10 +136,10 @@ impl DangerDetector {
                     // All non-Safe variants exit. The reducer re-inspects on
                     // the next startup and selects one phase, Retry, or Refuse
                     // from the then-current facts.
-                    tracing::error!(
+                    tracing::warn!(
                         ?status,
                         danger_threshold = self.protocol.danger_threshold(),
-                        l1_read_stale_after_blocks = self.protocol.l1_read_stale_after_blocks,
+                        l1_read_stale_after_blocks = self.protocol.l1_read_stale_after_blocks(),
                         "danger detected — triggering shutdown for startup recovery"
                     );
                     return Ok(DetectorExit::RecoveryRequired { status });
@@ -189,19 +176,11 @@ fn map_storage_task_join(err: tokio::task::JoinError) -> DangerDetectorError {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::test_helpers::{SENDER_A, temp_db};
+    use crate::storage::test_helpers::{SENDER_A, default_protocol_timing};
     use crate::storage::{SafeInputRange, Storage, StoredSafeInput};
+    use crate::test_support::temp_db;
     use std::time::Duration;
 
-    fn test_protocol() -> ProtocolTiming {
-        ProtocolTiming {
-            max_wait_blocks: 1200,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        }
-    }
-
     #[tokio::test]
     async fn exits_on_shutdown_when_safe() {
         let db = temp_db("detector-shutdown");
@@ -210,14 +189,14 @@ mod tests {
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize");
         storage
-            .append_safe_inputs(10, &[], SENDER_A, &test_protocol())
+            .append_safe_inputs(10, &[], SENDER_A, &default_protocol_timing())
             .expect("record fresh safe-head observation");
         drop(storage);
 
         let shutdown = ShutdownSignal::default();
         let detector = DangerDetector::new(
             db.path.clone(),
-            test_protocol(),
+            default_protocol_timing(),
             Duration::from_millis(50),
             ProcessLock::test(),
         );
@@ -249,7 +228,7 @@ mod tests {
             .close_frame_and_batch(&mut head, 10)
             .expect("close batch 1");
 
-        let protocol = test_protocol();
+        let protocol = default_protocol_timing();
         let landed = crate::storage::test_helpers::local_batch_payload(&mut storage, 0);
         storage
             .append_safe_inputs(
@@ -310,7 +289,7 @@ mod tests {
             .close_frame_and_batch(&mut head, 100)
             .expect("close batch 1");
 
-        let protocol = test_protocol();
+        let protocol = default_protocol_timing();
         let landed = crate::storage::test_helpers::local_batch_payload(&mut storage, 0);
         storage
             .append_safe_inputs(
@@ -326,7 +305,8 @@ mod tests {
             .expect("append accepted batch 0");
 
         // Observed check: batch 1's first_frame_safe_block = 100, current
-        // safe = 1200. age = 1100 < danger_threshold (1125), so observed
+        // safe = 1200. age = 1100 < danger_threshold (MAX_WAIT_BLOCKS 1200 -
+        // margin 75 = 1125), so observed
         // closed-batch danger would NOT fire.
         //
         // Rewind synced_at_ms by 25 blocks' worth of wall-clock time so the
diff --git a/sequencer/src/recovery/flusher.rs b/sequencer/src/recovery/flusher.rs
index ee4242fb..e001aba3 100644
--- a/sequencer/src/recovery/flusher.rs
+++ b/sequencer/src/recovery/flusher.rs
@@ -1,25 +1,20 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Mempool flusher: submits no-op transactions to resolve pending wallet-nonce slots
-//! before recovery runs.
-//!
-//! After a danger-zone detection, the sequencer goes offline and calls
-//! [`MempoolFlusher::flush_and_wait`] to ensure every `w_nonce` slot is consumed
-//! (either by its original batch transaction or by a replacement no-op). Once all
-//! slots reach safe finality, the recovery procedure can read fully-finalized L1 state.
+//! Mempool flusher: every wallet-nonce slot the submitter may have used is
+//! consumed, by its original transaction or a no-op, and reaches safe depth, so
+//! recovery reads settled L1 state. Entry point: [`MempoolFlusher::flush_to_safe`].
 
 use alloy::network::TransactionBuilder;
-use alloy::providers::{
-    DynProvider, PendingTransactionConfig, PendingTransactionError, Provider, WatchTxError,
-};
+use alloy::providers::Provider;
 use alloy::rpc::types::BlockNumberOrTag;
-use alloy_primitives::{Address, B256, U256};
+use alloy_primitives::{Address, U256};
 use std::time::Duration;
 use thiserror::Error;
-use tracing::{debug, error, info, warn};
+use tracing::{debug, info, warn};
 
 use crate::l1::eip1559::{estimate_fees, pad_gas_estimate};
+use crate::l1::provider::{KeyedProviders, SendError, error_chain};
 use crate::l1::watermark::{
     StorageWatermarkSink, WalletNonceWatermarkError, WalletNonceWatermarkSink,
 };
@@ -28,6 +23,10 @@ use crate::l1::watermark::{
 pub enum FlushError {
     #[error("provider/transport: {0}")]
     Provider(String),
+    /// The submit provider could not sign a no-op this flusher built: a field
+    /// is missing. A defect, not a condition a retry heals.
+    #[error("flush no-op not signable: {0}")]
+    UnsignableTransaction(String),
     #[error(transparent)]
     Watermark(#[from] WalletNonceWatermarkError),
 }
@@ -38,22 +37,24 @@ impl FlushError {
         // here, not silently default to restartable.
         match self {
             Self::Watermark(source) => source.is_persistent_invariant(),
+            Self::UnsignableTransaction(_) => true,
             Self::Provider(_) => false,
         }
     }
 }
 
 pub struct MempoolFlusher {
-    provider: DynProvider,
+    providers: KeyedProviders,
     address: Address,
     confirmation_timeout: Duration,
     safe_poll_interval: Duration,
 }
 
-/// Derive the flusher's watch/poll durations from the configured block time.
+/// Derive the flusher's wait and poll durations from the configured block time.
 ///
-/// `confirmation_timeout` is 10 blocks — long enough to survive one-off L1
-/// stalls but short enough to retry within a reasonable window.
+/// `confirmation_timeout` is 10 blocks, how long one pass waits for its slots
+/// to be mined before resubmitting: long enough to survive one-off L1 stalls,
+/// short enough to retry within a reasonable window.
 /// `safe_poll_interval` is one block — matches the natural cadence for
 /// `get_transaction_count(Safe)` to advance.
 ///
@@ -98,7 +99,7 @@ fn send_failures_error(failures: &[(u64, String)]) -> FlushError {
     let samples = failures
         .iter()
         .take(MAX_SAMPLES)
-        .map(|(nonce, message)| format!("nonce {nonce}: {message}"))
+        .map(|(wallet_nonce, message)| format!("wallet nonce {wallet_nonce}: {message}"))
         .collect::<Vec<_>>()
         .join("; ");
     let remaining = failures.len().saturating_sub(MAX_SAMPLES);
@@ -114,40 +115,26 @@ fn send_failures_error(failures: &[(u64, String)]) -> FlushError {
     ))
 }
 
-fn map_watch_error(err: PendingTransactionError) -> Result<bool, FlushError> {
-    match err {
-        PendingTransactionError::TxWatcher(WatchTxError::Timeout) => Ok(false),
-        other => Err(FlushError::Provider(other.to_string())),
-    }
-}
-
 impl MempoolFlusher {
-    /// Build a flusher over `provider` plus the DB-backed watermark sink, run
-    /// the watermark-anchored flush, and return the observed safe block `C`.
-    ///
-    /// This is the flush-acquire core shared by all three keyed-flush sites
-    /// (`setup --recovery`, the runtime danger path, and `flush-mempool`). They
-    /// differ only in where the signing key, submitter address, and watermark
-    /// come from, and in the surrounding error type — so callers resolve those
-    /// (provider creation keeps each site's own error mapping; the returned
-    /// [`FlushError`] maps into `CommandError`/`RecoveryError` via the existing
-    /// `From` impls) and this owns the sink build + `flush_and_wait`.
+    /// Build a flusher over `providers` with the DB-backed watermark sink, run
+    /// [`Self::flush_and_wait`], and return the observed safe block `C`. Callers
+    /// supply the key, submitter address and watermark, and map [`FlushError`].
     pub(crate) async fn flush_to_safe(
-        provider: DynProvider,
+        providers: KeyedProviders,
         submitter_address: Address,
         seconds_per_block: u64,
         db_path: impl Into<String>,
         watermark: Option<u64>,
     ) -> Result<u64, FlushError> {
-        let flusher = Self::new(provider, submitter_address, seconds_per_block);
+        let flusher = Self::new(providers, submitter_address, seconds_per_block);
         let sink = StorageWatermarkSink::new(db_path);
         flusher.flush_and_wait(watermark, &sink).await
     }
 
-    pub fn new(provider: DynProvider, address: Address, seconds_per_block: u64) -> Self {
+    pub fn new(providers: KeyedProviders, address: Address, seconds_per_block: u64) -> Self {
         let (confirmation_timeout, safe_poll_interval) = derive_timeouts(seconds_per_block);
         Self {
-            provider,
+            providers,
             address,
             confirmation_timeout,
             safe_poll_interval,
@@ -155,7 +142,7 @@ impl MempoolFlusher {
     }
 
     /// Flush the mempool by submitting no-op transactions for unresolved
-    /// nonce slots, then waiting until every slot we ever used is safe.
+    /// wallet-nonce slots, then waiting until every slot we ever used is safe.
     ///
     /// `watermark` durably covers every wallet nonce this deployment may
     /// have broadcast. Write-before-send can cover an unused slot. `None`
@@ -174,17 +161,18 @@ impl MempoolFlusher {
     /// it.
     ///
     /// At each iteration:
-    /// 1. Submit 0-ETH self-transfers for nonces in
+    /// 1. Submit 0-ETH self-transfers for wallet nonces in
     ///    `[Latest, max(Pending, watermark + 1))` — every slot not yet
     ///    mined that we might ever have used. The sink raises the persisted
     ///    watermark before the broadcast (uniform write-before-broadcast,
     ///    though no-ops never exceed the existing watermark under the
     ///    invariant). These compete with any of our txs still in the
     ///    network; whichever wins, the slot advances.
-    /// 2. Watch each submitted no-op for L1 inclusion.
+    /// 2. Wait until every slot below the flush end is mined, by an original
+    ///    or a no-op: the slot, not a particular tx, is what must be consumed.
     /// 3. Sleep to let the safe head advance, then re-check the loop condition.
-    /// 4. If any watch times out, retry the outer loop (tx may have been dropped,
-    ///    or the original batch may be making progress instead).
+    /// 4. If the slots are not mined in time, retry the outer loop (a no-op may
+    ///    have been dropped or underpriced).
     ///
     /// Returns the L1 **safe block number** at which resolution was observed:
     /// the caller must not cascade until its own re-synced view reaches at
@@ -196,41 +184,43 @@ impl MempoolFlusher {
     ) -> Result<u64, FlushError> {
         let mut attempt = 0u32;
         loop {
-            let safe_nonce = self.nonce_at(BlockNumberOrTag::Safe).await?;
-            let pending_nonce = self.nonce_at(BlockNumberOrTag::Pending).await?;
+            let safe_wallet_nonce = self.wallet_nonce_at(BlockNumberOrTag::Safe).await?;
+            let pending_wallet_nonce = self.wallet_nonce_at(BlockNumberOrTag::Pending).await?;
             // The durable anchor: every slot we ever used must be consumed
             // at safe depth, regardless of what the local pool remembers.
-            let required_safe_nonce = watermark.map_or(0, |w| {
+            let required_safe_wallet_nonce = watermark.map_or(0, |w| {
                 w.checked_add(1)
                     .expect("persisted wallet nonce watermark must leave room for the next nonce")
             });
 
-            if pending_nonce <= safe_nonce && safe_nonce >= required_safe_nonce {
+            if pending_wallet_nonce <= safe_wallet_nonce
+                && safe_wallet_nonce >= required_safe_wallet_nonce
+            {
                 let safe_block = self.safe_block_number().await?;
                 info!(
-                    safe_nonce,
-                    required_safe_nonce,
+                    safe_wallet_nonce,
+                    required_safe_wallet_nonce,
                     safe_block,
                     "mempool flush complete — all slots reached safe finality"
                 );
                 return Ok(safe_block);
             }
 
-            let flush_end = pending_nonce.max(required_safe_nonce);
+            let flush_end = pending_wallet_nonce.max(required_safe_wallet_nonce);
             // The completion predicate failed, so either pending > safe or
             // required_safe > safe. Therefore their maximum is strictly above
             // safe; clamping here would hide a broken loop invariant.
             let unresolved = flush_end
-                .checked_sub(safe_nonce)
+                .checked_sub(safe_wallet_nonce)
                 .expect("incomplete flush must have at least one unresolved nonce");
 
             if attempt == 0 {
                 info!(
-                    safe_nonce,
-                    pending_nonce,
-                    required_safe_nonce,
+                    safe_wallet_nonce,
+                    pending_wallet_nonce,
+                    required_safe_wallet_nonce,
                     unresolved,
-                    "flushing mempool: submitting no-ops for unresolved w_nonce slots"
+                    "flushing mempool: submitting no-ops for unresolved wallet-nonce slots"
                 );
             } else {
                 // Retry after a previous timeout — re-print status so operators
@@ -239,9 +229,9 @@ impl MempoolFlusher {
                 // ordinary rhythm, not a fault.
                 warn!(
                     attempt,
-                    safe_nonce,
-                    pending_nonce,
-                    required_safe_nonce,
+                    safe_wallet_nonce,
+                    pending_wallet_nonce,
+                    required_safe_wallet_nonce,
                     unresolved,
                     "flush retry: previous attempt timed out, resubmitting"
                 );
@@ -249,23 +239,22 @@ impl MempoolFlusher {
             attempt += 1;
 
             // Submit no-ops for every not-yet-mined slot up to the flush end.
-            // The full range goes out before watching any tx, so every
-            // unresolved slot gets a competing no-op attempt in this pass.
-            let latest_nonce = self.nonce_at(BlockNumberOrTag::Latest).await?;
-            if latest_nonce < flush_end {
+            // The full range goes out before the wait, so every unresolved
+            // slot gets a competing no-op attempt in this pass.
+            let latest_wallet_nonce = self.wallet_nonce_at(BlockNumberOrTag::Latest).await?;
+            if latest_wallet_nonce < flush_end {
                 // Uniform write-before-broadcast; covers the no-ops we are
                 // about to send (a no-op above the current watermark can only
                 // happen if someone else used our key — over-covering then is
                 // exactly right).
-                let highest_nonce = flush_end
+                let highest_wallet_nonce = flush_end
                     .checked_sub(1)
                     .expect("a non-empty flush range must have a highest nonce");
-                sink.raise_to(highest_nonce)?;
+                sink.raise_to(highest_wallet_nonce)?;
             }
-            let tx_hashes = self.submit_noops(latest_nonce, flush_end).await?;
+            self.submit_noops(latest_wallet_nonce, flush_end).await?;
 
-            // Watch each submitted tx for L1 inclusion.
-            if !self.watch_txs(&tx_hashes).await? {
+            if !self.wait_for_slots_mined(flush_end).await? {
                 continue;
             }
 
@@ -277,22 +266,27 @@ impl MempoolFlusher {
     /// Block number of the current L1 safe head.
     async fn safe_block_number(&self) -> Result<u64, FlushError> {
         let block = self
-            .provider
+            .providers
+            .read
             .get_block_by_number(BlockNumberOrTag::Safe)
             .await
-            .map_err(|e| FlushError::Provider(e.to_string()))?
+            .map_err(|e| FlushError::Provider(error_chain(&e)))?
             .ok_or_else(|| FlushError::Provider("no safe block available".to_string()))?;
         Ok(block.header.number)
     }
 
-    /// Submit 0-ETH self-transfers for nonces `from_nonce..to_nonce`.
-    /// Returns the tx hashes of successfully submitted transactions.
-    async fn submit_noops(&self, from_nonce: u64, to_nonce: u64) -> Result<Vec<B256>, FlushError> {
-        if from_nonce >= to_nonce {
-            return Ok(Vec::new());
+    /// Submit 0-ETH self-transfers for wallet nonces
+    /// `from_wallet_nonce..to_wallet_nonce`.
+    async fn submit_noops(
+        &self,
+        from_wallet_nonce: u64,
+        to_wallet_nonce: u64,
+    ) -> Result<(), FlushError> {
+        if from_wallet_nonce >= to_wallet_nonce {
+            return Ok(());
         }
 
-        let estimate = estimate_fees(&self.provider)
+        let estimate = estimate_fees(&self.providers.read)
             .await
             .map_err(FlushError::Provider)?;
         // Fresh estimates cannot guarantee replacement: a falling tip can
@@ -316,43 +310,44 @@ impl MempoolFlusher {
             .with_to(self.address)
             .with_value(U256::ZERO);
         let gas = self
-            .provider
+            .providers
+            .read
             .estimate_gas(tx_base.clone())
             .block(BlockNumberOrTag::Latest.into())
             .await
             .map(pad_gas_estimate)
-            .map_err(|e| FlushError::Provider(e.to_string()))?;
+            .map_err(|e| FlushError::Provider(error_chain(&e)))?;
 
         debug!(
-            from_nonce,
-            to_nonce,
-            count = to_nonce - from_nonce,
+            from_wallet_nonce,
+            to_wallet_nonce,
+            count = to_wallet_nonce - from_wallet_nonce,
             max_fee_per_gas = max_fee,
             max_priority_fee = priority_fee,
             gas,
             "submitting flush no-ops"
         );
 
-        let mut tx_hashes = Vec::new();
         let mut send_failures = Vec::new();
-        for nonce in from_nonce..to_nonce {
+        for wallet_nonce in from_wallet_nonce..to_wallet_nonce {
             let tx = tx_base
                 .clone()
                 .with_gas_limit(gas)
-                .with_nonce(nonce)
+                .with_nonce(wallet_nonce)
                 .with_max_fee_per_gas(max_fee)
                 .with_max_priority_fee_per_gas(priority_fee);
 
-            match self.provider.send_transaction(tx).await {
-                Ok(pending) => {
-                    let tx_hash = *pending.tx_hash();
-                    debug!(nonce, %tx_hash, gas, "flush no-op submitted");
-                    tx_hashes.push(tx_hash);
+            match self.providers.submit.send(tx).await {
+                Ok(tx_hash) => {
+                    debug!(wallet_nonce, %tx_hash, gas, "flush no-op submitted");
                 }
-                Err(e) => {
-                    let message = e.to_string();
-                    error!(nonce, error = %message, "flush no-op send failed");
-                    send_failures.push((nonce, message));
+                Err(SendError::Unsignable(message)) => {
+                    return Err(FlushError::UnsignableTransaction(message));
+                }
+                Err(SendError::Rpc(e)) => {
+                    let message = error_chain(&e);
+                    warn!(wallet_nonce, error = %message, "flush no-op send failed");
+                    send_failures.push((wallet_nonce, message));
                 }
             }
         }
@@ -361,45 +356,36 @@ impl MempoolFlusher {
             return Err(send_failures_error(send_failures.as_slice()));
         }
 
-        Ok(tx_hashes)
-    }
-
-    /// Watch submitted transactions for L1 inclusion.
-    /// Uses the same `PendingTransactionConfig::watch` pattern as the batch poster.
-    /// Returns `true` if all txs confirmed, `false` on timeout.
-    async fn watch_txs(&self, tx_hashes: &[B256]) -> Result<bool, FlushError> {
-        for tx_hash in tx_hashes {
-            let watch = PendingTransactionConfig::new(*tx_hash)
-                .with_required_confirmations(1)
-                .with_timeout(Some(self.confirmation_timeout))
-                .with_provider(self.provider.root().clone());
-            match watch.watch().await {
-                Ok(_) => {
-                    debug!(%tx_hash, "flush no-op included on L1");
-                }
-                Err(err @ PendingTransactionError::TxWatcher(WatchTxError::Timeout)) => {
-                    // This should not happen during normal L1 operation.
-                    // Possible causes: L1 congestion, tx dropped from mempool,
-                    // gas price too low to compete.
-                    error!(
-                        %tx_hash,
-                        timeout_secs = self.confirmation_timeout.as_secs(),
-                        "flush no-op timed out waiting for L1 inclusion — will retry"
-                    );
-                    return map_watch_error(err);
-                }
-                Err(err) => return map_watch_error(err),
+        Ok(())
+    }
+
+    /// Wait until the Latest wallet nonce reaches `flush_end`, polling once per
+    /// block. Returns `false` when the confirmation timeout passes first.
+    async fn wait_for_slots_mined(&self, flush_end: u64) -> Result<bool, FlushError> {
+        let deadline = tokio::time::Instant::now() + self.confirmation_timeout;
+        loop {
+            if self.wallet_nonce_at(BlockNumberOrTag::Latest).await? >= flush_end {
+                return Ok(true);
+            }
+            if tokio::time::Instant::now() >= deadline {
+                debug!(
+                    flush_end,
+                    timeout_secs = self.confirmation_timeout.as_secs(),
+                    "flush slots not mined before the timeout"
+                );
+                return Ok(false);
             }
+            tokio::time::sleep(self.safe_poll_interval).await;
         }
-        Ok(true)
     }
 
-    async fn nonce_at(&self, block: BlockNumberOrTag) -> Result<u64, FlushError> {
-        self.provider
+    async fn wallet_nonce_at(&self, block: BlockNumberOrTag) -> Result<u64, FlushError> {
+        self.providers
+            .read
             .get_transaction_count(self.address)
             .block_id(block.into())
             .await
-            .map_err(|e| FlushError::Provider(e.to_string()))
+            .map_err(|e| FlushError::Provider(error_chain(&e)))
     }
 }
 
@@ -549,24 +535,13 @@ mod tests {
 
         let message = err.to_string();
         assert!(message.contains("failed to submit 4 flush no-op transaction(s)"));
-        assert!(message.contains("nonce 7: nonce too low"));
-        assert!(message.contains("nonce 8: replacement transaction underpriced"));
-        assert!(message.contains("nonce 9: insufficient funds"));
+        assert!(message.contains("wallet nonce 7: nonce too low"));
+        assert!(message.contains("wallet nonce 8: replacement transaction underpriced"));
+        assert!(message.contains("wallet nonce 9: insufficient funds"));
         assert!(message.contains("and 1 more"));
         assert!(!message.contains("nonce 10"));
     }
 
-    #[test]
-    fn watch_error_mapping_retries_only_timeouts() {
-        let timeout = map_watch_error(PendingTransactionError::TxWatcher(WatchTxError::Timeout))
-            .expect("timeout should be a retryable watch result");
-        assert!(!timeout, "timeout should ask the caller to retry");
-
-        let err = map_watch_error(PendingTransactionError::FailedToRegister)
-            .expect_err("non-timeout watcher failures must surface");
-        assert!(matches!(err, FlushError::Provider(_)));
-    }
-
     // ── Timeouts derive from seconds_per_block ────────────────
 
     #[test]
@@ -620,19 +595,30 @@ mod tests {
             .spawn()
     }
 
-    /// Create a signer provider from an Anvil private key.
-    fn signer_provider(anvil: &alloy::node_bindings::AnvilInstance) -> DynProvider {
+    /// Keyed providers for Anvil's first account, dialing `endpoint`.
+    fn keyed_providers_at(
+        anvil: &alloy::node_bindings::AnvilInstance,
+        endpoint: &str,
+    ) -> KeyedProviders {
         let key_hex = alloy_primitives::hex::encode(anvil.first_key().to_bytes());
-        crate::l1::provider::create_signer_provider(
-            anvil.endpoint_url().as_str(),
+        crate::l1::provider::create_keyed_providers(
+            endpoint,
             &format!("0x{key_hex}"),
+            anvil.chain_id(),
             false,
         )
-        .expect("create signer provider")
+        .expect("create keyed providers")
+    }
+
+    fn keyed_providers(anvil: &alloy::node_bindings::AnvilInstance) -> KeyedProviders {
+        keyed_providers_at(anvil, anvil.endpoint_url().as_str())
     }
 
     /// Mine blocks at a fixed interval until the token is dropped.
-    fn start_miner(provider: DynProvider, interval: Duration) -> tokio::sync::oneshot::Sender<()> {
+    fn start_miner(
+        provider: alloy::providers::DynProvider,
+        interval: Duration,
+    ) -> tokio::sync::oneshot::Sender<()> {
         let (stop_tx, mut stop_rx) = tokio::sync::oneshot::channel();
         tokio::spawn(async move {
             loop {
@@ -648,27 +634,32 @@ mod tests {
         stop_tx
     }
 
-    /// Send a 0-ETH self-transfer at a specific nonce (without waiting for inclusion).
-    async fn send_tx_at_nonce(provider: &DynProvider, addr: Address, nonce: u64) {
-        let fees = provider
+    /// Send a 0-ETH self-transfer at a specific wallet nonce (without waiting
+    /// for inclusion).
+    async fn send_tx_at_wallet_nonce(providers: &KeyedProviders, addr: Address, wallet_nonce: u64) {
+        let fees = providers
+            .read
             .estimate_eip1559_fees()
             .await
             .expect("estimate fees");
         let tx = alloy::rpc::types::TransactionRequest::default()
+            .with_from(addr)
             .with_to(addr)
             .with_value(U256::ZERO)
-            .with_nonce(nonce)
+            .with_gas_limit(21_000)
+            .with_nonce(wallet_nonce)
             .with_max_fee_per_gas(fees.max_fee_per_gas)
             .with_max_priority_fee_per_gas(fees.max_priority_fee_per_gas);
-        let _ = provider.send_transaction(tx).await.expect("send tx");
+        providers.submit.send(tx).await.expect("send tx");
     }
 
     #[tokio::test]
-    async fn flush_is_noop_when_no_pending_nonces() {
+    async fn flush_is_noop_when_no_pending_wallet_nonces() {
         require_anvil();
 
         let anvil = spawn_anvil();
-        let provider = signer_provider(&anvil);
+        let providers = keyed_providers(&anvil);
+        let provider = providers.read.clone();
         let addr = anvil.addresses()[0];
 
         // Mine a few blocks so safe head advances past genesis.
@@ -679,7 +670,7 @@ mod tests {
                 .expect("mine");
         }
 
-        let flusher = MempoolFlusher::new(provider, addr, 12);
+        let flusher = MempoolFlusher::new(providers.clone(), addr, 12);
         // No pending txs — should return immediately.
         flusher
             .flush_and_wait(None, &NoopWatermarkSink)
@@ -688,16 +679,17 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn flush_resolves_pending_nonces_to_safe() {
+    async fn flush_resolves_pending_wallet_nonces_to_safe() {
         require_anvil();
 
         let anvil = spawn_anvil();
-        let provider = signer_provider(&anvil);
+        let providers = keyed_providers(&anvil);
+        let provider = providers.read.clone();
         let addr = anvil.addresses()[0];
 
         // Send 3 txs into the mempool (unmined).
-        for nonce in 0..3 {
-            send_tx_at_nonce(&provider, addr, nonce).await;
+        for wallet_nonce in 0..3 {
+            send_tx_at_wallet_nonce(&providers, addr, wallet_nonce).await;
         }
 
         // Verify: pending=3, safe=0.
@@ -719,7 +711,7 @@ mod tests {
         let _miner = start_miner(provider.clone(), Duration::from_millis(100));
 
         // Run the flusher — it should resolve all 3 nonces to safe.
-        let flusher = MempoolFlusher::new(provider.clone(), addr, 12)
+        let flusher = MempoolFlusher::new(providers.clone(), addr, 12)
             .with_timeouts(Duration::from_secs(5), Duration::from_millis(200));
         tokio::time::timeout(
             Duration::from_secs(10),
@@ -746,7 +738,8 @@ mod tests {
         require_anvil();
 
         let anvil = spawn_anvil();
-        let provider = signer_provider(&anvil);
+        let providers = keyed_providers(&anvil);
+        let provider = providers.read.clone();
         let addr = anvil.addresses()[0];
 
         // Models the zombie: the persisted watermark says slot 0 was
@@ -756,7 +749,7 @@ mod tests {
         // a zombie; the anchored flush must consume slot 0 with a no-op
         // and wait for it to reach safe depth.
         let _miner = start_miner(provider.clone(), Duration::from_millis(100));
-        let flusher = MempoolFlusher::new(provider.clone(), addr, 12)
+        let flusher = MempoolFlusher::new(providers.clone(), addr, 12)
             .with_timeouts(Duration::from_secs(5), Duration::from_millis(200));
         let observed_safe_block = tokio::time::timeout(
             Duration::from_secs(10),
@@ -781,17 +774,46 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn slot_wait_counts_a_slot_mined_by_any_transaction() {
+        require_anvil();
+
+        let anvil = spawn_anvil();
+        let providers = keyed_providers(&anvil);
+        let provider = providers.read.clone();
+        let addr = anvil.addresses()[0];
+        let flusher = MempoolFlusher::new(providers.clone(), addr, 12)
+            .with_timeouts(Duration::from_millis(300), Duration::from_millis(50));
+
+        assert!(
+            !flusher.wait_for_slots_mined(1).await.expect("wait"),
+            "an unmined slot must time out"
+        );
+
+        // The original tx, not a flush no-op, consumes the slot.
+        send_tx_at_wallet_nonce(&providers, addr, 0).await;
+        let _: serde_json::Value = provider
+            .raw_request("evm_mine".into(), ())
+            .await
+            .expect("mine");
+        assert!(
+            flusher.wait_for_slots_mined(1).await.expect("wait"),
+            "a slot mined by any tx is consumed"
+        );
+    }
+
     #[tokio::test]
     async fn flush_handles_already_mined_but_not_safe() {
         require_anvil();
 
         let anvil = spawn_anvil();
-        let provider = signer_provider(&anvil);
+        let providers = keyed_providers(&anvil);
+        let provider = providers.read.clone();
         let addr = anvil.addresses()[0];
 
         // Send 2 txs and mine them (latest but not safe).
-        for nonce in 0..2 {
-            send_tx_at_nonce(&provider, addr, nonce).await;
+        for wallet_nonce in 0..2 {
+            send_tx_at_wallet_nonce(&providers, addr, wallet_nonce).await;
         }
         let _: serde_json::Value = provider
             .raw_request("evm_mine".into(), ())
@@ -816,7 +838,7 @@ mod tests {
         let _miner = start_miner(provider.clone(), Duration::from_millis(100));
 
         // Flusher should wait for safe finality (no new txs to submit).
-        let flusher = MempoolFlusher::new(provider.clone(), addr, 12)
+        let flusher = MempoolFlusher::new(providers.clone(), addr, 12)
             .with_timeouts(Duration::from_secs(5), Duration::from_millis(200));
         tokio::time::timeout(
             Duration::from_secs(10),
@@ -862,7 +884,8 @@ mod tests {
         // Direct-to-Anvil provider: the test uses this to seed pending
         // mempool state and inspect the chain. Bypasses the proxy so the
         // seeding itself isn't affected by disconnect.
-        let direct_provider = signer_provider(&anvil);
+        let direct = keyed_providers(&anvil);
+        let direct_provider = direct.read.clone();
         let addr = anvil.addresses()[0];
 
         // Proxy in front of Anvil — this is what the flusher dials. Anvil's
@@ -873,17 +896,11 @@ mod tests {
             .await
             .expect("spawn proxy");
 
-        let key_hex = alloy_primitives::hex::encode(anvil.first_key().to_bytes());
-        let proxied_provider = crate::l1::provider::create_signer_provider(
-            proxy.endpoint().as_str(),
-            &format!("0x{key_hex}"),
-            false,
-        )
-        .expect("create signer provider through proxy");
+        let proxied = keyed_providers_at(&anvil, proxy.endpoint().as_str());
 
         // Seed: submit a tx at wallet-nonce 0 into Anvil's mempool (auto-
         // mining is off, so it stays pending). The flusher now has work.
-        send_tx_at_nonce(&direct_provider, addr, 0).await;
+        send_tx_at_wallet_nonce(&direct, addr, 0).await;
         let pending = direct_provider
             .get_transaction_count(addr)
             .block_id(BlockNumberOrTag::Pending.into())
@@ -894,7 +911,7 @@ mod tests {
         // Disconnect the proxy. The flusher's provider can no longer reach
         // Anvil — any RPC call sees a torn-down TCP connection.
         proxy.disconnect();
-        let flusher = MempoolFlusher::new(proxied_provider.clone(), addr, 12)
+        let flusher = MempoolFlusher::new(proxied.clone(), addr, 12)
             .with_timeouts(Duration::from_secs(2), Duration::from_millis(200));
 
         // `flush_and_wait` must fail fast (no internal retry loop). Wrap in
@@ -921,7 +938,7 @@ mod tests {
         // A fresh flusher (a respawn would build a new one from scratch).
         // It should now read nonces, replace the pending tx with a bumped-
         // fee no-op (or let the original land), wait for safe, and return.
-        let flusher_after = MempoolFlusher::new(proxied_provider, addr, 12)
+        let flusher_after = MempoolFlusher::new(proxied, addr, 12)
             .with_timeouts(Duration::from_secs(5), Duration::from_millis(200));
         tokio::time::timeout(
             Duration::from_secs(15),
@@ -932,7 +949,7 @@ mod tests {
         .expect("flush should succeed once the provider is reachable");
 
         // Forward progress: the nonce-0 slot was consumed (either by the
-        // flusher's no-op or by the original tx landing). `safe_nonce` is
+        // flusher's no-op or by the original tx landing). `safe_wallet_nonce` is
         // >= 1 only if something at nonce 0 reached safe finality — proof
         // the flusher completed its job end-to-end.
         let safe_after = direct_provider
diff --git a/sequencer/src/recovery/mod.rs b/sequencer/src/recovery/mod.rs
index 3bf9b9f9..476c3ae5 100644
--- a/sequencer/src/recovery/mod.rs
+++ b/sequencer/src/recovery/mod.rs
@@ -86,8 +86,6 @@ pub enum RecoveryRetryReason {
     },
     #[error("local recovery facts changed before phase execution: {status:?}")]
     StaleDecision { status: DangerStatus },
-    #[error("the Tip was already open when the EnsureOpenTip phase ran")]
-    TipAlreadyOpen,
     #[error("runtime preparation outlived its clean admission decision ({decision})")]
     AdmissionChanged { decision: &'static str },
 }
@@ -102,6 +100,11 @@ pub enum RecoveryRefusalReason {
     MissingRecoveryCheckpoint,
     #[error("post-sync recovery has no persisted safe head")]
     MissingSafeHead,
+    /// A Tip appeared between the no-Tip inspection and the `EnsureOpenTip`
+    /// transaction. Under the process lock nothing else writes, so this is a
+    /// lock violation or an inspection bug; retrying would admit over it.
+    #[error("the Tip was already open when the EnsureOpenTip phase ran")]
+    TipAlreadyOpen,
     /// The `EnsureOpenTip` transaction violated its open-Tip postcondition.
     #[error("the EnsureOpenTip phase left no valid open Tip")]
     TipMissingAfterOpen,
@@ -229,7 +232,7 @@ impl RecoveryL1 for StartupL1<'_> {
     }
 
     async fn flush(&mut self) -> Result<u64, RecoveryError> {
-        let provider = crate::l1::provider::create_verified_signer_provider(
+        let providers = crate::l1::provider::create_verified_keyed_providers(
             &self.l1_config.eth_rpc_url,
             self.l1_config.batch_submitter_private_key.expose_secret(),
             self.l1_config.identity.chain_id,
@@ -243,9 +246,9 @@ impl RecoveryL1 for StartupL1<'_> {
             storage.wallet_nonce_watermark().map_err(classify_storage)?
         };
         MempoolFlusher::flush_to_safe(
-            provider,
+            providers,
             self.l1_config.identity.batch_submitter_address,
-            self.protocol.seconds_per_block,
+            self.protocol.seconds_per_block(),
             self.db_path,
             watermark,
         )
@@ -427,38 +430,16 @@ fn classify_signer_provider(
     }
 }
 
-/// Input-reader errors met during the startup phases (`InitialSync` and
-/// `PostFlushSync`, both through `sync_to_current_safe_head`), classified
-/// at birth. `ChainIdMismatch` and `StorageTaskPanicked` are refused here
-/// and terminal in the live worker alike. Two variants are phase-dependent
-/// by design and differ from `InputReaderError::is_terminal_invariant`:
-///
-/// - `Bootstrap` here can only be the sync's `create_provider` failing on
-///   the configured RPC URL (parse, the plaintext-remote rule, client
-///   build), refused because re-running the same boot re-fails
-///   identically. The discovery-time facts (wrong contract, pre-v3
-///   InputBox) never reach this function: they arise in `InputReader::new`,
-///   which only `setup` calls and currently projects as a live-worker exit
-///   rather than a deterministic configuration failure. In the live loop the
-///   same URL was already proven by this boot's initial sync, so a live
-///   `Bootstrap` restarts unclassified rather than poisoning the data directory.
-/// - `Join` (a non-panic loss of a storage task) is shutdown-path
-///   cancellation in the live loop. During startup the runtime that would
-///   cancel it is the one driving this boot, so an unexplained loss is
-///   refused rather than retried blind.
-///
-/// Both halves are pinned.
+/// Input-reader errors met during the startup phases, classified at birth by
+/// [`InputReaderError::is_retryable_at_startup`]; storage keeps its provenance.
 fn classify_input_reader(error: InputReaderError) -> RecoveryError {
     match error {
-        error @ (InputReaderError::Provider(_) | InputReaderError::InconsistentL1Response(_)) => {
-            RecoveryError::retry(RecoveryFailure::InputReader(error))
-        }
         InputReaderError::OpenStorage(source) => classify_open(source),
         InputReaderError::Storage(source) => classify_storage(source),
-        error @ (InputReaderError::ChainIdMismatch { .. }
-        | InputReaderError::Bootstrap(_)
-        | InputReaderError::StorageTaskPanicked { .. }
-        | InputReaderError::Join(_)) => RecoveryError::refuse(RecoveryFailure::InputReader(error)),
+        error if error.is_retryable_at_startup() => {
+            RecoveryError::retry(RecoveryFailure::InputReader(error))
+        }
+        error => RecoveryError::refuse(RecoveryFailure::InputReader(error)),
     }
 }
 
@@ -495,7 +476,7 @@ fn classify_mutation(error: RecoveryMutationError) -> RecoveryError {
             RecoveryError::retry(RecoveryRetryReason::StaleDecision { status: actual })
         }
         RecoveryMutationError::TipAlreadyOpen => {
-            RecoveryError::retry(RecoveryRetryReason::TipAlreadyOpen)
+            RecoveryError::refuse(RecoveryRefusalReason::TipAlreadyOpen)
         }
         RecoveryMutationError::TipMissingAfterOpen => {
             RecoveryError::refuse(RecoveryRefusalReason::TipMissingAfterOpen)
@@ -533,6 +514,43 @@ mod tests {
         );
     }
 
+    /// The reader's predicate and the startup classifier agree on every
+    /// variant, including both storage polarities.
+    #[test]
+    fn startup_reader_polarity_has_one_owner() {
+        let busy = || sqlite_failure(rusqlite::ffi::ErrorCode::DatabaseBusy, 5);
+        let corrupt = || sqlite_failure(rusqlite::ffi::ErrorCode::NotADatabase, 26);
+        let errors: Vec<fn() -> InputReaderError> = vec![
+            || InputReaderError::Provider("offline".into()),
+            || InputReaderError::InconsistentL1Response("gap".into()),
+            || InputReaderError::ChainIdMismatch {
+                rpc: 1,
+                expected: 2,
+            },
+            || InputReaderError::Bootstrap("bad url".into()),
+            || InputReaderError::StorageTaskPanicked { operation: "sync" },
+            || InputReaderError::Join("lost".into()),
+        ];
+        let mut cases: Vec<InputReaderError> = errors.into_iter().map(|make| make()).collect();
+        cases.push(InputReaderError::Storage(busy()));
+        cases.push(InputReaderError::Storage(corrupt()));
+        cases.push(InputReaderError::OpenStorage(StorageOpenError::Sqlite(
+            busy(),
+        )));
+        cases.push(InputReaderError::OpenStorage(StorageOpenError::Sqlite(
+            corrupt(),
+        )));
+        for error in cases {
+            let expected = error.is_retryable_at_startup();
+            let description = error.to_string();
+            assert_eq!(
+                classify_input_reader(error).is_retryable(),
+                expected,
+                "{description}"
+            );
+        }
+    }
+
     #[test]
     fn error_classifiers_pin_retry_and_refuse_polarity() {
         use crate::l1::watermark::WalletNonceWatermarkError;
@@ -613,11 +631,14 @@ mod tests {
         }
 
         assert_retry(classify_flush(FlushError::Provider("offline".into())));
+        assert_refuse(classify_flush(FlushError::UnsignableTransaction(
+            "no signer".into(),
+        )));
         assert_refuse(classify_flush(FlushError::Watermark(
             WalletNonceWatermarkError::Storage(rusqlite::Error::QueryReturnedNoRows),
         )));
 
-        assert_retry(classify_mutation(RecoveryMutationError::TipAlreadyOpen));
+        assert_refuse(classify_mutation(RecoveryMutationError::TipAlreadyOpen));
         assert_refuse(classify_mutation(
             RecoveryMutationError::TipMissingAfterOpen,
         ));
@@ -644,8 +665,9 @@ mod tests {
         name: &str,
         has_recovery_checkpoint: bool,
         has_open_tip: bool,
-    ) -> (crate::storage::test_helpers::TestDb, ProtocolTiming) {
-        use crate::storage::test_helpers::{SENDER_A, default_protocol_timing, temp_db};
+    ) -> (crate::test_support::TestDb, ProtocolTiming) {
+        use crate::storage::test_helpers::{SENDER_A, default_protocol_timing};
+        use crate::test_support::temp_db;
 
         let db = temp_db(name);
         let protocol = default_protocol_timing();
@@ -653,7 +675,7 @@ mod tests {
         let mut storage =
             storage::Storage::initialize_for_command(&db.path, storage::LifecycleCommand::Setup)
                 .expect("initialize setup");
-        crate::storage::test_helpers::pin_test_deployment_identity(&mut storage, SENDER_A);
+        crate::test_support::pin_test_deployment_identity(&mut storage, SENDER_A);
         storage
             .append_safe_inputs_with_timestamp(
                 0,
@@ -746,10 +768,7 @@ mod tests {
         }
     }
 
-    fn danger_fixture(
-        name: &str,
-        closed: bool,
-    ) -> (crate::storage::test_helpers::TestDb, ProtocolTiming) {
+    fn danger_fixture(name: &str, closed: bool) -> (crate::test_support::TestDb, ProtocolTiming) {
         let (db, protocol) = admission_fixture(name, true, true);
         let mut storage = storage::Storage::open_writer(&db.path).expect("open writer");
         if closed {
@@ -972,7 +991,7 @@ mod tests {
     #[tokio::test]
     async fn observed_tip_repair_still_refuses_a_surviving_clock_fault() {
         let (db, protocol) = danger_fixture("recovery-tip-clock", false);
-        let ahead = crate::clock::unix_now_ms() + protocol.seconds_per_block * 2_000;
+        let ahead = crate::clock::unix_now_ms() + protocol.seconds_per_block() * 2_000;
         storage::Storage::open_writer(&db.path)
             .unwrap()
             .write(|tx| {
diff --git a/sequencer/src/runtime/mod.rs b/sequencer/src/runtime/mod.rs
index 789e599c..457a61bc 100644
--- a/sequencer/src/runtime/mod.rs
+++ b/sequencer/src/runtime/mod.rs
@@ -1,17 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The runtime authority capabilities — the ADR's "structured process
-//! ownership" mechanism, and nothing else:
-//!
-//! - [`process_lock`] — the exclusive kernel-enforced data-directory lock
-//!   every command and nested blocking task retains until it truly stops.
-//! - [`shutdown`] — `RuntimeScope` (lock + cooperative `ShutdownSignal`) and
-//!   terminal runtime abort.
-//!
-//! Everything here is consumed crate-wide (workers, egress, l1, recovery);
-//! the command brackets live in [`crate::commands`], which also owns the
-//! command-scoped config and error taxonomy.
+//! Runtime authority capabilities (authority-boundary ADR, mechanism 1): the
+//! exclusive data-directory lock ([`process_lock`]) and `RuntimeScope` with
+//! cooperative shutdown and terminal abort ([`shutdown`]).
 
 pub(crate) mod process_lock;
 pub mod shutdown;
diff --git a/sequencer/src/runtime/process_lock.rs b/sequencer/src/runtime/process_lock.rs
index b3a60a03..5f04354b 100644
--- a/sequencer/src/runtime/process_lock.rs
+++ b/sequencer/src/runtime/process_lock.rs
@@ -1,22 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Exclusive data-directory process lock.
-//!
-//! Every subcommand that touches a data directory (`run`, `setup`,
-//! `flush-mempool`) acquires an OS-held advisory
-//! lock on `<data_dir>/sequencer.lock` before reading or mutating anything
-//! there. `run` clones it into the structured runtime scope and into each
-//! data-directory worker, and keeps one itself through settlement; the lock
-//! is released only after the last clone — controller, scope, worker, or
-//! nested blocking closure — drops, including during pre-worker
-//! setup/recovery. The other
-//! commands hold it until they and any detached blocking work return.
-//! Persisted lifecycle rows cannot distinguish a live owner from a stale one;
-//! a kernel-held lock can — it vanishes with the process, however the process
-//! dies. This prevents two processes from racing settlement, rebuild, or
-//! boot on one data dir, and is the exclusive-ownership primitive the
-//! authority-boundary ADR's durable lifecycle builds on.
+//! Exclusive data-directory lock: every command takes an OS-held advisory lock on
+//! `<data_dir>/sequencer.lock` before touching the directory and keeps it until
+//! the last clone drops. Unlike a persisted row, a kernel lock dies with its
+//! process. Lifetime rules: authority-boundary ADR, mechanism 1.
 
 use std::fs::{File, TryLockError};
 use std::path::Path;
@@ -37,8 +25,12 @@ pub(crate) enum ProcessLockError {
          refusing to run concurrently"
     )]
     Locked { path: String },
-    #[error(transparent)]
-    Io(#[from] std::io::Error),
+    #[error("data-directory lock {path}: {source}")]
+    Io {
+        path: String,
+        #[source]
+        source: std::io::Error,
+    },
 }
 
 /// Lock-anchor file name inside the data directory. Contents are irrelevant
@@ -64,12 +56,17 @@ impl ProcessLock {
     /// kernel-enforced fact rather than an operational convention.
     pub(crate) fn acquire(data_dir: &str) -> Result<Self, ProcessLockError> {
         let path = Path::new(data_dir).join(LOCK_FILE_NAME);
+        let io_error = |source: std::io::Error| ProcessLockError::Io {
+            path: path.display().to_string(),
+            source,
+        };
         let file = File::options()
             .read(true)
             .write(true)
             .create(true)
             .truncate(false)
-            .open(&path)?;
+            .open(&path)
+            .map_err(io_error)?;
         match file.try_lock() {
             Ok(()) => Ok(Self {
                 _file: Arc::new(file),
@@ -77,7 +74,7 @@ impl ProcessLock {
             Err(TryLockError::WouldBlock) => Err(ProcessLockError::Locked {
                 path: path.display().to_string(),
             }),
-            Err(TryLockError::Error(err)) => Err(err.into()),
+            Err(TryLockError::Error(err)) => Err(io_error(err)),
         }
     }
 
@@ -92,6 +89,60 @@ impl ProcessLock {
         std::mem::forget(dir);
         lock
     }
+
+    /// Acquire a lock this process has just released, for tests asserting
+    /// the release. `flock` frees a lock only when every descriptor sharing
+    /// it closes, and a child spawned by a concurrent test (Anvil, a
+    /// re-executed test binary) holds copies of all of them until its `exec`
+    /// closes them, so an immediate acquire can see
+    /// [`ProcessLockError::Locked`] for that window. It retries only while no
+    /// descriptor of this process is open on the lock file, so an owner in
+    /// this process that has not released fails at once, as a plain acquire
+    /// would.
+    #[cfg(test)]
+    pub(crate) fn acquire_released(data_dir: &str) -> Self {
+        use std::time::{Duration, Instant};
+
+        let path = Path::new(data_dir).join(LOCK_FILE_NAME);
+        let deadline = Instant::now() + Duration::from_secs(2);
+        loop {
+            match Self::acquire(data_dir) {
+                Ok(lock) => return lock,
+                Err(ProcessLockError::Locked { .. }) if open_in_this_process(&path) => {
+                    panic!("an owner in this process still holds {}", path.display())
+                }
+                Err(ProcessLockError::Locked { .. }) if Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(1));
+                }
+                Err(err) => panic!("re-acquiring the released lock failed: {err}"),
+            }
+        }
+    }
+}
+
+/// Whether a descriptor of this process is open on `path`: its descriptor
+/// table, read through `/dev/fd` (`/proc/self/fd` on Linux), matched by
+/// inode and change time, since macOS reports devfs's device for a `/dev/fd`
+/// entry. A spawned child's copies are in the child's table.
+#[cfg(test)]
+fn open_in_this_process(path: &Path) -> bool {
+    use std::os::unix::fs::MetadataExt;
+
+    let target = std::fs::metadata(path).expect("stat the lock file");
+    let table = if cfg!(target_os = "linux") {
+        "/proc/self/fd"
+    } else {
+        "/dev/fd"
+    };
+    std::fs::read_dir(table)
+        .expect("read this process's descriptor table")
+        .filter_map(Result::ok)
+        .filter_map(|entry| std::fs::metadata(entry.path()).ok())
+        .any(|meta| {
+            meta.ino() == target.ino()
+                && meta.ctime() == target.ctime()
+                && meta.ctime_nsec() == target.ctime_nsec()
+        })
 }
 
 /// Spawn blocking work while retaining the command/runtime lock for the
@@ -138,7 +189,19 @@ mod tests {
         );
 
         drop(held);
-        ProcessLock::acquire(data_dir).expect("acquire after release");
+        ProcessLock::acquire_released(data_dir);
+    }
+
+    #[test]
+    fn open_in_this_process_tracks_the_lock_descriptor() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let data_dir = dir.path().to_str().expect("utf8 path");
+        let path = Path::new(data_dir).join(LOCK_FILE_NAME);
+
+        let held = ProcessLock::acquire(data_dir).expect("acquire");
+        assert!(open_in_this_process(&path));
+        drop(held);
+        assert!(!open_in_this_process(&path));
     }
 
     #[test]
@@ -160,7 +223,7 @@ mod tests {
         ProcessLock::acquire(data_dir).expect_err("retained clone must keep the lock held");
 
         drop(retained);
-        ProcessLock::acquire(data_dir).expect("last clone releases the lock");
+        ProcessLock::acquire_released(data_dir);
     }
 
     #[tokio::test]
@@ -196,4 +259,22 @@ mod tests {
         .await
         .expect("blocking closure should release its retained lock");
     }
+
+    #[test]
+    fn io_failure_names_the_lock_path() {
+        let parent = tempfile::tempdir().expect("create parent dir");
+        let missing = parent.path().join("missing");
+        let lock_path = missing.join(LOCK_FILE_NAME).display().to_string();
+
+        let err = ProcessLock::acquire(missing.to_str().expect("utf8 path"))
+            .expect_err("a lock in a missing directory cannot open");
+
+        assert!(matches!(&err, ProcessLockError::Io { path, .. } if *path == lock_path));
+        let projected = crate::commands::error::CommandError::from(err);
+        assert!(projected.to_string().contains(&lock_path), "{projected}");
+        assert_eq!(
+            projected.exit_code(),
+            crate::commands::error::EXIT_UNCLASSIFIED
+        );
+    }
 }
diff --git a/sequencer/src/runtime/shutdown.rs b/sequencer/src/runtime/shutdown.rs
index e3f07f34..7e728882 100644
--- a/sequencer/src/runtime/shutdown.rs
+++ b/sequencer/src/runtime/shutdown.rs
@@ -14,7 +14,11 @@ use super::process_lock::ProcessLock;
 /// Logging is best-effort: an operator-supplied blocking subscriber can delay
 /// this call. No worker drain or durable settlement precedes process abort.
 pub(crate) fn abort_terminal(error: impl std::fmt::Display) -> ! {
-    tracing::error!(error = %error, "terminal runtime failure; aborting process");
+    tracing::error!(
+        error = %error,
+        exit = "SIGABRT(134): terminal, do not restart",
+        "terminal runtime failure; aborting process"
+    );
     std::process::abort()
 }
 
diff --git a/sequencer/src/storage/admin.rs b/sequencer/src/storage/admin.rs
deleted file mode 100644
index 539e7bd5..00000000
--- a/sequencer/src/storage/admin.rs
+++ /dev/null
@@ -1,134 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-//! Operator/admin writes: tune the alpha policy parameter.
-
-use rusqlite::{Result, params};
-
-use super::Storage;
-
-impl Storage {
-    /// Set the alpha knob from a `num/denom` rational. Computes both
-    /// `log_alpha` and `log_one_plus_alpha` (the policy-derived view needs
-    /// both). Panics if `num + denom` overflows `u64` — a misuse, not a
-    /// runtime condition.
-    pub fn set_alpha(&mut self, num: u64, denom: u64) -> Result<()> {
-        use sequencer_core::fee::log_fee_ratio;
-
-        let log_alpha = log_fee_ratio(num, denom);
-        let one_plus_alpha_num = num.checked_add(denom).expect(
-            "set_alpha: num + denom overflows u64; use smaller values for the alpha fraction",
-        );
-        let log_one_plus_alpha = log_fee_ratio(one_plus_alpha_num, denom);
-
-        let changed = self.conn.execute(
-            "UPDATE batch_policy \
-             SET log_alpha = ?1, log_one_plus_alpha = ?2 \
-             WHERE singleton_id = 0",
-            params![i64::from(log_alpha), i64::from(log_one_plus_alpha)],
-        )?;
-        if changed != 1 {
-            return Err(rusqlite::Error::StatementChangedRows(changed));
-        }
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use crate::storage::{Storage, test_helpers::temp_db};
-
-    #[test]
-    fn negative_batch_size_target_floors_to_zero() {
-        let db = temp_db("floor-batch-target");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-
-        // This row satisfies every schema constraint while deriving a negative
-        // target: 1403 - 2000 - 419 = -1016.
-        storage
-            .conn
-            .execute(
-                "UPDATE batch_policy SET log_alpha = 2000 WHERE singleton_id = 0",
-                [],
-            )
-            .expect("set high alpha");
-
-        let policy = storage.batch_policy().expect("read policy");
-        assert_eq!(
-            policy.batch_size_target, 0,
-            "negative batch-size target should be floored to zero"
-        );
-    }
-
-    #[test]
-    #[should_panic(expected = "batch policy derived recommended fee")]
-    fn negative_recommended_fee_fails_loud() {
-        let db = temp_db("negative-recommended-fee");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-
-        // A negative derived fee is ruled out by the column constraints. Model
-        // corruption/tampering that bypassed them and ensure the read cannot
-        // launder the impossible value into a plausible zero fee.
-        storage
-            .conn
-            .execute_batch(
-                "PRAGMA ignore_check_constraints = ON;
-                 UPDATE batch_policy SET log_delta = -10000 WHERE singleton_id = 0;",
-            )
-            .expect("inject impossible policy row");
-
-        let _ = storage.batch_policy();
-    }
-
-    #[test]
-    #[should_panic(expected = "batch policy derived batch size target")]
-    fn oversized_batch_size_target_fails_loud() {
-        let db = temp_db("oversized-batch-target");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-
-        // This is schema-valid: the derived target is 17984, which remains
-        // below the row's configured log_max_batch_bytes of 20000. It is still
-        // outside the core fee exponent domain and must not become u64::MAX.
-        storage
-            .conn
-            .execute(
-                "UPDATE batch_policy
-                 SET log_alpha = -17000, log_max_batch_bytes = 20000
-                 WHERE singleton_id = 0",
-                [],
-            )
-            .expect("set schema-valid oversized target");
-        let integrity: String = storage
-            .conn
-            .query_row("PRAGMA integrity_check", [], |row| row.get(0))
-            .expect("check database integrity");
-        assert_eq!(integrity, "ok");
-
-        let _ = storage.batch_policy();
-    }
-
-    #[test]
-    #[should_panic(expected = "num + denom overflows u64")]
-    fn set_alpha_rejects_overflow() {
-        let db = temp_db("alpha-overflow");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage.set_alpha(u64::MAX, 1).unwrap();
-    }
-
-    /// CHECK constraint guards against alpha values that would push the batch-size
-    /// target past `log_max_batch_bytes`. Migrated from the old `sql.rs` test suite.
-    #[test]
-    fn batch_policy_check_rejects_unsafe_alpha() {
-        let db = temp_db("unsafe-alpha");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        // log_alpha=-350 → log_batch_size_target = 1403-(-350)-419 = 1334 >= log_max_batch_bytes=1333
-        let err = storage.conn.execute(
-            "UPDATE batch_policy SET log_alpha = ?1, log_one_plus_alpha = ?2 WHERE singleton_id = 0",
-            [-350_i64, 0_i64],
-        );
-        assert!(
-            err.is_err(),
-            "CHECK should reject unsafe alpha (log_batch_size_target >= log_max_batch_bytes)"
-        );
-    }
-}
diff --git a/sequencer/src/storage/convert.rs b/sequencer/src/storage/convert.rs
index be1e2376..51d84d14 100644
--- a/sequencer/src/storage/convert.rs
+++ b/sequencer/src/storage/convert.rs
@@ -1,30 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Integer conversions between Rust domain types and SQLite `INTEGER` columns,
-//! plus `SystemTime` ↔ `i64` Unix-ms conversions.
-//!
-//! Two conversion families with opposite postures, per the fail-loud check
-//! policy in `docs/invariants.md`:
-//!
-//! - **Contract-bound conversions fail loud.** Domain values (indices, nonces,
-//!   block numbers, offsets, fees) are non-negative and far below `i64::MAX`
-//!   by schema `CHECK`s, triggers, or writer-side types. An out-of-range value
-//!   can only mean DB corruption, tampering, or a sequencer bug; saturating it
-//!   would fabricate a plausible value and let the divergence externalize (a
-//!   signed batch, a feed event, a wrong recovery pivot). These panic to stop
-//!   the operation before externalization. A persistent violation is not
-//!   repaired by restart and may require inspection or cockroach recovery;
-//!   fail-loud is a safety property, not a self-healing claim.
-//! - **Clock and query-bound conversions saturate.** Wall-clock time is
-//!   environmental, not an invariant: a far-future clock clamps to
-//!   `i64::MAX` rather than aborting. Untrusted or config-sourced SQL bounds
-//!   go through [`saturating_query_bound`], where clamping preserves the
-//!   comparison semantics exactly. Sign remains contract-bound even for clock
-//!   *columns*: every timestamp writer is u64-clock-sourced (floored at 0), so
-//!   [`from_unix_ms`] fail-louds on a negative stored value — a sign check is
-//!   a real invariant, unlike cross-column timestamp ordering checks, which
-//!   once wedged recovery and are deliberately left unenforced.
+//! Domain integers and `SystemTime` <-> SQLite `INTEGER`. Contract-bound values
+//! (indices, nonces, blocks, offsets, fees, a stored timestamp's sign) panic out
+//! of range, since a saturated value could reach a signed batch or the feed.
+//! Clock writes and untrusted query bounds saturate (`docs/invariants.md`).
 
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
diff --git a/sequencer/src/storage/egress.rs b/sequencer/src/storage/egress.rs
index 2f64adbe..33d527e4 100644
--- a/sequencer/src/storage/egress.rs
+++ b/sequencer/src/storage/egress.rs
@@ -1,73 +1,7 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Application replay entries and the historical L1 prefix for consumer bootstrap.
+//! Era-pinned historical L1 pages for consumer bootstrap.
 
-use alloy_primitives::{Address, B256};
-use rusqlite::{Result, Row};
-use sequencer_core::history::ExecutedInputCount;
-use sequencer_core::l2_tx::{DirectInput, ValidUserOp};
-
-use super::convert::{i64_to_u16, i64_to_u32, i64_to_u64};
-
-mod canonical;
-pub(crate) use canonical::HistoryReadError;
 mod historical;
 pub(crate) use historical::HistoricalReadError;
-
-#[derive(Debug, Clone)]
-pub(crate) enum L2TxContext {
-    UserOp {
-        tx: ValidUserOp,
-        nonce: u32,
-        safe_block: u64,
-        batch_nonce: u64,
-    },
-    DirectInput {
-        tx: DirectInput,
-        input_index: u64,
-        batch_nonce: u64,
-        block_timestamp: u64,
-        transaction_hash: B256,
-    },
-}
-
-#[derive(Debug, Clone)]
-pub(crate) struct ApplicationInputRow {
-    pub(crate) offset: ExecutedInputCount,
-    pub(crate) context: L2TxContext,
-}
-
-fn decode_application_input(row: &Row<'_>) -> Result<ApplicationInputRow> {
-    let sender = Address::from_slice(row.get::<_, Vec<u8>>(2)?.as_slice());
-    let safe_block = i64_to_u64(row.get(7)?);
-    let batch_nonce = i64_to_u64(row.get(8)?);
-    let context = match row.get::<_, i64>(1)? {
-        0 => L2TxContext::UserOp {
-            tx: ValidUserOp {
-                sender,
-                data: row.get(3)?,
-                fee: i64_to_u16(row.get(4)?),
-            },
-            nonce: i64_to_u32(row.get(10)?),
-            safe_block,
-            batch_nonce,
-        },
-        1 => L2TxContext::DirectInput {
-            tx: DirectInput {
-                sender,
-                payload: row.get(5)?,
-                block_number: i64_to_u64(row.get(6)?),
-            },
-            input_index: i64_to_u64(row.get(9)?),
-            batch_nonce,
-            block_timestamp: i64_to_u64(row.get(11)?),
-            transaction_hash: B256::from_slice(row.get::<_, Vec<u8>>(12)?.as_slice()),
-        },
-        kind => panic!("invalid application input kind {kind}"),
-    };
-    Ok(ApplicationInputRow {
-        offset: ExecutedInputCount::new(i64_to_u64(row.get(0)?)),
-        context,
-    })
-}
diff --git a/sequencer/src/storage/egress/historical.rs b/sequencer/src/storage/egress/historical.rs
index 2b5ba5f6..a988f8e0 100644
--- a/sequencer/src/storage/egress/historical.rs
+++ b/sequencer/src/storage/egress/historical.rs
@@ -33,7 +33,7 @@ pub(crate) enum HistoricalReadError {
     BadRequest(String),
     #[error(transparent)]
     Checkpoint(#[from] FinalizedSelectionError),
-    #[error("reading historical L1 inputs: {0}")]
+    #[error("reading history: {0}")]
     Storage(#[from] rusqlite::Error),
 }
 
diff --git a/sequencer/src/storage/egress/historical/tests.rs b/sequencer/src/storage/egress/historical/tests.rs
index af0b4506..eaa331e2 100644
--- a/sequencer/src/storage/egress/historical/tests.rs
+++ b/sequencer/src/storage/egress/historical/tests.rs
@@ -6,12 +6,12 @@ use std::path::Path;
 use super::*;
 use crate::storage::history::{advance_recovery_generation_in, initialize_history_in};
 use crate::storage::test_helpers::{
-    SENDER_A, SENDER_B, TestDb, default_protocol_timing, local_batch_payload,
-    pin_test_deployment_identity, temp_db,
+    SENDER_A, SENDER_B, default_protocol_timing, local_batch_payload,
 };
 use crate::storage::{
     DirectInputExecution, FrontierMode, IngestedSafeInput, LifecycleCommand, SafeInputRange,
 };
+use crate::test_support::{TestDb, pin_test_deployment_identity, temp_db};
 
 fn fixture(name: &str, stop: u64, count: u64, nonce: u64) -> (TestDb, Storage) {
     let db = temp_db(name);
@@ -290,7 +290,10 @@ fn missing_raw_input_is_an_invariant_fault() {
     );
     storage
         .conn
-        .execute("DELETE FROM safe_inputs WHERE safe_input_index=1", [])
+        .execute_batch(
+            "DROP TRIGGER trg_safe_inputs_not_deletable; \
+             DELETE FROM safe_inputs WHERE safe_input_index=1;",
+        )
         .unwrap();
     let _ = page(&mut storage, 0, 3);
 }
@@ -325,7 +328,6 @@ fn accepted_checkpoint_uses_the_exact_latest_snapshot_and_preserves_baseline() {
                 &mut head,
                 20,
                 Path::new(&format!("/snapshot/{index}")),
-                index,
                 ExecutedInputCount::new(41),
             )
             .unwrap();
diff --git a/sequencer/src/storage/fee_oracle.rs b/sequencer/src/storage/fee_oracle.rs
index 12c017c8..9c1b1284 100644
--- a/sequencer/src/storage/fee_oracle.rs
+++ b/sequencer/src/storage/fee_oracle.rs
@@ -9,11 +9,23 @@ use super::Storage;
 use super::convert::{i64_to_u64, now_unix_ms};
 
 impl Storage {
-    pub fn log_gas_price(&self) -> Result<u16> {
+    pub fn log_gas_price(&self) -> Result<i16> {
         self.conn.query_row(
             "SELECT log_gas_price FROM batch_policy WHERE singleton_id = 0",
             [],
-            |row| row.get::<_, u16>(0),
+            |row| row.get::<_, i16>(0),
+        )
+    }
+
+    /// Lowest `log_gas_price` the schema admits: the one that brings the
+    /// derived recommended fee to exponent 0. Derived from the view so the
+    /// summand list has one owner.
+    pub fn log_gas_price_floor(&self) -> Result<i16> {
+        self.conn.query_row(
+            "SELECT log_gas_price - log_recommended_fee FROM batch_policy_derived \
+             WHERE singleton_id = 0",
+            [],
+            |row| row.get::<_, i16>(0),
         )
     }
 
@@ -27,7 +39,7 @@ impl Storage {
         )
     }
 
-    pub fn set_log_gas_price(&mut self, log_gas_price: u16) -> Result<()> {
+    pub fn set_log_gas_price(&mut self, log_gas_price: i16) -> Result<()> {
         let changed = self.conn.execute(
             "UPDATE batch_policy \
              SET log_gas_price = ?1, log_gas_price_updated_at_ms = ?2 \
@@ -39,25 +51,12 @@ impl Storage {
         }
         Ok(())
     }
-
-    /// Test-only: pin the observation stamp without going through wall-clock now.
-    #[cfg(test)]
-    pub fn set_log_gas_price_updated_at_ms_for_test(&mut self, updated_at_ms: u64) -> Result<()> {
-        use super::convert::u64_to_i64;
-        let changed = self.conn.execute(
-            "UPDATE batch_policy SET log_gas_price_updated_at_ms = ?1 WHERE singleton_id = 0",
-            params![u64_to_i64(updated_at_ms)],
-        )?;
-        if changed != 1 {
-            return Err(rusqlite::Error::StatementChangedRows(changed));
-        }
-        Ok(())
-    }
 }
 
 #[cfg(test)]
 mod tests {
-    use crate::storage::{Storage, test_helpers::temp_db};
+    use crate::storage::Storage;
+    use crate::test_support::temp_db;
 
     #[test]
     fn high_gas_price_clamps_recommended_fee_to_max_exponent() {
@@ -72,6 +71,25 @@ mod tests {
         let _ = sequencer_core::fee::fee_to_linear(policy.recommended_fee);
     }
 
+    #[test]
+    fn negative_log_gas_price_lowers_the_recommended_fee_to_the_floor() {
+        let db = temp_db("negative-fee");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let floor = storage.log_gas_price_floor().expect("floor");
+        assert_eq!(floor, -1356);
+        storage
+            .set_log_gas_price(-1000)
+            .expect("below one unit per gas");
+        assert_eq!(storage.batch_policy().unwrap().recommended_fee, 356);
+        storage.set_log_gas_price(floor).expect("the floor itself");
+        assert_eq!(storage.batch_policy().unwrap().recommended_fee, 0);
+        let err = storage
+            .set_log_gas_price(floor - 1)
+            .expect_err("below the floor");
+        assert!(err.to_string().contains("CHECK constraint failed"), "{err}");
+        assert_eq!(storage.log_gas_price().unwrap(), floor);
+    }
+
     #[test]
     fn set_log_gas_price_stamps_updated_at() {
         let db = temp_db("fee-price-stamp");
diff --git a/sequencer/src/storage/history.rs b/sequencer/src/storage/history.rs
index 975e70ba..819d0021 100644
--- a/sequencer/src/storage/history.rs
+++ b/sequencer/src/storage/history.rs
@@ -9,6 +9,11 @@ use sequencer_core::history::{EraId, ExecutedInputCount, HistoryVersion, Recover
 use super::Storage;
 use super::convert::{i64_to_u64, now_unix_ms, u64_to_i64};
 
+mod canonical;
+#[cfg(test)]
+pub(crate) use canonical::ApplicationInputRow;
+pub(crate) use canonical::{HistoryReadError, L2TxContext};
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct HistoryState {
     pub version: HistoryVersion,
@@ -28,10 +33,6 @@ impl Storage {
     pub fn history_state(&self) -> Result<HistoryState> {
         query_history_state(&self.conn)
     }
-
-    pub fn next_executed_input_count(&mut self) -> Result<ExecutedInputCount> {
-        self.read(|tx| next_executed_input_count_in(tx))
-    }
 }
 
 pub(super) fn query_history_state(conn: &Connection) -> Result<HistoryState> {
@@ -150,7 +151,8 @@ pub(super) fn preserved_input_count_in(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::{LifecycleCommand, test_helpers::temp_db};
+    use crate::storage::LifecycleCommand;
+    use crate::test_support::temp_db;
 
     #[test]
     fn complete_baseline_is_immutable_and_survives_restart() {
diff --git a/sequencer/src/storage/egress/canonical.rs b/sequencer/src/storage/history/canonical.rs
similarity index 70%
rename from sequencer/src/storage/egress/canonical.rs
rename to sequencer/src/storage/history/canonical.rs
index 8537293c..ad949994 100644
--- a/sequencer/src/storage/egress/canonical.rs
+++ b/sequencer/src/storage/history/canonical.rs
@@ -1,18 +1,80 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Version-checked canonical pages, read with their boundaries in one transaction.
+//! Canonical application history: version-checked pages read with their
+//! boundaries in one transaction. Native restart catch-up and the WS feed
+//! read it.
 
-use rusqlite::{Connection, Transaction, params};
+use alloy_primitives::{Address, B256};
+use rusqlite::{Connection, Row, Transaction, params};
 use sequencer_core::history::{
     ExecutedInputCount, HistoryBounds, HistoryClaim, HistoryPolicyError,
 };
+use sequencer_core::l2_tx::{DirectInput, ValidUserOp};
 
-use super::{ApplicationInputRow, decode_application_input};
 use crate::storage::Storage;
-use crate::storage::convert::{saturating_query_bound, u64_to_i64};
+use crate::storage::convert::{
+    i64_to_u16, i64_to_u32, i64_to_u64, saturating_query_bound, u64_to_i64,
+};
 use crate::storage::history::{next_executed_input_count_in, query_history_state};
 
+#[derive(Debug, Clone)]
+pub(crate) enum L2TxContext {
+    UserOp {
+        tx: ValidUserOp,
+        nonce: u32,
+        safe_block: u64,
+        batch_nonce: u64,
+    },
+    DirectInput {
+        tx: DirectInput,
+        input_index: u64,
+        batch_nonce: u64,
+        block_timestamp: u64,
+        transaction_hash: B256,
+    },
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct ApplicationInputRow {
+    pub(crate) offset: ExecutedInputCount,
+    pub(crate) context: L2TxContext,
+}
+
+fn decode_application_input(row: &Row<'_>) -> rusqlite::Result<ApplicationInputRow> {
+    let sender = Address::from_slice(row.get::<_, Vec<u8>>(2)?.as_slice());
+    let safe_block = i64_to_u64(row.get(7)?);
+    let batch_nonce = i64_to_u64(row.get(8)?);
+    let context = match row.get::<_, i64>(1)? {
+        0 => L2TxContext::UserOp {
+            tx: ValidUserOp {
+                sender,
+                data: row.get(3)?,
+                fee: i64_to_u16(row.get(4)?),
+            },
+            nonce: i64_to_u32(row.get(10)?),
+            safe_block,
+            batch_nonce,
+        },
+        1 => L2TxContext::DirectInput {
+            tx: DirectInput {
+                sender,
+                payload: row.get(5)?,
+                block_number: i64_to_u64(row.get(6)?),
+            },
+            input_index: i64_to_u64(row.get(9)?),
+            batch_nonce,
+            block_timestamp: i64_to_u64(row.get(11)?),
+            transaction_hash: B256::from_slice(row.get::<_, Vec<u8>>(12)?.as_slice()),
+        },
+        kind => panic!("invalid application input kind {kind}"),
+    };
+    Ok(ApplicationInputRow {
+        offset: ExecutedInputCount::new(i64_to_u64(row.get(0)?)),
+        context,
+    })
+}
+
 #[derive(Debug)]
 pub(crate) struct CanonicalHistoryPage {
     pub(crate) bounds: HistoryBounds,
diff --git a/sequencer/src/storage/egress/canonical/tests.rs b/sequencer/src/storage/history/canonical/tests.rs
similarity index 99%
rename from sequencer/src/storage/egress/canonical/tests.rs
rename to sequencer/src/storage/history/canonical/tests.rs
index 63edf933..e3da72cb 100644
--- a/sequencer/src/storage/egress/canonical/tests.rs
+++ b/sequencer/src/storage/history/canonical/tests.rs
@@ -12,13 +12,13 @@ use crate::ingress::inclusion_lane::{IncludedUserOp, PendingUserOp};
 use crate::storage::L2TxContext;
 use crate::storage::history::initialize_history_in;
 use crate::storage::test_helpers::{
-    SENDER_A, SENDER_B, default_protocol_timing, local_batch_payload, pin_test_deployment_identity,
-    temp_db,
+    SENDER_A, SENDER_B, default_protocol_timing, local_batch_payload,
 };
 use crate::storage::{
     DirectInputExecution, FrontierMode, IngestedSafeInput, LifecycleCommand, SafeInputRange,
     StoredSafeInput,
 };
+use crate::test_support::{pin_test_deployment_identity, temp_db};
 
 fn included(nonce: u32, offset: u64, payload: u8) -> IncludedUserOp {
     let (respond_to, _response) = oneshot::channel();
diff --git a/sequencer/src/storage/history/generation_tests.rs b/sequencer/src/storage/history/generation_tests.rs
index 977db217..18393f93 100644
--- a/sequencer/src/storage/history/generation_tests.rs
+++ b/sequencer/src/storage/history/generation_tests.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 use super::*;
-use crate::storage::test_helpers::temp_db;
+use crate::test_support::temp_db;
 
 fn ledger(storage: &Storage) -> Vec<(i64, i64)> {
     storage
diff --git a/sequencer/src/storage/ingress.rs b/sequencer/src/storage/ingress.rs
index e39a6c9b..20a23614 100644
--- a/sequencer/src/storage/ingress.rs
+++ b/sequencer/src/storage/ingress.rs
@@ -1,24 +1,16 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Inclusion-lane writer: opens the initial batch/frame, appends user-op chunks,
-//! and rotates frame/batch boundaries on the hot path.
-//!
-//! The lane also reads classified external directs and the open
-//! state (resumed on startup) — those reads live here too because they're driven
-//! by the lane's flow, not by an L1 ingress event. The public ingress reads
-//! live here too: the fee quote and the next user nonce, derived from the
-//! lane's user-op rows.
+//! Inclusion-lane storage: open the first batch and frame, append user-op chunks,
+//! rotate frames and batches, and the lane-driven reads (classified directs, open
+//! state). The public `/fee` and `/nonce` reads live here too, since they derive
+//! from the lane's rows.
 
 use std::path::Path;
 
 use alloy_primitives::Address;
 use rusqlite::{OptionalExtension, Result, Transaction, params};
 
-#[cfg(test)]
-use super::StoredSafeInput;
-#[cfg(test)]
-use super::convert::external_u64_to_i64;
 use super::convert::{
     from_unix_ms, i64_to_u32, i64_to_u64, now_unix_ms, saturating_query_bound, to_unix_ms,
     u64_to_i64,
@@ -90,68 +82,6 @@ impl Storage {
         })
     }
 
-    /// Bootstrap the very first batch + frame with explicit values, returning
-    /// its loaded [`WriteHead`]. Asserts no open state exists.
-    ///
-    /// Production opens the genesis Tip through guarded startup recovery, which derives `safe_block`/leading range from the
-    /// synced L1 view; this explicit form is kept for tests that seed a
-    /// specific open state without a safe-head observation.
-    #[cfg(test)]
-    pub fn initialize_open_state(
-        &mut self,
-        safe_block: u64,
-        leading_direct_range: SafeInputRange,
-    ) -> Result<WriteHead> {
-        self.write(|tx| {
-            assert!(
-                load_current_write_head(tx)?.is_none(),
-                "open state already exists"
-            );
-            let batch_index = insert_tip_rows(tx, Some(0), None, safe_block)?;
-            persist_frame_direct_sequence_derived(tx, batch_index, 0, leading_direct_range)?;
-            Ok(load_current_write_head(tx)?.expect("genesis tip just inserted"))
-        })
-    }
-
-    /// Ensure a valid open Tip exists. Establishes the tip-existence
-    /// invariant; does **not** return the head — callers that need it load it
-    /// via [`Storage::open_state`], so [`WriteHead`] has a single constructor
-    /// (`load_current_write_head`) rather than a hand-built twin.
-    ///
-    /// No-op on a warm DB (or after a recovery cascade already reopened the
-    /// Tip). On a genuinely fresh DB it opens the genesis Tip via the shared
-    /// `open_fresh_tip_in_tx` mechanism: index 0 / nonce 0 at the current
-    /// safe head, the leading safe-input range **sequenced but not executed**.
-    /// Those directs are executed by the lane's catch-up replay (the same path
-    /// warm resume and recovery batches use), so there is no cold-start drain.
-    ///
-    /// This unguarded form exists for test harnesses only. Production uses
-    /// `ensure_open_tip_for_recovery`, which reasserts the startup facts in its
-    /// write transaction. The lane only ever *loads* a Tip (fail-loud if
-    /// absent); Cascade owns its own atomic reopen using the same mechanism.
-    ///
-    /// **Precondition (genesis branch only):** a safe-head observation must
-    /// exist. A fresh DB requires L1 at bootstrap plus a successful recovery
-    /// sync, else startup refuses before reaching here; the warm-DB early
-    /// return fires before any safe-head read.
-    #[cfg(test)]
-    pub(crate) fn ensure_open_tip(&mut self) -> Result<()> {
-        self.write(|tx| {
-            if load_current_write_head(tx)?.is_some() {
-                return Ok(());
-            }
-            open_fresh_tip_in_tx(tx)
-        })
-    }
-
-    /// Open the rebuilt root at the baseline's L1 stop block. Its prefix is
-    /// represented by the baseline artifact and contributes no replay rows.
-    #[cfg(test)]
-    pub(crate) fn open_recovery_tip(&mut self, stop_block: u64) -> Result<()> {
-        external_u64_to_i64(stop_block, "recovery checkpoint block")?;
-        self.write(|tx| open_recovery_tip_in_tx(tx, stop_block))
-    }
-
     /// Snapshot the current L1 reconciliation state. A canonical-divergence
     /// marker outranks and withholds the otherwise-usable frontier.
     ///
@@ -213,78 +143,6 @@ impl Storage {
         Ok(())
     }
 
-    /// Replace `out`'s contents with the safe-input rows in `range`. Asserts
-    /// contiguity — gaps in `safe_input_index` are a bug, not a runtime
-    /// condition.
-    #[cfg(test)]
-    pub(crate) fn fill_safe_inputs(
-        &mut self,
-        range: SafeInputRange,
-        out: &mut Vec<StoredSafeInput>,
-    ) -> Result<()> {
-        out.clear();
-        if range.is_empty() {
-            return Ok(());
-        }
-
-        const SQL: &str = "
-            SELECT safe_input_index, sender, payload, block_number
-            FROM safe_inputs
-            WHERE safe_input_index >= ?1 AND safe_input_index < ?2
-            ORDER BY safe_input_index ASC
-        ";
-        let mut stmt = self.conn.prepare_cached(SQL)?;
-        let rows = stmt.query_map(
-            params![u64_to_i64(range.start()), u64_to_i64(range.end())],
-            |row| {
-                Ok((
-                    row.get::<_, i64>(0)?,
-                    row.get::<_, Vec<u8>>(1)?,
-                    row.get::<_, Vec<u8>>(2)?,
-                    row.get::<_, i64>(3)?,
-                ))
-            },
-        )?;
-
-        let mut fetched_count = 0_u64;
-        for (offset, row) in rows.enumerate() {
-            let (index_i64, sender, payload, block_number_i64) = row?;
-            let index = i64_to_u64(index_i64);
-            let offset = u64::try_from(offset)
-                .expect("safe-input result offset exceeds u64: contract-impossible");
-            let expected = range
-                .start()
-                .checked_add(offset)
-                .expect("safe-input expected index overflow: contract-impossible");
-
-            assert_eq!(
-                index, expected,
-                "non-contiguous safe-input index: expected {expected}, found {index}"
-            );
-
-            out.push(StoredSafeInput {
-                sender: Address::from_slice(sender.as_slice()),
-                payload,
-                block_number: i64_to_u64(block_number_i64),
-            });
-            fetched_count = fetched_count
-                .checked_add(1)
-                .expect("safe-input fetched count overflow: contract-impossible");
-        }
-
-        let fetched_end = range
-            .start()
-            .checked_add(fetched_count)
-            .expect("safe-input fetched range overflow: contract-impossible");
-        assert_eq!(
-            fetched_end,
-            range.end(),
-            "safe-input range {range:?} not fully populated"
-        );
-
-        Ok(())
-    }
-
     /// Persist a chunk of user ops into the open frame and bump `head`'s
     /// counters.
     ///
@@ -320,33 +178,6 @@ impl Storage {
         Ok(())
     }
 
-    /// Physical-only fixture writer. Production must use
-    /// [`Storage::append_executed_user_ops_chunk`] so creation and canonical
-    /// execution attribution commit atomically.
-    #[cfg(test)]
-    pub fn append_user_ops_chunk(
-        &mut self,
-        head: &mut WriteHead,
-        user_ops: &[PendingUserOp],
-    ) -> Result<()> {
-        if user_ops.is_empty() {
-            return Ok(());
-        }
-        let mut next_head = *head;
-        next_head.increment_batch_user_op_count(user_ops.len());
-        self.write(|tx| {
-            insert_user_ops_batch(
-                tx,
-                head.batch_index,
-                head.frame_in_batch,
-                head.open_frame_user_op_count,
-                user_ops,
-            )
-        })?;
-        *head = next_head;
-        Ok(())
-    }
-
     /// Commit frame advancement together with its application inputs.
     pub fn close_frame_only_with_executions(
         &mut self,
@@ -362,48 +193,6 @@ impl Storage {
         Ok(())
     }
 
-    /// Fixture frame rotation with derived application offsets. Production must supply explicit
-    /// execution attributions through
-    /// [`Storage::close_frame_only_with_executions`].
-    #[cfg(test)]
-    pub fn close_frame_only(
-        &mut self,
-        head: &mut WriteHead,
-        next_safe_block: u64,
-        leading_direct_range: SafeInputRange,
-    ) -> Result<()> {
-        let policy = self
-            .write(|tx| close_frame_derived_in(tx, head, next_safe_block, leading_direct_range))?;
-        head.advance_frame(policy, next_safe_block);
-        Ok(())
-    }
-
-    /// Close the current batch and open a fresh one with its first frame,
-    /// without registering a snapshot. Test-only: production closes
-    /// through [`Storage::close_frame_and_batch_with_snapshot`], which
-    /// registers the snapshot row in the same transaction (I7).
-    ///
-    /// Atomically: seal the current Tip (sets `sealed_at_ms`), insert the new
-    /// Tip with `parent_batch_index = head.batch_index`, open its first frame.
-    /// Order matters: sealing first removes the old row from the
-    /// `ux_single_valid_tip` partial index, making room for the new Tip.
-    #[cfg(test)]
-    pub(crate) fn close_frame_and_batch(
-        &mut self,
-        head: &mut WriteHead,
-        next_safe_block: u64,
-    ) -> Result<()> {
-        let (next_batch_index, now_ms, policy) =
-            self.write(|tx| seal_and_open_next_batch(tx, head.batch_index, next_safe_block))?;
-        head.move_to_next_batch(
-            next_batch_index,
-            from_unix_ms(now_ms),
-            policy,
-            next_safe_block,
-        );
-        Ok(())
-    }
-
     /// The artifact is durable before sealing and registering its snapshot in
     /// one transaction. A failed commit leaves only an unreferenced artifact.
     pub fn close_frame_and_batch_with_snapshot(
@@ -411,13 +200,8 @@ impl Storage {
         head: &mut WriteHead,
         next_safe_block: u64,
         dump_dir: &Path,
-        batch_index: u64,
         executed_input_count: ExecutedInputCount,
     ) -> Result<()> {
-        assert_eq!(
-            batch_index, head.batch_index,
-            "snapshot belongs to another batch"
-        );
         let (next_batch_index, now_ms, policy) = self.write(|tx| {
             assert_eq!(
                 next_executed_input_count_in(tx)?,
@@ -425,7 +209,7 @@ impl Storage {
                 "application count changed between dump creation and batch close"
             );
             let result = seal_and_open_next_batch(tx, head.batch_index, next_safe_block)?;
-            insert_batch_snapshot_in(tx, dump_dir, batch_index, executed_input_count)?;
+            insert_batch_snapshot_in(tx, dump_dir, head.batch_index, executed_input_count)?;
             Ok(result)
         })?;
         head.move_to_next_batch(
@@ -436,16 +220,12 @@ impl Storage {
         );
         Ok(())
     }
-
-    pub fn batch_policy(&mut self) -> Result<BatchPolicy> {
-        query_batch_policy(&self.conn)
-    }
 }
 
 /// Insert the Tip and its first frame. Callers separately attach the complete
 /// leading application range, except for a recovery baseline's empty root.
 /// Returns its local identity; callers load `WriteHead` through the shared reader.
-fn insert_tip_rows(
+pub(super) fn insert_tip_rows(
     tx: &Transaction<'_>,
     batch_index_opt: Option<u64>,
     parent: Option<u64>,
@@ -466,7 +246,8 @@ fn insert_tip_rows(
 }
 
 /// Extend the valid batch path with a fresh open Tip at the current safe head,
-/// draining all currently-undrained safe inputs into its first frame.
+/// attributing every undrained safe input to its first frame (lane catch-up
+/// executes them, I11).
 ///
 /// One mechanism, two callers with distinct intents (each keeps its own guard):
 /// startup recovery's guarded Tip creation (genesis / first startup) and
@@ -559,13 +340,12 @@ fn next_undrained_safe_input_index_in(tx: &Transaction<'_>) -> Result<u64> {
 
 /// Seal the current Tip and open the successor batch's first frame, in `tx`.
 ///
-/// Shared by [`Storage::close_frame_and_batch`] and
-/// [`Storage::close_frame_and_batch_with_snapshot`] so the seal ordering
-/// invariant lives in one place: seal first (which frees the old row from the
+/// Shared with the test fixture `close_frame_and_batch` so the seal ordering
+/// lives in one place: seal first (which frees the old row from the
 /// `ux_single_valid_tip` partial index), then insert the successor as the new
 /// Tip. Returns the new batch index, the close timestamp, and the sampled
 /// policy for the caller to apply to its in-memory write head.
-fn seal_and_open_next_batch(
+pub(super) fn seal_and_open_next_batch(
     tx: &Transaction<'_>,
     closing_batch_index: u64,
     next_safe_block: u64,
@@ -632,24 +412,7 @@ fn close_frame_in(
     Ok(policy)
 }
 
-#[cfg(test)]
-fn close_frame_derived_in(
-    tx: &Transaction<'_>,
-    head: &WriteHead,
-    next_safe_block: u64,
-    leading_direct_range: SafeInputRange,
-) -> Result<BatchPolicy> {
-    let (policy, next_frame_in_batch) = open_successor_frame_in(tx, head, next_safe_block)?;
-    persist_frame_direct_sequence_derived(
-        tx,
-        head.batch_index,
-        next_frame_in_batch,
-        leading_direct_range,
-    )?;
-    Ok(policy)
-}
-
-fn open_successor_frame_in(
+pub(super) fn open_successor_frame_in(
     tx: &Transaction<'_>,
     head: &WriteHead,
     next_safe_block: u64,
@@ -675,32 +438,6 @@ fn open_successor_frame_in(
     Ok((policy, next_frame_in_batch))
 }
 
-/// Fixture insertion of source operations and their application positions.
-#[cfg(test)]
-fn insert_user_ops_batch(
-    tx: &Transaction<'_>,
-    batch_index: u64,
-    frame_in_batch: u32,
-    frame_pos_start: u32,
-    user_ops: &[PendingUserOp],
-) -> Result<()> {
-    let mut next = next_executed_input_count_in(tx)?;
-    insert_user_op_iter(
-        tx,
-        batch_index,
-        frame_in_batch,
-        frame_pos_start,
-        user_ops.iter(),
-    )?;
-    for position in 0..user_ops.len() {
-        tx.execute("INSERT INTO application_inputs (offset,batch_index,frame_in_batch,user_op_pos_in_frame) VALUES (?1,?2,?3,?4)",
-            params![u64_to_i64(next.get()),u64_to_i64(batch_index),i64::from(frame_in_batch),
-                i64::from(frame_pos_start.checked_add(u32::try_from(position).unwrap()).unwrap())])?;
-        next = next.checked_next().expect("input count overflow");
-    }
-    Ok(())
-}
-
 fn insert_user_op_iter<'a>(
     tx: &Transaction<'_>,
     batch_index: u64,
@@ -773,11 +510,11 @@ fn insert_executed_user_ops_batch(
 mod tests {
     use crate::ingress::inclusion_lane::{IncludedUserOp, PendingUserOp};
     use crate::storage::{
-        DeploymentIdentity, DirectInputExecution, ExecutedInputCount, FeeOracleIdentity,
-        LifecycleCommand, SafeFrontierState, SafeInputFrontier, SafeInputRange, Storage,
-        StoredSafeInput,
-        test_helpers::{SENDER_A, default_protocol_timing, record_canonical_divergence, temp_db},
+        DirectInputExecution, ExecutedInputCount, LifecycleCommand, SafeFrontierState,
+        SafeInputFrontier, SafeInputRange, Storage, StoredSafeInput,
+        test_helpers::{SENDER_A, default_protocol_timing, record_canonical_divergence},
     };
+    use crate::test_support::{pin_test_deployment_identity, temp_db};
     use alloy_primitives::{Address, Signature};
     use sequencer_core::l2_tx::SequencedL2Tx;
     use sequencer_core::user_op::{SignedUserOp, UserOp};
@@ -809,19 +546,6 @@ mod tests {
         }
     }
 
-    fn pin_deployment_identity(storage: &mut Storage, batch_submitter_address: Address) {
-        storage
-            .load_or_insert_deployment_identity(DeploymentIdentity {
-                chain_id: 1,
-                app_address: Address::repeat_byte(0x11),
-                input_box_address: Address::repeat_byte(0x22),
-                app_deployment_block: 0,
-                batch_submitter_address,
-                fee_oracle: FeeOracleIdentity::Fixed { log_gas_price: 0 },
-            })
-            .expect("pin deployment identity");
-    }
-
     #[test]
     fn snapshot_registration_failure_rolls_back_batch_close_and_cached_head() {
         let db = temp_db("snapshot-close-rollback");
@@ -835,13 +559,7 @@ mod tests {
             .unwrap();
         let batch = head.batch_index;
         let error = storage
-            .close_frame_and_batch_with_snapshot(
-                &mut head,
-                10,
-                prefix,
-                batch,
-                ExecutedInputCount::ZERO,
-            )
+            .close_frame_and_batch_with_snapshot(&mut head, 10, prefix, ExecutedInputCount::ZERO)
             .expect_err("colliding artifact name must roll back the whole close");
         assert!(error.to_string().contains("UNIQUE"));
         assert_eq!(head.batch_index, batch);
@@ -968,23 +686,9 @@ mod tests {
             .expect("initialize open state");
         head.open_frame_user_op_count = u32::MAX;
 
-        let (respond_to, _response) = oneshot::channel();
-        let pending = PendingUserOp {
-            signed: SignedUserOp {
-                sender: Address::ZERO,
-                signature: Signature::test_signature(),
-                user_op: UserOp {
-                    nonce: 0,
-                    max_fee: u16::MAX,
-                    data: vec![].into(),
-                },
-            },
-            respond_to,
-            received_at: SystemTime::now(),
-        };
-
+        let included = included_user_op(0, 0);
         let panic = catch_unwind(AssertUnwindSafe(|| {
-            let _ = storage.append_user_ops_chunk(&mut head, &[pending]);
+            let _ = storage.append_executed_user_ops_chunk(&mut head, &[included]);
         }));
         assert!(panic.is_err(), "counter overflow must fail loud");
 
@@ -1036,7 +740,7 @@ mod tests {
     fn live_direct_rotation_requires_complete_classified_attribution() {
         let db = temp_db("direct-execution-attribution-complete");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        pin_deployment_identity(&mut storage, SENDER_A);
+        pin_test_deployment_identity(&mut storage, SENDER_A);
         let mut head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .expect("initialize open state");
@@ -1158,8 +862,8 @@ mod tests {
     }
 
     #[test]
-    fn recovery_checkpoint_block_uses_query_and_persistence_boundaries() {
-        let db = temp_db("recovery-checkpoint-boundaries");
+    fn saturated_block_bound_counts_every_representable_block() {
+        let db = temp_db("saturated-block-bound");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
         storage
             .append_safe_inputs(
@@ -1181,11 +885,6 @@ mod tests {
             boundary, 1,
             "a saturated upper predicate must include every representable block"
         );
-
-        let err = storage
-            .open_recovery_tip(i64::MAX as u64 + 1)
-            .expect_err("unrepresentable persisted checkpoint must be refused");
-        assert!(matches!(err, rusqlite::Error::ToSqlConversionFailure(_)));
     }
 
     #[test]
@@ -1293,7 +992,7 @@ mod tests {
     fn next_undrained_input_is_derived_from_accounted_frame_block() {
         let db = temp_db("safe-cursor");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        pin_deployment_identity(&mut storage, SENDER_A);
+        pin_test_deployment_identity(&mut storage, SENDER_A);
         assert_eq!(
             storage
                 .next_undrained_safe_input_index()
@@ -1358,7 +1057,7 @@ mod tests {
     fn replay_returns_direct_inputs_in_drain_order() {
         let db = temp_db("replay-order");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        pin_deployment_identity(&mut storage, SENDER_A);
+        pin_test_deployment_identity(&mut storage, SENDER_A);
         let head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .expect("initialize open state");
@@ -1399,7 +1098,7 @@ mod tests {
     fn ensure_open_tip_opens_genesis_and_sequences_leading_range() {
         let db = temp_db("ensure-tip-genesis");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        pin_deployment_identity(&mut storage, SENDER_A);
+        pin_test_deployment_identity(&mut storage, SENDER_A);
 
         // Pre-existing L1 history: two safe inputs at block 10, and an
         // observed safe head of 10 (as the startup recovery sync would leave).
@@ -1540,7 +1239,7 @@ mod tests {
     fn envelopes_advance_accounting_without_becoming_application_inputs() {
         let db = temp_db("envelope-only-accounting");
         let mut storage = Storage::open(&db.path).unwrap();
-        pin_deployment_identity(&mut storage, SENDER_A);
+        pin_test_deployment_identity(&mut storage, SENDER_A);
         let mut head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .unwrap();
diff --git a/sequencer/src/storage/l1_inputs.rs b/sequencer/src/storage/l1_inputs.rs
index bb6c3b68..76e2679d 100644
--- a/sequencer/src/storage/l1_inputs.rs
+++ b/sequencer/src/storage/l1_inputs.rs
@@ -1,15 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Input reader writer: ingests L1 InputBox events into `safe_inputs`,
-//! advances `l1_safe_head`, and pins the deployment identity.
-//!
-//! Also exposes the read-side queries the input reader and other callers need
-//! (current safe block, safe-input bounds, last safe-progress timestamp).
+//! Input-reader storage: ingest InputBox events into `safe_inputs`, advance
+//! `l1_safe_head`, pin the deployment identity, and serve the safe-head reads.
 
 use alloy_primitives::Address;
-#[cfg(test)]
-use alloy_primitives::B256;
 use rusqlite::{OptionalExtension, Result, Transaction, params};
 
 use super::Storage;
@@ -35,22 +30,6 @@ type FeeOracleIdentitySql = (
     Option<i64>,
 );
 
-/// Test-fixture conversion: a provenance-free [`StoredSafeInput`] becomes a
-/// row with explicit zero provenance. Production writes go through
-/// [`Storage::append_ingested_safe_inputs_with_timestamp`] with real
-/// provenance only — one honest row model, no trait shim (the old
-/// `SafeInputRecord` shim was churn-avoidance, not a contract).
-#[cfg(test)]
-fn synthetic_row(input: &StoredSafeInput) -> IngestedSafeInput {
-    IngestedSafeInput {
-        sender: input.sender,
-        payload: input.payload.clone(),
-        block_number: input.block_number,
-        block_timestamp: 0,
-        transaction_hash: B256::ZERO,
-    }
-}
-
 impl Storage {
     /// `MAX(safe_input_index) + 1` (or 0 if empty). The exclusive bound on the
     /// `safe_inputs` table — the next index a fresh row would receive.
@@ -151,57 +130,6 @@ impl Storage {
         Ok(out)
     }
 
-    /// Test seed: [`Storage::append_safe_inputs_with_timestamp`] at the
-    /// current wall clock. See
-    /// [`Storage::append_ingested_safe_inputs_with_timestamp`] for the
-    /// operation's contract.
-    #[cfg(test)]
-    pub(crate) fn append_safe_inputs(
-        &mut self,
-        safe_block: u64,
-        inputs: &[StoredSafeInput],
-        batch_submitter: Address,
-        timing: &ProtocolTiming,
-    ) -> Result<()> {
-        self.append_safe_inputs_with_timestamp(
-            safe_block,
-            i64_to_u64(now_unix_ms()) / 1000,
-            inputs,
-            batch_submitter,
-            timing,
-            FrontierMode::Populate,
-        )
-    }
-
-    /// Same as [`Storage::append_safe_inputs`], but records the L1 timestamp
-    /// of `safe_block`. Test seed only: synthetic inputs receive explicit zero
-    /// provenance via [`synthetic_row`]; the production write path is
-    /// [`Storage::append_ingested_safe_inputs_with_timestamp`].
-    ///
-    /// `frontier` gates the `safe_accepted_batches` update — see
-    /// [`FrontierMode`]. Everything except `setup --recovery`'s interim syncs
-    /// uses [`FrontierMode::Populate`].
-    #[cfg(test)]
-    pub(crate) fn append_safe_inputs_with_timestamp(
-        &mut self,
-        safe_block: u64,
-        safe_block_timestamp: u64,
-        inputs: &[StoredSafeInput],
-        batch_submitter: Address,
-        timing: &ProtocolTiming,
-        frontier: FrontierMode,
-    ) -> Result<()> {
-        let rows: Vec<IngestedSafeInput> = inputs.iter().map(synthetic_row).collect();
-        self.append_ingested_safe_inputs_with_timestamp(
-            safe_block,
-            safe_block_timestamp,
-            rows.as_slice(),
-            batch_submitter,
-            timing,
-            frontier,
-        )
-    }
-
     /// Production input-reader path — the one write of the safe-input stream.
     ///
     /// Atomically: insert `inputs` (assigned contiguous indexes starting from
@@ -449,10 +377,11 @@ fn insert_safe_inputs_batch(
 #[cfg(test)]
 mod tests {
     use crate::storage::{
-        DeploymentIdentity, FeeOracleIdentity, FrontierMode, IngestedSafeInput, SafeInputRange,
-        Storage, StoredSafeInput,
-        test_helpers::{SENDER_A, SENDER_B, default_protocol_timing, temp_db},
+        DeploymentIdentity, FeeOracleIdentity, FrontierMode, IngestedSafeInput, Storage,
+        StoredSafeInput,
+        test_helpers::{SENDER_A, SENDER_B, default_protocol_timing},
     };
+    use crate::test_support::temp_db;
     use alloy_primitives::{Address, B256};
 
     fn identity() -> DeploymentIdentity {
@@ -467,17 +396,12 @@ mod tests {
     }
 
     #[test]
-    fn safe_input_api_uses_half_open_intervals() {
+    fn safe_input_end_exclusive_counts_appended_inputs() {
         let db = temp_db("safe-input-api");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
         let protocol = default_protocol_timing();
 
         assert_eq!(storage.safe_input_end_exclusive().expect("safe head"), 0);
-        let mut out = Vec::new();
-        storage
-            .fill_safe_inputs(SafeInputRange::new(0, 0), &mut out)
-            .expect("query empty interval");
-        assert!(out.is_empty());
 
         let inserted = vec![
             StoredSafeInput {
@@ -496,16 +420,12 @@ mod tests {
             .expect("insert safe directs");
 
         assert_eq!(storage.safe_input_end_exclusive().expect("safe head"), 2);
-
-        storage
-            .fill_safe_inputs(SafeInputRange::new(0, 2), &mut out)
-            .expect("query full interval");
-        assert_eq!(out, inserted);
-
-        storage
-            .fill_safe_inputs(SafeInputRange::new(1, 1), &mut out)
-            .expect("query empty half-open interval");
-        assert!(out.is_empty());
+        assert_eq!(
+            storage
+                .safe_inputs_in_block_range(9, 10)
+                .expect("read back"),
+            inserted
+        );
     }
 
     #[test]
diff --git a/sequencer/src/storage/l1_submission.rs b/sequencer/src/storage/l1_submission.rs
index 89e150ed..1ef7e04c 100644
--- a/sequencer/src/storage/l1_submission.rs
+++ b/sequencer/src/storage/l1_submission.rs
@@ -1,30 +1,19 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The submitter's storage half: frontier lookup, per-batch frames + user
-//! ops, the catch-up / per-batch replay reader, the SSZ-encoded pending-batch
-//! list the submitter pulls each tick — and the one submission-side write,
-//! the wallet-nonce watermark (raised before every broadcast).
-//!
-//! Structural nonces are assigned by the `batches.nonce` trigger at close
-//! time (see `ingress`), and `safe_accepted_batches` is maintained by
-//! `append_safe_inputs` (see `l1_inputs`). The reads here are shared between
-//! the batch submitter (hot-path tick) and the egress replay path (catch-up
-//! reader); they live together because they all aggregate at the batch level.
+//! The submitter's storage half: frontier lookup, the SSZ-encoded pending-batch
+//! list, and the wallet-nonce watermark. `load_batch_frames_in` is also the seal
+//! path's encoder, so the hash stamped at seal and the submitted bytes come from
+//! one encode path.
 
 use rusqlite::{Result, params};
 
 use super::Storage;
 use super::convert::{external_u64_to_i64, i64_to_u16, i64_to_u32, i64_to_u64, u64_to_i64};
-use super::mutations::{batch_tree_anchor_in, set_batch_tree_anchor_in};
 use super::queries::current_safe_block_required;
-#[cfg(test)]
-use super::queries::decode_l2_tx_row;
 use super::safe_accepted_batches::frontier_nonce;
 use super::{FrameHeader, PendingBatch, SubmitterFrontier};
 use sequencer_core::batch::{Batch, Frame as BatchFrame, WireUserOp};
-#[cfg(test)]
-use sequencer_core::l2_tx::SequencedL2Tx;
 
 impl Storage {
     /// Read-only frontier view used by the submitter each tick to derive the
@@ -32,10 +21,10 @@ impl Storage {
     /// is expected to accept, derived from `safe_accepted_batches`.
     ///
     /// The scheduler-accepted frontier is maintained by
-    /// [`Storage::append_safe_inputs`], so this is a pure read.
+    /// `Storage::append_ingested_safe_inputs_with_timestamp`, so this is a pure read.
     ///
     /// **Precondition:** at least one safe-head observation must have been
-    /// recorded (via [`Storage::append_safe_inputs`]). In production this is
+    /// recorded (by `Storage::append_ingested_safe_inputs_with_timestamp`). In production this is
     /// always true because the startup recovery procedure completes InitialSync and
     /// refuses admission unless its persisted view is usable. Tests must seed
     /// an observation explicitly; a fresh DB returns `QueryReturnedNoRows`.
@@ -48,18 +37,6 @@ impl Storage {
         })
     }
 
-    /// Set the batch-tree anchor nonce (the nonce the parentless root carries).
-    /// Used by `setup --recovery` to root the rebuilt tree at `N'`. Aborts if
-    /// `setup_complete` already exists (`trg_batch_tree_anchor_write_once`).
-    pub fn set_batch_tree_anchor(&mut self, nonce: u64) -> Result<()> {
-        self.write(|tx| set_batch_tree_anchor_in(tx, nonce))
-    }
-
-    /// Read the batch-tree anchor nonce (default 0).
-    pub fn batch_tree_anchor(&mut self) -> Result<u64> {
-        self.read(|tx| batch_tree_anchor_in(tx))
-    }
-
     /// The highest wallet nonce ever broadcast by this deployment's
     /// batch-submitter key, or `None` if nothing was ever broadcast
     /// (the durable realization of the TLA+ `walletNonce`).
@@ -77,104 +54,28 @@ impl Storage {
         })
     }
 
-    /// Write-before-broadcast: durably raise the watermark to
-    /// cover `nonce` *before* any tx at a nonce `<= nonce` is sent. The
+    /// Write-before-broadcast: durably raise the watermark to cover
+    /// `wallet_nonce` *before* any tx at a wallet nonce `<= wallet_nonce` is
+    /// sent. The
     /// commit is power-loss durable (`synchronous=FULL`); a crash between
     /// commit and send only over-covers — the flush later no-ops a
     /// never-used slot, which is harmless. Monotonic: never lowers.
-    pub fn raise_wallet_nonce_watermark(&mut self, nonce: u64) -> Result<()> {
+    pub fn raise_wallet_nonce_watermark(&mut self, wallet_nonce: u64) -> Result<()> {
         self.write(|tx| {
             tx.execute(
                 "INSERT INTO wallet_nonce_watermark (singleton_id, watermark) \
                  VALUES (0, ?1) \
                  ON CONFLICT(singleton_id) \
                  DO UPDATE SET watermark = MAX(watermark, excluded.watermark)",
-                params![external_u64_to_i64(nonce, "batch-submitter wallet nonce")?],
+                params![external_u64_to_i64(
+                    wallet_nonce,
+                    "batch-submitter wallet nonce"
+                )?],
             )?;
             Ok(())
         })
     }
 
-    /// Highest valid (non-invalidated) `batch_index`, or `None` if no valid
-    /// batches exist. The open batch is included. Test-only.
-    #[cfg(test)]
-    pub(crate) fn latest_batch_index(&mut self) -> Result<Option<u64>> {
-        let value: Option<i64> =
-            self.conn
-                .query_row("SELECT MAX(batch_index) FROM valid_batches", [], |row| {
-                    row.get(0)
-                })?;
-        Ok(value.map(i64_to_u64))
-    }
-
-    /// The structural nonce of the current open Tip (the single
-    /// `valid_open_batch`), or `None` if no Tip is open. Used by `setup
-    /// --recovery` to detect a partially-recovered DB whose root tip carries a
-    /// different resume nonce than the current attempt (the at-most-one-valid-
-    /// open-tip index makes this at most one row).
-    pub fn open_tip_nonce(&mut self) -> Result<Option<u64>> {
-        use rusqlite::OptionalExtension;
-        let value: Option<i64> = self
-            .conn
-            .query_row("SELECT nonce FROM valid_open_batch", [], |row| row.get(0))
-            .optional()?;
-        Ok(value.map(i64_to_u64))
-    }
-
-    /// Frame headers for `batch_index` in `frame_in_batch` order. Reads the
-    /// raw `frames` table — does NOT filter on validity, since callers only
-    /// reach this method after they already know the batch is valid.
-    pub fn frames_for_batch(&mut self, batch_index: u64) -> Result<Vec<FrameHeader>> {
-        frames_for_batch_in(&self.conn, batch_index)
-    }
-
-    /// Materialize all sequenced L2 txs in one batch. Returns `[]` for
-    /// invalidated batches. Test-only: production replay pages the valid
-    /// stream by offset, never per batch.
-    #[cfg(test)]
-    pub(crate) fn ordered_l2_txs_for_batch(
-        &mut self,
-        batch_index: u64,
-    ) -> Result<Vec<SequencedL2Tx>> {
-        const SQL: &str = "
-            SELECT
-                CASE WHEN s.user_op_pos_in_frame IS NOT NULL THEN 0 ELSE 1 END AS kind,
-                CASE
-                    WHEN s.user_op_pos_in_frame IS NOT NULL THEN u.sender
-                    WHEN s.safe_input_index IS NOT NULL THEN d.sender
-                    ELSE NULL
-                END AS sender,
-                CASE WHEN s.user_op_pos_in_frame IS NOT NULL THEN u.data ELSE NULL END AS data,
-                CASE WHEN s.user_op_pos_in_frame IS NOT NULL THEN f.fee  ELSE NULL END AS fee,
-                CASE WHEN s.safe_input_index   IS NOT NULL THEN d.payload      ELSE NULL END AS payload,
-                CASE WHEN s.safe_input_index   IS NOT NULL THEN d.block_number ELSE NULL END AS block_number
-            FROM application_inputs s
-            LEFT JOIN user_ops u
-              ON u.batch_index    = s.batch_index
-             AND u.frame_in_batch = s.frame_in_batch
-             AND u.pos_in_frame   = s.user_op_pos_in_frame
-            LEFT JOIN frames f
-              ON f.batch_index    = s.batch_index
-             AND f.frame_in_batch = s.frame_in_batch
-            LEFT JOIN safe_inputs d
-              ON d.safe_input_index = s.safe_input_index
-            WHERE s.batch_index = ?1
-            ORDER BY s.offset ASC
-        ";
-        let mut stmt = self.conn.prepare_cached(SQL)?;
-        let rows = stmt.query_map(params![u64_to_i64(batch_index)], |row| {
-            Ok(decode_l2_tx_row(
-                row.get(0)?,
-                row.get(1)?,
-                row.get(2)?,
-                row.get(3)?,
-                row.get(4)?,
-                row.get(5)?,
-            ))
-        })?;
-        rows.collect::<Result<Vec<_>>>()
-    }
-
     /// Load all valid closed batches with nonce >= `min_nonce`, in nonce order,
     /// each one fully assembled and SSZ-encoded with its authoritative nonce.
     ///
@@ -272,13 +173,11 @@ pub(super) fn load_batch_frames_in(
 #[cfg(test)]
 mod tests {
     use super::super::test_helpers::{
-        SENDER_A, SENDER_B, local_batch_payload, seed_closed_batches,
-        seed_safe_inputs_with_batch_nonces, temp_db,
+        SENDER_A, default_protocol_timing, seed_closed_batches, seed_safe_inputs_with_batch_nonces,
     };
-    use crate::storage::{SafeInputRange, Storage, StoredSafeInput};
-    use alloy_primitives::Address;
+    use crate::storage::{SafeInputRange, Storage};
+    use crate::test_support::temp_db;
     use sequencer_core::batch::Batch;
-    use sequencer_core::protocol::ProtocolTiming;
 
     #[test]
     fn pending_batches_stamps_authoritative_nonce_into_wire_bytes() {
@@ -351,9 +250,7 @@ mod tests {
         assert_eq!(latest, 1);
 
         // Batch 0 should still have at least one frame header.
-        let frames = storage
-            .frames_for_batch(0)
-            .expect("load frames for batch 0");
+        let frames = super::frames_for_batch_in(&storage.conn, 0).expect("load frames for batch 0");
         assert!(!frames.is_empty());
 
         // Ordered L2 txs for batch 0 should be queryable (even if empty).
@@ -455,7 +352,7 @@ mod tests {
         let db = temp_db("submitter-frontier-empty");
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
         storage
-            .append_safe_inputs(0, &[], SENDER_A, &default_test_protocol())
+            .append_safe_inputs(0, &[], SENDER_A, &default_protocol_timing())
             .expect("record observed safe head");
         let frontier = storage.submitter_frontier().expect("submitter frontier");
         assert_eq!(frontier.safe_block, 0);
@@ -475,7 +372,7 @@ mod tests {
         let mut storage = Storage::open(db.path.as_str()).expect("open storage");
         storage.set_batch_tree_anchor(7).expect("anchor at N'=7");
         storage
-            .append_safe_inputs(0, &[], SENDER_A, &default_test_protocol())
+            .append_safe_inputs(0, &[], SENDER_A, &default_protocol_timing())
             .expect("record observed safe head");
         let frontier = storage.submitter_frontier().expect("submitter frontier");
         assert_eq!(frontier.accepted_next_nonce, 7);
@@ -506,812 +403,6 @@ mod tests {
         assert_eq!(frontier.accepted_next_nonce, 2);
     }
 
-    fn default_test_protocol() -> ProtocolTiming {
-        ProtocolTiming {
-            max_wait_blocks: 1200,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        }
-    }
-
-    fn unix_now_ms() -> u64 {
-        std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_millis() as u64
-    }
-
-    #[test]
-    fn check_danger_reports_observed_closed_batch_danger() {
-        let db = temp_db("check-danger-observed-closed");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 1");
-
-        let protocol = default_test_protocol();
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                1135,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append accepted batch 0");
-
-        let status = storage
-            .check_danger(&protocol, unix_now_ms())
-            .expect("check_danger");
-        assert_eq!(status, crate::storage::DangerStatus::ClosedBatchInDanger(1));
-    }
-
-    #[test]
-    fn check_danger_reports_estimated_batch_danger_on_wall_clock_drift() {
-        // Observed block-based checks wouldn't fire (batch 1 has
-        // first_frame_safe_block = 100 and safe_block = 1200, age = 1100 <
-        // 1125). But wall-clock says the safe head hasn't advanced in ~25
-        // blocks: the effective threshold drops to 1100, so batch 1 reaches
-        // danger via the wall-clock correction.
-        let db = temp_db("check-danger-estimated");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(100, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 100)
-            .expect("close batch 0");
-        storage
-            .close_frame_and_batch(&mut head, 100)
-            .expect("close batch 1");
-
-        let protocol = default_test_protocol();
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                1200,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 200,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append accepted batch 0");
-
-        // Pretend safe-progress was recorded 25 blocks' worth of wall-clock ago.
-        let now_ms = unix_now_ms();
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms.saturating_sub(25 * 12 * 1000)).unwrap_or(i64::MAX)],
-            )
-            .expect("rewind safe-progress timestamp");
-
-        let status = storage
-            .check_danger(&protocol, now_ms)
-            .expect("check_danger");
-        assert_eq!(
-            status,
-            crate::storage::DangerStatus::EstimatedBatchInDanger(1)
-        );
-    }
-
-    #[test]
-    fn check_danger_prefers_observed_closed_over_estimated_when_both_fire() {
-        // If the observed safe head already puts the closed frontier past
-        // `danger_threshold`, route to observed closed-batch recovery. The
-        // wall-clock arm is a fallback, not a mask over observed danger.
-        let db = temp_db("check-danger-observed-closed-wins");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0");
-
-        let protocol = default_test_protocol();
-        // Advance safe head so batch 0 is past `danger_threshold` (1125):
-        // current=1200 - first_frame=10 = 1190 >= 1125.
-        // No safe_input ingested for batch 0, so it stays non-gold.
-        storage
-            .append_safe_inputs(1200, &[], SENDER_A, &protocol)
-            .expect("advance safe head past observed danger threshold");
-
-        // Pretend safe-progress was recorded 25 blocks' worth of wall-clock
-        // ago. With the wall-clock correction, the adjusted threshold is
-        // 1100 — batch 0's age (1190) also clears that, so wall-clock fires.
-        let now_ms = unix_now_ms();
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms.saturating_sub(25 * 12 * 1000)).unwrap_or(i64::MAX)],
-            )
-            .expect("rewind safe-progress timestamp");
-
-        let status = storage
-            .check_danger(&protocol, now_ms)
-            .expect("check_danger");
-        assert_eq!(
-            status,
-            crate::storage::DangerStatus::ClosedBatchInDanger(0),
-            "observed closed-batch danger must win once safe-state has crossed danger",
-        );
-    }
-
-    #[test]
-    fn check_danger_prefers_observed_tip_over_estimated_when_both_fire() {
-        // Same fallback rule for the open Tip: if observed safe-state already
-        // puts the Tip in danger, recover the Tip directly instead of refusing
-        // under the wall-clock classification.
-        let db = temp_db("check-danger-observed-tip-wins");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0; batch 1 is Tip");
-
-        let protocol = default_test_protocol();
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                1200,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append accepted batch 0");
-
-        // The Tip's observed age is 1190 >= 1125, and the wall-clock-adjusted
-        // arm would also fire. Observed Tip danger must win.
-        let now_ms = unix_now_ms();
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms.saturating_sub(25 * 12 * 1000)).unwrap_or(i64::MAX)],
-            )
-            .expect("rewind safe-progress timestamp");
-
-        let status = storage
-            .check_danger(&protocol, now_ms)
-            .expect("check_danger");
-        assert_eq!(
-            status,
-            crate::storage::DangerStatus::TipInDanger(1),
-            "Tip must win when observed safe-state has already crossed danger",
-        );
-    }
-
-    #[test]
-    fn check_danger_refuses_when_l1_view_is_stale() {
-        let db = temp_db("check-danger-l1-view-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0");
-
-        let protocol = default_test_protocol();
-        let old_safe_timestamp = 1_000_u64;
-        storage
-            .append_safe_inputs_with_timestamp(
-                1200,
-                old_safe_timestamp,
-                &[],
-                SENDER_A,
-                &protocol,
-                crate::storage::FrontierMode::Populate,
-            )
-            .expect("advance safe head with stale L1 timestamp");
-
-        let now_ms =
-            (old_safe_timestamp + protocol.l1_read_stale_after_secs()).saturating_mul(1000);
-        let status = storage
-            .check_danger(&protocol, now_ms)
-            .expect("check_danger");
-        assert_eq!(
-            status,
-            crate::storage::DangerStatus::L1ViewStale,
-            "global L1 view staleness must refuse before observed batch recovery",
-        );
-    }
-
-    #[test]
-    fn check_danger_refuses_when_safe_block_timestamp_is_in_the_future() {
-        let db = temp_db("check-danger-future-safe-timestamp");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-        let now_ms = 1_000_000_u64;
-
-        // A full block-time (12 s) ahead of the local clock: unusable. Sub-block
-        // ahead-ness is NTP-scale skew and tolerated (see the companion assert).
-        storage
-            .append_safe_inputs_with_timestamp(
-                10,
-                1_012,
-                &[],
-                SENDER_A,
-                &protocol,
-                crate::storage::FrontierMode::Populate,
-            )
-            .expect("record future L1 timestamp");
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms).expect("test time fits")],
-            )
-            .expect("make local progress baseline usable");
-
-        assert_eq!(
-            storage
-                .check_danger(&protocol, now_ms)
-                .expect("check danger"),
-            crate::storage::DangerStatus::L1ViewStale
-        );
-
-        // Sub-block skew (1 s ahead) is the freshest possible view, not a fault.
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET block_timestamp = 1001 WHERE singleton_id = 0",
-                [],
-            )
-            .expect("set sub-block-ahead timestamp");
-        assert_eq!(
-            storage
-                .check_danger(&protocol, now_ms)
-                .expect("check danger"),
-            crate::storage::DangerStatus::Safe
-        );
-    }
-
-    #[test]
-    fn check_danger_refuses_when_local_progress_timestamp_is_in_the_future() {
-        let db = temp_db("check-danger-future-progress");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-        let now_ms = 1_000_000_u64;
-
-        storage
-            .append_safe_inputs_with_timestamp(
-                10,
-                1_000,
-                &[],
-                SENDER_A,
-                &protocol,
-                crate::storage::FrontierMode::Populate,
-            )
-            .expect("record safe head");
-        // One full block-time (12 s) of regression: the wall-clock
-        // extrapolation is genuinely invalid — refuse. A sub-block step is
-        // tolerated (companion assert below).
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms + 12_000).expect("test time fits")],
-            )
-            .expect("move local progress baseline into future");
-
-        assert_eq!(
-            storage
-                .check_danger(&protocol, now_ms)
-                .expect("check danger"),
-            crate::storage::DangerStatus::L1ViewStale
-        );
-
-        // A 1 ms step is quantization noise for a block-granular estimate.
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms + 1).expect("test time fits")],
-            )
-            .expect("move baseline a sub-block step into the future");
-        assert_eq!(
-            storage
-                .check_danger(&protocol, now_ms)
-                .expect("check danger"),
-            crate::storage::DangerStatus::Safe
-        );
-    }
-
-    #[test]
-    fn observed_batch_danger_outranks_regressed_progress_clock() {
-        let db = temp_db("check-danger-future-progress-priority");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0");
-        let protocol = default_test_protocol();
-        let now_ms = 1_000_000_u64;
-
-        storage
-            .append_safe_inputs_with_timestamp(
-                1200,
-                1_000,
-                &[],
-                SENDER_A,
-                &protocol,
-                crate::storage::FrontierMode::Populate,
-            )
-            .expect("advance observed safe block past danger");
-        // Even a full-block clock regression (a real fault, not noise) must
-        // not suppress the observed arm: batch age here is pure block
-        // arithmetic on persisted L1 observations, valid regardless of the
-        // local clock. The refusal only wins when no observed danger stands
-        // (2026-07-31 review of the containment commit).
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms + 12_000).expect("test time fits")],
-            )
-            .expect("move local progress baseline into future");
-
-        assert_eq!(
-            storage
-                .check_danger(&protocol, now_ms)
-                .expect("check danger"),
-            crate::storage::DangerStatus::ClosedBatchInDanger(0),
-            "observed danger stands on L1 observation alone; a wall-clock \
-             fault must not delay recovery of a batch aging toward staleness"
-        );
-
-        // Same verdict with BOTH baselines faulted: the safe-block timestamp
-        // a full block ahead of the clock AND the progress baseline regressed.
-        storage
-            .conn
-            .execute(
-                "UPDATE l1_safe_head SET block_timestamp = ?1 WHERE singleton_id = 0",
-                [i64::try_from(now_ms / 1000 + 12).expect("test time fits")],
-            )
-            .expect("move safe-block timestamp a block into the future");
-        assert_eq!(
-            storage
-                .check_danger(&protocol, now_ms)
-                .expect("check danger"),
-            crate::storage::DangerStatus::ClosedBatchInDanger(0),
-            "both clock-fault baselines together still yield to observed danger"
-        );
-    }
-
-    #[test]
-    fn check_danger_safe_when_never_synced() {
-        // Fresh DB, no prior safe block timestamp. The L1 view is unusable
-        // until the input reader records a real safe-head observation.
-        let db = temp_db("check-danger-never-synced");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let status = storage
-            .check_danger(&default_test_protocol(), unix_now_ms())
-            .expect("check_danger");
-        assert_eq!(status, crate::storage::DangerStatus::L1ViewStale);
-    }
-
-    #[test]
-    fn check_danger_errors_when_valid_tip_has_no_first_frame() {
-        let db = temp_db("check-danger-missing-first-frame");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        let protocol = default_test_protocol();
-        storage
-            .append_safe_inputs(10, &[], SENDER_A, &protocol)
-            .expect("record fresh safe head");
-        storage
-            .conn
-            .execute("DELETE FROM frames WHERE batch_index = 0", [])
-            .expect("inject missing-frame corruption");
-
-        let err = storage
-            .check_danger(&protocol, unix_now_ms())
-            .expect_err("a valid batch without a first frame must fail loud");
-        assert!(matches!(err, rusqlite::Error::QueryReturnedNoRows));
-    }
-
-    #[test]
-    fn populate_safe_accepted_batches_resumes_from_latest_row() {
-        let db = temp_db("safe-accepted-frontier-resume");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        for nonce in 0..4 {
-            storage
-                .close_frame_and_batch(&mut head, 10)
-                .unwrap_or_else(|e| panic!("close {nonce}: {e}"));
-        }
-        seed_safe_inputs_with_batch_nonces(&mut storage, SENDER_A, 10, &[0, 1]);
-
-        // Mixed-sender wave: the SENDER_B row must be ignored, SENDER_A rows
-        // must resume from the cursor and advance the frontier.
-        let second_wave = vec![
-            StoredSafeInput {
-                sender: SENDER_B,
-                payload: ssz::Encode::as_ssz_bytes(&sequencer_core::batch::Batch {
-                    nonce: 99,
-                    frames: Vec::new(),
-                }),
-                block_number: 11,
-            },
-            StoredSafeInput {
-                sender: SENDER_A,
-                payload: local_batch_payload(&mut storage, 2),
-                block_number: 11,
-            },
-            StoredSafeInput {
-                sender: SENDER_A,
-                payload: local_batch_payload(&mut storage, 3),
-                block_number: 11,
-            },
-        ];
-        storage
-            .append_safe_inputs(11, second_wave.as_slice(), SENDER_A, &protocol)
-            .expect("append second wave");
-
-        let frontier = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(frontier.safe_block, 11);
-        assert_eq!(frontier.accepted_next_nonce, 4);
-
-        let accepted_count: i64 = storage
-            .conn
-            .query_row("SELECT COUNT(*) FROM safe_accepted_batches", [], |row| {
-                row.get(0)
-            })
-            .expect("count accepted rows");
-        assert_eq!(accepted_count, 4);
-    }
-
-    #[test]
-    fn safe_accepted_frontier_skips_stale_payloads() {
-        let db = temp_db("safe-accepted-frontier-skip-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-
-        // Local batch 0 (first frame safe_block=1900) and batch 1 (first frame
-        // safe_block=1900). Their landings carry the real wire bytes so the
-        // content-identity check accepts them.
-        let mut head = storage
-            .initialize_open_state(1900, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 1900)
-            .expect("close 0");
-        storage
-            .close_frame_and_batch(&mut head, 1900)
-            .expect("close 1");
-
-        // Non-stale landing of batch 0 (block 1950 - safe_block 1900 < 1200).
-        let non_stale_payload = local_batch_payload(&mut storage, 0);
-        // Stale copy at nonce 1 (safe_block=100, block 2000 → age >= 1200):
-        // a scheduler no-op, so its content is never compared — synthetic
-        // bytes are deliberate here.
-        let stale_payload = super::super::test_helpers::make_stale_batch_payload(1, 100);
-        // Non-stale landing of batch 1 (block 2000 - safe_block 1900 < 1200).
-        let non_stale_payload_2 = local_batch_payload(&mut storage, 1);
-
-        let inputs = vec![
-            StoredSafeInput {
-                sender: SENDER_A,
-                payload: non_stale_payload,
-                block_number: 1950,
-            },
-            StoredSafeInput {
-                sender: SENDER_A,
-                payload: stale_payload,
-                block_number: 2000,
-            },
-            StoredSafeInput {
-                sender: SENDER_A,
-                payload: non_stale_payload_2,
-                block_number: 2000,
-            },
-        ];
-        storage
-            .append_safe_inputs(2000, inputs.as_slice(), SENDER_A, &protocol)
-            .expect("append");
-
-        let frontier = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(frontier.accepted_next_nonce, 2);
-    }
-
-    #[test]
-    fn seal_stamps_payload_hash_of_the_submitter_encode_path() {
-        // Hash-at-seal: the hash stamped on the sealed row must
-        // be the keccak256 of exactly the bytes the submitter will broadcast
-        // (`pending_batches`'s encoding) — same code path, by construction.
-        let db = temp_db("seal-stamps-payload-hash");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0");
-
-        let stamped: Vec<u8> = storage
-            .conn
-            .query_row(
-                "SELECT payload_hash FROM batches WHERE batch_index = 0",
-                [],
-                |row| row.get(0),
-            )
-            .expect("sealed batch must carry a payload hash");
-        let wire = local_batch_payload(&mut storage, 0);
-        assert_eq!(
-            stamped.as_slice(),
-            alloy_primitives::keccak256(&wire).as_slice(),
-            "seal-time hash must match the submitter's wire bytes"
-        );
-    }
-
-    #[test]
-    fn accepted_landing_with_mismatched_content_freezes_frontier() {
-        // The zombie / re-seal shape: a landing at the expected nonce
-        // whose bytes differ from the batch we sealed. The check records a
-        // 'mismatch' marker atomically with the sync and freezes the
-        // frontier; later syncs stay frozen.
-        let db = temp_db("mismatch-divergence");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close batch 0");
-
-        // Same nonce + same first-frame safe block (fresh by inclusion),
-        // different content (synthetic fee 0 vs the sealed fee).
-        let imposter = super::super::test_helpers::make_stale_batch_payload(0, 10);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: imposter,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("sync commits; the marker rides the same transaction");
-
-        let kind: String = storage
-            .conn
-            .query_row(
-                "SELECT kind FROM canonical_divergence WHERE singleton_id = 0",
-                [],
-                |row| row.get(0),
-            )
-            .expect("marker persisted");
-        assert_eq!(kind, "mismatch");
-        let frontier = storage.submitter_frontier().expect("frontier");
-        assert_eq!(frontier.accepted_next_nonce, 0, "frontier frozen");
-
-        // A later sync — even one carrying the *correct* bytes — must not
-        // thaw the frontier: the marker is terminal until cockroach recovery.
-        let genuine = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                21,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: genuine,
-                    block_number: 21,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append after marker");
-        let frontier = storage.submitter_frontier().expect("frontier");
-        assert_eq!(frontier.accepted_next_nonce, 0, "frontier stays frozen");
-    }
-
-    #[test]
-    fn sim_accepted_foreign_batch_freezes_frontier_with_divergence_marker() {
-        // `scheduler_accepts` deliberately omits the two structural
-        // rejections (future safe_block, non-monotonic frames) under
-        // self-trust — the sequencer never produces them. Before the
-        // content-identity check, such a foreign batch at the
-        // expected nonce would be sim-accepted and silently desync the
-        // frontier forever. With the check, it fails the local-batch lookup
-        // (kind = foreign), the poison marker persists atomically with the
-        // sync, the frontier freezes, and `check_danger` reports
-        // `CanonicalDivergence` ahead of every other arm.
-        let db = temp_db("frontier-future-safe-block");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-
-        let future_safe_block_payload = ssz::Encode::as_ssz_bytes(&sequencer_core::batch::Batch {
-            nonce: 0,
-            frames: vec![sequencer_core::batch::Frame {
-                user_ops: Vec::new(),
-                safe_block: 500,
-                fee_price: 0,
-            }],
-        });
-
-        let batch_submitter = Address::repeat_byte(0xCC);
-        let protocol = ProtocolTiming {
-            max_wait_blocks: u64::MAX,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        };
-        let inputs = vec![StoredSafeInput {
-            sender: batch_submitter,
-            payload: future_safe_block_payload,
-            block_number: 100,
-        }];
-        storage
-            .append_safe_inputs(200, inputs.as_slice(), batch_submitter, &protocol)
-            .expect("append commits; the marker rides the same transaction");
-
-        let frontier = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(
-            frontier.accepted_next_nonce, 0,
-            "the frontier must freeze before the diverged landing"
-        );
-        let status = storage
-            .check_danger(&protocol, unix_now_ms())
-            .expect("check_danger");
-        assert_eq!(
-            status,
-            crate::storage::DangerStatus::CanonicalDivergence(0),
-            "the marker outranks every other danger arm"
-        );
-    }
-
-    #[test]
-    fn populate_accepts_post_recovery_batch_at_anchor() {
-        // A cockroach-recovered deployment is anchored at N' > 0; its first
-        // post-recovery batch lands at nonce N'. populate must seed `expected`
-        // from the anchor and accept it (frontier → N'+1), content-identity
-        // passing against the genuine local batch. Every other populate test
-        // uses anchor=0, so the N' > 0 acceptance path had no coverage.
-        let db = temp_db("populate-at-anchor");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-        let submitter = SENDER_A;
-
-        // Root the tree at N' = 7, then build + seal one local batch — it carries
-        // nonce 7 (compute_next_nonce(None) reads the anchor).
-        storage.set_batch_tree_anchor(7).expect("anchor at N'=7");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close the nonce-7 batch");
-        assert_eq!(
-            storage.batch_nonce(0).expect("nonce"),
-            7,
-            "the root tip carries the anchor nonce N'"
-        );
-
-        // Its genuine wire bytes (looked up by nonce N'=7) land from the
-        // submitter at a fresh inclusion block.
-        let genuine = local_batch_payload(&mut storage, 7);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: submitter,
-                    payload: genuine,
-                    block_number: 20,
-                }],
-                submitter,
-                &protocol,
-            )
-            .expect("sync the N' landing");
-
-        assert_eq!(
-            storage
-                .submitter_frontier()
-                .expect("frontier")
-                .accepted_next_nonce,
-            8,
-            "the N'=7 batch is accepted; the frontier advances to 8"
-        );
-        let divergence: i64 = storage
-            .conn
-            .query_row("SELECT COUNT(*) FROM canonical_divergence", [], |r| {
-                r.get(0)
-            })
-            .expect("count");
-        assert_eq!(
-            divergence, 0,
-            "a genuine N' landing must not flag divergence"
-        );
-    }
-
-    #[test]
-    fn populate_skips_below_anchor_collapsed_history_without_divergence() {
-        // Below the anchor the local tree has no batches (that history was folded
-        // into S'). Old-generation L1 landings at nonces < N' are trusted
-        // collapsed history: skipped by nonce-mismatch BEFORE the content-identity
-        // check, so they must NOT be flagged Foreign (which would freeze the
-        // frontier and force a false recovery). Pins the anchor-aware-frontier
-        // (I15) skip arm — the inverse of the foreign-batch freeze test above.
-        let db = temp_db("populate-below-anchor");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-        let submitter = SENDER_A;
-        storage.set_batch_tree_anchor(7).expect("anchor at N'=7");
-
-        // Old-generation batches at nonces 0, 1, 2 (< anchor) land from the submitter.
-        let mk = |nonce: u64| {
-            ssz::Encode::as_ssz_bytes(&sequencer_core::batch::Batch {
-                nonce,
-                frames: vec![sequencer_core::batch::Frame {
-                    user_ops: Vec::new(),
-                    safe_block: 10,
-                    fee_price: 0,
-                }],
-            })
-        };
-        let landings: Vec<StoredSafeInput> = (0..3)
-            .map(|n| StoredSafeInput {
-                sender: submitter,
-                payload: mk(n),
-                block_number: 20 + n,
-            })
-            .collect();
-        storage
-            .append_safe_inputs(30, &landings, submitter, &protocol)
-            .expect("sync below-anchor landings");
-
-        let divergence: i64 = storage
-            .conn
-            .query_row("SELECT COUNT(*) FROM canonical_divergence", [], |r| {
-                r.get(0)
-            })
-            .expect("count");
-        assert_eq!(
-            divergence, 0,
-            "below-anchor history must be skipped by nonce-mismatch, not flagged Foreign"
-        );
-        assert_eq!(
-            storage
-                .submitter_frontier()
-                .expect("frontier")
-                .accepted_next_nonce,
-            7,
-            "nothing is accepted; the frontier stays at the anchor N'"
-        );
-    }
-
     #[test]
     fn pending_batches_skips_invalidated_and_respects_min_nonce() {
         let db = temp_db("load-pending-batches-filter");
@@ -1363,7 +454,7 @@ mod tests {
         storage.insert_invalid_batch(0).expect("invalidate batch 0");
         storage.insert_invalid_batch(1).expect("invalidate batch 1");
         storage
-            .append_safe_inputs(10, &[], SENDER_A, &default_test_protocol())
+            .append_safe_inputs(10, &[], SENDER_A, &default_protocol_timing())
             .expect("record observed safe head");
         storage
             .recover_post_flush(1200)
@@ -1386,125 +477,4 @@ mod tests {
             .expect("query recovery nonce");
         assert_eq!(recovery_nonce, 0, "recovery Tip reuses nonce 0");
     }
-
-    #[test]
-    fn populate_safe_accepted_batches_skips_duplicate_nonces() {
-        let db = temp_db("populate-dup-nonces");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("init");
-        storage.close_frame_and_batch(&mut head, 10).expect("close");
-
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[
-                    StoredSafeInput {
-                        sender: SENDER_A,
-                        payload: landed.clone(),
-                        block_number: 20,
-                    },
-                    StoredSafeInput {
-                        sender: SENDER_A,
-                        payload: landed,
-                        block_number: 20,
-                    },
-                ],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append");
-
-        let frontier = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(
-            frontier.accepted_next_nonce, 1,
-            "duplicate nonce must be skipped"
-        );
-    }
-
-    #[test]
-    fn populate_safe_accepted_batches_handles_large_nonce_gap() {
-        let db = temp_db("populate-nonce-gap");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("init");
-        storage.close_frame_and_batch(&mut head, 10).expect("close");
-
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: super::super::test_helpers::make_stale_batch_payload(5, 10),
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append");
-
-        let frontier = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(frontier.accepted_next_nonce, 0, "gap must stall frontier");
-    }
-
-    #[test]
-    fn populate_safe_accepted_batches_out_of_order_arrivals_stalls_frontier() {
-        let db = temp_db("populate-out-of-order");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let protocol = default_test_protocol();
-
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("init");
-        storage.close_frame_and_batch(&mut head, 10).expect("close");
-        storage
-            .close_frame_and_batch(&mut head, 10)
-            .expect("close 2");
-
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: super::super::test_helpers::make_stale_batch_payload(1, 10),
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append");
-
-        let frontier = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(
-            frontier.accepted_next_nonce, 0,
-            "out of order must stall frontier"
-        );
-
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                21,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 21,
-                }],
-                SENDER_A,
-                &protocol,
-            )
-            .expect("append nonce 0");
-
-        let frontier2 = storage.submitter_frontier().expect("submitter frontier");
-        assert_eq!(
-            frontier2.accepted_next_nonce, 1,
-            "frontier must remain stalled"
-        );
-    }
 }
diff --git a/sequencer/src/storage/lifecycle.rs b/sequencer/src/storage/lifecycle.rs
index 3cf089fa..2d43973e 100644
--- a/sequencer/src/storage/lifecycle.rs
+++ b/sequencer/src/storage/lifecycle.rs
@@ -1,28 +1,9 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! The command-admission facts and the terminal-fault black box.
-//!
-//! Admission is governed by facts, each with one owner:
-//!
-//! - concurrent owners: the kernel process lock (`crate::runtime`);
-//! - command ordering: two-sided `setup_complete` — run and maintenance
-//!   preflight it here and never start before one; setup and rebuild check
-//!   it in their own admission (`crate::commands::setup`) and never restart
-//!   over a completed one;
-//! - the one absorbing refusal: `canonical_divergence`, checked at every
-//!   entry — its only exit is a fresh-directory cockroach rebuild;
-//! - restart policy after a terminal fault: the exit-code contract
-//!   (`crate::commands::error`), which the supervisor is expected to honor;
-//!   there is no database gate. Standard recovery needs no intervention at
-//!   all: every run boots through the fact-derived recovery procedure.
-//!
-//! The black box (`terminal_faults`) is for operators and postmortems: the
-//! cause of a terminal death, best-effort recorded before the process
-//! exits, traveling with the data directory. Nothing branches on it — `run`
-//! logs the latest row once at startup, operators read it after the fact —
-//! and its writes are verdict-neutral: a failed record loses only the
-//! black-box copy; the exit code and logs still carry the verdict.
+//! Command-admission facts and the `terminal_faults` black box: an append-only,
+//! best-effort record of terminal causes for operators that nothing branches on.
+//! Admission design: authority-boundary ADR, mechanism 2.
 
 use rusqlite::{OptionalExtension, TransactionBehavior, params};
 use thiserror::Error;
@@ -142,34 +123,6 @@ impl Storage {
         require_command_fits_completion(&self.conn, command)
     }
 
-    /// Commit setup's timeless completion fact. The `setup_complete`
-    /// primary key makes double-completion unrepresentable at the engine,
-    /// and the preconditions (recovery checkpoint + application-history base)
-    /// are re-read inside the same transaction so completion can never
-    /// outrun the state it certifies.
-    #[cfg(test)]
-    pub(crate) fn complete_setup(&mut self) -> Result<(), LifecycleError> {
-        let tx = self
-            .conn
-            .transaction_with_behavior(TransactionBehavior::Immediate)?;
-        // Completing setup over persisted divergence would be a lie.
-        refuse_on_canonical_divergence(&tx)?;
-        super::history::query_history_state(&tx)?;
-        if !super::snapshot_dumps::has_rollback_safe_snapshot_in(&tx)? {
-            return Err(LifecycleError::Malformed(
-                "setup cannot complete before its recovery checkpoint and \
-                 application-history baseline are established"
-                    .to_string(),
-            ));
-        }
-        tx.execute(
-            "INSERT INTO setup_complete (singleton_id, completed_at_ms) VALUES (0, ?1)",
-            [now_unix_ms()],
-        )?;
-        tx.commit()?;
-        Ok(())
-    }
-
     /// Best-effort terminal-cause record, written by the command bracket at
     /// settlement. Deliberately gated on nothing — not even divergence —
     /// because a refused write must never be the reason a cause goes
@@ -229,14 +182,35 @@ impl Storage {
             })?,
         }))
     }
+
+    /// When setup completed, or `None` before it has.
+    pub fn setup_completed_at_ms(&self) -> Result<Option<u64>, LifecycleError> {
+        let completed: Option<i64> = self
+            .conn
+            .query_row(
+                "SELECT completed_at_ms FROM setup_complete WHERE singleton_id = 0",
+                [],
+                |row| row.get(0),
+            )
+            .optional()?;
+        completed
+            .map(|ms| {
+                u64::try_from(ms).map_err(|_| {
+                    LifecycleError::Malformed(format!(
+                        "setup_complete completed_at_ms {ms} is negative"
+                    ))
+                })
+            })
+            .transpose()
+    }
 }
 
 /// The two-sided completion rule — the one command-ordering fact:
 /// setup/rebuild never restart over a completed setup (completion is
 /// once-per-database), run and maintenance never start before one exists.
-/// Only the run/maintenance side has a production caller; setup and
-/// rebuild admit through `crate::commands::setup`, which checks the same
-/// fact itself.
+/// Run and maintenance reach it through `preflight_lifecycle_command`;
+/// setup and rebuild inside `complete_baseline_setup`'s transaction, after
+/// `crate::commands::setup` has checked the same fact up front.
 fn require_command_fits_completion(
     conn: &rusqlite::Connection,
     command: LifecycleCommand,
@@ -288,9 +262,9 @@ fn refuse_on_canonical_divergence(conn: &rusqlite::Connection) -> Result<(), Lif
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::test_helpers::temp_db;
+    use crate::test_support::temp_db;
 
-    fn seeded(command: LifecycleCommand) -> (crate::storage::test_helpers::TestDb, Storage) {
+    fn seeded(command: LifecycleCommand) -> (crate::test_support::TestDb, Storage) {
         let db = temp_db("lifecycle-facts");
         let storage =
             Storage::initialize_for_command(db.path.as_str(), command).expect("initialize");
@@ -321,6 +295,19 @@ mod tests {
             .expect("seed divergence");
     }
 
+    #[test]
+    fn setup_completed_at_ms_reads_the_completion_fact() {
+        let (_db, mut storage) = seeded(LifecycleCommand::Setup);
+        assert_eq!(storage.setup_completed_at_ms().expect("read"), None);
+        complete_seeded_setup(&mut storage);
+        assert!(
+            storage
+                .setup_completed_at_ms()
+                .expect("read")
+                .is_some_and(|ms| ms > 0)
+        );
+    }
+
     #[test]
     fn completion_rule_is_two_sided() {
         let (_db, mut storage) = seeded(LifecycleCommand::Rebuild);
@@ -373,7 +360,13 @@ mod tests {
             ));
         }
         assert!(matches!(
-            storage.complete_setup(),
+            storage.complete_baseline_setup(
+                std::path::Path::new("/tmp/facts-genesis"),
+                sequencer_core::history::ExecutedInputCount::ZERO,
+                0,
+                0,
+                false,
+            ),
             Err(LifecycleError::CanonicalDivergence { nonce: 7 })
         ));
     }
@@ -431,11 +424,4 @@ mod tests {
                 .is_err()
         );
     }
-
-    #[test]
-    fn setup_cannot_complete_before_base_and_snapshot_exist() {
-        let (_db, mut storage) = seeded(LifecycleCommand::Rebuild);
-        assert!(storage.complete_setup().is_err());
-        assert!(!storage.is_setup_complete().expect("read completion"));
-    }
 }
diff --git a/sequencer/src/storage/migrations/0001_schema.sql b/sequencer/src/storage/migrations/0001_schema.sql
index 1299a75f..f471c19c 100644
--- a/sequencer/src/storage/migrations/0001_schema.sql
+++ b/sequencer/src/storage/migrations/0001_schema.sql
@@ -14,23 +14,21 @@
 -- The **Tip** is the one batch currently accepting ops: sealed_at_ms IS NULL
 -- AND invalidated_at_ms IS NULL. A partial unique index enforces at-most-one.
 --
--- `nonce` is structural: equal to `parent.nonce + 1`, or 0 for genesis (parent
--- NULL). Enforced by trigger on INSERT. The scheduler's view of a batch's
+-- `nonce` is structural: equal to `parent.nonce + 1`, or the batch-tree anchor's
+-- nonce for the parentless root (0 at genesis). Enforced by trigger on INSERT. The scheduler's view of a batch's
 -- identity; reused across recovery cascades (new Tip forks from last valid
 -- ancestor, inheriting nonce via the +1 rule).
 -- ---------------------------------------------------------------------------
--- `sealed_at_ms` / `invalidated_at_ms` are observability stamps from the
--- wall clock — write-once (triggers below), but deliberately NOT
--- cross-checked against `created_at_ms`: wall-clock monotonicity is an
--- environmental assumption, not an invariant (NTP steps, VM resume), and a
--- CHECK on it once wedged batch close and the recovery cascade in a clock
--- regression. No production code reads these as values; every
--- reader is an IS NULL / IS NOT NULL predicate.
+-- `sealed_at_ms` / `invalidated_at_ms` are write-once observability stamps from
+-- the wall clock, deliberately not cross-checked against `created_at_ms`:
+-- wall-clock order is environmental, not an invariant (NTP steps, VM resume), and
+-- such a CHECK would wedge batch close and the recovery cascade on a clock
+-- regression. Every reader is an IS NULL / IS NOT NULL predicate.
 -- `payload_hash` is the keccak256 of the batch's SSZ wire bytes, stamped at
--- seal time by the same encode path the submitter uses (hash-at-seal). It is what the content-identity check compares an accepted
--- L1 landing against — and because it is computed by the code that sealed
--- the batch, it survives wire-format upgrades. NULL only while the batch is
--- the open Tip (and on recovery sentinels, which carry no payload).
+-- seal time by the encode path the submitter uses. The content-identity check
+-- compares an accepted L1 landing against it; because the sealing code computed
+-- it, it survives wire-format upgrades. NULL only on a never-sealed batch (the
+-- open Tip, or a Tip a cascade invalidated).
 CREATE TABLE IF NOT EXISTS batches (
     batch_index        INTEGER PRIMARY KEY,
     parent_batch_index INTEGER REFERENCES batches(batch_index),  -- NULL only for genesis
@@ -70,20 +68,12 @@ CREATE VIEW IF NOT EXISTS valid_closed_batches AS
 CREATE VIEW IF NOT EXISTS valid_open_batch AS
     SELECT * FROM valid_batches WHERE sealed_at_ms IS NULL;
 
--- Batch-tree anchor: the nonce the single (valid) parentless root carries.
---
--- A genesis deployment is anchored at 0; a cockroach-recovered one is anchored
--- at N' (the post-checkpoint resume nonce), so `run`'s first tip roots at N'
--- without replaying history — there is no separate "sentinel" batch row, the
--- root tip *is* the anchor. The value generalizes the rule the tree already
--- has ("a parentless root carries nonce 0") from a hard-coded 0 to this
--- singleton; it is read by `trg_enforce_nonce_contiguity` (below) and by
--- `compute_next_nonce(parent = None)`.
---
--- Default 0, so a normal deployment is byte-identical to before this table
--- existed. Written exactly once — by `setup` (recovery sets N' before the
--- `setup_complete` marker); `trg_batch_tree_anchor_write_once` freezes it
--- thereafter, since re-anchoring a live deployment would strand its spine.
+-- Batch-tree anchor (I16): the nonce the single valid parentless root carries,
+-- 0 for genesis and N' (the resume nonce) after a cockroach rebuild, so `run`'s
+-- first Tip roots at N' without replaying history. Read by
+-- `trg_enforce_nonce_contiguity` and `compute_next_nonce`. Setup writes it once,
+-- before `setup_complete`; `trg_batch_tree_anchor_write_once` then freezes it,
+-- since re-anchoring a live deployment would strand its spine.
 CREATE TABLE IF NOT EXISTS batch_tree_anchor (
     singleton_id INTEGER PRIMARY KEY CHECK (singleton_id = 0),
     nonce        INTEGER NOT NULL CHECK (nonce >= 0)
@@ -112,10 +102,8 @@ AFTER INSERT ON batches
 FOR EACH ROW
 BEGIN
     SELECT CASE
-        -- A parentless root must carry the deployment's anchor nonce. This is
-        -- an *exact* match — tighter than the old "must be 0": a buggy root at
-        -- any other nonce still ABORTs, including a re-root at 0 on a recovered
-        -- (anchor = N') deployment.
+        -- A parentless root must carry exactly the deployment's anchor nonce,
+        -- so a buggy root at any other nonce ABORTs, including 0 on a recovered one.
         WHEN NEW.parent_batch_index IS NULL
          AND NEW.nonce != (SELECT nonce FROM batch_tree_anchor WHERE singleton_id = 0)
             THEN RAISE(ABORT, 'parentless root must carry the batch-tree anchor nonce')
@@ -268,6 +256,16 @@ CREATE TABLE IF NOT EXISTS safe_inputs (
 CREATE INDEX IF NOT EXISTS idx_safe_inputs_sender
     ON safe_inputs(sender);
 
+-- The InputBox record is append-only: its rows are the source of every
+-- replayed direct input and of the acceptance scan (I11). Direct reads filter by
+-- sender, so a changed or missing undrained row would execute silently.
+CREATE TRIGGER IF NOT EXISTS trg_safe_inputs_immutable
+BEFORE UPDATE ON safe_inputs FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'safe inputs are immutable'); END;
+CREATE TRIGGER IF NOT EXISTS trg_safe_inputs_not_deletable
+BEFORE DELETE ON safe_inputs FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'safe inputs are retained for the database lifetime'); END;
+
 -- Current application order. Recovery replaces only an invalidated suffix;
 -- immutable source payloads remain in their owning tables.
 CREATE TABLE IF NOT EXISTS application_inputs (
@@ -294,8 +292,8 @@ CREATE INDEX IF NOT EXISTS idx_safe_inputs_block
 -- Derived log of batch submissions the scheduler would actually execute.
 -- Unlike a raw log of all safe submissions, this only contains the accepted
 -- prefix: batches whose nonce matched the expected sequence and were not stale.
--- Maintained atomically by Storage::append_safe_inputs (via
--- populate_safe_accepted_batches), which simulates the scheduler's
+-- Maintained atomically by Storage::append_ingested_safe_inputs_with_timestamp
+-- (via populate_safe_accepted_batches), which simulates the scheduler's
 -- acceptance logic over new safe_inputs rows.
 CREATE TABLE IF NOT EXISTS safe_accepted_batches (
     safe_input_index     INTEGER PRIMARY KEY REFERENCES safe_inputs(safe_input_index),
@@ -494,7 +492,7 @@ CREATE TABLE IF NOT EXISTS deployment_identity (
     -- Immutable setup-pinned fee source. Fixed has only fixed_log_gas_price;
     -- Uniswap has the complete reviewed token/pool tuple.
     fee_oracle_mode           TEXT    NOT NULL CHECK (fee_oracle_mode IN ('fixed', 'uniswap')),
-    fixed_log_gas_price       INTEGER CHECK (fixed_log_gas_price BETWEEN 0 AND 65535),
+    fixed_log_gas_price       INTEGER CHECK (fixed_log_gas_price BETWEEN -32768 AND 32767),
     fee_oracle_weth           BLOB    CHECK (fee_oracle_weth IS NULL OR length(fee_oracle_weth) = 20),
     fee_oracle_fee_token      BLOB    CHECK (fee_oracle_fee_token IS NULL OR length(fee_oracle_fee_token) = 20),
     fee_oracle_pool           BLOB    CHECK (fee_oracle_pool IS NULL OR length(fee_oracle_pool) = 20),
@@ -545,6 +543,10 @@ END;
 --   WETH/X TWAP and encodes the approximate quote to log space. The tenfold safety
 --   margin lives in `log_slack` (not in the oracle). Local Anvil uses an
 --   explicit fixed exponent instead of Uniswap.
+--   `log_gas_price` may be negative: a few-decimal fee token (USDC) can cost
+--   less than one smallest unit per gas at low L1 gas. The floor is set on
+--   the derived fee instead, one smallest unit per user op (exponent 0);
+--   below it the oracle clamps rather than overcharging per gas.
 --
 -- Fee derivation (view):
 --   log_recommended_fee = log_gas_price + log_slack + log_one_plus_alpha
@@ -557,6 +559,8 @@ END;
 --   log_batch_size_target = log_base_gas - log_alpha - log_delta
 --   batch_size_target = base_gas / (alpha * delta). The inclusion lane converts
 --   to linear bytes via fee_to_linear() for its byte-count comparison.
+--   InputBox gas ≈ base_gas + delta × payload bytes; each op pays
+--   (1 + alpha) × delta per byte, so alpha × delta × batch_size_target = base_gas.
 --
 -- Batch size invariant (CHECK):
 --   log_base_gas - log_alpha - log_delta < log_max_batch_bytes
@@ -564,18 +568,18 @@ END;
 CREATE TABLE IF NOT EXISTS batch_policy (
     singleton_id             INTEGER PRIMARY KEY CHECK (singleton_id = 0),
 
-    -- Knobs (operator-tunable, set via set_alpha(num, denom)):
+    -- Knobs (schema defaults; no runtime writer; tests override by SQL):
     -- log_alpha = log(alpha) where alpha = num/denom. Can be negative (alpha < 1).
     log_alpha                INTEGER NOT NULL,
     -- log_one_plus_alpha = log(1 + alpha). Always >= 0.
     log_one_plus_alpha       INTEGER NOT NULL CHECK (log_one_plus_alpha >= 0),
-    -- Log-space fee exponent fed by the oracle.
-    log_gas_price            INTEGER NOT NULL CHECK (log_gas_price >= 0),
+    -- Log-space fee exponent fed by the oracle. Negative below one fee-token
+    -- smallest unit per L1 gas; the fee-floor CHECK below bounds it.
+    log_gas_price            INTEGER NOT NULL,
     -- Unix-ms of the last successful oracle (or Fixed setup) write.
     -- 0 means never written; completed setup guarantees a nonzero observation.
     log_gas_price_updated_at_ms INTEGER NOT NULL CHECK (log_gas_price_updated_at_ms >= 0),
-    -- log_{129/128}(10), rounded by log_fee_ratio(10, 1) = 296.
-    -- This tenfold price slack is applied in log space, not in the oracle.
+    -- log_{129/128}(10) = 296: the tenfold price slack (see the header).
     log_slack                INTEGER NOT NULL CHECK (log_slack >= 0),
 
     -- Constants (log-space):
@@ -584,7 +588,9 @@ CREATE TABLE IF NOT EXISTS batch_policy (
     log_user_op_bytes        INTEGER NOT NULL CHECK (log_user_op_bytes > 0),
     log_max_batch_bytes      INTEGER NOT NULL CHECK (log_max_batch_bytes > 0),
 
-    CHECK (log_base_gas - log_alpha - log_delta < log_max_batch_bytes)
+    CHECK (log_base_gas - log_alpha - log_delta < log_max_batch_bytes),
+    -- Fee floor: the derived per-op fee never drops below exponent 0.
+    CHECK (log_gas_price + log_slack + log_one_plus_alpha + log_delta + log_user_op_bytes >= 0)
 );
 
 -- Default values. All log-space exponents with base 129/128:
@@ -616,7 +622,7 @@ VALUES (
 -- Derived view for reads. All outputs are log-space exponents (base 129/128).
 CREATE VIEW IF NOT EXISTS batch_policy_derived AS
 SELECT *,
-    -- Fee per user-op byte.
+    -- Fee per user op.
     log_gas_price + log_slack + log_one_plus_alpha + log_delta + log_user_op_bytes
         AS log_recommended_fee,
     -- Batch size target in log-space (convert via fee_to_linear for bytes).
diff --git a/sequencer/src/storage/mod.rs b/sequencer/src/storage/mod.rs
index 97d6fac3..b866a88e 100644
--- a/sequencer/src/storage/mod.rs
+++ b/sequencer/src/storage/mod.rs
@@ -1,34 +1,11 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! SQLite-backed storage for the sequencer.
-//!
-//! [`Storage`] is the single entry point. Methods are clustered by caller role
-//! across sibling files — mostly "one file per writer", plus one read-only
-//! batch-aggregate file that two roles share:
-//!
-//! - `ingress` — inclusion lane: user-op append, frame/batch close
-//! - `egress` — WS feed and catch-up replay (read-only)
-//! - `l1_inputs` — input reader: safe-input ingestion, L1 head, deployment identity
-//! - `l1_submission` — batch-aggregate reads (submitter frontier, pending
-//!   batches, per-batch replay) shared between the submitter and egress
-//! - `recovery` — cascade invalidation, recovery-batch open, danger checks
-//! - `admin` — operator policy alpha tuning
-//! - `fee_oracle` — L1 fee-oracle gas-price updates
-//! - `snapshot_dumps` — immutable snapshots, derived acceptance, lease counts
-//! - `history` — write-once era/base metadata and recovery generation
-//! - `lifecycle` — command-admission facts + the terminal-fault black box
-//!
-//! Cross-writer helpers are split by concern:
-//!
-//! - `convert` — int width + time conversions
-//! - `queries` — shared read helpers (`query_*`, `load_current_write_head`)
-//! - `mutations` — shared write helpers (`insert_new_batch`, `seal_batch`, …)
-//!
-//! The schema and `valid_*` views live in `migrations/0001_schema.sql`. See
-//! `docs/recovery/README.md` for the recovery design and TLA+ specs.
-
-mod admin;
+//! SQLite storage. [`Storage`] is the single entry point; each writer role's
+//! methods live in its own sibling file (writer table: `docs/invariants.md`),
+//! shared reads in `queries` and shared writes in `mutations`. The schema and
+//! `valid_*` views live in `migrations/0001_schema.sql`.
+
 mod convert;
 mod egress;
 mod fee_oracle;
@@ -52,10 +29,11 @@ pub(crate) use convert::is_persistent_storage_error;
 use std::time::SystemTime;
 use thiserror::Error;
 
+pub(crate) use egress::HistoricalReadError;
 #[cfg(test)]
-pub(crate) use egress::ApplicationInputRow;
-pub(crate) use egress::{HistoricalReadError, HistoryReadError, L2TxContext};
+pub(crate) use history::ApplicationInputRow;
 pub use history::{DirectInputExecution, HistoryState};
+pub(crate) use history::{HistoryReadError, L2TxContext};
 pub use lifecycle::{LifecycleCommand, LifecycleError, TerminalFault};
 pub use open::Storage;
 pub use recovery::DangerStatus;
@@ -135,7 +113,8 @@ impl SafeInputRange {
         }
     }
 
-    pub fn empty_at(index: u64) -> Self {
+    #[cfg(test)]
+    pub(crate) fn empty_at(index: u64) -> Self {
         Self::new(index, index)
     }
 
@@ -250,7 +229,7 @@ pub struct DeploymentIdentity {
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum FeeOracleIdentity {
     Fixed {
-        log_gas_price: u16,
+        log_gas_price: i16,
     },
     Uniswap {
         weth: alloy_primitives::Address,
@@ -339,10 +318,6 @@ impl WriteHead {
         self.open_frame_user_op_count = next_frame_count;
     }
 
-    pub fn open_frame_has_user_ops(&self) -> bool {
-        self.open_frame_user_op_count > 0
-    }
-
     pub fn advance_frame(&mut self, policy: BatchPolicy, safe_block: u64) {
         self.frame_in_batch = self
             .frame_in_batch
diff --git a/sequencer/src/storage/mutations.rs b/sequencer/src/storage/mutations.rs
index 8495b2ad..1c82e540 100644
--- a/sequencer/src/storage/mutations.rs
+++ b/sequencer/src/storage/mutations.rs
@@ -1,11 +1,8 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Write-side helpers shared across writer-role files.
-//!
-//! Like [`super::queries`] these take `&Transaction` so they compose inside a
-//! larger atomic unit. The two consumers today are ingress (batch/frame close
-//! + re-drain) and recovery (opening a recovery batch after cascade).
+//! Write helpers shared across writer roles. Like [`super::queries`], they take a
+//! `&Transaction` so they compose inside a larger atomic unit.
 
 use alloy_primitives::Address;
 use rusqlite::{Connection, Result, Transaction, params};
diff --git a/sequencer/src/storage/open.rs b/sequencer/src/storage/open.rs
index d9beba94..03f0b9ef 100644
--- a/sequencer/src/storage/open.rs
+++ b/sequencer/src/storage/open.rs
@@ -4,7 +4,7 @@
 //! `Storage` struct definition plus connection-open and migration entry points.
 //!
 //! Method clusters live in sibling files (`ingress`, `egress`, `l1_inputs`,
-//! `l1_submission`, `recovery`, `admin`) — each adds its own `impl Storage`.
+//! `l1_submission`, `recovery`) — each adds its own `impl Storage`.
 
 use rusqlite::{Connection, OpenFlags, Result, Transaction, TransactionBehavior};
 use rusqlite_migration::{HookResult, M, Migrations};
@@ -115,14 +115,6 @@ impl Storage {
         })
     }
 
-    /// Test-only: return a raw `Connection` with the same pragmas as
-    /// [`Storage::open`]. Used by tests that need to reach past the typed API
-    /// (e.g., rewinding `synced_at_ms`, installing failure triggers).
-    #[cfg(test)]
-    pub fn open_connection(path: &str) -> std::result::Result<Connection, StorageOpenError> {
-        open_writer_connection(path)
-    }
-
     /// Run `f` inside a Deferred transaction, commit on success. For pure reads.
     ///
     /// Using Deferred rather than Immediate matches SQLite's default — readers
@@ -163,7 +155,7 @@ impl Storage {
 
 /// Open a read-write connection with WAL + `FULL` sync (`SYNCHRONOUS_PRAGMA`) +
 /// 5s busy timeout.
-fn open_writer_connection(path: &str) -> Result<Connection, StorageOpenError> {
+pub(super) fn open_writer_connection(path: &str) -> Result<Connection, StorageOpenError> {
     let conn = Connection::open(path)?;
     conn.pragma_update(None, "foreign_keys", "ON")?;
     conn.pragma_update(None, "journal_mode", "WAL")?;
@@ -317,3 +309,6 @@ mod tests {
         assert_eq!(b.base_safe_block, 100);
     }
 }
+
+#[cfg(test)]
+mod schema_tests;
diff --git a/sequencer/src/storage/open/schema_tests.rs b/sequencer/src/storage/open/schema_tests.rs
new file mode 100644
index 00000000..7e16fd1c
--- /dev/null
+++ b/sequencer/src/storage/open/schema_tests.rs
@@ -0,0 +1,732 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! Schema-invariant regression tests: the triggers, CHECKs and partial unique
+//! indexes in `migrations/0001_schema.sql` enforce the batch-tree invariants, and
+//! each test pins one tripwire.
+
+use rusqlite::params;
+
+use super::super::test_helpers::{
+    RecoveryFixture, SENDER_A, SENDER_B, default_protocol_timing, local_batch_payload,
+    open_temp_storage, temp_db_with_default_deployment_identity as temp_db,
+};
+use crate::storage::{SafeInputRange, Storage, StoredSafeInput};
+
+#[test]
+fn schema_rejects_second_valid_tip() {
+    // The partial unique index `ux_single_valid_tip` catches a writer that
+    // opens a new Tip without sealing the old one first.
+    let (_db, mut storage) = open_temp_storage("schema-second-tip");
+    storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+
+    // Try to bypass the lane and insert a second valid Tip directly.
+    let err = storage.conn.execute(
+        "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms) \
+         VALUES (99, 0, 1, 1000)",
+        [],
+    );
+    let msg = format!("{err:?}");
+    assert!(
+        msg.contains("UNIQUE constraint failed") && msg.contains("ux_single_valid_tip"),
+        "expected ux_single_valid_tip violation, got: {msg}"
+    );
+}
+
+#[test]
+fn schema_rejects_bad_nonce_contiguity() {
+    // Nonce must equal parent.nonce + 1 — trigger enforces it.
+    // Insert the bad-nonce batch as already-sealed so it doesn't collide
+    // with the existing Tip on `ux_single_valid_tip`.
+    let (_db, mut storage) = open_temp_storage("schema-bad-nonce");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage
+        .close_batch_at(&mut head, 0)
+        .expect("close batch 0; batch 1 is now Tip");
+    // Batch 1 has nonce 1 (0 + 1). Insert child with nonce 99 (should be 2).
+    let err = storage.conn.execute(
+        "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
+         VALUES (999, 1, 99, \
+                 (SELECT created_at_ms FROM batches WHERE batch_index = 1), \
+                 (SELECT created_at_ms FROM batches WHERE batch_index = 1))",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("batch nonce must equal parent.nonce + 1"),
+        "expected nonce trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_genesis_with_nonzero_nonce() {
+    // Default anchor is 0, so a parentless root at a non-zero nonce ABORTs
+    // (genesis must be 0) — the exact-match form of the contiguity rule.
+    let (_db, storage) = open_temp_storage("schema-genesis-nonzero");
+    let err = storage.conn.execute(
+        "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms) \
+         VALUES (0, NULL, 7, 100)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("parentless root must carry the batch-tree anchor nonce"),
+        "expected anchor-nonce trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_allows_parentless_root_at_anchor_nonce() {
+    // With the anchor set to N' (a recovered deployment), a parentless root
+    // at N' is permitted — the recovery generalization of "genesis at 0".
+    // (Rows are inserted sealed so the single-Tip partial index, which only
+    // covers open rows, doesn't mask the contiguity trigger under test.)
+    let db = temp_db("schema-anchor-root");
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    storage
+        .conn
+        .execute(
+            "UPDATE batch_tree_anchor SET nonce = 42 WHERE singleton_id = 0",
+            [],
+        )
+        .expect("set anchor");
+    // A root at the anchor nonce (42) is accepted...
+    storage
+        .conn
+        .execute(
+            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
+             VALUES (0, NULL, 42, 100, 100)",
+            [],
+        )
+        .expect("parentless root at the anchor nonce is allowed");
+    // ...but a root at 0 ABORTs: the rule is an exact match against the anchor.
+    let err = storage.conn.execute(
+        "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
+         VALUES (1, NULL, 0, 100, 100)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("parentless root must carry the batch-tree anchor nonce"),
+        "a root at the wrong nonce must abort, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_second_valid_parentless_root() {
+    // At most one *valid* parentless root: a second parentless insert (both
+    // valid, both at the anchor nonce 0) ABORTs on the single-root guard.
+    // (Sealed inserts isolate this from the single-Tip index; a fully-torn
+    // cascade re-roots only after invalidating the old root, covered below.)
+    let db = temp_db("schema-two-roots");
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    storage
+        .conn
+        .execute(
+            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
+             VALUES (0, NULL, 0, 100, 100)",
+            [],
+        )
+        .expect("first root ok");
+    let err = storage.conn.execute(
+        "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
+         VALUES (1, NULL, 0, 100, 100)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("at most one valid parentless root"),
+        "expected single-root guard, got: {err:?}"
+    );
+    // Invalidate the first root, then a second parentless root is allowed —
+    // exactly the fully-torn-cascade re-root shape.
+    storage
+        .conn
+        .execute(
+            "UPDATE batches SET invalidated_at_ms = 200 WHERE batch_index = 0",
+            [],
+        )
+        .expect("invalidate first root");
+    storage
+        .conn
+        .execute(
+            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
+             VALUES (1, NULL, 0, 100, 100)",
+            [],
+        )
+        .expect("re-root parentless after the old root is invalidated");
+}
+
+#[test]
+fn schema_freezes_anchor_after_setup_complete() {
+    // The anchor is write-once: once `setup_complete` exists, UPDATEs abort.
+    let db = temp_db("schema-anchor-frozen");
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    // Pre-marker: UPDATE is allowed (this is what recovery setup does).
+    storage
+        .conn
+        .execute(
+            "UPDATE batch_tree_anchor SET nonce = 7 WHERE singleton_id = 0",
+            [],
+        )
+        .expect("anchor settable before setup_complete");
+    storage
+        .conn
+        .execute(
+            "INSERT INTO setup_complete (singleton_id, completed_at_ms) VALUES (0, 1)",
+            [],
+        )
+        .expect("mark setup complete");
+    let err = storage.conn.execute(
+        "UPDATE batch_tree_anchor SET nonce = 8 WHERE singleton_id = 0",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("batch-tree anchor is frozen after setup completes"),
+        "expected anchor-freeze trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_re_seal() {
+    let (_db, mut storage) = open_temp_storage("schema-re-seal");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage
+        .close_batch_at(&mut head, 0)
+        .expect("close batch 0 (seals it)");
+    // Batch 0 is sealed. Attempt to re-seal with a different timestamp.
+    let err = storage.conn.execute(
+        "UPDATE batches SET sealed_at_ms = sealed_at_ms + 1 WHERE batch_index = 0",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("sealed_at_ms is write-once"),
+        "expected write-once trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_re_invalidate() {
+    let (_db, mut storage) = open_temp_storage("schema-re-invalidate");
+    storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    // Seed via test helper (uses now_unix_ms internally).
+    storage.insert_invalid_batch(0).expect("first invalidate");
+    let err = storage.conn.execute(
+        "UPDATE batches SET invalidated_at_ms = invalidated_at_ms + 1 \
+         WHERE batch_index = 0",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("invalidated_at_ms is write-once"),
+        "expected write-once trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_frame_insert_into_sealed_batch() {
+    // This is the bug class we've been fighting: writer holds a stale
+    // WriteHead and writes to a batch that's no longer the Tip.
+    let (_db, mut storage) = open_temp_storage("schema-frame-into-sealed");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage
+        .close_batch_at(&mut head, 0)
+        .expect("close batch 0; batch 0 is now sealed");
+    // Batch 0 is sealed. Any direct insert into its frames must fail.
+    let err = storage.conn.execute(
+        "INSERT INTO frames (batch_index, frame_in_batch, created_at_ms, fee, safe_block) \
+         VALUES (0, 1, 100, 1356, 0)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("frames can only be inserted into the current Tip"),
+        "expected tip-only-frames trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_frame_insert_into_invalidated_batch() {
+    let (_db, mut storage) = open_temp_storage("schema-frame-into-invalid");
+    storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    // Invalidate (without sealing) — Tip that never closed, now dead.
+    storage.insert_invalid_batch(0).expect("invalidate tip");
+    let err = storage.conn.execute(
+        "INSERT INTO frames (batch_index, frame_in_batch, created_at_ms, fee, safe_block) \
+         VALUES (0, 1, 100, 1356, 0)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("frames can only be inserted into the current Tip"),
+        "expected tip-only-frames trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_parent_batch_index_mutation() {
+    let (_db, mut storage) = open_temp_storage("schema-parent-immutable");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage.close_batch_at(&mut head, 0).expect("close batch 0");
+    // Try to change parent of batch 1 — should be rejected.
+    let err = storage.conn.execute(
+        "UPDATE batches SET parent_batch_index = NULL WHERE batch_index = 1",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("parent_batch_index is immutable"),
+        "expected parent-immutable trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_application_input_into_non_tip() {
+    // The third sibling of the tip-only triggers (frames + user_ops already
+    // have negative tests; application_inputs did not). The global replay order
+    // is the source for recovery re-drain and catch-up; a stale-WriteHead row
+    // into a sealed batch would corrupt it.
+    let (_db, mut storage) = open_temp_storage("schema-sequenced-into-sealed");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage
+        .close_batch_at(&mut head, 0)
+        .expect("close batch 0; it is now sealed (no longer the Tip)");
+    // Target the sealed batch's existing frame (0, 0). The BEFORE-INSERT
+    // trigger fires before the safe_input_index FK is evaluated.
+    let err = storage.conn.execute(
+        "INSERT INTO application_inputs \
+         (offset, batch_index, frame_in_batch, user_op_pos_in_frame, safe_input_index) \
+         VALUES (0, 0, 0, NULL, 0)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("application input must target the current valid Tip"),
+        "expected tip-only-sequenced trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_nonce_mutation() {
+    // Nonce immutability underpins the frontier + contiguity invariants.
+    let (_db, mut storage) = open_temp_storage("schema-nonce-immutable");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage.close_batch_at(&mut head, 0).expect("close batch 0");
+    let err = storage.conn.execute(
+        "UPDATE batches SET nonce = nonce + 1 WHERE batch_index = 0",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("nonce is immutable"),
+        "expected nonce-immutable trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn schema_rejects_payload_hash_rewrite() {
+    // payload_hash is the content-identity anchor for the canonical-
+    // divergence check; a rewrite would let a foreign/zombie L1 landing
+    // false-match a local batch. Write-once once stamped at seal.
+    let (_db, mut storage) = open_temp_storage("schema-payload-hash-write-once");
+    let mut head = storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    storage
+        .close_batch_at(&mut head, 0)
+        .expect("close batch 0; payload_hash is stamped at seal");
+    let err = storage.conn.execute(
+        "UPDATE batches SET payload_hash = \
+         X'0000000000000000000000000000000000000000000000000000000000000000' \
+         WHERE batch_index = 0",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("payload_hash is write-once"),
+        "expected payload-hash-write-once trigger, got: {err:?}"
+    );
+}
+
+#[test]
+fn nonce_reuse_after_cascade_with_valid_ancestor() {
+    // Beautiful part of parent-pointer + structural nonce: after a cascade
+    // that invalidates only the suffix (keeping an ancestor valid), the
+    // new Tip's parent is the last valid ancestor, so its nonce is
+    // `ancestor.nonce + 1` — the same nonce the invalidated suffix's
+    // first batch had. Nonce reuse is automatic.
+    //
+    // Scenario: batch 0 is accepted (safe_accepted_batches advances past
+    // nonce 0). Batch 1 is stale and triggers cascade. Batches 1, 2, 3
+    // invalidated; batch 0 remains valid.
+    let (_db, mut storage) = open_temp_storage("nonce-reuse-with-ancestor");
+
+    let mut head = storage
+        .initialize_open_state(10, SafeInputRange::empty_at(0))
+        .expect("initialize at safe_block=10");
+    storage
+        .close_batch_at(&mut head, 100)
+        .expect("close batch 0 (nonce 0)");
+    storage
+        .close_batch_at(&mut head, 100)
+        .expect("close batch 1 (nonce 1)");
+    storage
+        .close_batch_at(&mut head, 100)
+        .expect("close batch 2 (nonce 2)");
+    // Head is now batch 3 (nonce 3, first_frame_safe_block=100).
+
+    // Batch 0 lands on L1 (accepted): safe_input at block 20 with nonce 0.
+    let landed = local_batch_payload(&mut storage, 0);
+    storage.land(20, &[(SENDER_A, landed)]); // append batch 0 submission
+    // Advance safe head so batches 1, 2, 3 (first_frame=100) are stale.
+    // current_safe=1400 → 1400-100=1300 >= 1200.
+    storage.advance_safe_head(1400); // advance past threshold
+
+    let inv = storage.recover_post_flush(1200).expect("recover");
+    // Batches 1, 2, 3 invalidated; batch 0 (accepted) stays valid.
+    assert_eq!(inv, vec![1, 2, 3], "only the suffix cascades, got {inv:?}");
+
+    // The NEW Tip has parent=0 (the last valid ancestor), nonce=1.
+    // This is what nonce reuse looks like: the invalidated batch 1 had
+    // nonce 1; the recovery batch gets the same nonce via +1-from-parent.
+    let (tip_nonce, tip_parent): (i64, i64) = storage
+        .conn
+        .query_row(
+            "SELECT nonce, parent_batch_index FROM valid_open_batch",
+            [],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )
+        .expect("query recovery tip");
+    assert_eq!(tip_nonce, 1, "recovery Tip reuses nonce 1");
+    assert_eq!(tip_parent, 0, "recovery Tip's parent is batch 0");
+}
+
+// ── CHECK-constraint regressions ──────────────────────────
+//
+// These differ from the trigger-based tests above: they exercise raw
+// `CHECK` clauses declared in `migrations/0001_schema.sql`. The
+// type-safe `Storage` API would reject these values Rust-side; we go
+// through `storage.conn.execute` to prove the schema itself refuses.
+
+#[test]
+fn schema_rejects_safe_input_with_wrong_sender_length() {
+    // `safe_inputs.sender` must be exactly 20 bytes (an
+    // Ethereum address). A shorter or longer blob must be refused
+    // by the schema even if it bypasses the Rust API.
+    let (_db, storage) = open_temp_storage("schema-safe-input-sender-len");
+    let err = storage.conn.execute(
+        "INSERT INTO safe_inputs \
+             (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
+             VALUES (0, X'DEADBEEF', X'00', 10, 0, zeroblob(32))",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on safe_inputs.sender, got: {err:?}",
+    );
+}
+
+#[test]
+fn schema_rejects_user_op_with_wrong_sender_length() {
+    // `user_ops.sender` must be 20 bytes.
+    let (_db, storage) = open_temp_storage("schema-user-op-sender-len");
+    // Seed a frame to satisfy the composite FK — initialize_open_state
+    // creates batch 0 frame 0 as the Tip.
+    let mut storage = storage;
+    storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    let err = storage.conn.execute(
+            "INSERT INTO user_ops \
+             (batch_index, frame_in_batch, pos_in_frame, sender, nonce, max_fee, data, sig, received_at_ms) \
+             VALUES (0, 0, 0, X'010203', 0, 0, X'', ?1, 0)",
+            params![vec![0u8; 65]],
+        );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on user_ops.sender length, got: {err:?}",
+    );
+}
+
+#[test]
+fn schema_rejects_user_op_with_wrong_signature_length() {
+    // `user_ops.sig` must be exactly 65 bytes (secp256k1
+    // r || s || v). Regression for "accidentally accepted a non-65
+    // signature and crashed a downstream consumer."
+    let (_db, mut storage) = open_temp_storage("schema-user-op-sig-len");
+    storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    let valid_sender = vec![0u8; 20];
+    let short_sig = vec![0u8; 32]; // Should be 65.
+    let err = storage.conn.execute(
+            "INSERT INTO user_ops \
+             (batch_index, frame_in_batch, pos_in_frame, sender, nonce, max_fee, data, sig, received_at_ms) \
+             VALUES (0, 0, 0, ?1, 0, 0, X'', ?2, 0)",
+            params![valid_sender, short_sig],
+        );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on user_ops.sig length, got: {err:?}",
+    );
+}
+
+#[test]
+fn schema_rejects_application_input_with_neither_xor_branch() {
+    // `application_inputs` must be either a user-op row
+    // (user_op_pos_in_frame IS NOT NULL) or a direct-input row
+    // (safe_input_index IS NOT NULL), never both and never neither.
+    // Setting both to NULL is the clean XOR violation to test —
+    // FKs are only triggered on non-NULL values so we isolate the
+    // CHECK constraint.
+    let (_db, mut storage) = open_temp_storage("schema-sequenced-l2-tx-xor-neither");
+    storage
+        .initialize_open_state(0, SafeInputRange::empty_at(0))
+        .expect("initialize");
+    let err = storage.conn.execute(
+        "INSERT INTO application_inputs \
+             (offset, batch_index, frame_in_batch, user_op_pos_in_frame, safe_input_index) \
+             VALUES (0, 0, 0, NULL, NULL)",
+        [],
+    );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on application_inputs XOR, got: {err:?}",
+    );
+}
+
+#[test]
+fn schema_rejects_deployment_identity_with_zero_chain_id() {
+    // `deployment_identity.chain_id > 0`. chain_id = 0 would
+    // collide with the EIP-712 domain's unspecified-chain sentinel
+    // and break signature recovery; the CHECK refuses to persist it
+    // in the first place.
+    let db = crate::test_support::temp_db("schema-deployment-chain-id-zero");
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    let address = vec![0u8; 20];
+    let err = storage.conn.execute(
+        "INSERT INTO deployment_identity \
+             (singleton_id, chain_id, app_address, input_box_address, \
+              app_deployment_block, batch_submitter_address, \
+              fee_oracle_mode, fixed_log_gas_price, \
+              fee_oracle_weth, fee_oracle_fee_token, fee_oracle_pool, \
+              fee_oracle_twap_window_secs) \
+             VALUES (0, 0, ?1, ?1, 0, ?1, 'fixed', 0, NULL, NULL, NULL, NULL)",
+        params![address],
+    );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on chain_id > 0, got: {err:?}",
+    );
+}
+
+#[test]
+fn schema_rejects_safe_input_with_negative_block_number() {
+    // `safe_inputs.block_number >= 0`. Catches a regression
+    // that would let a negative block number slip through — the rest
+    // of the system assumes non-negative and could panic on cast.
+    let (_db, storage) = open_temp_storage("schema-safe-input-neg-block");
+    let sender = vec![0u8; 20];
+    let err = storage.conn.execute(
+        "INSERT INTO safe_inputs \
+             (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
+             VALUES (0, ?1, X'00', -1, 0, zeroblob(32))",
+        params![sender],
+    );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on block_number >= 0, got: {err:?}",
+    );
+}
+
+#[test]
+fn divergence_marker_freezes_batch_tree_promotions_and_pending_clears() {
+    // I15 structural enforcement: with the canonical-divergence marker
+    // present, the trg_*_frozen_on_divergence family must RAISE on batch
+    // inserts/updates, promotion inserts, and pending-snapshot deletes —
+    // even for a caller that bypassed every typed Rust refusal.
+    let (_db, mut storage) = open_temp_storage("schema-divergence-freeze");
+    let mut head = storage
+        .initialize_open_state(10, SafeInputRange::empty_at(0))
+        .expect("initialize open state");
+    storage
+        .close_batch_at(&mut head, 10)
+        .expect("close batch 0 before freezing");
+    storage
+        .insert_batch_snapshot(std::path::Path::new("/tmp/pending-fixture"), 0)
+        .expect("insert a pending dump row to attempt deleting");
+    crate::storage::test_helpers::record_canonical_divergence(&mut storage, 0, 0);
+
+    let frozen = |err: rusqlite::Error| {
+        let text = format!("{err}");
+        assert!(
+            text.contains("frozen") && text.contains("divergence"),
+            "expected a divergence-freeze RAISE, got: {text}"
+        );
+    };
+
+    frozen(
+        storage
+            .conn
+            .execute(
+                "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms) \
+                 VALUES (99, NULL, 0, 0)",
+                [],
+            )
+            .expect_err("batch INSERT must be frozen"),
+    );
+    frozen(
+        storage
+            .conn
+            .execute(
+                "UPDATE batches SET invalidated_at_ms = 1 WHERE invalidated_at_ms IS NULL",
+                [],
+            )
+            .expect_err("batch UPDATE (cascade shape) must be frozen"),
+    );
+    frozen(
+        storage
+            .conn
+            .execute("DELETE FROM snapshots", [])
+            .expect_err("pending-snapshot DELETE must be frozen"),
+    );
+
+    // Reads stay usable on a frozen DB: the danger check must still
+    // classify the divergence (the boot-refusal path depends on it).
+    let protocol = default_protocol_timing();
+    let status = storage
+        .check_danger(&protocol, 1_000_000)
+        .expect("check danger on a frozen DB");
+    assert_eq!(status, crate::storage::DangerStatus::CanonicalDivergence(0));
+}
+
+#[test]
+fn schema_rejects_safe_input_with_negative_block_timestamp() {
+    let (_db, storage) = open_temp_storage("schema-safe-input-neg-block-timestamp");
+    let sender = vec![0u8; 20];
+    let err = storage.conn.execute(
+        "INSERT INTO safe_inputs \
+             (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
+             VALUES (0, ?1, X'00', 10, -1, zeroblob(32))",
+        params![sender],
+    );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on block_timestamp >= 0, got: {err:?}",
+    );
+}
+
+#[test]
+fn schema_rejects_safe_input_with_wrong_transaction_hash_length() {
+    let (_db, storage) = open_temp_storage("schema-safe-input-transaction-hash-len");
+    let sender = vec![0u8; 20];
+    let err = storage.conn.execute(
+        "INSERT INTO safe_inputs \
+             (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
+             VALUES (0, ?1, X'00', 10, 0, X'DEADBEEF')",
+        params![sender],
+    );
+    assert!(
+        format!("{err:?}").contains("CHECK constraint failed"),
+        "expected CHECK constraint error on transaction_hash length, got: {err:?}",
+    );
+}
+
+/// CHECK constraint guards against alpha values that would push the batch-size
+/// target past `log_max_batch_bytes`.
+#[test]
+fn batch_policy_check_rejects_unsafe_alpha() {
+    let db = crate::test_support::temp_db("unsafe-alpha");
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    // log_alpha=-350 → log_batch_size_target = 1403-(-350)-419 = 1334 >= log_max_batch_bytes=1333
+    let err = storage.conn.execute(
+        "UPDATE batch_policy SET log_alpha = ?1, log_one_plus_alpha = ?2 WHERE singleton_id = 0",
+        [-350_i64, 0_i64],
+    );
+    assert!(
+        err.is_err(),
+        "CHECK should reject unsafe alpha (log_batch_size_target >= log_max_batch_bytes)"
+    );
+}
+
+/// The seeded `log_slack` is the exponent nearest a tenfold price slack, as
+/// its schema comment says.
+#[test]
+fn seeded_log_slack_is_the_exponent_nearest_tenfold() {
+    use alloy_primitives::U256;
+    use sequencer_core::fee::fee_to_linear;
+
+    let db = crate::test_support::temp_db("seeded-log-slack");
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    let slack: u16 = storage
+        .conn
+        .query_row(
+            "SELECT log_slack FROM batch_policy WHERE singleton_id = 0",
+            [],
+            |row| row.get(0),
+        )
+        .expect("read seeded log_slack");
+    // Nearest in log space: r^(2·slack−1) <= 10² < r^(2·slack+1), r = 129/128.
+    // At this base the linear fees are about 3.3e13 units, so flooring is far
+    // below the margins.
+    let base = 4000;
+    let raised = fee_to_linear(base + slack);
+    let raised_squared = raised * raised;
+    let hundredfold_base_squared = fee_to_linear(base) * fee_to_linear(base) * U256::from(100u64);
+    assert!(raised_squared * U256::from(128u64) <= hundredfold_base_squared * U256::from(129u64));
+    assert!(hundredfold_base_squared * U256::from(128u64) < raised_squared * U256::from(129u64));
+}
+
+#[test]
+fn schema_rejects_safe_input_update_and_delete() {
+    let db = crate::test_support::temp_db("safe-inputs-append-only");
+    let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+    let inputs = vec![
+        StoredSafeInput {
+            sender: SENDER_B,
+            payload: vec![0x01],
+            block_number: 10,
+        },
+        StoredSafeInput {
+            sender: SENDER_B,
+            payload: vec![0x02],
+            block_number: 10,
+        },
+    ];
+    storage
+        .append_safe_inputs(10, inputs.as_slice(), SENDER_A, &default_protocol_timing())
+        .expect("seed safe inputs");
+
+    let update = storage
+        .conn
+        .execute(
+            "UPDATE safe_inputs SET payload = X'03' WHERE safe_input_index = 1",
+            [],
+        )
+        .expect_err("a stored input must not change");
+    assert!(
+        update.to_string().contains("safe inputs are immutable"),
+        "{update}"
+    );
+    // Index 0 is a hole below the head, which no production reader detects.
+    let delete = storage
+        .conn
+        .execute("DELETE FROM safe_inputs WHERE safe_input_index = 0", [])
+        .expect_err("a stored input must not disappear");
+    assert!(delete.to_string().contains("retained"), "{delete}");
+
+    assert_eq!(storage.safe_input_end_exclusive().expect("end"), 2);
+    assert_eq!(
+        storage
+            .safe_inputs_in_block_range(9, 10)
+            .expect("read back"),
+        inputs
+    );
+}
diff --git a/sequencer/src/storage/queries.rs b/sequencer/src/storage/queries.rs
index 04eddc09..5e3a0c14 100644
--- a/sequencer/src/storage/queries.rs
+++ b/sequencer/src/storage/queries.rs
@@ -1,21 +1,14 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Read-side helpers shared across writer-role files.
-//!
-//! These take a `&Connection` (or `&Transaction`, which derefs) rather than
-//! `&mut Storage`, so they can compose inside a larger transaction built by
-//! any writer role. Single-caller reads stay inline in the writer that owns
-//! them; only the reads reused by two or more roles live here.
+//! Read helpers shared by two or more writer roles. They take `&Connection` so
+//! they compose inside any writer's transaction; single-caller reads stay with the
+//! writer that owns them.
 
-#[cfg(test)]
-use alloy_primitives::Address;
 use rusqlite::{Connection, OptionalExtension, Result, Transaction, params};
 
 use super::convert::{from_unix_ms, i64_to_u16, i64_to_u32, i64_to_u64};
 use super::{BatchPolicy, WriteHead};
-#[cfg(test)]
-use sequencer_core::l2_tx::{DirectInput, SequencedL2Tx, ValidUserOp};
 
 // ── Write-head loading ───────────────────────────────────────────────────
 //
@@ -175,41 +168,77 @@ pub(super) fn query_batch_policy(conn: &Connection) -> Result<BatchPolicy> {
     })
 }
 
-// ── Ordered L2-tx row decoding ───────────────────────────────────────────
-//
-// Used by egress paging and the per-batch replay reader. Each caller builds
-// the row shape inside its own `query_map` closure and hands the fields to
-// this decoder rather than defining an intermediate struct.
-
 #[cfg(test)]
-pub(super) fn decode_l2_tx_row(
-    kind: i64,
-    sender: Option<Vec<u8>>,
-    data: Option<Vec<u8>>,
-    fee: Option<i64>,
-    payload: Option<Vec<u8>>,
-    block_number: Option<i64>,
-) -> SequencedL2Tx {
-    let sender_bytes = sender.expect("ordered replay row: missing sender");
-    assert_eq!(
-        sender_bytes.len(),
-        20,
-        "ordered replay row: sender must be 20 bytes"
-    );
-    if kind == 0 {
-        SequencedL2Tx::UserOp(ValidUserOp {
-            sender: Address::from_slice(sender_bytes.as_slice()),
-            // Replay uses the persisted frame fee (log-space exponent) to mirror canonical execution.
-            fee: i64_to_u16(fee.expect("ordered replay row: missing fee")),
-            data: data.expect("ordered replay row: missing data"),
-        })
-    } else {
-        SequencedL2Tx::Direct(DirectInput {
-            sender: Address::from_slice(sender_bytes.as_slice()),
-            block_number: i64_to_u64(
-                block_number.expect("ordered replay row: missing block_number"),
-            ),
-            payload: payload.expect("ordered replay row: missing payload"),
-        })
+mod tests {
+    use crate::storage::Storage;
+    use crate::test_support::temp_db;
+
+    #[test]
+    fn negative_batch_size_target_floors_to_zero() {
+        let db = temp_db("floor-batch-target");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+
+        // This row satisfies every schema constraint while deriving a negative
+        // target: 1403 - 2000 - 419 = -1016.
+        storage
+            .conn
+            .execute(
+                "UPDATE batch_policy SET log_alpha = 2000 WHERE singleton_id = 0",
+                [],
+            )
+            .expect("set high alpha");
+
+        let policy = storage.batch_policy().expect("read policy");
+        assert_eq!(
+            policy.batch_size_target, 0,
+            "negative batch-size target should be floored to zero"
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "batch policy derived recommended fee")]
+    fn negative_recommended_fee_fails_loud() {
+        let db = temp_db("negative-recommended-fee");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+
+        // A negative derived fee is ruled out by the column constraints. Model
+        // corruption/tampering that bypassed them and ensure the read cannot
+        // launder the impossible value into a plausible zero fee.
+        storage
+            .conn
+            .execute_batch(
+                "PRAGMA ignore_check_constraints = ON;
+                 UPDATE batch_policy SET log_delta = -10000 WHERE singleton_id = 0;",
+            )
+            .expect("inject impossible policy row");
+
+        let _ = storage.batch_policy();
+    }
+
+    #[test]
+    #[should_panic(expected = "batch policy derived batch size target")]
+    fn oversized_batch_size_target_fails_loud() {
+        let db = temp_db("oversized-batch-target");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+
+        // This is schema-valid: the derived target is 17984, which remains
+        // below the row's configured log_max_batch_bytes of 20000. It is still
+        // outside the core fee exponent domain and must not become u64::MAX.
+        storage
+            .conn
+            .execute(
+                "UPDATE batch_policy
+                 SET log_alpha = -17000, log_max_batch_bytes = 20000
+                 WHERE singleton_id = 0",
+                [],
+            )
+            .expect("set schema-valid oversized target");
+        let integrity: String = storage
+            .conn
+            .query_row("PRAGMA integrity_check", [], |row| row.get(0))
+            .expect("check database integrity");
+        assert_eq!(integrity, "ok");
+
+        let _ = storage.batch_policy();
     }
 }
diff --git a/sequencer/src/storage/recovery.rs b/sequencer/src/storage/recovery.rs
index 7d8d05de..c8589299 100644
--- a/sequencer/src/storage/recovery.rs
+++ b/sequencer/src/storage/recovery.rs
@@ -1,25 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Recovery storage: danger inspection, guarded suffix invalidation, and Tip creation.
-//!
-//! See `docs/recovery/README.md` for the procedure, safety arguments, and
-//! bounded model coverage. This file's job is to enforce that design
-//! locally — read the design first if you're touching this code.
-//!
-//! Free functions here are shared with the batch submitter
-//! (`l1_submission.rs`); they take `&Connection` / `&Transaction` so the
-//! startup path can compose them into one atomic transaction.
-//!
-//! ## Fault model
-//!
-//! Recovery is robust to submission and outage failures (crashes, network
-//! errors, mempool drops, extended downtime). It is NOT designed to defend
-//! against arbitrarily malformed self-submissions: the scheduler-frontier
-//! materialization in [`super::safe_accepted_batches`] trusts that on-chain
-//! batches from the sequencer's own address are structurally valid. The
-//! sequencer controls its own submissions; the threat model records that
-//! self-trust boundary.
+//! Recovery storage: danger inspection, guarded suffix invalidation, and Tip
+//! creation. `docs/recovery/README.md` owns the design; read it before editing.
+//! Helpers take `&Connection`/`&Transaction` so one startup transaction can
+//! compose inspection and repair.
 
 use rusqlite::{Connection, OptionalExtension, Result, Transaction, TransactionBehavior, params};
 use sequencer_core::protocol::{ProtocolTiming, age_exceeds};
@@ -34,52 +19,25 @@ use super::queries::{
 use super::safe_accepted_batches::{canonical_divergence_in, frontier_nonce};
 use super::snapshot_dumps::has_rollback_safe_snapshot_in;
 
-/// Outcome of a danger-zone check.
-///
-/// Each variant maps to a distinct response in the startup recovery procedure:
-///
-/// - `L1ViewStale` → retry boot. The L1 safe block is too old or unknown.
-/// - `ClosedBatchInDanger(closed_idx)` → Flush → Sync → Cascade.
-/// - `TipInDanger(tip_idx)` → direct Tip recovery, no flush. The Tip has no L1
-///   footprint, so we can invalidate it and open a fresh one without
-///   any L1 round-trip.
-/// - `EstimatedBatchInDanger(idx)` → retry boot. The observed safe block is
-///   still below the danger threshold, but wall-clock time since the last
-///   safe-head advance has consumed the batch's remaining runway.
-/// - `Safe` → admit when a Tip exists, otherwise run `EnsureOpenTip` and
-///   re-inspect.
-///
-/// The runtime danger detector treats every non-`Safe` variant as
-/// "exit for recovery" — the difference between them only matters at the
-/// next startup, where the dispatch differs.
+/// Outcome of [`Storage::check_danger`]. The runtime detector exits on any
+/// non-`Safe` variant; startup maps each variant to one action
+/// (`docs/recovery/README.md`, "Lifecycle and startup dispatch").
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum DangerStatus {
-    /// No danger detected — none of the checks tripped.
+    /// No check tripped.
     Safe,
-    /// A fully-accepted L1 landing failed the content-identity check:
-    /// canonical state contains executed effects with no
-    /// reliable local source. Carries the diverged batch nonce. Ranked
-    /// ahead of every other arm so the respawn loop can never route a
-    /// diverged node into a provider call, mutation, or admission. The remedy
-    /// is cockroach recovery (wipe + rebuild from L1), never standard recovery.
+    /// An accepted landing failed the content-identity check (I15); carries the
+    /// diverged batch nonce. Only cockroach recovery clears it.
     CanonicalDivergence(u64),
-    /// L1 safe-head timestamp is too old/unknown, or the current clock
-    /// predates one of the persisted safety baselines. Recovery cannot reason
-    /// from the local L1 view, so startup must retry.
+    /// The safe-block timestamp is missing or too old, or the local clock is a
+    /// block-time or more behind a persisted baseline.
     L1ViewStale,
-    /// Observed-safe check tripped on a *closed* batch past the
-    /// accepted frontier: aged beyond `protocol.danger_threshold()` against
-    /// the observed safe block. L1 view is fresh; flushing and cascading is
-    /// meaningful.
+    /// A closed batch past the accepted frontier is past the danger threshold at
+    /// the observed safe block.
     ClosedBatchInDanger(u64),
-    /// Observed-safe check tripped on the open *Tip*: aged beyond
-    /// `protocol.danger_threshold()` against the observed safe block, but
-    /// no closed batch is in danger. L1 view is fresh; the Tip has no L1
-    /// footprint, so direct recovery (no flush) is correct.
+    /// The open Tip is past the danger threshold and no closed batch is.
     TipInDanger(u64),
-    /// Batch-relative wall-clock estimate tripped after the global L1 view
-    /// freshness check passed. We refuse rather than recover because the batch
-    /// only crossed danger in estimated time, not observed safe-state.
+    /// A batch is past the threshold only by wall-clock estimate.
     EstimatedBatchInDanger(u64),
 }
 
@@ -112,9 +70,8 @@ pub(crate) enum RecoveryMutationError {
     },
     #[error("cannot open the Tip without a recovery checkpoint")]
     MissingRecoveryCheckpoint,
-    /// `EnsureOpenTip` found a valid open Tip already present. A
-    /// stale no-Tip decision, not a danger change; unreachable under the
-    /// process lock, and retryable if it ever fires.
+    /// `EnsureOpenTip` found a valid open Tip already present. Unreachable
+    /// under the process lock, so it refuses startup.
     #[error("the Tip was already open when the EnsureOpenTip phase ran")]
     TipAlreadyOpen,
     /// `EnsureOpenTip` left no valid open Tip after opening one. This broken
@@ -170,66 +127,10 @@ impl Storage {
         self.read(|tx| canonical_divergence_in(tx))
     }
 
-    /// Unified danger-zone detection.
-    ///
-    /// Runs checks inside a single read transaction, in priority order:
-    ///
-    /// 1. **Canonical divergence**: an already-confirmed mismatch is an
-    ///    absorbing terminal fact and outranks every view/clock condition.
-    /// 2. **L1 view freshness**: if the safe block timestamp is missing or
-    ///    older than `protocol.l1_read_stale_after_blocks`, return
-    ///    `L1ViewStale`. A stale L1 *view* is unusable even if the RPC
-    ///    answers — recovery itself needs a trustworthy view, so this gate
-    ///    stays ahead of everything.
-    /// 3. **Observed closed-frontier**: `find_closed_frontier_batch_in_danger`
-    ///    against `protocol.danger_threshold()`. Uses the observed safe block.
-    /// 4. **Observed open Tip**: `find_tip_batch_in_danger` against
-    ///    `protocol.danger_threshold()`. Catches the case where all closed
-    ///    batches are gold but the Tip is aging — the lane is stuck or the
-    ///    Tip rotated without a safe-block advance.
-    /// 5. **Clock faults**, deliberately after the observed arms: a local
-    ///    clock a full block-time or more out of step with either persisted
-    ///    baseline (behind the safe-block timestamp, or behind the local
-    ///    last-progress baseline) is a *clock* fault, not a view fault. The
-    ///    observed arms (3, 4) are pure block arithmetic, and a wall-clock
-    ///    fault must never suppress a danger verdict that stands on L1
-    ///    observation alone. Sub-block skew in either direction is
-    ///    quantization noise, not a fault.
-    /// 6. **Batch-relative wall-clock estimate**: if a correction applies
-    ///    ([`ProtocolTiming::wall_clock_adjusted_danger_threshold`] returns
-    ///    `Some`), widens to `find_first_batch_in_danger` against
-    ///    `danger_threshold − missed_blocks`. This is a fallback for when the
-    ///    observed safe block has not crossed danger yet, but wall-clock time
-    ///    since the last safe-head advance says the provider view is too stale
-    ///    to trust for continued soft confirmations.
-    ///
-    /// Returns the first variant that fires, in the order
-    /// `CanonicalDivergence` → `L1ViewStale` (stale view) →
-    /// `ClosedBatchInDanger` → `TipInDanger` → `L1ViewStale` (clock fault) →
-    /// `EstimatedBatchInDanger` → `Safe`. The order encodes the
-    /// "trust" hierarchy:
-    ///
-    /// - **View staleness gates everything after divergence.** If the safe
-    ///   block timestamp is too old or unknown, neither recovery nor
-    ///   continued soft confirmations are honest.
-    /// - **Clock faults yield to observed danger.** A local clock a full
-    ///   block-time or more out of step with either persisted baseline
-    ///   refuses only when no observed danger stands; sub-block skew is
-    ///   tolerated.
-    /// - **Closed observed danger beats Tip.** When a closed batch is in danger,
-    ///   we need a flush (to resolve its L1 transaction's fate) regardless
-    ///   of the Tip's state. The cascade naturally catches the Tip via
-    ///   `batch_index >= N`.
-    /// - **Tip is the residual.** Only fires when no closed batch is in
-    ///   danger. Routes to direct Tip recovery — no flush needed.
-    /// - **Estimated danger is the fallback.** If the observed safe-state checks have
-    ///   not crossed the threshold, but wall-clock extrapolation says they
-    ///   would have crossed had the safe head kept advancing, startup refuses
-    ///   instead of issuing soft confirmations on a stale L1 view.
-    ///
-    /// `now_ms` is passed in (rather than read from `SystemTime::now()` here)
-    /// so the storage layer stays testable without time mocking. Production
-    /// callers pass the current Unix-ms clock.
+    /// Classify danger in one read transaction. Arms fire in order: divergence,
+    /// stale view, closed batch, Tip, clock fault, estimate; the order is the
+    /// startup dispatch policy (I4; `docs/recovery/README.md`, "When safe-head
+    /// progress stops"). `now_ms` is injected so storage tests need no clock mock.
     pub fn check_danger(&mut self, protocol: &ProtocolTiming, now_ms: u64) -> Result<DangerStatus> {
         self.read(|tx| check_danger_in(tx, protocol, now_ms))
     }
@@ -336,38 +237,6 @@ impl Storage {
         tx.commit()?;
         Ok(invalidated)
     }
-
-    /// Mark a single batch as invalid. Test-only seeder — production code goes
-    /// through [`Storage::recover_post_flush_for_recovery`] or
-    /// [`Storage::recover_aging_tip_for_recovery`].
-    /// Idempotent: leaves already-invalid rows alone.
-    #[cfg(test)]
-    pub(crate) fn insert_invalid_batch(&mut self, batch_index: u64) -> Result<()> {
-        let now_ms = now_unix_ms();
-        self.conn.execute(
-            "UPDATE batches SET invalidated_at_ms = ?1 \
-             WHERE batch_index = ?2 AND invalidated_at_ms IS NULL",
-            params![now_ms, u64_to_i64(batch_index)],
-        )?;
-        Ok(())
-    }
-
-    /// Test-only unguarded Cascade primitive. Production calls
-    /// [`Storage::recover_post_flush_for_recovery`]; the design rationale
-    /// lives on [`recover_post_flush_inner`], the shared body.
-    #[cfg(test)]
-    pub fn recover_post_flush(&mut self, danger_threshold: u64) -> Result<Vec<u64>> {
-        self.write(|tx| recover_post_flush_inner(tx, danger_threshold))
-    }
-
-    /// Test-only unguarded primitive; production calls
-    /// [`Storage::recover_aging_tip_for_recovery`], which transactionally
-    /// reasserts the exact startup decision. Design rationale on
-    /// [`recover_aging_tip_inner`], the shared body.
-    #[cfg(test)]
-    pub fn recover_aging_tip(&mut self, danger_threshold: u64) -> Result<Vec<u64>> {
-        self.write(|tx| recover_aging_tip_inner(tx, danger_threshold))
-    }
 }
 
 pub(super) fn inspect_recovery_in(
@@ -433,7 +302,7 @@ fn refuse_divergence(danger: DangerStatus) -> std::result::Result<(), RecoveryMu
     Ok(())
 }
 
-// ── Free functions used by both recovery and the batch submitter ──────────
+// ── Repair bodies, pub(super) for storage::test_helpers ───────────────────
 
 /// Discard the entire non-accepted closed suffix after flush and caught-up Sync.
 /// This is a convergence policy: replaced or never-submitted work could be
@@ -446,7 +315,10 @@ fn refuse_divergence(danger: DangerStatus) -> std::result::Result<(), RecoveryMu
 /// has since crossed the danger threshold. Cascade and reopening share `tx`.
 ///
 /// Returns the newly-invalidated batch indices (empty if none).
-fn recover_post_flush_inner(tx: &Transaction<'_>, danger_threshold: u64) -> Result<Vec<u64>> {
+pub(super) fn recover_post_flush_inner(
+    tx: &Transaction<'_>,
+    danger_threshold: u64,
+) -> Result<Vec<u64>> {
     // Path 1: any closed batch past gold cascades unconditionally.
     let pivot = match first_non_gold_closed_batch(tx)? {
         Some(batch_index) => Some(batch_index),
@@ -464,7 +336,10 @@ fn recover_post_flush_inner(tx: &Transaction<'_>, danger_threshold: u64) -> Resu
 ///
 /// Returns the newly-invalidated batch indices (empty if Tip is fresh,
 /// `[tip_index]` when the Tip was cascaded).
-fn recover_aging_tip_inner(tx: &Transaction<'_>, danger_threshold: u64) -> Result<Vec<u64>> {
+pub(super) fn recover_aging_tip_inner(
+    tx: &Transaction<'_>,
+    danger_threshold: u64,
+) -> Result<Vec<u64>> {
     let pivot = find_tip_batch_in_danger(tx, danger_threshold)?;
     cascade_and_reopen(tx, pivot)
 }
@@ -532,7 +407,7 @@ fn first_non_gold_closed_batch(conn: &Connection) -> Result<Option<u64>> {
 /// spine, so an existing closed frontier is at least as old as the Tip.
 ///
 /// Reads `safe_accepted_batches`, which is maintained atomically with each
-/// [`Storage::append_safe_inputs`] call.
+/// `Storage::append_ingested_safe_inputs_with_timestamp` call.
 pub(super) fn find_first_batch_in_danger(conn: &Connection, threshold: u64) -> Result<Option<u64>> {
     if let Some(batch_index) = find_closed_frontier_batch_in_danger(conn, threshold)? {
         return Ok(Some(batch_index));
@@ -639,5 +514,4 @@ fn has_valid_open_batch(tx: &Connection) -> Result<bool> {
 }
 
 #[cfg(test)]
-#[path = "recovery_tests.rs"]
 mod tests;
diff --git a/sequencer/src/storage/recovery_tests.rs b/sequencer/src/storage/recovery/tests.rs
similarity index 56%
rename from sequencer/src/storage/recovery_tests.rs
rename to sequencer/src/storage/recovery/tests.rs
index 30fc2687..a09f14c0 100644
--- a/sequencer/src/storage/recovery_tests.rs
+++ b/sequencer/src/storage/recovery/tests.rs
@@ -1,12 +1,13 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
 use super::super::test_helpers::{
-    SENDER_A, all_ordered_l2_txs, default_protocol_timing, local_batch_payload,
-    make_stale_batch_payload, seed_closed_batches, seed_safe_inputs_with_batch_nonces,
-    temp_db_with_default_deployment_identity as temp_db,
+    RecoveryFixture, SENDER_A, all_ordered_l2_txs, default_protocol_timing, local_batch_payload,
+    make_stale_batch_payload, open_temp_storage, seed_closed_batches,
+    seed_safe_inputs_with_batch_nonces,
 };
 use super::{find_closed_frontier_batch_in_danger, find_first_batch_in_danger};
-use crate::storage::{
-    DirectInputExecution, ExecutedInputCount, SafeInputRange, Storage, StoredSafeInput,
-};
+use crate::storage::{DirectInputExecution, ExecutedInputCount, SafeInputRange, Storage};
 use alloy_primitives::Address;
 use sequencer_core::l2_tx::SequencedL2Tx;
 use sequencer_core::protocol::ProtocolTiming;
@@ -22,39 +23,6 @@ fn generation_cuts(storage: &Storage) -> Vec<(i64, i64)> {
         .unwrap()
 }
 
-/// Exercise the same frame-advance-before-close sequence as the live lane.
-trait RecoveryFixture {
-    fn close_batch_at(
-        &mut self,
-        head: &mut crate::storage::WriteHead,
-        safe_block: u64,
-    ) -> rusqlite::Result<()>;
-}
-impl RecoveryFixture for Storage {
-    fn close_batch_at(
-        &mut self,
-        head: &mut crate::storage::WriteHead,
-        safe_block: u64,
-    ) -> rusqlite::Result<()> {
-        if head.safe_block != safe_block {
-            let start = self.next_undrained_safe_input_index()?;
-            let end: i64 = self.read(|tx| {
-                tx.query_row(
-                    "SELECT COUNT(*) FROM safe_inputs WHERE block_number <= ?1",
-                    [i64::try_from(safe_block).unwrap()],
-                    |r| r.get(0),
-                )
-            })?;
-            self.close_frame_only(
-                head,
-                safe_block,
-                SafeInputRange::new(start, u64::try_from(end).unwrap()),
-            )?;
-        }
-        self.close_frame_and_batch(head, safe_block)
-    }
-}
-
 mod guarded_phases {
     use super::*;
     use crate::storage::RecoveryMutationError;
@@ -82,13 +50,8 @@ mod guarded_phases {
     fn ensure_tip_fixture(
         name: &str,
         with_recovery_checkpoint: bool,
-    ) -> (
-        crate::storage::test_helpers::TestDb,
-        Storage,
-        ProtocolTiming,
-    ) {
-        let db = temp_db(name);
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+    ) -> (crate::test_support::TestDb, Storage, ProtocolTiming) {
+        let (db, mut storage) = open_temp_storage(name);
         let protocol = default_protocol_timing();
         let now_ms = crate::clock::unix_now_ms();
         storage
@@ -164,7 +127,7 @@ mod guarded_phases {
 
         let error = storage
             .ensure_open_tip_for_recovery(&protocol, crate::clock::unix_now_ms())
-            .expect_err("stale no-Tip decision must be rejected");
+            .expect_err("an unexpected open Tip must be rejected");
         assert!(matches!(error, RecoveryMutationError::TipAlreadyOpen));
         assert_eq!(open_tip_count(&storage), 1);
     }
@@ -211,9 +174,8 @@ mod guarded_phases {
         assert_eq!(batches, 0, "the refused phase must roll back its insert");
     }
 
-    fn cascade_fixture(name: &str) -> (crate::storage::test_helpers::TestDb, Storage) {
-        let db = temp_db(name);
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+    fn cascade_fixture(name: &str) -> (crate::test_support::TestDb, Storage) {
+        let (db, mut storage) = open_temp_storage(name);
         let protocol = default_protocol_timing();
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -293,8 +255,7 @@ mod guarded_phases {
 
     #[test]
     fn tip_guard_reasserts_the_exact_reducer_decision() {
-        let db = temp_db("guarded-tip-decision");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (db, mut storage) = open_temp_storage("guarded-tip-decision");
         let protocol = default_protocol_timing();
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -329,8 +290,7 @@ mod guarded_phases {
 
     #[test]
     fn tip_guard_refuses_missing_snapshot_without_tree_mutation() {
-        let db = temp_db("guarded-tip-no-snapshot");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("guarded-tip-no-snapshot");
         let protocol = default_protocol_timing();
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -364,8 +324,7 @@ mod invalid_batches {
 
     #[test]
     fn invalid_batches_excluded_from_latest_batch_index() {
-        let db = temp_db("invalid-latest-batch");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("invalid-latest-batch");
         seed_closed_batches(&mut storage, 3);
         assert_eq!(
             storage.latest_batch_index().expect("latest").unwrap(),
@@ -382,25 +341,12 @@ mod invalid_batches {
 
     #[test]
     fn invalid_batches_excluded_from_ordered_l2_txs() {
-        let db = temp_db("invalid-ordered-txs");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("invalid-ordered-txs");
 
         let mut head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .expect("initialize");
-        let directs_0 = vec![StoredSafeInput {
-            sender: Address::ZERO,
-            payload: vec![0xaa],
-            block_number: 10,
-        }];
-        storage
-            .append_safe_inputs(
-                10,
-                directs_0.as_slice(),
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append");
+        storage.land(10, &[(Address::ZERO, vec![0xaa])]);
         storage
             .close_frame_only(&mut head, 10, SafeInputRange::new(0, 1))
             .expect("close frame");
@@ -408,19 +354,7 @@ mod invalid_batches {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0");
 
-        let directs_1 = vec![StoredSafeInput {
-            sender: Address::ZERO,
-            payload: vec![0xbb],
-            block_number: 20,
-        }];
-        storage
-            .append_safe_inputs(
-                20,
-                directs_1.as_slice(),
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append");
+        storage.land(20, &[(Address::ZERO, vec![0xbb])]);
         storage
             .close_frame_only(&mut head, 20, SafeInputRange::new(1, 2))
             .expect("close frame");
@@ -442,20 +376,12 @@ mod invalid_batches {
 
     #[test]
     fn invalid_batches_excluded_from_ordered_l2_txs_for_batch() {
-        let db = temp_db("invalid-ordered-for-batch");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("invalid-ordered-for-batch");
 
         let mut head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .expect("initialize");
-        let directs = vec![StoredSafeInput {
-            sender: Address::ZERO,
-            payload: vec![0xaa],
-            block_number: 10,
-        }];
-        storage
-            .append_safe_inputs(10, directs.as_slice(), SENDER_A, &default_protocol_timing())
-            .expect("append");
+        storage.land(10, &[(Address::ZERO, vec![0xaa])]);
         storage
             .close_frame_only(&mut head, 10, SafeInputRange::new(0, 1))
             .expect("close frame");
@@ -475,27 +401,15 @@ mod invalid_batches {
 
     #[test]
     fn invalid_batches_excluded_from_drained_direct_count() {
-        let db = temp_db("invalid-drained-count");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("invalid-drained-count");
 
         let mut head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .expect("initialize");
-        let directs = vec![
-            StoredSafeInput {
-                sender: Address::ZERO,
-                payload: vec![0xaa],
-                block_number: 10,
-            },
-            StoredSafeInput {
-                sender: Address::ZERO,
-                payload: vec![0xbb],
-                block_number: 10,
-            },
-        ];
-        storage
-            .append_safe_inputs(10, directs.as_slice(), SENDER_A, &default_protocol_timing())
-            .expect("append");
+        storage.land(
+            10,
+            &[(Address::ZERO, vec![0xaa]), (Address::ZERO, vec![0xbb])],
+        );
         storage
             .close_frame_only(&mut head, 10, SafeInputRange::new(0, 2))
             .expect("close frame");
@@ -527,8 +441,7 @@ mod recover_post_flush {
 
     #[test]
     fn cascades_from_stale() {
-        let db = temp_db("detect-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-stale");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -537,19 +450,7 @@ mod recover_post_flush {
             storage.close_batch_at(&mut head, 10).expect("close batch");
         }
 
-        let batch_submitter = Address::repeat_byte(0xAA);
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let invalidated = storage
             .recover_post_flush(1200)
             .expect("detect and recover");
@@ -562,8 +463,7 @@ mod recover_post_flush {
 
     #[test]
     fn is_idempotent() {
-        let db = temp_db("detect-idempotent");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-idempotent");
         let initial_history = storage.history_state().expect("initial history");
         assert_eq!(initial_history.version.recovery_generation.get(), 0);
 
@@ -572,19 +472,7 @@ mod recover_post_flush {
             .expect("initialize");
         storage.close_batch_at(&mut head, 10).expect("close batch");
 
-        let batch_submitter = Address::repeat_byte(0xAA);
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let first = storage.recover_post_flush(1200).expect("first detect");
         assert_eq!(first, vec![0, 1]);
         assert_eq!(
@@ -640,8 +528,7 @@ mod recover_post_flush {
         // is gold and a fresh `recover_post_flush` call should be a no-op —
         // the stale ancestor's safe-input must not false-match the
         // nonce-reused gen-2 batch.
-        let db = temp_db("post-flush-no-op-after-fresh-gen2");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("post-flush-no-op-after-fresh-gen2");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -650,19 +537,7 @@ mod recover_post_flush {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0");
 
-        let batch_submitter = Address::repeat_byte(0xAA);
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append stale safe input");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         // Gen 1 cascade. Stale batch 0 + open Tip 1 invalidated; recovery
         // batch 2 opened with nonce reused (= 0).
         let first = storage.recover_post_flush(1200).expect("gen1 recovery");
@@ -683,18 +558,7 @@ mod recover_post_flush {
             .close_batch_at(&mut head, 1300)
             .expect("close recovery batch");
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                1310,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 1310,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append fresh safe input for recovery batch");
+        storage.land(1310, &[(SENDER_A, landed)]); // append fresh safe input for recovery batch
 
         // populate_safe_accepted_batches accepts the gen-2 batch (nonce 0 at
         // first_frame=1300, inclusion=1310 → inclusion-staleness 10 < MAX_WAIT).
@@ -711,8 +575,7 @@ mod recover_post_flush {
 
     #[test]
     fn detects_stale_reused_nonce_in_new_generation() {
-        let db = temp_db("detect-reused-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-reused-stale");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -721,19 +584,8 @@ mod recover_post_flush {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0");
 
-        let batch_submitter = Address::repeat_byte(0xAA);
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append gen1 stale safe input");
+        // Append gen1 stale safe input.
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let first = storage.recover_post_flush(1200).expect("gen1 recovery");
         assert_eq!(first, vec![0, 1]);
 
@@ -742,18 +594,8 @@ mod recover_post_flush {
             .close_batch_at(&mut head, 1210)
             .expect("close gen2 batch");
 
-        storage
-            .append_safe_inputs(
-                2410,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 1210),
-                    block_number: 2410,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append gen2 stale safe input");
+        // Append gen2 stale safe input.
+        storage.land(2410, &[(SENDER_A, make_stale_batch_payload(0, 1210))]);
         let second = storage.recover_post_flush(1200).expect("gen2 recovery");
         assert_eq!(
             second,
@@ -784,8 +626,7 @@ mod recover_post_flush {
         // batch; on no closed pivot it became a no-op, leaving the stale Tip
         // for the next danger trip to catch. Fix: fall through to a Tip
         // check against `danger_threshold` and cascade the Tip directly.
-        let db = temp_db("post-flush-tip-no-pivot");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("post-flush-tip-no-pivot");
 
         // S_closed = S_tip = 10 (lane rotated without a safe-block advance).
         let mut head = storage
@@ -795,27 +636,13 @@ mod recover_post_flush {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0; open Tip with same safe_block=10");
 
-        let batch_submitter = Address::repeat_byte(0xAA);
         // Closed batch 0 landed fresh: inclusion_block=200 → inclusion-staleness 190
         // is well below MAX_WAIT, so populate accepts it as gold.
         // Then advance safe head to 1100: batch 0 age (gold) is irrelevant,
         // but Tip's age = 1100 - 10 = 1090 > danger_threshold (let's pass 1000).
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                200,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 200,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append fresh safe input — batch 0 becomes gold");
-        storage
-            .append_safe_inputs(1100, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past Tip's danger threshold");
+        storage.land(200, &[(SENDER_A, landed)]); // append fresh safe input — batch 0 becomes gold
+        storage.advance_safe_head(1100); // advance safe head past Tip's danger threshold
 
         // Sanity: no closed batch is past gold (all gold).
         assert_eq!(
@@ -844,8 +671,7 @@ mod recover_post_flush {
     fn no_op_when_tip_age_below_danger_threshold() {
         // Negative companion to the above: closed batch is gold, Tip exists,
         // but Tip's age is below `danger_threshold`. Cascade must not fire.
-        let db = temp_db("post-flush-tip-below-danger");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("post-flush-tip-below-danger");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -854,24 +680,10 @@ mod recover_post_flush {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0");
 
-        let batch_submitter = Address::repeat_byte(0xAA);
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                200,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 200,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append fresh safe input — batch 0 becomes gold");
+        storage.land(200, &[(SENDER_A, landed)]); // append fresh safe input — batch 0 becomes gold
         // current=500: Tip's age = 490, below threshold 1000.
-        storage
-            .append_safe_inputs(500, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head, but not past danger threshold");
+        storage.advance_safe_head(500); // advance safe head, but not past danger threshold
 
         let invalidated = storage
             .recover_post_flush(1000)
@@ -894,7 +706,7 @@ mod tip_staleness {
     //
     // `recover_aging_tip` backs the RecoverTip startup action: all closed
     // batches are outside the danger zone, but the open Tip has aged past the
-    // configured threshold. The Tip has no L1 footprint (no `w_nonce`, no
+    // configured threshold. The Tip has no L1 footprint (no wallet nonce, no
     // `safe_input`), so it can be invalidated directly without a flush.
     //
     // The first four tests cover that path:
@@ -910,10 +722,10 @@ mod tip_staleness {
     #[test]
     fn open_batch_stale_by_current_safe_block_is_invalidated() {
         // Scenario: sequencer opened batch 0 at safe_block=10, never closed it,
-        // then stayed down until safe advanced to 1500 (>1200 past safe_block).
+        // then stayed down until safe advanced to 1500 (>= the 1200-block threshold
+        // past safe_block).
         // Recovery must invalidate the open batch.
-        let db = temp_db("open-batch-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("open-batch-stale");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -921,9 +733,7 @@ mod tip_staleness {
 
         // Advance the safe head so the open batch's first frame (safe_block=10)
         // is now stale: 1500 - 10 >= 1200.
-        storage
-            .append_safe_inputs(1500, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past MAX_WAIT_BLOCKS");
+        storage.advance_safe_head(1500); // advance safe head past the 1200-block danger threshold
 
         let invalidated = storage
             .recover_aging_tip(1200)
@@ -954,16 +764,13 @@ mod tip_staleness {
         // Negative: open batch's first frame safe_block=10 with current safe=1100.
         // 1100 - 10 = 1090 < 1200. Must NOT cascade.
         // Catches false-positive regressions in `recover_aging_tip`.
-        let db = temp_db("open-batch-fresh");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("open-batch-fresh");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize open state at safe_block=10");
 
-        storage
-            .append_safe_inputs(1100, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head below threshold");
+        storage.advance_safe_head(1100); // advance safe head below threshold
 
         let invalidated = storage
             .recover_aging_tip(1200)
@@ -983,18 +790,15 @@ mod tip_staleness {
 
     #[test]
     fn open_batch_exactly_at_threshold_is_invalidated() {
-        // Boundary: 1210 - 10 = 1200, which is >= MAX_WAIT_BLOCKS.
+        // Boundary: 1210 - 10 = 1200, which is >= the danger_threshold argument (1200).
         // The staleness comparison is `>=`, so this must invalidate.
-        let db = temp_db("open-batch-boundary");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("open-batch-boundary");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize");
 
-        storage
-            .append_safe_inputs(1210, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head to exact threshold");
+        storage.advance_safe_head(1210); // advance safe head to exact threshold
 
         let invalidated = storage.recover_aging_tip(1200).expect("recover");
         assert_eq!(invalidated, vec![0], "boundary (>= threshold) invalidates");
@@ -1003,16 +807,13 @@ mod tip_staleness {
     #[test]
     fn open_batch_one_block_below_threshold_is_not_invalidated() {
         // Boundary: 1209 - 10 = 1199 < 1200. One-block margin must NOT invalidate.
-        let db = temp_db("open-batch-below-boundary");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("open-batch-below-boundary");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize");
 
-        storage
-            .append_safe_inputs(1209, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head to one block below threshold");
+        storage.advance_safe_head(1209); // advance safe head to one block below threshold
 
         let invalidated = storage.recover_aging_tip(1200).expect("recover");
         assert!(
@@ -1027,8 +828,7 @@ mod tip_staleness {
         // (safe_accepted_batches is empty). Batch 1 is open and also stale.
         // `find_first_batch_in_danger` should return closed batch 0 at the
         // frontier (nonce 0, no acceptance yet) and cascade through batch 1.
-        let db = temp_db("closed-unsubmitted-and-open-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("closed-unsubmitted-and-open-stale");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1038,9 +838,7 @@ mod tip_staleness {
             .expect("close batch 0");
 
         // Advance safe head so batch 0's first frame (safe_block=10) is stale.
-        storage
-            .append_safe_inputs(1500, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past staleness");
+        storage.advance_safe_head(1500); // advance safe head past staleness
 
         let invalidated = storage.recover_post_flush(1200).expect("recover");
         assert_eq!(
@@ -1052,8 +850,7 @@ mod tip_staleness {
 
     #[test]
     fn opens_batch_after_torn_invalidation() {
-        let db = temp_db("detect-torn");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-torn");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1064,9 +861,7 @@ mod tip_staleness {
 
         storage.insert_invalid_batch(0).expect("invalidate 0");
         storage.insert_invalid_batch(1).expect("invalidate 1");
-        storage
-            .append_safe_inputs(10, &[], SENDER_A, &default_protocol_timing())
-            .expect("record observed safe head");
+        storage.advance_safe_head(10); // record observed safe head
 
         let invalidated = storage
             .recover_post_flush(1200)
@@ -1091,8 +886,7 @@ mod tip_staleness {
 
     #[test]
     fn rolls_back_when_cascade_update_aborts() {
-        let db = temp_db("detect-cascade-abort");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (db, mut storage) = open_temp_storage("detect-cascade-abort");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1102,9 +896,7 @@ mod tip_staleness {
             .expect("close batch 0");
 
         // Advance safe head so batch 0's first frame (safe_block=10) is stale.
-        storage
-            .append_safe_inputs(1500, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past staleness");
+        storage.advance_safe_head(1500); // advance safe head past staleness
 
         storage
             .conn
@@ -1162,24 +954,12 @@ mod tip_staleness {
 
     #[test]
     fn rolls_back_generation_and_invalidation_when_tip_reopen_aborts() {
-        let db = temp_db("detect-tip-reopen-abort");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-tip-reopen-abort");
 
         let mut head = storage
             .initialize_open_state(0, SafeInputRange::empty_at(0))
             .expect("initialize");
-        storage
-            .append_safe_inputs(
-                10,
-                &[StoredSafeInput {
-                    sender: Address::ZERO,
-                    payload: vec![0xd1],
-                    block_number: 10,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append mapped direct");
+        storage.land(10, &[(Address::ZERO, vec![0xd1])]); // append mapped direct
         storage
             .close_frame_only_with_executions(
                 &mut head,
@@ -1200,9 +980,7 @@ mod tip_staleness {
                 .expect("pre-recovery history head"),
             ExecutedInputCount::new(1)
         );
-        storage
-            .append_safe_inputs(1500, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past staleness");
+        storage.advance_safe_head(1500); // advance safe head past staleness
 
         storage
             .conn
@@ -1279,32 +1057,15 @@ mod tip_staleness {
 
     #[test]
     fn recovery_redrains_direct_inputs_and_replay_sees_them_once() {
-        let db = temp_db("recovery-redrain-e2e");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("recovery-redrain-e2e");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize");
-        let deposits = vec![
-            StoredSafeInput {
-                sender: Address::ZERO,
-                payload: vec![0xd1],
-                block_number: 10,
-            },
-            StoredSafeInput {
-                sender: Address::ZERO,
-                payload: vec![0xd2],
-                block_number: 10,
-            },
-        ];
-        storage
-            .append_safe_inputs(
-                10,
-                deposits.as_slice(),
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append deposits");
+        storage.land(
+            10,
+            &[(Address::ZERO, vec![0xd1]), (Address::ZERO, vec![0xd2])],
+        ); // two deposits
         storage
             .close_frame_only(&mut head, 10, SafeInputRange::new(0, 2))
             .expect("close frame with deposits");
@@ -1316,18 +1077,7 @@ mod tip_staleness {
         assert_eq!(before.len(), 2, "both deposits should be visible");
 
         let batch_submitter = Address::repeat_byte(0xAA);
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append stale batch submission");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let invalidated = storage
             .recover_post_flush(1200)
             .expect("detect and recover");
@@ -1376,10 +1126,10 @@ mod tip_staleness {
     fn undrained_safe_input_appears_in_recovery_batch_first_frame() {
         // a deposit ingested into safe_inputs but not yet drained
         // into any frame must be sequenced into the recovery batch's first
-        // frame after cascade. Complements  (re-drain from
+        // frame after cascade. Complements
+        // `recovery_redrains_direct_inputs_and_replay_sees_them_once` (re-drain from
         // invalidated) with the never-drained case.
-        let db = temp_db("recovery-includes-undrained");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("recovery-includes-undrained");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1389,18 +1139,7 @@ mod tip_staleness {
             .expect("close batch 0 with no deposits");
 
         let non_submitter = Address::repeat_byte(0xCC);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: non_submitter,
-                    payload: vec![0xde, 0xad],
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append undrained deposit");
+        storage.land(20, &[(non_submitter, vec![0xde, 0xad])]); // append undrained deposit
         let before = all_ordered_l2_txs(&mut storage);
         assert!(
             before.iter().all(|tx| !matches!(
@@ -1410,19 +1149,7 @@ mod tip_staleness {
             "undrained deposit must not be sequenced before drain",
         );
 
-        let batch_submitter = SENDER_A;
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append stale batch submission");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let invalidated = storage.recover_post_flush(1200).expect("recover");
         assert!(!invalidated.is_empty(), "stale batch must cascade");
 
@@ -1450,8 +1177,7 @@ mod tip_staleness {
         // inputs → recovery batch opens with an empty first frame (aside
         // from the batch-submitter's own self-submission, which is drained
         // but carries no user-visible payload).
-        let db = temp_db("recovery-empty-first-frame");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("recovery-empty-first-frame");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1461,18 +1187,7 @@ mod tip_staleness {
             .expect("close batch 0");
 
         let batch_submitter = SENDER_A;
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append stale batch submission");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let invalidated = storage.recover_post_flush(1200).expect("recover");
         assert_eq!(invalidated, vec![0, 1]);
 
@@ -1498,8 +1213,7 @@ mod tip_staleness {
         // first-ever batch (nonce 0) goes stale before reaching
         // Gold. Cascade invalidates it; recovery opens a fresh batch that
         // reuses nonce 0 (no valid ancestor exists to advance the nonce).
-        let db = temp_db("first-batch-stale-nonce-zero");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (db, mut storage) = open_temp_storage("first-batch-stale-nonce-zero");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1508,19 +1222,7 @@ mod tip_staleness {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0 (nonce 0)");
 
-        let batch_submitter = SENDER_A;
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append stale batch submission");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let invalidated = storage.recover_post_flush(1200).expect("recover");
         assert_eq!(
             invalidated,
@@ -1570,8 +1272,7 @@ mod tip_staleness {
         // Distinct from `is_idempotent` (idempotent back-to-back call on the
         // same Storage handle): this test drops and reopens Storage to model
         // a full restart over the persisted DB.
-        let db = temp_db("post-recovery-crash-idempotent");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (db, mut storage) = open_temp_storage("post-recovery-crash-idempotent");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1580,19 +1281,7 @@ mod tip_staleness {
             .close_batch_at(&mut head, 10)
             .expect("close batch 0");
 
-        let batch_submitter = SENDER_A;
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append stale submission");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         // First call: full recovery runs to completion and opens a new Tip.
         let invalidated = storage.recover_post_flush(1200).expect("recover");
         assert_eq!(invalidated, vec![0, 1]);
@@ -1639,9 +1328,7 @@ mod check_danger_zone {
         // `check_danger_zone` must return None: no unresolved batch is in
         // danger. Gold batches (accepted past the frontier) never participate,
         // and the open tip isn't old enough to trip the threshold.
-        let db = temp_db("danger-zone-gold");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let batch_submitter = Address::repeat_byte(0xAA);
+        let (_db, mut storage) = open_temp_storage("danger-zone-gold");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1651,24 +1338,11 @@ mod check_danger_zone {
             .expect("close batch 0");
 
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
+        storage.land(20, &[(SENDER_A, landed)]);
         // Advance to a current safe block where batch 0 (safe_block=10) is
         // past threshold (1200-10=1190>=1125) but batch 1 (safe_block=100)
         // is still fresh (1200-100=1100<1125).
-        storage
-            .append_safe_inputs(1200, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe block");
+        storage.advance_safe_head(1200); // advance safe block
 
         let result =
             find_closed_frontier_batch_in_danger(&storage.conn, 1125).expect("check danger zone");
@@ -1688,16 +1362,13 @@ mod check_danger_zone {
         //
         // Scenario: only an open batch exists, aged past the danger
         // threshold. `check_danger_zone` returns None.
-        let db = temp_db("danger-zone-open-no-zombie");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("danger-zone-open-no-zombie");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize open batch at safe_block=10");
 
-        storage
-            .append_safe_inputs(1200, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past danger threshold");
+        storage.advance_safe_head(1200); // advance safe head past danger threshold
 
         let result =
             find_closed_frontier_batch_in_danger(&storage.conn, 1125).expect("check danger zone");
@@ -1720,16 +1391,13 @@ mod check_any_unresolved {
         // fallback relies on — if L1 is unreachable and an open batch may be
         // past the threshold, refuse to boot rather than accept user ops
         // into a batch that can't land.
-        let db = temp_db("any-unresolved-open-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("any-unresolved-open-stale");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize open batch at safe_block=10");
 
-        storage
-            .append_safe_inputs(1200, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head past threshold");
+        storage.advance_safe_head(1200); // advance safe head past threshold
 
         let result = find_first_batch_in_danger(&storage.conn, 1125)
             .expect("check any unresolved in danger");
@@ -1744,16 +1412,13 @@ mod check_any_unresolved {
     fn check_any_unresolved_does_not_flag_fresh_open_batch() {
         // Negative counterpart. Fresh open batch below threshold must not
         // trigger false positives in the unified check.
-        let db = temp_db("any-unresolved-open-fresh");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("any-unresolved-open-fresh");
 
         storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize open batch at safe_block=10");
 
-        storage
-            .append_safe_inputs(1100, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head below threshold");
+        storage.advance_safe_head(1100); // advance safe head below threshold
 
         let result = find_first_batch_in_danger(&storage.conn, 1125)
             .expect("check any unresolved in danger");
@@ -1765,9 +1430,7 @@ mod check_any_unresolved {
 
     #[test]
     fn check_danger_zone_triggers_on_frontier_batch() {
-        let db = temp_db("danger-zone-frontier");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let batch_submitter = Address::repeat_byte(0xAA);
+        let (_db, mut storage) = open_temp_storage("danger-zone-frontier");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1780,21 +1443,8 @@ mod check_any_unresolved {
             .expect("close batch 1");
 
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
-        storage
-            .append_safe_inputs(1200, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe block");
+        storage.land(20, &[(SENDER_A, landed)]);
+        storage.advance_safe_head(1200); // advance safe block
 
         let result =
             find_closed_frontier_batch_in_danger(&storage.conn, 1125).expect("check danger zone");
@@ -1803,9 +1453,7 @@ mod check_any_unresolved {
 
     #[test]
     fn check_danger_zone_does_not_trigger_below_threshold() {
-        let db = temp_db("danger-zone-below");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let batch_submitter = Address::repeat_byte(0xAA);
+        let (_db, mut storage) = open_temp_storage("danger-zone-below");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1818,21 +1466,8 @@ mod check_any_unresolved {
             .expect("close batch 1");
 
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
-        storage
-            .append_safe_inputs(1134, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe block");
+        storage.land(20, &[(SENDER_A, landed)]);
+        storage.advance_safe_head(1134); // advance safe block
 
         let result =
             find_closed_frontier_batch_in_danger(&storage.conn, 1125).expect("check danger zone");
@@ -1850,8 +1485,7 @@ mod check_any_unresolved {
         // pending-snapshot clear keys on the pivot's nonce. Both existing
         // find_*_in_danger tests use open-batch-only scenarios; the closed-over-Tip
         // preference (the helper's whole point) was unasserted.
-        let db = temp_db("danger-prefers-closed-frontier");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("danger-prefers-closed-frontier");
 
         // batch 0 (frame sb 10) → made gold below; batch 1 (frame sb 50) → the
         // closed frontier; batch 2 (Tip, frame sb 50) → open at the same safe
@@ -1868,18 +1502,7 @@ mod check_any_unresolved {
 
         // Make batch 0 gold: land its genuine bytes (accepted) → frontier → nonce 1.
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("land batch 0");
+        storage.land(20, &[(SENDER_A, landed)]); // land batch 0
         assert_eq!(
             storage
                 .submitter_frontier()
@@ -1891,9 +1514,7 @@ mod check_any_unresolved {
 
         // Advance the safe head so both batch 1 and the Tip (both sb 50) are aged:
         // 1200 - 50 = 1150 >= threshold 1125.
-        storage
-            .append_safe_inputs(1200, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance safe head");
+        storage.advance_safe_head(1200);
 
         let result = find_first_batch_in_danger(&storage.conn, 1125).expect("find first in danger");
         assert_eq!(
@@ -1911,26 +1532,14 @@ mod boundary {
 
     #[test]
     fn boundary_exactly_max_wait_is_stale() {
-        let db = temp_db("detect-boundary-exact");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-boundary-exact");
 
         let mut head = storage
             .initialize_open_state(100, SafeInputRange::empty_at(0))
             .expect("initialize");
         storage.close_batch_at(&mut head, 100).expect("close batch");
 
-        storage
-            .append_safe_inputs(
-                1300,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 100),
-                    block_number: 1300,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
+        storage.land(1300, &[(SENDER_A, make_stale_batch_payload(0, 100))]);
         let invalidated = storage.recover_post_flush(1200).expect("detect");
         assert_eq!(invalidated, vec![0, 1], "exactly at max_wait must be stale");
         assert_eq!(storage.open_state().expect("load").unwrap().batch_index, 2);
@@ -1938,8 +1547,7 @@ mod boundary {
 
     #[test]
     fn boundary_one_below_max_wait_is_not_stale() {
-        let db = temp_db("detect-boundary-one-below");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-boundary-one-below");
 
         let mut head = storage
             .initialize_open_state(100, SafeInputRange::empty_at(0))
@@ -1947,18 +1555,7 @@ mod boundary {
         storage.close_batch_at(&mut head, 100).expect("close batch");
 
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                1299,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 1299,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append safe input");
+        storage.land(1299, &[(SENDER_A, landed)]);
         let invalidated = storage.recover_post_flush(1200).expect("detect");
         assert!(
             invalidated.is_empty(),
@@ -1968,8 +1565,7 @@ mod boundary {
 
     #[test]
     fn all_batches_invalidated_frontier_zero() {
-        let db = temp_db("detect-frontier-zero");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-frontier-zero");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -1978,18 +1574,7 @@ mod boundary {
             storage.close_batch_at(&mut head, 10).expect("close");
         }
 
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let inv = storage.recover_post_flush(1200).expect("detect");
         assert_eq!(inv, vec![0, 1, 2, 3]);
         assert!(storage.open_state().expect("open").is_some());
@@ -1997,26 +1582,14 @@ mod boundary {
 
     #[test]
     fn recovery_batch_itself_becomes_stale() {
-        let db = temp_db("detect-recovery-stale");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-recovery-stale");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize");
         storage.close_batch_at(&mut head, 10).expect("close");
 
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append gen1");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]); // append gen1
         let inv1 = storage.recover_post_flush(1200).expect("recover gen1");
         assert_eq!(inv1, vec![0, 1]);
 
@@ -2025,18 +1598,7 @@ mod boundary {
             .close_batch_at(&mut head2, 1210)
             .expect("close gen2");
 
-        storage
-            .append_safe_inputs(
-                2410,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 1210),
-                    block_number: 2410,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append gen2");
+        storage.land(2410, &[(SENDER_A, make_stale_batch_payload(0, 1210))]); // append gen2
         let inv2 = storage.recover_post_flush(1200).expect("recover gen2");
         assert_eq!(inv2, vec![2, 3]);
         assert!(storage.open_state().expect("open").is_some());
@@ -2044,43 +1606,20 @@ mod boundary {
 
     #[test]
     fn multi_round_gen3_recovery() {
-        let db = temp_db("detect-gen3");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-gen3");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("init");
         storage.close_batch_at(&mut head, 10).expect("close");
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         storage.recover_post_flush(1200).expect("recover gen1");
 
         let mut head2 = storage.open_state().expect("load").unwrap();
         storage
             .close_batch_at(&mut head2, 1210)
             .expect("close gen2");
-        storage
-            .append_safe_inputs(
-                2410,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 1210),
-                    block_number: 2410,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append gen2");
+        storage.land(2410, &[(SENDER_A, make_stale_batch_payload(0, 1210))]); // append gen2
         storage.recover_post_flush(1200).expect("recover gen2");
 
         let mut head3 = storage.open_state().expect("load").unwrap();
@@ -2088,26 +1627,14 @@ mod boundary {
             .close_batch_at(&mut head3, 2410)
             .expect("close gen3");
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                2420,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: landed,
-                    block_number: 2420,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append gen3");
+        storage.land(2420, &[(SENDER_A, landed)]); // append gen3
         let inv3 = storage.recover_post_flush(1200).expect("recover gen3");
         assert!(inv3.is_empty(), "gen3 should be healthy");
     }
 
     #[test]
     fn large_cascade_50_batches() {
-        let db = temp_db("detect-large-cascade");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let (_db, mut storage) = open_temp_storage("detect-large-cascade");
 
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
@@ -2116,705 +1643,12 @@ mod boundary {
             storage.close_batch_at(&mut head, 10).expect("close");
         }
 
-        storage
-            .append_safe_inputs(
-                1210,
-                &[StoredSafeInput {
-                    sender: SENDER_A,
-                    payload: make_stale_batch_payload(0, 10),
-                    block_number: 1210,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append");
+        storage.land(1210, &[(SENDER_A, make_stale_batch_payload(0, 10))]);
         let inv = storage.recover_post_flush(1200).expect("detect");
         assert_eq!(inv.len(), 51);
     }
 }
 
-mod schema_invariants {
-    use super::*;
-    use rusqlite::params;
-
-    // ── Schema-invariant regression tests ─────────────────────────────────
-    //
-    // These exercise the triggers + partial unique index in the schema
-    // directly. Each one checks a specific invariant that previously lived
-    // in writer discipline and now has a schema-level tripwire.
-    //
-    // They're here (rather than in a dedicated file) because they share the
-    // recovery tests' setup: same helpers, same fixture. Failures here mean
-    // the schema guard regressed, which is the whole point of making the
-    // invariants declarative.
-
-    #[test]
-    fn schema_rejects_second_valid_tip() {
-        // The partial unique index `ux_single_valid_tip` catches a writer that
-        // opens a new Tip without sealing the old one first.
-        let db = temp_db("schema-second-tip");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-
-        // Try to bypass the lane and insert a second valid Tip directly.
-        let err = storage.conn.execute(
-            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms) \
-             VALUES (99, 0, 1, 1000)",
-            [],
-        );
-        let msg = format!("{err:?}");
-        assert!(
-            msg.contains("UNIQUE constraint failed") && msg.contains("ux_single_valid_tip"),
-            "expected ux_single_valid_tip violation, got: {msg}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_bad_nonce_contiguity() {
-        // Nonce must equal parent.nonce + 1 — trigger enforces it.
-        // Insert the bad-nonce batch as already-sealed so it doesn't collide
-        // with the existing Tip on `ux_single_valid_tip`.
-        let db = temp_db("schema-bad-nonce");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_batch_at(&mut head, 0)
-            .expect("close batch 0; batch 1 is now Tip");
-        // Batch 1 has nonce 1 (0 + 1). Insert child with nonce 99 (should be 2).
-        let err = storage.conn.execute(
-            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
-             VALUES (999, 1, 99, \
-                     (SELECT created_at_ms FROM batches WHERE batch_index = 1), \
-                     (SELECT created_at_ms FROM batches WHERE batch_index = 1))",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("batch nonce must equal parent.nonce + 1"),
-            "expected nonce trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_genesis_with_nonzero_nonce() {
-        // Default anchor is 0, so a parentless root at a non-zero nonce ABORTs
-        // (genesis must be 0) — the exact-match form of the contiguity rule.
-        let db = temp_db("schema-genesis-nonzero");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        let err = storage.conn.execute(
-            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms) \
-             VALUES (0, NULL, 7, 100)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("parentless root must carry the batch-tree anchor nonce"),
-            "expected anchor-nonce trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_allows_parentless_root_at_anchor_nonce() {
-        // With the anchor set to N' (a recovered deployment), a parentless root
-        // at N' is permitted — the recovery generalization of "genesis at 0".
-        // (Rows are inserted sealed so the single-Tip partial index, which only
-        // covers open rows, doesn't mask the contiguity trigger under test.)
-        let db = temp_db("schema-anchor-root");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .conn
-            .execute(
-                "UPDATE batch_tree_anchor SET nonce = 42 WHERE singleton_id = 0",
-                [],
-            )
-            .expect("set anchor");
-        // A root at the anchor nonce (42) is accepted...
-        storage
-            .conn
-            .execute(
-                "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
-                 VALUES (0, NULL, 42, 100, 100)",
-                [],
-            )
-            .expect("parentless root at the anchor nonce is allowed");
-        // ...but a root at 0 (the old hard-coded value) now ABORTs — the rule is
-        // an exact match against the anchor, tighter than the old "must be 0".
-        let err = storage.conn.execute(
-            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
-             VALUES (1, NULL, 0, 100, 100)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("parentless root must carry the batch-tree anchor nonce"),
-            "a root at the wrong nonce must abort, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_second_valid_parentless_root() {
-        // At most one *valid* parentless root: a second parentless insert (both
-        // valid, both at the anchor nonce 0) ABORTs on the single-root guard.
-        // (Sealed inserts isolate this from the single-Tip index; a fully-torn
-        // cascade re-roots only after invalidating the old root, covered below.)
-        let db = temp_db("schema-two-roots");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .conn
-            .execute(
-                "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
-                 VALUES (0, NULL, 0, 100, 100)",
-                [],
-            )
-            .expect("first root ok");
-        let err = storage.conn.execute(
-            "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
-             VALUES (1, NULL, 0, 100, 100)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("at most one valid parentless root"),
-            "expected single-root guard, got: {err:?}"
-        );
-        // Invalidate the first root, then a second parentless root is allowed —
-        // exactly the fully-torn-cascade re-root shape.
-        storage
-            .conn
-            .execute(
-                "UPDATE batches SET invalidated_at_ms = 200 WHERE batch_index = 0",
-                [],
-            )
-            .expect("invalidate first root");
-        storage
-            .conn
-            .execute(
-                "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms, sealed_at_ms) \
-                 VALUES (1, NULL, 0, 100, 100)",
-                [],
-            )
-            .expect("re-root parentless after the old root is invalidated");
-    }
-
-    #[test]
-    fn schema_freezes_anchor_after_setup_complete() {
-        // The anchor is write-once: once `setup_complete` exists, UPDATEs abort.
-        let db = temp_db("schema-anchor-frozen");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        // Pre-marker: UPDATE is allowed (this is what recovery setup does).
-        storage
-            .conn
-            .execute(
-                "UPDATE batch_tree_anchor SET nonce = 7 WHERE singleton_id = 0",
-                [],
-            )
-            .expect("anchor settable before setup_complete");
-        storage
-            .conn
-            .execute(
-                "INSERT INTO setup_complete (singleton_id, completed_at_ms) VALUES (0, 1)",
-                [],
-            )
-            .expect("mark setup complete");
-        let err = storage.conn.execute(
-            "UPDATE batch_tree_anchor SET nonce = 8 WHERE singleton_id = 0",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("batch-tree anchor is frozen after setup completes"),
-            "expected anchor-freeze trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_re_seal() {
-        let db = temp_db("schema-re-seal");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_batch_at(&mut head, 0)
-            .expect("close batch 0 (seals it)");
-        // Batch 0 is sealed. Attempt to re-seal with a different timestamp.
-        let err = storage.conn.execute(
-            "UPDATE batches SET sealed_at_ms = sealed_at_ms + 1 WHERE batch_index = 0",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("sealed_at_ms is write-once"),
-            "expected write-once trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_re_invalidate() {
-        let db = temp_db("schema-re-invalidate");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        // Seed via test helper (uses now_unix_ms internally).
-        storage.insert_invalid_batch(0).expect("first invalidate");
-        let err = storage.conn.execute(
-            "UPDATE batches SET invalidated_at_ms = invalidated_at_ms + 1 \
-             WHERE batch_index = 0",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("invalidated_at_ms is write-once"),
-            "expected write-once trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_frame_insert_into_sealed_batch() {
-        // This is the bug class we've been fighting: writer holds a stale
-        // WriteHead and writes to a batch that's no longer the Tip.
-        let db = temp_db("schema-frame-into-sealed");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_batch_at(&mut head, 0)
-            .expect("close batch 0; batch 0 is now sealed");
-        // Batch 0 is sealed. Any direct insert into its frames must fail.
-        let err = storage.conn.execute(
-            "INSERT INTO frames (batch_index, frame_in_batch, created_at_ms, fee, safe_block) \
-             VALUES (0, 1, 100, 1356, 0)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("frames can only be inserted into the current Tip"),
-            "expected tip-only-frames trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_frame_insert_into_invalidated_batch() {
-        let db = temp_db("schema-frame-into-invalid");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        // Invalidate (without sealing) — Tip that never closed, now dead.
-        storage.insert_invalid_batch(0).expect("invalidate tip");
-        let err = storage.conn.execute(
-            "INSERT INTO frames (batch_index, frame_in_batch, created_at_ms, fee, safe_block) \
-             VALUES (0, 1, 100, 1356, 0)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("frames can only be inserted into the current Tip"),
-            "expected tip-only-frames trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_parent_batch_index_mutation() {
-        let db = temp_db("schema-parent-immutable");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage.close_batch_at(&mut head, 0).expect("close batch 0");
-        // Try to change parent of batch 1 — should be rejected.
-        let err = storage.conn.execute(
-            "UPDATE batches SET parent_batch_index = NULL WHERE batch_index = 1",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("parent_batch_index is immutable"),
-            "expected parent-immutable trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_application_input_into_non_tip() {
-        // The third sibling of the tip-only triggers (frames + user_ops already
-        // have negative tests; application_inputs did not). The global replay order
-        // is the source for recovery re-drain and catch-up; a stale-WriteHead row
-        // into a sealed batch would corrupt it.
-        let db = temp_db("schema-sequenced-into-sealed");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_batch_at(&mut head, 0)
-            .expect("close batch 0; it is now sealed (no longer the Tip)");
-        // Target the sealed batch's existing frame (0, 0). The BEFORE-INSERT
-        // trigger fires before the safe_input_index FK is evaluated.
-        let err = storage.conn.execute(
-            "INSERT INTO application_inputs \
-             (offset, batch_index, frame_in_batch, user_op_pos_in_frame, safe_input_index) \
-             VALUES (0, 0, 0, NULL, 0)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("application input must target the current valid Tip"),
-            "expected tip-only-sequenced trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_nonce_mutation() {
-        // Nonce immutability underpins the frontier + contiguity invariants.
-        let db = temp_db("schema-nonce-immutable");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage.close_batch_at(&mut head, 0).expect("close batch 0");
-        let err = storage.conn.execute(
-            "UPDATE batches SET nonce = nonce + 1 WHERE batch_index = 0",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("nonce is immutable"),
-            "expected nonce-immutable trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn schema_rejects_payload_hash_rewrite() {
-        // payload_hash is the content-identity anchor for the canonical-
-        // divergence check; a rewrite would let a foreign/zombie L1 landing
-        // false-match a local batch. Write-once once stamped at seal.
-        let db = temp_db("schema-payload-hash-write-once");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        storage
-            .close_batch_at(&mut head, 0)
-            .expect("close batch 0; payload_hash is stamped at seal");
-        let err = storage.conn.execute(
-            "UPDATE batches SET payload_hash = \
-             X'0000000000000000000000000000000000000000000000000000000000000000' \
-             WHERE batch_index = 0",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("payload_hash is write-once"),
-            "expected payload-hash-write-once trigger, got: {err:?}"
-        );
-    }
-
-    #[test]
-    fn nonce_reuse_after_cascade_with_valid_ancestor() {
-        // Beautiful part of parent-pointer + structural nonce: after a cascade
-        // that invalidates only the suffix (keeping an ancestor valid), the
-        // new Tip's parent is the last valid ancestor, so its nonce is
-        // `ancestor.nonce + 1` — the same nonce the invalidated suffix's
-        // first batch had. Nonce reuse is automatic.
-        //
-        // Scenario: batch 0 is accepted (safe_accepted_batches advances past
-        // nonce 0). Batch 1 is stale and triggers cascade. Batches 1, 2, 3
-        // invalidated; batch 0 remains valid.
-        let db = temp_db("nonce-reuse-with-ancestor");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let batch_submitter = SENDER_A;
-
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize at safe_block=10");
-        storage
-            .close_batch_at(&mut head, 100)
-            .expect("close batch 0 (nonce 0)");
-        storage
-            .close_batch_at(&mut head, 100)
-            .expect("close batch 1 (nonce 1)");
-        storage
-            .close_batch_at(&mut head, 100)
-            .expect("close batch 2 (nonce 2)");
-        // Head is now batch 3 (nonce 3, first_frame_safe_block=100).
-
-        // Batch 0 lands on L1 (accepted): safe_input at block 20 with nonce 0.
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append batch 0 submission");
-        // Advance safe head so batches 1, 2, 3 (first_frame=100) are stale.
-        // current_safe=1400 → 1400-100=1300 >= 1200.
-        storage
-            .append_safe_inputs(1400, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance past threshold");
-
-        let inv = storage.recover_post_flush(1200).expect("recover");
-        // Batches 1, 2, 3 invalidated; batch 0 (accepted) stays valid.
-        assert_eq!(inv, vec![1, 2, 3], "only the suffix cascades, got {inv:?}");
-
-        // The NEW Tip has parent=0 (the last valid ancestor), nonce=1.
-        // This is what nonce reuse looks like: the invalidated batch 1 had
-        // nonce 1; the recovery batch gets the same nonce via +1-from-parent.
-        let (tip_nonce, tip_parent): (i64, i64) = storage
-            .conn
-            .query_row(
-                "SELECT nonce, parent_batch_index FROM valid_open_batch",
-                [],
-                |row| Ok((row.get(0)?, row.get(1)?)),
-            )
-            .expect("query recovery tip");
-        assert_eq!(tip_nonce, 1, "recovery Tip reuses nonce 1");
-        assert_eq!(tip_parent, 0, "recovery Tip's parent is batch 0");
-    }
-
-    // ── CHECK-constraint regressions ──────────────────────────
-    //
-    // These differ from the trigger-based tests above: they exercise raw
-    // `CHECK` clauses declared in `migrations/0001_schema.sql`. The
-    // type-safe `Storage` API would reject these values Rust-side; we go
-    // through `storage.conn.execute` to prove the schema itself refuses.
-
-    #[test]
-    fn schema_rejects_safe_input_with_wrong_sender_length() {
-        // `safe_inputs.sender` must be exactly 20 bytes (an
-        // Ethereum address). A shorter or longer blob must be refused
-        // by the schema even if it bypasses the Rust API.
-        let db = temp_db("schema-safe-input-sender-len");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        let err = storage.conn.execute(
-            "INSERT INTO safe_inputs \
-                 (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
-                 VALUES (0, X'DEADBEEF', X'00', 10, 0, zeroblob(32))",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on safe_inputs.sender, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn schema_rejects_user_op_with_wrong_sender_length() {
-        // `user_ops.sender` must be 20 bytes.
-        let db = temp_db("schema-user-op-sender-len");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        // Seed a frame to satisfy the composite FK — initialize_open_state
-        // creates batch 0 frame 0 as the Tip.
-        let mut storage = storage;
-        storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        let err = storage.conn.execute(
-                "INSERT INTO user_ops \
-                 (batch_index, frame_in_batch, pos_in_frame, sender, nonce, max_fee, data, sig, received_at_ms) \
-                 VALUES (0, 0, 0, X'010203', 0, 0, X'', ?1, 0)",
-                params![vec![0u8; 65]],
-            );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on user_ops.sender length, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn schema_rejects_user_op_with_wrong_signature_length() {
-        // `user_ops.sig` must be exactly 65 bytes (secp256k1
-        // r || s || v). Regression for "accidentally accepted a non-65
-        // signature and crashed a downstream consumer."
-        let db = temp_db("schema-user-op-sig-len");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        let valid_sender = vec![0u8; 20];
-        let short_sig = vec![0u8; 32]; // Should be 65.
-        let err = storage.conn.execute(
-                "INSERT INTO user_ops \
-                 (batch_index, frame_in_batch, pos_in_frame, sender, nonce, max_fee, data, sig, received_at_ms) \
-                 VALUES (0, 0, 0, ?1, 0, 0, X'', ?2, 0)",
-                params![valid_sender, short_sig],
-            );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on user_ops.sig length, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn schema_rejects_application_input_with_neither_xor_branch() {
-        // `application_inputs` must be either a user-op row
-        // (user_op_pos_in_frame IS NOT NULL) or a direct-input row
-        // (safe_input_index IS NOT NULL), never both and never neither.
-        // Setting both to NULL is the clean XOR violation to test —
-        // FKs are only triggered on non-NULL values so we isolate the
-        // CHECK constraint.
-        let db = temp_db("schema-sequenced-l2-tx-xor-neither");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        storage
-            .initialize_open_state(0, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        let err = storage.conn.execute(
-            "INSERT INTO application_inputs \
-                 (offset, batch_index, frame_in_batch, user_op_pos_in_frame, safe_input_index) \
-                 VALUES (0, 0, 0, NULL, NULL)",
-            [],
-        );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on application_inputs XOR, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn schema_rejects_deployment_identity_with_zero_chain_id() {
-        // `deployment_identity.chain_id > 0`. chain_id = 0 would
-        // collide with the EIP-712 domain's unspecified-chain sentinel
-        // and break signature recovery; the CHECK refuses to persist it
-        // in the first place.
-        let db = crate::storage::test_helpers::temp_db("schema-deployment-chain-id-zero");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        let address = vec![0u8; 20];
-        let err = storage.conn.execute(
-            "INSERT INTO deployment_identity \
-                 (singleton_id, chain_id, app_address, input_box_address, \
-                  app_deployment_block, batch_submitter_address, \
-                  fee_oracle_mode, fixed_log_gas_price, \
-                  fee_oracle_weth, fee_oracle_fee_token, fee_oracle_pool, \
-                  fee_oracle_twap_window_secs) \
-                 VALUES (0, 0, ?1, ?1, 0, ?1, 'fixed', 0, NULL, NULL, NULL, NULL)",
-            params![address],
-        );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on chain_id > 0, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn schema_rejects_safe_input_with_negative_block_number() {
-        // `safe_inputs.block_number >= 0`. Catches a regression
-        // that would let a negative block number slip through — the rest
-        // of the system assumes non-negative and could panic on cast.
-        let db = temp_db("schema-safe-input-neg-block");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        let sender = vec![0u8; 20];
-        let err = storage.conn.execute(
-            "INSERT INTO safe_inputs \
-                 (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
-                 VALUES (0, ?1, X'00', -1, 0, zeroblob(32))",
-            params![sender],
-        );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on block_number >= 0, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn divergence_marker_freezes_batch_tree_promotions_and_pending_clears() {
-        // I15 structural enforcement: with the canonical-divergence marker
-        // present, the trg_*_frozen_on_divergence family must RAISE on batch
-        // inserts/updates, promotion inserts, and pending-snapshot deletes —
-        // even for a caller that bypassed every typed Rust refusal.
-        let db = temp_db("schema-divergence-freeze");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize open state");
-        storage
-            .close_batch_at(&mut head, 10)
-            .expect("close batch 0 before freezing");
-        storage
-            .insert_batch_snapshot(std::path::Path::new("/tmp/pending-fixture"), 0)
-            .expect("insert a pending dump row to attempt deleting");
-        crate::storage::test_helpers::record_canonical_divergence(&mut storage, 0, 0);
-
-        let frozen = |err: rusqlite::Error| {
-            let text = format!("{err}");
-            assert!(
-                text.contains("frozen") && text.contains("divergence"),
-                "expected a divergence-freeze RAISE, got: {text}"
-            );
-        };
-
-        frozen(
-            storage
-                .conn
-                .execute(
-                    "INSERT INTO batches (batch_index, parent_batch_index, nonce, created_at_ms) \
-                     VALUES (99, NULL, 0, 0)",
-                    [],
-                )
-                .expect_err("batch INSERT must be frozen"),
-        );
-        frozen(
-            storage
-                .conn
-                .execute(
-                    "UPDATE batches SET invalidated_at_ms = 1 WHERE invalidated_at_ms IS NULL",
-                    [],
-                )
-                .expect_err("batch UPDATE (cascade shape) must be frozen"),
-        );
-        frozen(
-            storage
-                .conn
-                .execute("DELETE FROM snapshots", [])
-                .expect_err("pending-snapshot DELETE must be frozen"),
-        );
-
-        // Reads stay usable on a frozen DB: the danger check must still
-        // classify the divergence (the boot-refusal path depends on it).
-        let protocol = ProtocolTiming {
-            max_wait_blocks: 1200,
-            preemptive_margin_blocks: 75,
-            l1_read_stale_after_blocks: 900,
-            seconds_per_block: 12,
-        };
-        let status = storage
-            .check_danger(&protocol, 1_000_000)
-            .expect("check danger on a frozen DB");
-        assert_eq!(status, crate::storage::DangerStatus::CanonicalDivergence(0));
-    }
-
-    #[test]
-    fn schema_rejects_safe_input_with_negative_block_timestamp() {
-        let db = temp_db("schema-safe-input-neg-block-timestamp");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        let sender = vec![0u8; 20];
-        let err = storage.conn.execute(
-            "INSERT INTO safe_inputs \
-                 (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
-                 VALUES (0, ?1, X'00', 10, -1, zeroblob(32))",
-            params![sender],
-        );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on block_timestamp >= 0, got: {err:?}",
-        );
-    }
-
-    #[test]
-    fn schema_rejects_safe_input_with_wrong_transaction_hash_length() {
-        let db = temp_db("schema-safe-input-transaction-hash-len");
-        let storage = Storage::open(db.path.as_str()).expect("open storage");
-        let sender = vec![0u8; 20];
-        let err = storage.conn.execute(
-            "INSERT INTO safe_inputs \
-                 (safe_input_index, sender, payload, block_number, block_timestamp, transaction_hash) \
-                 VALUES (0, ?1, X'00', 10, 0, X'DEADBEEF')",
-            params![sender],
-        );
-        assert!(
-            format!("{err:?}").contains("CHECK constraint failed"),
-            "expected CHECK constraint error on transaction_hash length, got: {err:?}",
-        );
-    }
-}
-
 mod tree_invariants {
     use super::*;
 
@@ -2822,104 +1656,24 @@ mod tree_invariants {
     use crate::storage::convert::{i64_to_u64, u64_to_i64};
     use rusqlite::params;
 
-    /// Check the tree invariants that should hold at every quiescent state:
-    ///   - Every valid batch has `nonce = parent.nonce + 1`, or `nonce = 0`
-    ///     with `parent_batch_index IS NULL` (genesis/post-torn-cascade).
-    ///   - Every `parent_batch_index` either is NULL or references an
-    ///     existing batch (FK handles this, but we assert explicitly).
-    ///   - Walking up `parent_batch_index` from any valid batch terminates
-    ///     at a NULL-parent row within `batch_index` hops (no cycles).
-    ///   - The valid path is strictly contiguous in `nonce`: the set of
-    ///     nonces among valid batches is `{0, 1, ..., max_valid_nonce}`.
-    ///   - At most one `valid_open_batch` row exists.
-    fn assert_tree_invariants(storage: &mut Storage) {
-        // 1. Nonce = parent.nonce + 1 (or nonce=0 for NULL parent).
-        let mut stmt = storage
-            .conn
-            .prepare(
-                "SELECT b.batch_index, b.parent_batch_index, b.nonce, p.nonce \
-                 FROM batches b LEFT JOIN batches p ON p.batch_index = b.parent_batch_index",
-            )
-            .expect("prepare");
-        let rows: Vec<(i64, Option<i64>, i64, Option<i64>)> = stmt
-            .query_map([], |row| {
-                Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?))
-            })
-            .expect("query")
-            .collect::<rusqlite::Result<_>>()
-            .expect("collect");
-        drop(stmt);
-        for (bi, parent, nonce, parent_nonce) in &rows {
-            match (parent, parent_nonce) {
-                (None, _) => assert_eq!(
-                    *nonce, 0,
-                    "batch {bi}: NULL parent must have nonce 0, got {nonce}"
-                ),
-                (Some(_), None) => panic!("batch {bi}: parent exists but parent row missing"),
-                (Some(_), Some(pn)) => assert_eq!(
-                    *nonce,
-                    pn + 1,
-                    "batch {bi}: nonce={nonce}, expected parent.nonce+1 = {}",
-                    pn + 1
-                ),
-            }
-        }
-
-        // 2. At most one valid open batch.
-        let open_count: i64 = storage
-            .conn
-            .query_row("SELECT COUNT(*) FROM valid_open_batch", [], |row| {
-                row.get(0)
-            })
-            .expect("count open");
-        assert!(open_count <= 1, "more than one valid Tip: {open_count}");
-
-        // 3. Valid-path nonce contiguity: nonces on the valid chain are 0..N.
-        let mut valid_nonces: Vec<i64> = storage
+    /// The schema triggers check parent links, the root and the single Tip on
+    /// every write; invalidation is an UPDATE no trigger checks, so assert the
+    /// valid spine here. The e2e harness asserts the same on the binary's DB.
+    fn assert_valid_spine_from_anchor(storage: &mut Storage) {
+        let anchor = u64_to_i64(storage.batch_tree_anchor().expect("anchor"));
+        let nonces: Vec<i64> = storage
             .conn
             .prepare("SELECT nonce FROM valid_batches ORDER BY nonce ASC")
             .expect("prepare")
-            .query_map([], |row| row.get::<_, i64>(0))
+            .query_map([], |row| row.get(0))
             .expect("query")
             .collect::<rusqlite::Result<_>>()
             .expect("collect");
-        // There can be multiple valid batches with the SAME nonce only if
-        // they live on different branches — but we don't allow that; valid
-        // batches form a strict chain. So dedup-and-equal means contiguous.
-        valid_nonces.sort();
-        valid_nonces.dedup();
-        for (i, &n) in valid_nonces.iter().enumerate() {
-            assert_eq!(
-                n, i as i64,
-                "valid nonces not contiguous: got {valid_nonces:?}"
-            );
-        }
-
-        // 4. Parent walk terminates at NULL in ≤ batch_index hops for every valid row.
-        for (bi, _, _, _) in &rows {
-            let mut cur: i64 = *bi;
-            let bi_u = i64_to_u64(*bi);
-            for _ in 0..=bi_u {
-                let parent: Option<i64> = storage
-                    .conn
-                    .query_row(
-                        "SELECT parent_batch_index FROM batches WHERE batch_index = ?1",
-                        params![cur],
-                        |row| row.get(0),
-                    )
-                    .expect("parent lookup");
-                match parent {
-                    None => break,
-                    Some(p) => {
-                        assert!(
-                            p < cur,
-                            "batch {bi}: parent-walk went backward ({p} >= {cur}) — cycle?"
-                        );
-                        cur = p;
-                    }
-                }
-            }
-        }
+        let expected: Vec<i64> = (anchor..).take(nonces.len()).collect();
+        assert_eq!(
+            nonces, expected,
+            "valid spine must be contiguous from anchor {anchor}"
+        );
     }
 
     #[test]
@@ -2927,48 +1681,34 @@ mod tree_invariants {
         // Exercises every mutating code path: genesis, rotations, partial
         // cascades (ancestor survives), cascades across accepted frontier,
         // torn cascades (no valid ancestor), and back-to-back generations.
-        // Asserts tree invariants after each step.
-        let db = temp_db("tree-invariants-workload");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let batch_submitter = SENDER_A;
+        // Every write is checked by the schema triggers (an ABORT fails its
+        // expect); the valid spine is asserted after each step.
+        let (_db, mut storage) = open_temp_storage("tree-invariants-workload");
 
         // Phase 1: genesis + 4 rotations. Simple chain.
         let mut head = storage
             .initialize_open_state(10, SafeInputRange::empty_at(0))
             .expect("initialize");
-        assert_tree_invariants(&mut storage);
+        assert_valid_spine_from_anchor(&mut storage);
         for _ in 0..4 {
             storage.close_batch_at(&mut head, 100).expect("close");
-            assert_tree_invariants(&mut storage);
+            assert_valid_spine_from_anchor(&mut storage);
         }
         // Tree: 0(Gold sentinel in concept)→1→2→3→4 (Tip)
 
         // Phase 2: cascade with a valid ancestor. Batch 0 is accepted first.
         let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append accepted");
-        storage
-            .append_safe_inputs(1400, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance past threshold");
+        storage.land(20, &[(SENDER_A, landed)]); // append accepted
+        storage.advance_safe_head(1400); // advance past threshold
         let inv = storage.recover_post_flush(1200).expect("recover");
         assert!(!inv.is_empty(), "partial cascade should invalidate");
-        assert_tree_invariants(&mut storage);
+        assert_valid_spine_from_anchor(&mut storage);
 
         // Phase 3: more rotations after partial cascade.
         let mut head = storage.open_state().expect("load").unwrap();
         for _ in 0..3 {
             storage.close_batch_at(&mut head, 1500).expect("close gen2");
-            assert_tree_invariants(&mut storage);
+            assert_valid_spine_from_anchor(&mut storage);
         }
 
         // Phase 4: torn cascade — invalidate everything including batch 0.
@@ -2977,13 +1717,13 @@ mod tree_invariants {
             storage.insert_invalid_batch(bi).expect("invalidate");
         }
         storage.recover_post_flush(1200).expect("recover from torn");
-        assert_tree_invariants(&mut storage);
+        assert_valid_spine_from_anchor(&mut storage);
 
         // Phase 5: rotations after torn cascade — new Tip has parent=NULL, nonce=0.
         let mut head = storage.open_state().expect("load").unwrap();
         for _ in 0..5 {
             storage.close_batch_at(&mut head, 2000).expect("close gen3");
-            assert_tree_invariants(&mut storage);
+            assert_valid_spine_from_anchor(&mut storage);
         }
     }
 
@@ -2992,33 +1732,18 @@ mod tree_invariants {
         // cascade queries use `batch_index >= N` as a shortcut for
         // "subtree rooted at N". This test asserts the equivalence on a
         // realistic scenario with multiple cascade generations.
-        let db = temp_db("subtree-equivalence");
-        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
-        let batch_submitter = SENDER_A;
+        let (_db, mut storage) = open_temp_storage("subtree-equivalence");
 
         // Build: 5 batches, cascade from 2 (partial), 3 more, cascade from 1 (torn-ish).
         let mut head = storage
-            .initialize_open_state(10, SafeInputRange::empty_at(0))
-            .expect("initialize");
-        for _ in 0..4 {
-            storage.close_batch_at(&mut head, 100).expect("close");
-        }
-        let landed = local_batch_payload(&mut storage, 0);
-        storage
-            .append_safe_inputs(
-                20,
-                &[StoredSafeInput {
-                    sender: batch_submitter,
-                    payload: landed,
-                    block_number: 20,
-                }],
-                SENDER_A,
-                &default_protocol_timing(),
-            )
-            .expect("append accepted");
-        storage
-            .append_safe_inputs(1400, &[], SENDER_A, &default_protocol_timing())
-            .expect("advance");
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        for _ in 0..4 {
+            storage.close_batch_at(&mut head, 100).expect("close");
+        }
+        let landed = local_batch_payload(&mut storage, 0);
+        storage.land(20, &[(SENDER_A, landed)]); // append accepted
+        storage.advance_safe_head(1400); // advance
         let _ = storage.recover_post_flush(1200).expect("cascade 1");
 
         let mut head = storage.open_state().expect("load").unwrap();
@@ -3108,8 +1833,7 @@ mod recovery_snapshot_selection {
 
     #[test]
     fn cascade_hides_every_doomed_snapshot_and_retains_baseline() {
-        let db = temp_db("recovery-baseline-fallback");
-        let mut storage = Storage::open(&db.path).expect("open");
+        let (_db, mut storage) = open_temp_storage("recovery-baseline-fallback");
         let baseline_id = baseline(&mut storage);
         seed_closed_batches(&mut storage, 3);
         for index in 0..3 {
@@ -3119,9 +1843,7 @@ mod recovery_snapshot_selection {
             storage.latest_snapshot().unwrap().unwrap().dump.id,
             baseline_id
         );
-        storage
-            .append_safe_inputs(1500, &[], SENDER_A, &default_protocol_timing())
-            .expect("safe head");
+        storage.advance_safe_head(1500); // safe head
         assert_eq!(
             storage.recover_post_flush(1200).expect("cascade"),
             vec![0, 1, 2, 3]
@@ -3144,8 +1866,7 @@ mod recovery_snapshot_selection {
 
     #[test]
     fn accepted_snapshot_survives_cascade_after_baseline_gc_and_restart() {
-        let db = temp_db("recovery-accepted-fallback");
-        let mut storage = Storage::open(&db.path).expect("open");
+        let (db, mut storage) = open_temp_storage("recovery-accepted-fallback");
         let baseline_id = baseline(&mut storage);
         seed_closed_batches(&mut storage, 2);
         let accepted_id = batch_snapshot(&mut storage, 0);
@@ -3198,8 +1919,7 @@ mod recovery_snapshot_selection {
 
     #[test]
     fn an_optimistic_snapshot_alone_does_not_admit_recovery() {
-        let db = temp_db("recovery-optimistic-is-not-fallback");
-        let mut storage = Storage::open(&db.path).expect("open");
+        let (_db, mut storage) = open_temp_storage("recovery-optimistic-is-not-fallback");
         seed_closed_batches(&mut storage, 1);
         batch_snapshot(&mut storage, 0);
         let protocol = default_protocol_timing();
@@ -3253,3 +1973,426 @@ mod recovery_snapshot_selection {
         );
     }
 }
+
+mod check_danger {
+    use crate::clock::unix_now_ms;
+    use crate::storage::test_helpers::{SENDER_A, default_protocol_timing, local_batch_payload};
+    use crate::storage::{SafeInputRange, Storage, StoredSafeInput};
+    use crate::test_support::temp_db;
+
+    #[test]
+    fn check_danger_reports_observed_closed_batch_danger() {
+        let db = temp_db("check-danger-observed-closed");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 1");
+
+        let protocol = default_protocol_timing();
+        let landed = local_batch_payload(&mut storage, 0);
+        storage
+            .append_safe_inputs(
+                1135,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: landed,
+                    block_number: 20,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append accepted batch 0");
+
+        let status = storage
+            .check_danger(&protocol, unix_now_ms())
+            .expect("check_danger");
+        assert_eq!(status, crate::storage::DangerStatus::ClosedBatchInDanger(1));
+    }
+
+    #[test]
+    fn check_danger_reports_estimated_batch_danger_on_wall_clock_drift() {
+        // Observed block-based checks wouldn't fire (batch 1 has
+        // first_frame_safe_block = 100 and safe_block = 1200, age = 1100 <
+        // 1125). But wall-clock says the safe head hasn't advanced in ~25
+        // blocks: the effective threshold drops to 1100, so batch 1 reaches
+        // danger via the wall-clock correction.
+        let db = temp_db("check-danger-estimated");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(100, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 100)
+            .expect("close batch 0");
+        storage
+            .close_frame_and_batch(&mut head, 100)
+            .expect("close batch 1");
+
+        let protocol = default_protocol_timing();
+        let landed = local_batch_payload(&mut storage, 0);
+        storage
+            .append_safe_inputs(
+                1200,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: landed,
+                    block_number: 200,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append accepted batch 0");
+
+        // Pretend safe-progress was recorded 25 blocks' worth of wall-clock ago.
+        let now_ms = unix_now_ms();
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms.saturating_sub(25 * 12 * 1000)).unwrap_or(i64::MAX)],
+            )
+            .expect("rewind safe-progress timestamp");
+
+        let status = storage
+            .check_danger(&protocol, now_ms)
+            .expect("check_danger");
+        assert_eq!(
+            status,
+            crate::storage::DangerStatus::EstimatedBatchInDanger(1)
+        );
+    }
+
+    #[test]
+    fn check_danger_prefers_observed_closed_over_estimated_when_both_fire() {
+        // If the observed safe head already puts the closed frontier past
+        // `danger_threshold`, route to observed closed-batch recovery. The
+        // wall-clock arm is a fallback, not a mask over observed danger.
+        let db = temp_db("check-danger-observed-closed-wins");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0");
+
+        let protocol = default_protocol_timing();
+        // Advance safe head so batch 0 is past `danger_threshold` (1125):
+        // current=1200 - first_frame=10 = 1190 >= 1125.
+        // No safe_input ingested for batch 0, so it stays non-gold.
+        storage
+            .append_safe_inputs(1200, &[], SENDER_A, &protocol)
+            .expect("advance safe head past observed danger threshold");
+
+        // Pretend safe-progress was recorded 25 blocks' worth of wall-clock
+        // ago. With the wall-clock correction, the adjusted threshold is
+        // 1100 — batch 0's age (1190) also clears that, so wall-clock fires.
+        let now_ms = unix_now_ms();
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms.saturating_sub(25 * 12 * 1000)).unwrap_or(i64::MAX)],
+            )
+            .expect("rewind safe-progress timestamp");
+
+        let status = storage
+            .check_danger(&protocol, now_ms)
+            .expect("check_danger");
+        assert_eq!(
+            status,
+            crate::storage::DangerStatus::ClosedBatchInDanger(0),
+            "observed closed-batch danger must win once safe-state has crossed danger",
+        );
+    }
+
+    #[test]
+    fn check_danger_prefers_observed_tip_over_estimated_when_both_fire() {
+        // Same fallback rule for the open Tip: if observed safe-state already
+        // puts the Tip in danger, recover the Tip directly instead of refusing
+        // under the wall-clock classification.
+        let db = temp_db("check-danger-observed-tip-wins");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0; batch 1 is Tip");
+
+        let protocol = default_protocol_timing();
+        let landed = local_batch_payload(&mut storage, 0);
+        storage
+            .append_safe_inputs(
+                1200,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: landed,
+                    block_number: 20,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append accepted batch 0");
+
+        // The Tip's observed age is 1190 >= 1125, and the wall-clock-adjusted
+        // arm would also fire. Observed Tip danger must win.
+        let now_ms = unix_now_ms();
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms.saturating_sub(25 * 12 * 1000)).unwrap_or(i64::MAX)],
+            )
+            .expect("rewind safe-progress timestamp");
+
+        let status = storage
+            .check_danger(&protocol, now_ms)
+            .expect("check_danger");
+        assert_eq!(
+            status,
+            crate::storage::DangerStatus::TipInDanger(1),
+            "Tip must win when observed safe-state has already crossed danger",
+        );
+    }
+
+    #[test]
+    fn check_danger_refuses_when_l1_view_is_stale() {
+        let db = temp_db("check-danger-l1-view-stale");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0");
+
+        let protocol = default_protocol_timing();
+        let old_safe_timestamp = 1_000_u64;
+        storage
+            .append_safe_inputs_with_timestamp(
+                1200,
+                old_safe_timestamp,
+                &[],
+                SENDER_A,
+                &protocol,
+                crate::storage::FrontierMode::Populate,
+            )
+            .expect("advance safe head with stale L1 timestamp");
+
+        let now_ms =
+            (old_safe_timestamp + protocol.l1_read_stale_after_secs()).saturating_mul(1000);
+        let status = storage
+            .check_danger(&protocol, now_ms)
+            .expect("check_danger");
+        assert_eq!(
+            status,
+            crate::storage::DangerStatus::L1ViewStale,
+            "global L1 view staleness must refuse before observed batch recovery",
+        );
+    }
+
+    #[test]
+    fn check_danger_refuses_when_safe_block_timestamp_is_in_the_future() {
+        let db = temp_db("check-danger-future-safe-timestamp");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+        let now_ms = 1_000_000_u64;
+
+        // A full block-time (12 s) ahead of the local clock: unusable. Sub-block
+        // ahead-ness is NTP-scale skew and tolerated (see the companion assert).
+        storage
+            .append_safe_inputs_with_timestamp(
+                10,
+                1_012,
+                &[],
+                SENDER_A,
+                &protocol,
+                crate::storage::FrontierMode::Populate,
+            )
+            .expect("record future L1 timestamp");
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms).expect("test time fits")],
+            )
+            .expect("make local progress baseline usable");
+
+        assert_eq!(
+            storage
+                .check_danger(&protocol, now_ms)
+                .expect("check danger"),
+            crate::storage::DangerStatus::L1ViewStale
+        );
+
+        // Sub-block skew (1 s ahead) is the freshest possible view, not a fault.
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET block_timestamp = 1001 WHERE singleton_id = 0",
+                [],
+            )
+            .expect("set sub-block-ahead timestamp");
+        assert_eq!(
+            storage
+                .check_danger(&protocol, now_ms)
+                .expect("check danger"),
+            crate::storage::DangerStatus::Safe
+        );
+    }
+
+    #[test]
+    fn check_danger_refuses_when_local_progress_timestamp_is_in_the_future() {
+        let db = temp_db("check-danger-future-progress");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+        let now_ms = 1_000_000_u64;
+
+        storage
+            .append_safe_inputs_with_timestamp(
+                10,
+                1_000,
+                &[],
+                SENDER_A,
+                &protocol,
+                crate::storage::FrontierMode::Populate,
+            )
+            .expect("record safe head");
+        // One full block-time (12 s) of regression: the wall-clock
+        // extrapolation is genuinely invalid — refuse. A sub-block step is
+        // tolerated (companion assert below).
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms + 12_000).expect("test time fits")],
+            )
+            .expect("move local progress baseline into future");
+
+        assert_eq!(
+            storage
+                .check_danger(&protocol, now_ms)
+                .expect("check danger"),
+            crate::storage::DangerStatus::L1ViewStale
+        );
+
+        // A 1 ms step is quantization noise for a block-granular estimate.
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms + 1).expect("test time fits")],
+            )
+            .expect("move baseline a sub-block step into the future");
+        assert_eq!(
+            storage
+                .check_danger(&protocol, now_ms)
+                .expect("check danger"),
+            crate::storage::DangerStatus::Safe
+        );
+    }
+
+    #[test]
+    fn observed_batch_danger_outranks_regressed_progress_clock() {
+        let db = temp_db("check-danger-future-progress-priority");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0");
+        let protocol = default_protocol_timing();
+        let now_ms = 1_000_000_u64;
+
+        storage
+            .append_safe_inputs_with_timestamp(
+                1200,
+                1_000,
+                &[],
+                SENDER_A,
+                &protocol,
+                crate::storage::FrontierMode::Populate,
+            )
+            .expect("advance observed safe block past danger");
+        // Even a full-block clock regression (a real fault, not noise) must
+        // not suppress the observed arm: batch age here is pure block
+        // arithmetic on persisted L1 observations, valid regardless of the
+        // local clock. The refusal only wins when no observed danger stands
+        // (2026-07-31 review of the containment commit).
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET synced_at_ms = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms + 12_000).expect("test time fits")],
+            )
+            .expect("move local progress baseline into future");
+
+        assert_eq!(
+            storage
+                .check_danger(&protocol, now_ms)
+                .expect("check danger"),
+            crate::storage::DangerStatus::ClosedBatchInDanger(0),
+            "observed danger stands on L1 observation alone; a wall-clock \
+             fault must not delay recovery of a batch aging toward staleness"
+        );
+
+        // Same verdict with BOTH baselines faulted: the safe-block timestamp
+        // a full block ahead of the clock AND the progress baseline regressed.
+        storage
+            .conn
+            .execute(
+                "UPDATE l1_safe_head SET block_timestamp = ?1 WHERE singleton_id = 0",
+                [i64::try_from(now_ms / 1000 + 12).expect("test time fits")],
+            )
+            .expect("move safe-block timestamp a block into the future");
+        assert_eq!(
+            storage
+                .check_danger(&protocol, now_ms)
+                .expect("check danger"),
+            crate::storage::DangerStatus::ClosedBatchInDanger(0),
+            "both clock-fault baselines together still yield to observed danger"
+        );
+    }
+
+    #[test]
+    fn check_danger_safe_when_never_synced() {
+        // Fresh DB, no prior safe block timestamp. The L1 view is unusable
+        // until the input reader records a real safe-head observation.
+        let db = temp_db("check-danger-never-synced");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let status = storage
+            .check_danger(&default_protocol_timing(), unix_now_ms())
+            .expect("check_danger");
+        assert_eq!(status, crate::storage::DangerStatus::L1ViewStale);
+    }
+
+    #[test]
+    fn check_danger_errors_when_valid_tip_has_no_first_frame() {
+        let db = temp_db("check-danger-missing-first-frame");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        let protocol = default_protocol_timing();
+        storage
+            .append_safe_inputs(10, &[], SENDER_A, &protocol)
+            .expect("record fresh safe head");
+        storage
+            .conn
+            .execute("DELETE FROM frames WHERE batch_index = 0", [])
+            .expect("inject missing-frame corruption");
+
+        let err = storage
+            .check_danger(&protocol, unix_now_ms())
+            .expect_err("a valid batch without a first frame must fail loud");
+        assert!(matches!(err, rusqlite::Error::QueryReturnedNoRows));
+    }
+}
diff --git a/sequencer/src/storage/safe_accepted_batches.rs b/sequencer/src/storage/safe_accepted_batches.rs
index 3294b13c..4b935da5 100644
--- a/sequencer/src/storage/safe_accepted_batches.rs
+++ b/sequencer/src/storage/safe_accepted_batches.rs
@@ -1,27 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Materialized view of the scheduler-accepted batches.
-//!
-//! `safe_accepted_batches` caches the prefix of submitted batches that the
-//! on-chain scheduler would accept, based on an off-chain simulation of its
-//! acceptance rules (see [`sequencer_core::protocol::ProtocolTiming`]).
-//!
-//! Maintenance contract: the view is advanced atomically with each
-//! [`super::Storage::append_safe_inputs`] write while no divergence exists. A
-//! foreign/mismatched accepted landing atomically commits the terminal marker
-//! and freezes this projection; later safe-head advances remain paired with
-//! that marker rather than further acceptance rows. No caller should populate
-//! this view directly.
-//!
-//! Readers:
-//! - batch submitter frontier / danger reads (`submitter_frontier`,
-//!   `check_danger`)
-//! - recovery cascade (`find_closed_frontier_batch_in_danger`)
-//! - wall-clock and stalled-safe-head danger estimates
-//!
-//! The only writer is [`populate_safe_accepted_batches`], invoked from
-//! `append_safe_inputs` inside its transaction.
+//! `safe_accepted_batches`: the prefix of submitted batches the on-chain scheduler
+//! would accept, simulated with `ProtocolTiming::scheduler_accepts`. Its only
+//! writer is [`populate_safe_accepted_batches`], inside the input reader's append
+//! transaction; a divergence marker freezes it (I15).
 
 use alloy_primitives::Address;
 use rusqlite::{Connection, OptionalExtension, Result, params};
@@ -88,53 +71,20 @@ fn next_expected_nonce(nonce: u64) -> u64 {
         .expect("accepted batch nonce overflow: contract-impossible")
 }
 
-/// Simulate the scheduler's acceptance logic over new safe inputs and append
-/// matches to `safe_accepted_batches`.
-///
-/// The content-identity check (I9/I15) is complete for this mirrored
-/// predicate: every post-baseline accepted landing is a byte-identical
-/// local match, foreign, or mismatched. It is not
-/// an independent oracle for the canonical scheduler, application state, or
-/// collapsed checkpoint history; foreign/mismatch requires manual cockroach
-/// recovery.
-///
-/// Paginates through `safe_inputs` rows newer than the latest accepted row,
-/// pre-filtered at SQL to `batch_submitter` as the sender. For each row,
-/// delegates to [`ProtocolTiming::scheduler_accepts`] with the
-/// currently-expected nonce — on `Some`, inserts the accepted row and advances
-/// expected; on `None`, moves on. The SQL sender filter is an optimization;
-/// `scheduler_accepts` re-checks defensively, so the filter is
-/// correctness-neutral.
-///
-/// `batch_submitter` and `timing` arrive separately because they're
-/// orthogonal: the address is identity (who the scheduler accepts from);
-/// the timing is the scheduler's staleness rules.
-///
-/// The scan cursor is local to one invocation. Persistently, the only cursor
-/// is the latest accepted row in `safe_accepted_batches`, not the latest row
-/// scanned. That is intentional for now: a recovery batch may reuse the same
-/// scheduler nonce after earlier rejected rows, and a too-eager persistent
-/// scan cursor would risk skipping it. The tradeoff is that rejected
-/// batch-submitter inputs after the gold frontier can be rescanned on later
-/// safe-head syncs until a later batch is accepted and moves the accepted
-/// cursor forward.
-///
-/// Scheduler-mirror co-location: the acceptance *predicate* lives at the
-/// library seam ([`ProtocolTiming::scheduler_accepts`]), and the bare
-/// nonce-advance fold in `protocol::advance_expected_batch_nonce`.
-/// This loop deliberately keeps its own inline `expected` advance rather than
-/// reusing that fold: the advance is interleaved with two storage-only side
-/// effects that cannot move below the protocol layer — the content-identity
-/// check ([`content_identity_violation`]) and the `canonical_divergence` freeze.
-/// Sharing a fold here would force a callback contract for those (a refactor,
-/// not the no-behavior-change library move).
+/// Mirror scheduler acceptance over new batch-submitter inputs into
+/// `safe_accepted_batches`; an accepted landing that is foreign or
+/// byte-different records `canonical_divergence` instead (I9, I15). The only
+/// persistent cursor is the latest accepted row: recovery can reuse a nonce
+/// after rejected rows, so those are rescanned until a later acceptance. The
+/// expected-nonce advance stays inline because it interleaves with the
+/// content-identity check and the divergence freeze.
 pub(super) fn populate_safe_accepted_batches(
     conn: &Connection,
     batch_submitter: Address,
     timing: &ProtocolTiming,
 ) -> Result<()> {
     const PAGE_SIZE: i64 = 256;
-    const SELECT_SQL: &str = "SELECT safe_input_index, payload, block_number \
+    const SELECT_SQL: &str = "SELECT safe_input_index, payload, block_number, transaction_hash \
                               FROM safe_inputs \
                               WHERE sender = ?1 AND safe_input_index > ?2 \
                                 AND block_number > ?3 \
@@ -143,12 +93,7 @@ pub(super) fn populate_safe_accepted_batches(
                               (safe_input_index, nonce, first_frame_safe_block, inclusion_block) \
                               VALUES (?1, ?2, ?3, ?4)";
 
-    // A persisted divergence marker freezes the acceptance frontier: the
-    // local batch tree is no longer a reliable mirror of canonical state,
-    // and advancing it would compound the divergence.
-    // `check_danger` reports `CanonicalDivergence` ahead of every other arm,
-    // so the detector exits / startup refuses; the remedy is cockroach
-    // recovery, never standard recovery.
+    // A persisted divergence marker freezes the acceptance frontier (I15).
     if canonical_divergence_in(conn)?.is_some() {
         return Ok(());
     }
@@ -190,7 +135,7 @@ pub(super) fn populate_safe_accepted_batches(
         // iterator borrows the prepared statement, so we can't INSERT on the
         // same connection while iterating. Once the page is collected and the
         // statement is dropped, the connection is free for inserts.
-        let page: Vec<(i64, Vec<u8>, i64)> = {
+        let page: Vec<(i64, Vec<u8>, i64, Vec<u8>)> = {
             let mut stmt = conn.prepare_cached(SELECT_SQL)?;
             stmt.query_map(
                 params![
@@ -199,7 +144,7 @@ pub(super) fn populate_safe_accepted_batches(
                     base_safe_block,
                     PAGE_SIZE
                 ],
-                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
             )?
             .collect::<Result<_>>()?
         };
@@ -210,7 +155,7 @@ pub(super) fn populate_safe_accepted_batches(
         let page_len = page.len() as i64;
 
         let mut insert_stmt = conn.prepare_cached(INSERT_SQL)?;
-        for (safe_input_index, payload, block_number) in &page {
+        for (safe_input_index, payload, block_number, transaction_hash) in &page {
             cursor = *safe_input_index;
             let input = SafeInputView {
                 safe_input_index: i64_to_u64(*safe_input_index),
@@ -226,12 +171,18 @@ pub(super) fn populate_safe_accepted_batches(
             // exactly here, where the simulated scheduler accepted the
             // landing. Rejected/stale/undecodable copies are scheduler
             // no-ops; their content is irrelevant by construction.
-            if let Some(kind) = content_identity_violation(conn, &accepted, payload.as_slice())? {
+            if let Some((kind, our_payload_hash)) =
+                content_identity_violation(conn, &accepted, payload.as_slice())?
+            {
                 record_canonical_divergence_in(conn, &accepted, kind)?;
                 tracing::error!(
                     nonce = accepted.nonce,
                     safe_input_index = accepted.safe_input_index,
                     kind = kind.as_str(),
+                    transaction_hash = %alloy_primitives::hex::encode_prefixed(transaction_hash),
+                    landed_payload_hash = %alloy_primitives::keccak256(payload),
+                    our_payload_hash = %our_payload_hash
+                        .map_or_else(|| "none".to_owned(), alloy_primitives::hex::encode_prefixed),
                     "CANONICAL DIVERGENCE: accepted L1 landing does not match \
                      our batch at this nonce; freezing the acceptance frontier \
                      — remedy is cockroach recovery (wipe + rebuild from L1)"
@@ -287,7 +238,7 @@ impl DivergenceKind {
 
 /// Content-identity check proper: compare a fully-accepted landing against
 /// our valid closed batch at the same nonce. `None` = identical (the normal
-/// case).
+/// case); a mismatch also returns our payload hash.
 ///
 /// Why content (not identity) suffices: accepted content-equal copies are
 /// effect-equal — which physical tx landed carries no semantic weight. The
@@ -297,7 +248,7 @@ fn content_identity_violation(
     conn: &Connection,
     accepted: &AcceptedBatch,
     landed_payload: &[u8],
-) -> Result<Option<DivergenceKind>> {
+) -> Result<Option<(DivergenceKind, Option<Vec<u8>>)>> {
     let ours: Option<Option<Vec<u8>>> = conn
         .query_row(
             "SELECT payload_hash FROM valid_closed_batches WHERE nonce = ?1",
@@ -306,12 +257,10 @@ fn content_identity_violation(
         )
         .optional()?;
     match ours {
-        None => Ok(Some(DivergenceKind::Foreign)),
+        None => Ok(Some((DivergenceKind::Foreign, None))),
         Some(None) => {
             // Sealed batches always carry a hash (stamped in the seal
             // UPDATE); a NULL here is an impossible state — fail loud.
-            // (Recovery sentinels carry no hash, but they sit *behind* the
-            // acceptance frontier by construction and are never compared.)
             // Surface it as a structured error (rolls back the reader's sync
             // transaction and travels its normal error path) rather than a
             // panic that would crash the reader task mid-transaction.
@@ -328,7 +277,7 @@ fn content_identity_violation(
             if hash.as_slice() == landed.as_slice() {
                 Ok(None)
             } else {
-                Ok(Some(DivergenceKind::Mismatch))
+                Ok(Some((DivergenceKind::Mismatch, Some(hash))))
             }
         }
     }
@@ -376,14 +325,19 @@ fn record_canonical_divergence_in(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::storage::{Storage, test_helpers::temp_db};
+    use crate::clock::unix_now_ms;
+    use crate::storage::test_helpers::{
+        SENDER_A, SENDER_B, default_protocol_timing, local_batch_payload,
+        seed_safe_inputs_with_batch_nonces,
+    };
+    use crate::storage::{SafeInputRange, Storage, StoredSafeInput};
+    use crate::test_support::temp_db;
 
     #[test]
     fn recovered_prefix_does_not_reinterpret_a_rejected_future_nonce() {
-        use crate::storage::test_helpers::{
-            default_protocol_timing, local_batch_payload, pin_test_deployment_identity,
-        };
+        use crate::storage::test_helpers::{default_protocol_timing, local_batch_payload};
         use crate::storage::{FrontierMode, LifecycleCommand, StoredSafeInput};
+        use crate::test_support::pin_test_deployment_identity;
         use sequencer_core::{batch::Batch, history::ExecutedInputCount};
         use ssz::Encode;
 
@@ -595,4 +549,493 @@ mod tests {
     fn accepted_batch_nonce_advance_fails_loud_on_overflow() {
         let _ = next_expected_nonce(u64::MAX);
     }
+    #[test]
+    fn populate_safe_accepted_batches_resumes_from_latest_row() {
+        let db = temp_db("safe-accepted-frontier-resume");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        for nonce in 0..4 {
+            storage
+                .close_frame_and_batch(&mut head, 10)
+                .unwrap_or_else(|e| panic!("close {nonce}: {e}"));
+        }
+        seed_safe_inputs_with_batch_nonces(&mut storage, SENDER_A, 10, &[0, 1]);
+
+        // Mixed-sender wave: the SENDER_B row must be ignored, SENDER_A rows
+        // must resume from the cursor and advance the frontier.
+        let second_wave = vec![
+            StoredSafeInput {
+                sender: SENDER_B,
+                payload: ssz::Encode::as_ssz_bytes(&sequencer_core::batch::Batch {
+                    nonce: 99,
+                    frames: Vec::new(),
+                }),
+                block_number: 11,
+            },
+            StoredSafeInput {
+                sender: SENDER_A,
+                payload: local_batch_payload(&mut storage, 2),
+                block_number: 11,
+            },
+            StoredSafeInput {
+                sender: SENDER_A,
+                payload: local_batch_payload(&mut storage, 3),
+                block_number: 11,
+            },
+        ];
+        storage
+            .append_safe_inputs(11, second_wave.as_slice(), SENDER_A, &protocol)
+            .expect("append second wave");
+
+        let frontier = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(frontier.safe_block, 11);
+        assert_eq!(frontier.accepted_next_nonce, 4);
+
+        let accepted_count: i64 = storage
+            .conn
+            .query_row("SELECT COUNT(*) FROM safe_accepted_batches", [], |row| {
+                row.get(0)
+            })
+            .expect("count accepted rows");
+        assert_eq!(accepted_count, 4);
+    }
+
+    #[test]
+    fn safe_accepted_frontier_skips_stale_payloads() {
+        let db = temp_db("safe-accepted-frontier-skip-stale");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+
+        // Local batch 0 (first frame safe_block=1900) and batch 1 (first frame
+        // safe_block=1900). Their landings carry the real wire bytes so the
+        // content-identity check accepts them.
+        let mut head = storage
+            .initialize_open_state(1900, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 1900)
+            .expect("close 0");
+        storage
+            .close_frame_and_batch(&mut head, 1900)
+            .expect("close 1");
+
+        // Non-stale landing of batch 0 (block 1950 - safe_block 1900 < 1200).
+        let non_stale_payload = local_batch_payload(&mut storage, 0);
+        // Stale copy at nonce 1 (safe_block=100, block 2000 → age >= 1200):
+        // a scheduler no-op, so its content is never compared — synthetic
+        // bytes are deliberate here.
+        let stale_payload = super::super::test_helpers::make_stale_batch_payload(1, 100);
+        // Non-stale landing of batch 1 (block 2000 - safe_block 1900 < 1200).
+        let non_stale_payload_2 = local_batch_payload(&mut storage, 1);
+
+        let inputs = vec![
+            StoredSafeInput {
+                sender: SENDER_A,
+                payload: non_stale_payload,
+                block_number: 1950,
+            },
+            StoredSafeInput {
+                sender: SENDER_A,
+                payload: stale_payload,
+                block_number: 2000,
+            },
+            StoredSafeInput {
+                sender: SENDER_A,
+                payload: non_stale_payload_2,
+                block_number: 2000,
+            },
+        ];
+        storage
+            .append_safe_inputs(2000, inputs.as_slice(), SENDER_A, &protocol)
+            .expect("append");
+
+        let frontier = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(frontier.accepted_next_nonce, 2);
+    }
+
+    #[test]
+    fn seal_stamps_payload_hash_of_the_submitter_encode_path() {
+        // Hash-at-seal: the hash stamped on the sealed row must
+        // be the keccak256 of exactly the bytes the submitter will broadcast
+        // (`pending_batches`'s encoding) — same code path, by construction.
+        let db = temp_db("seal-stamps-payload-hash");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0");
+
+        let stamped: Vec<u8> = storage
+            .conn
+            .query_row(
+                "SELECT payload_hash FROM batches WHERE batch_index = 0",
+                [],
+                |row| row.get(0),
+            )
+            .expect("sealed batch must carry a payload hash");
+        let wire = local_batch_payload(&mut storage, 0);
+        assert_eq!(
+            stamped.as_slice(),
+            alloy_primitives::keccak256(&wire).as_slice(),
+            "seal-time hash must match the submitter's wire bytes"
+        );
+    }
+
+    #[test]
+    fn accepted_landing_with_mismatched_content_freezes_frontier() {
+        // The zombie / re-seal shape: a landing at the expected nonce
+        // whose bytes differ from the batch we sealed. The check records a
+        // 'mismatch' marker atomically with the sync and freezes the
+        // frontier; later syncs stay frozen.
+        let db = temp_db("mismatch-divergence");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close batch 0");
+
+        // Same nonce + same first-frame safe block (fresh by inclusion),
+        // different content (synthetic fee 0 vs the sealed fee).
+        let imposter = super::super::test_helpers::make_stale_batch_payload(0, 10);
+        storage
+            .append_safe_inputs(
+                20,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: imposter,
+                    block_number: 20,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("sync commits; the marker rides the same transaction");
+
+        let kind: String = storage
+            .conn
+            .query_row(
+                "SELECT kind FROM canonical_divergence WHERE singleton_id = 0",
+                [],
+                |row| row.get(0),
+            )
+            .expect("marker persisted");
+        assert_eq!(kind, "mismatch");
+        let frontier = storage.submitter_frontier().expect("frontier");
+        assert_eq!(frontier.accepted_next_nonce, 0, "frontier frozen");
+
+        // A later sync — even one carrying the *correct* bytes — must not
+        // thaw the frontier: the marker is terminal until cockroach recovery.
+        let genuine = local_batch_payload(&mut storage, 0);
+        storage
+            .append_safe_inputs(
+                21,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: genuine,
+                    block_number: 21,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append after marker");
+        let frontier = storage.submitter_frontier().expect("frontier");
+        assert_eq!(frontier.accepted_next_nonce, 0, "frontier stays frozen");
+    }
+
+    #[test]
+    fn sim_accepted_foreign_batch_freezes_frontier_with_divergence_marker() {
+        // `scheduler_accepts` deliberately omits the two structural
+        // rejections (future safe_block, non-monotonic frames) under
+        // self-trust — the sequencer never produces them. Before the
+        // content-identity check, such a foreign batch at the
+        // expected nonce would be sim-accepted and silently desync the
+        // frontier forever. With the check, it fails the local-batch lookup
+        // (kind = foreign), the poison marker persists atomically with the
+        // sync, the frontier freezes, and `check_danger` reports
+        // `CanonicalDivergence` ahead of every other arm.
+        let db = temp_db("frontier-future-safe-block");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+
+        let future_safe_block_payload = ssz::Encode::as_ssz_bytes(&sequencer_core::batch::Batch {
+            nonce: 0,
+            frames: vec![sequencer_core::batch::Frame {
+                user_ops: Vec::new(),
+                safe_block: 500,
+                fee_price: 0,
+            }],
+        });
+
+        let batch_submitter = Address::repeat_byte(0xCC);
+        let protocol = ProtocolTiming::try_new(u64::MAX, 75, 900, 12).expect("valid timing");
+        let inputs = vec![StoredSafeInput {
+            sender: batch_submitter,
+            payload: future_safe_block_payload,
+            block_number: 100,
+        }];
+        storage
+            .append_safe_inputs(200, inputs.as_slice(), batch_submitter, &protocol)
+            .expect("append commits; the marker rides the same transaction");
+
+        let frontier = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(
+            frontier.accepted_next_nonce, 0,
+            "the frontier must freeze before the diverged landing"
+        );
+        let status = storage
+            .check_danger(&protocol, unix_now_ms())
+            .expect("check_danger");
+        assert_eq!(
+            status,
+            crate::storage::DangerStatus::CanonicalDivergence(0),
+            "the marker outranks every other danger arm"
+        );
+    }
+
+    #[test]
+    fn populate_accepts_post_recovery_batch_at_anchor() {
+        // A cockroach-recovered deployment is anchored at N' > 0; its first
+        // post-recovery batch lands at nonce N'. populate must seed `expected`
+        // from the anchor and accept it (frontier → N'+1), content-identity
+        // passing against the genuine local batch. Every other populate test
+        // uses anchor=0, so the N' > 0 acceptance path had no coverage.
+        let db = temp_db("populate-at-anchor");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+        let submitter = SENDER_A;
+
+        // Root the tree at N' = 7, then build + seal one local batch — it carries
+        // nonce 7 (compute_next_nonce(None) reads the anchor).
+        storage.set_batch_tree_anchor(7).expect("anchor at N'=7");
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("initialize");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close the nonce-7 batch");
+        assert_eq!(
+            storage.batch_nonce(0).expect("nonce"),
+            7,
+            "the root tip carries the anchor nonce N'"
+        );
+
+        // Its genuine wire bytes (looked up by nonce N'=7) land from the
+        // submitter at a fresh inclusion block.
+        let genuine = local_batch_payload(&mut storage, 7);
+        storage
+            .append_safe_inputs(
+                20,
+                &[StoredSafeInput {
+                    sender: submitter,
+                    payload: genuine,
+                    block_number: 20,
+                }],
+                submitter,
+                &protocol,
+            )
+            .expect("sync the N' landing");
+
+        assert_eq!(
+            storage
+                .submitter_frontier()
+                .expect("frontier")
+                .accepted_next_nonce,
+            8,
+            "the N'=7 batch is accepted; the frontier advances to 8"
+        );
+        let divergence: i64 = storage
+            .conn
+            .query_row("SELECT COUNT(*) FROM canonical_divergence", [], |r| {
+                r.get(0)
+            })
+            .expect("count");
+        assert_eq!(
+            divergence, 0,
+            "a genuine N' landing must not flag divergence"
+        );
+    }
+
+    #[test]
+    fn populate_skips_below_anchor_collapsed_history_without_divergence() {
+        // Below the anchor the local tree has no batches (that history was folded
+        // into S'). Old-generation L1 landings at nonces < N' are trusted
+        // collapsed history: skipped by nonce-mismatch BEFORE the content-identity
+        // check, so they must NOT be flagged Foreign (which would freeze the
+        // frontier and force a false recovery). Pins the anchor-aware-frontier
+        // (I15) skip arm — the inverse of the foreign-batch freeze test above.
+        let db = temp_db("populate-below-anchor");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+        let submitter = SENDER_A;
+        storage.set_batch_tree_anchor(7).expect("anchor at N'=7");
+
+        // Old-generation batches at nonces 0, 1, 2 (< anchor) land from the submitter.
+        let mk = |nonce: u64| {
+            ssz::Encode::as_ssz_bytes(&sequencer_core::batch::Batch {
+                nonce,
+                frames: vec![sequencer_core::batch::Frame {
+                    user_ops: Vec::new(),
+                    safe_block: 10,
+                    fee_price: 0,
+                }],
+            })
+        };
+        let landings: Vec<StoredSafeInput> = (0..3)
+            .map(|n| StoredSafeInput {
+                sender: submitter,
+                payload: mk(n),
+                block_number: 20 + n,
+            })
+            .collect();
+        storage
+            .append_safe_inputs(30, &landings, submitter, &protocol)
+            .expect("sync below-anchor landings");
+
+        let divergence: i64 = storage
+            .conn
+            .query_row("SELECT COUNT(*) FROM canonical_divergence", [], |r| {
+                r.get(0)
+            })
+            .expect("count");
+        assert_eq!(
+            divergence, 0,
+            "below-anchor history must be skipped by nonce-mismatch, not flagged Foreign"
+        );
+        assert_eq!(
+            storage
+                .submitter_frontier()
+                .expect("frontier")
+                .accepted_next_nonce,
+            7,
+            "nothing is accepted; the frontier stays at the anchor N'"
+        );
+    }
+
+    #[test]
+    fn populate_safe_accepted_batches_skips_duplicate_nonces() {
+        let db = temp_db("populate-dup-nonces");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("init");
+        storage.close_frame_and_batch(&mut head, 10).expect("close");
+
+        let landed = local_batch_payload(&mut storage, 0);
+        storage
+            .append_safe_inputs(
+                20,
+                &[
+                    StoredSafeInput {
+                        sender: SENDER_A,
+                        payload: landed.clone(),
+                        block_number: 20,
+                    },
+                    StoredSafeInput {
+                        sender: SENDER_A,
+                        payload: landed,
+                        block_number: 20,
+                    },
+                ],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append");
+
+        let frontier = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(
+            frontier.accepted_next_nonce, 1,
+            "duplicate nonce must be skipped"
+        );
+    }
+
+    #[test]
+    fn populate_safe_accepted_batches_handles_large_nonce_gap() {
+        let db = temp_db("populate-nonce-gap");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("init");
+        storage.close_frame_and_batch(&mut head, 10).expect("close");
+
+        storage
+            .append_safe_inputs(
+                20,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: super::super::test_helpers::make_stale_batch_payload(5, 10),
+                    block_number: 20,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append");
+
+        let frontier = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(frontier.accepted_next_nonce, 0, "gap must stall frontier");
+    }
+
+    #[test]
+    fn populate_safe_accepted_batches_out_of_order_arrivals_stalls_frontier() {
+        let db = temp_db("populate-out-of-order");
+        let mut storage = Storage::open(db.path.as_str()).expect("open storage");
+        let protocol = default_protocol_timing();
+
+        let mut head = storage
+            .initialize_open_state(10, SafeInputRange::empty_at(0))
+            .expect("init");
+        storage.close_frame_and_batch(&mut head, 10).expect("close");
+        storage
+            .close_frame_and_batch(&mut head, 10)
+            .expect("close 2");
+
+        storage
+            .append_safe_inputs(
+                20,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: super::super::test_helpers::make_stale_batch_payload(1, 10),
+                    block_number: 20,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append");
+
+        let frontier = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(
+            frontier.accepted_next_nonce, 0,
+            "out of order must stall frontier"
+        );
+
+        let landed = local_batch_payload(&mut storage, 0);
+        storage
+            .append_safe_inputs(
+                21,
+                &[StoredSafeInput {
+                    sender: SENDER_A,
+                    payload: landed,
+                    block_number: 21,
+                }],
+                SENDER_A,
+                &protocol,
+            )
+            .expect("append nonce 0");
+
+        let frontier2 = storage.submitter_frontier().expect("submitter frontier");
+        assert_eq!(
+            frontier2.accepted_next_nonce, 1,
+            "frontier must remain stalled"
+        );
+    }
 }
diff --git a/sequencer/src/storage/snapshot_dumps.rs b/sequencer/src/storage/snapshot_dumps.rs
index e2503dec..ecf8b33c 100644
--- a/sequencer/src/storage/snapshot_dumps.rs
+++ b/sequencer/src/storage/snapshot_dumps.rs
@@ -119,17 +119,6 @@ impl Storage {
         self.write(|tx| tx.execute("UPDATE dumps SET lease_count = 0", []))
     }
 
-    pub fn dump_lease_count(&mut self, dump_id: i64) -> Result<Option<i64>> {
-        self.read(|tx| {
-            tx.query_row(
-                "SELECT lease_count FROM dumps WHERE id = ?1",
-                [dump_id],
-                |r| r.get(0),
-            )
-            .optional()
-        })
-    }
-
     /// GC keeps the accepted rollback checkpoint and every valid snapshot beyond
     /// it. Intermediate optimistic snapshots may become the next accepted head.
     /// Row selection/deletion serializes with lease acquisition; files follow.
@@ -175,10 +164,6 @@ impl Storage {
         self.read(|tx| rollback_snapshot_in(tx))
     }
 
-    pub fn has_rollback_safe_snapshot(&mut self) -> Result<bool> {
-        self.read(|tx| has_rollback_safe_snapshot_in(tx))
-    }
-
     pub fn acquire_finalized_lease(
         &mut self,
         schedule: ReleaseScheduler,
@@ -253,22 +238,6 @@ impl Storage {
     pub fn batch_nonce(&mut self, batch_index: u64) -> Result<u64> {
         self.read(|tx| batch_nonce_in(tx, batch_index))
     }
-
-    #[cfg(test)]
-    pub(crate) fn insert_batch_snapshot(&mut self, prefix: &Path, batch_index: u64) -> Result<i64> {
-        self.write(|tx| {
-            insert_batch_snapshot_in(tx, prefix, batch_index, next_executed_input_count_in(tx)?)
-        })
-    }
-
-    #[cfg(test)]
-    pub(crate) fn insert_baseline_snapshot(
-        &mut self,
-        prefix: &Path,
-        count: ExecutedInputCount,
-    ) -> Result<i64> {
-        self.write(|tx| insert_baseline_snapshot_in(tx, prefix, count))
-    }
 }
 
 pub(super) fn insert_baseline_snapshot_in(
@@ -477,10 +446,9 @@ mod tests {
     use super::*;
     use crate::ingress::inclusion_lane::{IncludedUserOp, PendingUserOp};
     use crate::storage::history::{advance_recovery_generation_in, initialize_history_in};
-    use crate::storage::test_helpers::{
-        SENDER_A, pin_test_deployment_identity, seed_safe_inputs_with_batch_nonces, temp_db,
-    };
+    use crate::storage::test_helpers::{SENDER_A, seed_safe_inputs_with_batch_nonces};
     use crate::storage::{LifecycleCommand, SafeInputRange, WriteHead};
+    use crate::test_support::{pin_test_deployment_identity, temp_db};
     use alloy_primitives::{Address, Signature};
     use sequencer_core::user_op::{SignedUserOp, UserOp};
     use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
@@ -501,7 +469,7 @@ mod tests {
         let safe_block = head.safe_block;
         let count = storage.next_executed_input_count().unwrap();
         storage
-            .close_frame_and_batch_with_snapshot(head, safe_block, &prefix(index + 1), index, count)
+            .close_frame_and_batch_with_snapshot(head, safe_block, &prefix(index + 1), count)
             .unwrap();
         storage.latest_snapshot().unwrap().unwrap().dump.id
     }
diff --git a/sequencer/src/storage/test_helpers.rs b/sequencer/src/storage/test_helpers.rs
index b6bf8fbe..b28f5219 100644
--- a/sequencer/src/storage/test_helpers.rs
+++ b/sequencer/src/storage/test_helpers.rs
@@ -1,14 +1,30 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! Shared test fixtures used by `#[cfg(test)]` modules in `storage/`.
+//! Storage-domain test fixtures: seeding, the recovery fixture trait and
+//! divergence markers. Crate-wide fixtures live in `crate::test_support`.
 
-use alloy_primitives::Address;
-use sequencer_core::l2_tx::SequencedL2Tx;
+use std::path::Path;
+
+use alloy_primitives::{Address, B256};
+use rusqlite::params;
+use sequencer_core::l2_tx::{DirectInput, SequencedL2Tx, ValidUserOp};
 use sequencer_core::protocol::ProtocolTiming;
-use tempfile::TempDir;
 
-use super::{DeploymentIdentity, FeeOracleIdentity, SafeInputRange, Storage, StoredSafeInput};
+use super::convert::{from_unix_ms, i64_to_u16, i64_to_u64, now_unix_ms, u64_to_i64};
+use super::history::next_executed_input_count_in;
+use super::ingress::{
+    insert_tip_rows, open_fresh_tip_in_tx, open_successor_frame_in, seal_and_open_next_batch,
+};
+use super::mutations::persist_frame_direct_sequence_derived;
+use super::queries::{load_current_write_head, query_batch_policy};
+use super::recovery::{recover_aging_tip_inner, recover_post_flush_inner};
+use super::snapshot_dumps::{insert_baseline_snapshot_in, insert_batch_snapshot_in};
+use super::{
+    BatchPolicy, ExecutedInputCount, FrontierMode, IngestedSafeInput, SafeInputRange, Storage,
+    StorageOpenError, StoredSafeInput, WriteHead,
+};
+use crate::test_support::{TestDb, pin_test_deployment_identity, temp_db};
 
 pub(crate) const SENDER_A: Address = Address::repeat_byte(0xAA);
 pub(crate) const SENDER_B: Address = Address::repeat_byte(0xBB);
@@ -17,47 +33,349 @@ pub(crate) const SENDER_B: Address = Address::repeat_byte(0xBB);
 /// Sender-independent (timing carries no address); pair with a submitter
 /// address as needed at the call site.
 pub(crate) fn default_protocol_timing() -> ProtocolTiming {
-    ProtocolTiming {
-        max_wait_blocks: sequencer_core::MAX_WAIT_BLOCKS,
-        preemptive_margin_blocks: 75,
-        l1_read_stale_after_blocks: 900,
-        seconds_per_block: 12,
+    ProtocolTiming::try_new(sequencer_core::MAX_WAIT_BLOCKS, 75, 900, 12)
+        .expect("valid test timing")
+}
+
+/// Lane fixtures. Production opens the Tip through
+/// `ensure_open_tip_for_recovery` and closes frames and batches with
+/// attributed executions and a snapshot (I7).
+impl Storage {
+    /// Open the genesis Tip with an explicit leading range; asserts none exists.
+    pub(crate) fn initialize_open_state(
+        &mut self,
+        safe_block: u64,
+        leading_direct_range: SafeInputRange,
+    ) -> rusqlite::Result<WriteHead> {
+        self.write(|tx| {
+            assert!(
+                load_current_write_head(tx)?.is_none(),
+                "open state already exists"
+            );
+            let batch_index = insert_tip_rows(tx, Some(0), None, safe_block)?;
+            persist_frame_direct_sequence_derived(tx, batch_index, 0, leading_direct_range)?;
+            Ok(load_current_write_head(tx)?.expect("genesis tip just inserted"))
+        })
+    }
+
+    /// Open the genesis Tip at the observed safe head unless one exists; the
+    /// unguarded twin of `ensure_open_tip_for_recovery`.
+    pub(crate) fn ensure_open_tip(&mut self) -> rusqlite::Result<()> {
+        self.write(|tx| {
+            if load_current_write_head(tx)?.is_some() {
+                return Ok(());
+            }
+            open_fresh_tip_in_tx(tx)
+        })
+    }
+
+    /// Rotate the frame with derived application offsets.
+    pub(crate) fn close_frame_only(
+        &mut self,
+        head: &mut WriteHead,
+        next_safe_block: u64,
+        leading_direct_range: SafeInputRange,
+    ) -> rusqlite::Result<()> {
+        let policy = self
+            .write(|tx| close_frame_derived_in(tx, head, next_safe_block, leading_direct_range))?;
+        head.advance_frame(policy, next_safe_block);
+        Ok(())
+    }
+
+    /// Close the batch without registering a snapshot.
+    pub(crate) fn close_frame_and_batch(
+        &mut self,
+        head: &mut WriteHead,
+        next_safe_block: u64,
+    ) -> rusqlite::Result<()> {
+        let (next_batch_index, now_ms, policy) =
+            self.write(|tx| seal_and_open_next_batch(tx, head.batch_index, next_safe_block))?;
+        head.move_to_next_batch(
+            next_batch_index,
+            from_unix_ms(now_ms),
+            policy,
+            next_safe_block,
+        );
+        Ok(())
+    }
+
+    pub(crate) fn batch_policy(&mut self) -> rusqlite::Result<BatchPolicy> {
+        query_batch_policy(&self.conn)
+    }
+
+    /// The batch-tree anchor nonce (default 0).
+    pub(crate) fn batch_tree_anchor(&mut self) -> rusqlite::Result<u64> {
+        self.read(|tx| super::mutations::batch_tree_anchor_in(tx))
+    }
+}
+
+/// Seeding and inspection levers. Each bypasses the guard, provenance or
+/// wall clock its production counterpart enforces.
+impl Storage {
+    /// Set the batch-tree anchor nonce directly; production sets it once, in
+    /// `complete_baseline_setup`. Aborts if `setup_complete` already exists
+    /// (`trg_batch_tree_anchor_write_once`).
+    pub(crate) fn set_batch_tree_anchor(&mut self, nonce: u64) -> rusqlite::Result<()> {
+        self.write(|tx| super::mutations::set_batch_tree_anchor_in(tx, nonce))
+    }
+
+    pub(crate) fn next_executed_input_count(&mut self) -> rusqlite::Result<ExecutedInputCount> {
+        self.read(|tx| next_executed_input_count_in(tx))
+    }
+
+    pub(crate) fn has_rollback_safe_snapshot(&mut self) -> rusqlite::Result<bool> {
+        self.read(|tx| super::snapshot_dumps::has_rollback_safe_snapshot_in(tx))
+    }
+
+    pub(crate) fn dump_lease_count(&mut self, dump_id: i64) -> rusqlite::Result<Option<i64>> {
+        use rusqlite::OptionalExtension;
+
+        self.read(|tx| {
+            tx.query_row(
+                "SELECT lease_count FROM dumps WHERE id = ?1",
+                [dump_id],
+                |r| r.get(0),
+            )
+            .optional()
+        })
+    }
+
+    /// A raw connection with [`Storage::open`]'s pragmas, for tests that reach
+    /// past the typed API (rewinding `synced_at_ms`, installing failure
+    /// triggers).
+    pub(crate) fn open_connection(path: &str) -> Result<rusqlite::Connection, StorageOpenError> {
+        super::open::open_writer_connection(path)
+    }
+
+    /// Append safe inputs at the current wall clock, with zero provenance.
+    pub(crate) fn append_safe_inputs(
+        &mut self,
+        safe_block: u64,
+        inputs: &[StoredSafeInput],
+        batch_submitter: Address,
+        timing: &ProtocolTiming,
+    ) -> rusqlite::Result<()> {
+        self.append_safe_inputs_with_timestamp(
+            safe_block,
+            i64_to_u64(now_unix_ms()) / 1000,
+            inputs,
+            batch_submitter,
+            timing,
+            FrontierMode::Populate,
+        )
+    }
+
+    /// [`Storage::append_safe_inputs`] at an explicit L1 timestamp of
+    /// `safe_block`. `frontier` gates the `safe_accepted_batches` update.
+    pub(crate) fn append_safe_inputs_with_timestamp(
+        &mut self,
+        safe_block: u64,
+        safe_block_timestamp: u64,
+        inputs: &[StoredSafeInput],
+        batch_submitter: Address,
+        timing: &ProtocolTiming,
+        frontier: FrontierMode,
+    ) -> rusqlite::Result<()> {
+        let rows: Vec<IngestedSafeInput> = inputs.iter().map(synthetic_row).collect();
+        self.append_ingested_safe_inputs_with_timestamp(
+            safe_block,
+            safe_block_timestamp,
+            rows.as_slice(),
+            batch_submitter,
+            timing,
+            frontier,
+        )
+    }
+
+    /// Highest valid `batch_index` (the open batch included), or `None`.
+    pub(crate) fn latest_batch_index(&mut self) -> rusqlite::Result<Option<u64>> {
+        let value: Option<i64> =
+            self.conn
+                .query_row("SELECT MAX(batch_index) FROM valid_batches", [], |row| {
+                    row.get(0)
+                })?;
+        Ok(value.map(i64_to_u64))
+    }
+
+    /// The sequenced L2 txs of one batch; `[]` for an invalidated batch.
+    /// Production replay pages the valid stream by offset, never per batch.
+    pub(crate) fn ordered_l2_txs_for_batch(
+        &mut self,
+        batch_index: u64,
+    ) -> rusqlite::Result<Vec<SequencedL2Tx>> {
+        const SQL: &str = "
+            SELECT
+                CASE WHEN s.user_op_pos_in_frame IS NOT NULL THEN 0 ELSE 1 END AS kind,
+                CASE
+                    WHEN s.user_op_pos_in_frame IS NOT NULL THEN u.sender
+                    WHEN s.safe_input_index IS NOT NULL THEN d.sender
+                    ELSE NULL
+                END AS sender,
+                CASE WHEN s.user_op_pos_in_frame IS NOT NULL THEN u.data ELSE NULL END AS data,
+                CASE WHEN s.user_op_pos_in_frame IS NOT NULL THEN f.fee  ELSE NULL END AS fee,
+                CASE WHEN s.safe_input_index   IS NOT NULL THEN d.payload      ELSE NULL END AS payload,
+                CASE WHEN s.safe_input_index   IS NOT NULL THEN d.block_number ELSE NULL END AS block_number
+            FROM application_inputs s
+            LEFT JOIN user_ops u
+              ON u.batch_index    = s.batch_index
+             AND u.frame_in_batch = s.frame_in_batch
+             AND u.pos_in_frame   = s.user_op_pos_in_frame
+            LEFT JOIN frames f
+              ON f.batch_index    = s.batch_index
+             AND f.frame_in_batch = s.frame_in_batch
+            LEFT JOIN safe_inputs d
+              ON d.safe_input_index = s.safe_input_index
+            WHERE s.batch_index = ?1
+            ORDER BY s.offset ASC
+        ";
+        let mut stmt = self.conn.prepare_cached(SQL)?;
+        let rows = stmt.query_map(params![u64_to_i64(batch_index)], |row| {
+            Ok(decode_l2_tx_row(
+                row.get(0)?,
+                row.get(1)?,
+                row.get(2)?,
+                row.get(3)?,
+                row.get(4)?,
+                row.get(5)?,
+            ))
+        })?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+    }
+
+    /// Mark one batch invalid; leaves an already-invalid row alone.
+    pub(crate) fn insert_invalid_batch(&mut self, batch_index: u64) -> rusqlite::Result<()> {
+        let now_ms = now_unix_ms();
+        self.conn.execute(
+            "UPDATE batches SET invalidated_at_ms = ?1 \
+             WHERE batch_index = ?2 AND invalidated_at_ms IS NULL",
+            params![now_ms, u64_to_i64(batch_index)],
+        )?;
+        Ok(())
+    }
+
+    /// The unguarded twin of `recover_post_flush_for_recovery`.
+    pub(crate) fn recover_post_flush(
+        &mut self,
+        danger_threshold: u64,
+    ) -> rusqlite::Result<Vec<u64>> {
+        self.write(|tx| recover_post_flush_inner(tx, danger_threshold))
+    }
+
+    /// The unguarded twin of `recover_aging_tip_for_recovery`.
+    pub(crate) fn recover_aging_tip(
+        &mut self,
+        danger_threshold: u64,
+    ) -> rusqlite::Result<Vec<u64>> {
+        self.write(|tx| recover_aging_tip_inner(tx, danger_threshold))
+    }
+
+    pub(crate) fn insert_batch_snapshot(
+        &mut self,
+        prefix: &Path,
+        batch_index: u64,
+    ) -> rusqlite::Result<i64> {
+        self.write(|tx| {
+            insert_batch_snapshot_in(tx, prefix, batch_index, next_executed_input_count_in(tx)?)
+        })
+    }
+
+    pub(crate) fn insert_baseline_snapshot(
+        &mut self,
+        prefix: &Path,
+        count: ExecutedInputCount,
+    ) -> rusqlite::Result<i64> {
+        self.write(|tx| insert_baseline_snapshot_in(tx, prefix, count))
+    }
+
+    /// Pin the oracle's observation stamp instead of the wall clock.
+    pub(crate) fn set_log_gas_price_updated_at_ms_for_test(
+        &mut self,
+        updated_at_ms: u64,
+    ) -> rusqlite::Result<()> {
+        let changed = self.conn.execute(
+            "UPDATE batch_policy SET log_gas_price_updated_at_ms = ?1 WHERE singleton_id = 0",
+            params![u64_to_i64(updated_at_ms)],
+        )?;
+        if changed != 1 {
+            return Err(rusqlite::Error::StatementChangedRows(changed));
+        }
+        Ok(())
     }
 }
 
-pub(crate) struct TestDb {
-    pub _dir: TempDir,
-    pub path: String,
+/// A provenance-free [`StoredSafeInput`] as a row with explicit zero
+/// provenance.
+fn synthetic_row(input: &StoredSafeInput) -> IngestedSafeInput {
+    IngestedSafeInput {
+        sender: input.sender,
+        payload: input.payload.clone(),
+        block_number: input.block_number,
+        block_timestamp: 0,
+        transaction_hash: B256::ZERO,
+    }
 }
 
-pub(crate) fn temp_db(name: &str) -> TestDb {
-    let dir = tempfile::Builder::new()
-        .prefix(format!("sequencer-{name}-").as_str())
-        .tempdir()
-        .expect("create temporary test directory");
-    let path = dir.path().join("sequencer.sqlite");
-    TestDb {
-        _dir: dir,
-        path: path.to_string_lossy().into_owned(),
+fn decode_l2_tx_row(
+    kind: i64,
+    sender: Option<Vec<u8>>,
+    data: Option<Vec<u8>>,
+    fee: Option<i64>,
+    payload: Option<Vec<u8>>,
+    block_number: Option<i64>,
+) -> SequencedL2Tx {
+    let sender_bytes = sender.expect("ordered replay row: missing sender");
+    assert_eq!(
+        sender_bytes.len(),
+        20,
+        "ordered replay row: sender must be 20 bytes"
+    );
+    if kind == 0 {
+        SequencedL2Tx::UserOp(ValidUserOp {
+            sender: Address::from_slice(sender_bytes.as_slice()),
+            // Replay uses the persisted frame fee (log-space exponent) to mirror canonical execution.
+            fee: i64_to_u16(fee.expect("ordered replay row: missing fee")),
+            data: data.expect("ordered replay row: missing data"),
+        })
+    } else {
+        SequencedL2Tx::Direct(DirectInput {
+            sender: Address::from_slice(sender_bytes.as_slice()),
+            block_number: i64_to_u64(
+                block_number.expect("ordered replay row: missing block_number"),
+            ),
+            payload: payload.expect("ordered replay row: missing payload"),
+        })
     }
 }
 
-/// Pin the trusted deployment identity a production setup establishes before
-/// any fresh-Tip attribution can classify safe inputs.
-pub(crate) fn pin_test_deployment_identity(
-    storage: &mut Storage,
-    batch_submitter_address: Address,
-) {
+/// Alpha 17 (17000/1000): `log_alpha` 364 = round(log(17)) and
+/// `log_one_plus_alpha` 371 = round(log(18)), base 129/128. The batch-size
+/// target becomes 1403 - 364 - 419 = 620 (about 124 bytes), below one 126-byte
+/// user op, so every op closes its batch.
+pub(crate) fn set_one_op_batch_target(storage: &mut Storage) {
     storage
-        .load_or_insert_deployment_identity(DeploymentIdentity {
-            chain_id: 1,
-            app_address: Address::repeat_byte(0x11),
-            input_box_address: Address::repeat_byte(0x22),
-            app_deployment_block: 0,
-            batch_submitter_address,
-            fee_oracle: FeeOracleIdentity::Fixed { log_gas_price: 0 },
-        })
-        .expect("pin test deployment identity");
+        .conn
+        .execute(
+            "UPDATE batch_policy SET log_alpha = 364, log_one_plus_alpha = 371 \
+             WHERE singleton_id = 0",
+            [],
+        )
+        .expect("set alpha");
+}
+
+fn close_frame_derived_in(
+    tx: &rusqlite::Transaction<'_>,
+    head: &WriteHead,
+    next_safe_block: u64,
+    leading_direct_range: SafeInputRange,
+) -> rusqlite::Result<BatchPolicy> {
+    let (policy, next_frame_in_batch) = open_successor_frame_in(tx, head, next_safe_block)?;
+    persist_frame_direct_sequence_derived(
+        tx,
+        head.batch_index,
+        next_frame_in_batch,
+        leading_direct_range,
+    )?;
+    Ok(policy)
 }
 
 /// Recovery-storage fixture with the same prerequisite ordering as setup:
@@ -150,7 +468,7 @@ pub(crate) fn seed_closed_batches(storage: &mut Storage, count: u64) {
 }
 
 /// Pull every valid sequenced L2 tx out of storage, dropping the offset.
-/// Test-only convenience around `ordered_l2_txs_page_from`.
+/// Test-only convenience around `canonical_history_page`.
 pub(crate) fn all_ordered_l2_txs(storage: &mut Storage) -> Vec<SequencedL2Tx> {
     let bounds = storage.history_bounds().expect("history bounds");
     storage
@@ -165,8 +483,8 @@ pub(crate) fn all_ordered_l2_txs(storage: &mut Storage) -> Vec<SequencedL2Tx> {
         .rows
         .into_iter()
         .map(|row| match row.context {
-            super::egress::L2TxContext::UserOp { tx, .. } => SequencedL2Tx::UserOp(tx),
-            super::egress::L2TxContext::DirectInput { tx, .. } => SequencedL2Tx::Direct(tx),
+            super::L2TxContext::UserOp { tx, .. } => SequencedL2Tx::UserOp(tx),
+            super::L2TxContext::DirectInput { tx, .. } => SequencedL2Tx::Direct(tx),
         })
         .collect()
 }
@@ -204,3 +522,68 @@ pub(crate) fn record_canonical_divergence(
         )
         .expect("record canonical divergence");
 }
+
+/// Recovery-test plumbing over [`Storage`]. `land` and `advance_safe_head`
+/// append through the production path with [`SENDER_A`] as the submitter and
+/// default timing; every input lands at `safe_block`.
+pub(crate) trait RecoveryFixture {
+    /// Exercise the same frame-advance-before-close sequence as the live lane.
+    fn close_batch_at(
+        &mut self,
+        head: &mut crate::storage::WriteHead,
+        safe_block: u64,
+    ) -> rusqlite::Result<()>;
+    fn land(&mut self, safe_block: u64, inputs: &[(Address, Vec<u8>)]);
+    fn advance_safe_head(&mut self, safe_block: u64);
+}
+impl RecoveryFixture for Storage {
+    fn close_batch_at(
+        &mut self,
+        head: &mut crate::storage::WriteHead,
+        safe_block: u64,
+    ) -> rusqlite::Result<()> {
+        if head.safe_block != safe_block {
+            let start = self.next_undrained_safe_input_index()?;
+            let end: i64 = self.read(|tx| {
+                tx.query_row(
+                    "SELECT COUNT(*) FROM safe_inputs WHERE block_number <= ?1",
+                    [i64::try_from(safe_block).unwrap()],
+                    |r| r.get(0),
+                )
+            })?;
+            self.close_frame_only(
+                head,
+                safe_block,
+                SafeInputRange::new(start, u64::try_from(end).unwrap()),
+            )?;
+        }
+        self.close_frame_and_batch(head, safe_block)
+    }
+
+    #[track_caller]
+    fn land(&mut self, safe_block: u64, inputs: &[(Address, Vec<u8>)]) {
+        let inputs: Vec<StoredSafeInput> = inputs
+            .iter()
+            .map(|(sender, payload)| StoredSafeInput {
+                sender: *sender,
+                payload: payload.clone(),
+                block_number: safe_block,
+            })
+            .collect();
+        self.append_safe_inputs(safe_block, &inputs, SENDER_A, &default_protocol_timing())
+            .expect("append safe inputs");
+    }
+
+    #[track_caller]
+    fn advance_safe_head(&mut self, safe_block: u64) {
+        self.land(safe_block, &[]);
+    }
+}
+
+/// A storage over a fresh pinned database. Bind the [`TestDb`] as `_db`, never
+/// `_`: dropping it deletes the directory under the open connection.
+pub(crate) fn open_temp_storage(name: &str) -> (TestDb, Storage) {
+    let db = temp_db_with_default_deployment_identity(name);
+    let storage = Storage::open(db.path.as_str()).expect("open storage");
+    (db, storage)
+}
diff --git a/sequencer/src/test_support/l1.rs b/sequencer/src/test_support/l1.rs
new file mode 100644
index 00000000..aa34349a
--- /dev/null
+++ b/sequencer/src/test_support/l1.rs
@@ -0,0 +1,63 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! InputBox inputs as `eth_getLogs` returns them, for the reader and the
+//! batch poster.
+
+use alloy::sol_types::SolCall;
+use alloy_primitives::{Address, B256, U256};
+use cartesi_rollups_contracts::input_box::InputBox::InputAdded;
+use cartesi_rollups_contracts::inputs::Inputs::EvmAdvanceCall;
+
+/// The ABI-encoded `EvmAdvance` input the InputBox builds for one `addInput`.
+pub(crate) fn evm_advance_input(
+    chain_id: u64,
+    app_contract: Address,
+    msg_sender: Address,
+    block_number: u64,
+    index: u64,
+    payload: &[u8],
+) -> Vec<u8> {
+    EvmAdvanceCall {
+        chainId: U256::from(chain_id),
+        appContract: app_contract,
+        msgSender: msg_sender,
+        blockNumber: U256::from(block_number),
+        blockTimestamp: U256::from(1_700_000_000_u64),
+        prevRandao: U256::ZERO,
+        index: U256::from(index),
+        payload: payload.to_vec().into(),
+    }
+    .abi_encode()
+}
+
+/// An `InputAdded` event at `topic_index` carrying `input`, and its log.
+pub(crate) fn input_added_pair(
+    topic_index: u64,
+    input: Vec<u8>,
+    block_number: Option<u64>,
+    transaction_hash: Option<B256>,
+) -> (InputAdded, alloy::rpc::types::Log) {
+    let event = InputAdded {
+        appContract: Address::ZERO,
+        index: U256::from(topic_index),
+        input: input.into(),
+    };
+    let log = alloy::rpc::types::Log {
+        inner: alloy_primitives::Log {
+            address: Address::ZERO,
+            data: alloy_primitives::LogData::new_unchecked(
+                Vec::new(),
+                alloy_primitives::Bytes::new(),
+            ),
+        },
+        block_hash: None,
+        block_number,
+        block_timestamp: None,
+        transaction_hash,
+        transaction_index: Some(0),
+        log_index: Some(0),
+        removed: false,
+    };
+    (event, log)
+}
diff --git a/sequencer/src/test_support/mod.rs b/sequencer/src/test_support/mod.rs
new file mode 100644
index 00000000..55aeea9e
--- /dev/null
+++ b/sequencer/src/test_support/mod.rs
@@ -0,0 +1,93 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! Shared `#[cfg(test)]` fixtures for the sequencer crate.
+
+use std::time::Duration;
+
+use alloy_primitives::Address;
+use tempfile::TempDir;
+
+use crate::ingress::inclusion_lane::InclusionLaneError;
+use crate::runtime::shutdown::RuntimeScope;
+use crate::storage::{DeploymentIdentity, FeeOracleIdentity, Storage};
+
+pub(crate) mod l1;
+pub(crate) mod server;
+mod stub_app;
+
+pub(crate) use stub_app::{ReplayEvent, StubApp, create_structured_dump};
+
+pub(crate) struct TestDb {
+    pub _dir: TempDir,
+    pub path: String,
+}
+
+pub(crate) fn temp_db(name: &str) -> TestDb {
+    let dir = tempfile::Builder::new()
+        .prefix(format!("sequencer-{name}-").as_str())
+        .tempdir()
+        .expect("create temporary test directory");
+    let path = dir.path().join("sequencer.sqlite");
+    TestDb {
+        _dir: dir,
+        path: path.to_string_lossy().into_owned(),
+    }
+}
+
+/// Pin the trusted deployment identity a production setup establishes before
+/// any fresh-Tip attribution can classify safe inputs.
+pub(crate) fn pin_test_deployment_identity(
+    storage: &mut Storage,
+    batch_submitter_address: Address,
+) {
+    storage
+        .load_or_insert_deployment_identity(DeploymentIdentity {
+            chain_id: 1,
+            app_address: Address::repeat_byte(0x11),
+            input_box_address: Address::repeat_byte(0x22),
+            app_deployment_block: 0,
+            batch_submitter_address,
+            fee_oracle: FeeOracleIdentity::Fixed { log_gas_price: 0 },
+        })
+        .expect("pin test deployment identity");
+}
+
+/// Poll `predicate` every 5 ms until it holds or `timeout` passes; returns its
+/// final value.
+pub(crate) async fn wait_until(timeout: Duration, mut predicate: impl FnMut() -> bool) -> bool {
+    let started = tokio::time::Instant::now();
+    while started.elapsed() < timeout {
+        if predicate() {
+            return true;
+        }
+        tokio::time::sleep(Duration::from_millis(5)).await;
+    }
+    predicate()
+}
+
+/// Accept one connection on `listener`, read the request, and write
+/// `response` verbatim: a raw HTTP answer no client library would build.
+pub(crate) async fn answer_once(listener: tokio::net::TcpListener, response: String) {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+    let (mut socket, _) = listener.accept().await.expect("accept");
+    let mut request = [0_u8; 4096];
+    let _ = socket.read(&mut request).await.expect("read request");
+    socket
+        .write_all(response.as_bytes())
+        .await
+        .expect("write response");
+}
+
+pub(crate) async fn shutdown_lane(
+    shutdown: &RuntimeScope,
+    handle: tokio::task::JoinHandle<Result<(), InclusionLaneError>>,
+) {
+    shutdown.request_shutdown();
+    let joined = tokio::time::timeout(Duration::from_secs(2), handle)
+        .await
+        .expect("wait for lane shutdown");
+    let result = joined.expect("join lane task");
+    assert!(result.is_ok(), "lane should shut down cleanly: {result:?}");
+}
diff --git a/sequencer/src/test_support/server.rs b/sequencer/src/test_support/server.rs
new file mode 100644
index 00000000..f964ac06
--- /dev/null
+++ b/sequencer/src/test_support/server.rs
@@ -0,0 +1,293 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! An in-process API server over a test database: [`TestServer`] and the
+//! two-listener [`bind_api_listeners`] helper.
+
+use std::net::SocketAddr;
+use std::time::Duration;
+
+use alloy_primitives::{Address, Signature};
+use alloy_sol_types::Eip712Domain;
+use app_core::application::{MAX_METHOD_PAYLOAD_BYTES, WalletApp, WalletConfig};
+use sequencer_core::application::Application;
+use sequencer_core::history::ExecutedInputCount;
+use sequencer_core::user_op::{SignedUserOp, UserOp};
+use tokio::sync::mpsc;
+
+use crate::egress::l2_tx_feed::{L2TxFeed, L2TxFeedConfig};
+use crate::http::{self, ApiConfig};
+use crate::ingress::inclusion_lane::{
+    InclusionLane, InclusionLaneConfig, InclusionLaneError, PendingUserOp, dump_info,
+};
+use crate::runtime::shutdown::RuntimeScope;
+use crate::storage::Storage;
+
+/// Two ephemeral loopback listeners; returns (listeners, public, internal).
+pub(crate) async fn bind_api_listeners() -> (
+    crate::http::ApiListeners,
+    std::net::SocketAddr,
+    std::net::SocketAddr,
+) {
+    let public = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind public listener");
+    let internal = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind internal listener");
+    let (public_addr, internal_addr) = (
+        public.local_addr().expect("public addr"),
+        internal.local_addr().expect("internal addr"),
+    );
+    (
+        crate::http::ApiListeners { public, internal },
+        public_addr,
+        internal_addr,
+    )
+}
+
+/// The public routes, per README#api; every other route is internal.
+pub(crate) const PUBLIC_ROUTES: [&str; 4] = ["/tx", "/fee", "/nonce", "/domain"];
+
+enum QueueMode {
+    /// Nothing drains `/tx`; the queue only has to exist.
+    Idle,
+    /// A `WalletApp` inclusion lane drains the queue.
+    Lane,
+    /// A capacity-one queue that already holds a parked op and is never
+    /// drained, so every `/tx` finds it full.
+    Full,
+}
+
+pub(crate) struct TestServerBuilder {
+    db_path: String,
+    domain: Eip712Domain,
+    queue: QueueMode,
+    max_body_bytes: Option<usize>,
+}
+
+impl TestServerBuilder {
+    pub(crate) fn domain(mut self, domain: Eip712Domain) -> Self {
+        self.domain = domain;
+        self
+    }
+
+    pub(crate) fn with_lane(mut self) -> Self {
+        self.queue = QueueMode::Lane;
+        self
+    }
+
+    pub(crate) fn full_queue(mut self) -> Self {
+        self.queue = QueueMode::Full;
+        self
+    }
+
+    pub(crate) fn max_body(mut self, max_body_bytes: usize) -> Self {
+        self.max_body_bytes = Some(max_body_bytes);
+        self
+    }
+
+    pub(crate) async fn start(self) -> TestServer {
+        let (listeners, public_addr, internal_addr) = bind_api_listeners().await;
+        let shutdown = RuntimeScope::default();
+        let db_path = self.db_path.as_str();
+        let (tx, lane_handle, queue_rx) = match self.queue {
+            QueueMode::Idle => {
+                let (tx, rx) = mpsc::channel::<PendingUserOp>(1);
+                (tx, None, Some(rx))
+            }
+            QueueMode::Lane => {
+                let (tx, handle) = start_wallet_lane(db_path, &shutdown);
+                (tx, Some(handle), None)
+            }
+            QueueMode::Full => {
+                let _storage = Storage::open(db_path).expect("open storage");
+                let (tx, rx) = mpsc::channel::<PendingUserOp>(1);
+                let (respond_to, _) = tokio::sync::oneshot::channel();
+                tx.try_send(PendingUserOp {
+                    signed: SignedUserOp {
+                        sender: Address::ZERO,
+                        signature: Signature::test_signature(),
+                        user_op: UserOp {
+                            nonce: 0,
+                            max_fee: 0,
+                            data: Vec::new().into(),
+                        },
+                    },
+                    respond_to,
+                    received_at: std::time::SystemTime::now(),
+                })
+                .expect("park one op in the lane queue");
+                (tx, None, Some(rx))
+            }
+        };
+        let tx_feed = L2TxFeed::new(
+            db_path.to_string(),
+            shutdown.clone(),
+            L2TxFeedConfig {
+                idle_poll_interval: Duration::from_millis(2),
+                page_size: 64,
+            },
+        );
+        let mut config = ApiConfig::new(self.domain, MAX_METHOD_PAYLOAD_BYTES);
+        if let Some(max_body_bytes) = self.max_body_bytes {
+            config.max_body_bytes = max_body_bytes;
+        }
+        let server_task = http::start_on_listeners(
+            listeners,
+            tx,
+            shutdown.clone(),
+            tx_feed,
+            config,
+            http::SnapshotState {
+                db_path: db_path.to_string(),
+                state_file_in_dump: |dump_dir| {
+                    WalletApp::state_file_in_dump(&dump_info::app_prefix(dump_dir))
+                },
+            },
+        );
+        TestServer {
+            public_addr,
+            internal_addr,
+            lane_handle,
+            shutdown,
+            server_task: Some(server_task),
+            _queue_rx: queue_rx,
+        }
+    }
+}
+
+/// Start a `WalletApp` lane over `db_path`, registering a genesis dump first
+/// when the database has no finalized snapshot.
+fn start_wallet_lane(
+    db_path: &str,
+    shutdown: &RuntimeScope,
+) -> (
+    mpsc::Sender<PendingUserOp>,
+    tokio::task::JoinHandle<Result<(), InclusionLaneError>>,
+) {
+    let mut storage = Storage::open(db_path).expect("open storage");
+    let dumps_dir = tempfile::tempdir().expect("test dumps dir").keep();
+    // Always-load invariant: ensure a finalized snapshot exists
+    // before the lane starts. On warm restart there's already one;
+    // on cold start we register a genesis dump from a fresh wallet.
+    // The lane reloads via `from_dump` either way.
+    if storage.finalized_dump().expect("read finalized").is_none() {
+        let mut app = WalletApp::new(WalletConfig::default());
+        let genesis_dir = dumps_dir.join("genesis");
+        dump_info::create_dump_dir_with_info(
+            &mut app,
+            &genesis_dir,
+            &dump_info::DumpInfo {
+                format_version: dump_info::FORMAT_VERSION,
+                next_batch_nonce: 0,
+            },
+        )
+        .expect("genesis dump");
+        storage
+            .insert_baseline_snapshot(&genesis_dir, ExecutedInputCount::ZERO)
+            .expect("register genesis");
+    }
+
+    // Tip-existence invariant: open the genesis Tip only after the genesis
+    // snapshot exists. Opening the Tip may attribute already-ingested direct
+    // inputs, so doing this first would give the fresh application dump the
+    // wrong executed-input count.
+    storage.ensure_open_tip().expect("establish open tip");
+    let head = storage
+        .open_state()
+        .expect("load open state")
+        .expect("open state exists");
+    // Default log_gas_price=0 -> 0+296+20+419+621 = 1356.
+    assert_eq!(head.frame_fee, 1356);
+
+    InclusionLane::<WalletApp>::start(
+        128,
+        shutdown.clone(),
+        storage,
+        InclusionLaneConfig {
+            dumps_dir,
+            max_user_ops_per_chunk: 32,
+            safe_input_buffer_capacity: 32,
+            max_batch_open: Duration::from_secs(60 * 60),
+            idle_poll_interval: Duration::from_millis(2),
+            frontier_min_interval: Duration::ZERO,
+        },
+    )
+}
+
+/// The API on two loopback listeners over a test database. Dropping it
+/// requests shutdown and aborts its tasks; [`Self::shutdown`] instead waits
+/// for both to stop cleanly.
+pub(crate) struct TestServer {
+    pub(crate) public_addr: SocketAddr,
+    pub(crate) internal_addr: SocketAddr,
+    pub(crate) lane_handle: Option<tokio::task::JoinHandle<Result<(), InclusionLaneError>>>,
+    shutdown: RuntimeScope,
+    server_task: Option<http::ApiServerTask>,
+    _queue_rx: Option<mpsc::Receiver<PendingUserOp>>,
+}
+
+impl TestServer {
+    pub(crate) fn builder(db_path: &str) -> TestServerBuilder {
+        TestServerBuilder {
+            db_path: db_path.to_string(),
+            domain: sequencer_core::build_input_domain(1, Address::ZERO),
+            queue: QueueMode::Idle,
+            max_body_bytes: None,
+        }
+    }
+
+    pub(crate) async fn start(db_path: &str) -> Self {
+        Self::builder(db_path).start().await
+    }
+
+    /// A URL on the listener that serves `path`.
+    pub(crate) fn url(&self, path: &str) -> String {
+        let route = path.split('?').next().unwrap_or(path);
+        let addr = if PUBLIC_ROUTES.contains(&route) {
+            self.public_addr
+        } else {
+            self.internal_addr
+        };
+        format!("http://{addr}{path}")
+    }
+
+    pub(crate) async fn shutdown(mut self) {
+        self.shutdown.request_shutdown();
+        if let Some(task) = self.lane_handle.take() {
+            let lane_result = tokio::time::timeout(Duration::from_secs(3), task)
+                .await
+                .expect("wait for inclusion lane")
+                .expect("join inclusion lane task");
+            // The router may close the lane's queue before the lane sees the
+            // shutdown request; the lane still stops cleanly.
+            assert!(
+                lane_result.is_ok(),
+                "expected clean lane shutdown, got {lane_result:?}"
+            );
+        }
+        if let Some(task) = self.server_task.take() {
+            let server_result = tokio::time::timeout(Duration::from_secs(3), task)
+                .await
+                .expect("wait for server task")
+                .expect("join server task");
+            assert!(
+                server_result.is_ok(),
+                "expected clean server shutdown, got {server_result:?}"
+            );
+        }
+    }
+}
+
+impl Drop for TestServer {
+    fn drop(&mut self) {
+        self.shutdown.request_shutdown();
+        if let Some(task) = self.server_task.take() {
+            task.abort();
+        }
+        if let Some(task) = self.lane_handle.take() {
+            task.abort();
+        }
+    }
+}
diff --git a/sequencer/src/test_support/stub_app.rs b/sequencer/src/test_support/stub_app.rs
new file mode 100644
index 00000000..ef40f09d
--- /dev/null
+++ b/sequencer/src/test_support/stub_app.rs
@@ -0,0 +1,189 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+use std::marker::PhantomData;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use alloy_primitives::Address;
+use app_core::application::MAX_METHOD_PAYLOAD_BYTES;
+use sequencer_core::application::{
+    AppError, AppOutputs, Application, ApplicationProgress, InvalidReason, ValidationOutcome,
+};
+use sequencer_core::history::ExecutedInputCount;
+use sequencer_core::l2_tx::{DirectInput, ValidUserOp};
+use sequencer_core::user_op::UserOp;
+
+use crate::ingress::inclusion_lane::dump_info::{self, create_dump_dir_with_info};
+use crate::runtime::shutdown::RuntimeScope;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum ReplayEvent {
+    UserOp {
+        sender: Address,
+        data: Vec<u8>,
+    },
+    DirectInput {
+        sender: Address,
+        block_number: u64,
+        payload: Vec<u8>,
+    },
+}
+
+/// Accepts and executes every input. Dumps persist only progress (two LE
+/// `u64`s at `prefix/state`); `from_dump` resets every other field, so a test
+/// observes what the lane executed through the dumps it writes.
+#[derive(Default)]
+pub(crate) struct StubApp {
+    pub(crate) progress: ApplicationProgress,
+    /// Inputs this instance executed; not persisted.
+    pub(crate) replayed: Vec<ReplayEvent>,
+    /// Test-only scheduling seam used to keep a rejected queue saturated long
+    /// enough to distinguish one bounded turn from an unbounded drain.
+    pub(crate) reject_user_ops_after: Option<Duration>,
+    pub(crate) fail_validation: bool,
+    pub(crate) fail_apply: bool,
+    pub(crate) fail_dump: bool,
+    /// Requests shutdown while the lane executes a direct input, so the
+    /// request lands after the loop's shutdown check and before the queue is
+    /// read.
+    pub(crate) shutdown_on_direct: Option<RuntimeScope>,
+    /// Not `Sync`, and no `Clone` derive: hosts must not require either.
+    pub(crate) not_sync: PhantomData<std::cell::Cell<()>>,
+}
+
+impl StubApp {
+    pub(crate) fn with_progress(executed_input_count: u64, last_executed_safe_block: u64) -> Self {
+        Self {
+            progress: ApplicationProgress::try_new(
+                ExecutedInputCount::new(executed_input_count),
+                last_executed_safe_block,
+            )
+            .expect("coherent progress"),
+            ..Self::default()
+        }
+    }
+}
+
+fn internal_failure() -> AppError {
+    AppError::Internal {
+        reason: "app invariant failed".to_owned(),
+    }
+}
+
+impl Application for StubApp {
+    fn max_method_payload_bytes() -> usize {
+        MAX_METHOD_PAYLOAD_BYTES
+    }
+
+    fn validate_user_op(
+        &self,
+        _sender: Address,
+        user_op: &UserOp,
+        _current_fee: u16,
+    ) -> Result<ValidationOutcome, AppError> {
+        if self.fail_validation {
+            return Err(internal_failure());
+        }
+        if let Some(delay) = self.reject_user_ops_after {
+            std::thread::sleep(delay);
+            return Ok(ValidationOutcome::Reject(InvalidReason::InvalidNonce {
+                expected: user_op.nonce.wrapping_add(1),
+                got: user_op.nonce,
+            }));
+        }
+        Ok(ValidationOutcome::Accept)
+    }
+
+    fn apply_valid_user_op(
+        &mut self,
+        user_op: &ValidUserOp,
+        safe_block: u64,
+    ) -> Result<AppOutputs, AppError> {
+        if self.fail_apply {
+            return Err(internal_failure());
+        }
+        self.replayed.push(ReplayEvent::UserOp {
+            sender: user_op.sender,
+            data: user_op.data.clone(),
+        });
+        self.progress.advance(safe_block);
+        Ok(Vec::new())
+    }
+
+    fn apply_direct_input(&mut self, input: &DirectInput) -> Result<AppOutputs, AppError> {
+        if let Some(shutdown) = &self.shutdown_on_direct {
+            shutdown.request_shutdown();
+        }
+        self.replayed.push(ReplayEvent::DirectInput {
+            sender: input.sender,
+            block_number: input.block_number,
+            payload: input.payload.clone(),
+        });
+        self.progress.advance(input.block_number);
+        Ok(Vec::new())
+    }
+
+    fn progress(&self) -> ApplicationProgress {
+        self.progress
+    }
+
+    fn from_dump(prefix: &Path) -> Result<Self, AppError> {
+        let bytes = std::fs::read(Self::state_file_in_dump(prefix))?;
+        Ok(Self {
+            progress: decode_progress(&bytes)?,
+            ..Self::default()
+        })
+    }
+
+    fn create_dump(&mut self, prefix: &Path) -> Result<(), AppError> {
+        if self.fail_dump {
+            return Err(std::io::Error::other("injected application dump failure").into());
+        }
+        std::fs::create_dir(prefix)?;
+        std::fs::write(
+            Self::state_file_in_dump(prefix),
+            encode_progress(self.progress),
+        )?;
+        Ok(())
+    }
+
+    fn state_file_in_dump(prefix: &Path) -> PathBuf {
+        prefix.join("state")
+    }
+}
+
+fn encode_progress(progress: ApplicationProgress) -> [u8; 16] {
+    let mut bytes = [0_u8; 16];
+    bytes[..8].copy_from_slice(&progress.executed_input_count().get().to_le_bytes());
+    bytes[8..].copy_from_slice(&progress.last_executed_safe_block().to_le_bytes());
+    bytes
+}
+
+fn decode_progress(bytes: &[u8]) -> Result<ApplicationProgress, AppError> {
+    if bytes.len() != 16 {
+        return Err(AppError::Internal {
+            reason: "StubApp dump must be exactly 16 bytes".to_owned(),
+        });
+    }
+    let count = u64::from_le_bytes(bytes[..8].try_into().expect("checked slice length"));
+    let safe_block = u64::from_le_bytes(bytes[8..].try_into().expect("checked slice length"));
+    Ok(
+        ApplicationProgress::try_new(ExecutedInputCount::new(count), safe_block)
+            .expect("coherent progress"),
+    )
+}
+
+/// Mirror of the production dump layout: a structured directory with
+/// `info.toml` and the stub's dump under `state`.
+pub(crate) fn create_structured_dump(dump_dir: &Path) {
+    create_dump_dir_with_info(
+        &mut StubApp::default(),
+        dump_dir,
+        &dump_info::DumpInfo {
+            format_version: dump_info::FORMAT_VERSION,
+            next_batch_nonce: 0,
+        },
+    )
+    .expect("create structured dump");
+}
diff --git a/tests/benchmarks/BENCHMARK_SPEC.md b/tests/benchmarks/BENCHMARK_SPEC.md
index e4f5ab21..773a233f 100644
--- a/tests/benchmarks/BENCHMARK_SPEC.md
+++ b/tests/benchmarks/BENCHMARK_SPEC.md
@@ -37,6 +37,14 @@ This spec makes that requirement measurable and repeatable.
 4. `rss_growth_mb`: `rss_end_mb - rss_start_mb`.
 5. `rss_growth_per_1k_accepted_tx_mb`: RSS growth normalized by accepted tx volume.
 
+### 2.5 Storage and Drain Metrics
+
+1. `logical_db_bytes`: `(page_count - freelist_count) * page_size`, read over a read-only connection at run end. It counts pages still in the WAL and excludes free pages.
+2. `db_bytes` and `wal_bytes`: on-disk footprint of the SQLite file and its WAL at run end.
+3. `growth_bytes_per_1k_accepted`: growth of `logical_db_bytes` over the measured steps, normalized by accepted tx volume.
+4. `batches_pending`: valid sealed batches whose nonce is not yet in `safe_accepted_batches` when the drain starts. The drain starts when the last measured step returns: every load worker is past its deadline, and in round-trip mode the WS matcher has finished, bounded by `--max-ws-wait-ms`.
+5. `drain_secs`: time from the drain start until `safe_accepted_batches` holds the highest valid sealed batch nonce read at the start. The open batch is excluded, so this is the submission backlog, not the batch-open window.
+
 ## 3. Measurement Method
 
 ### 3.1 Percentiles and Sample Size
@@ -45,7 +53,7 @@ This spec makes that requirement measurable and repeatable.
 2. Target percentile is `p99` for both latency goals.
 3. `p99.9` is diagnostic in this phase.
 4. Runs are valid for target evaluation only when `accepted_count >= 5,000`.
-5. `p99.9` is considered reliable when `accepted_count >= 10,000`; otherwise it must be marked diagnostic-low-confidence.
+5. `p99.9` is diagnostic below `accepted_count` 10,000.
 
 ### 3.2 Request Outcome Classification
 
@@ -72,25 +80,29 @@ This spec makes that requirement measurable and repeatable.
 1. For end-to-end runs, every HTTP-accepted request must have a matching WS `user_op` within the configured wait timeout.
 2. Any sanity assertion failure indicates a correctness bug and invalidates the benchmark run.
 
+### 3.6 Storage and Drain Collection Rules
+
+1. Self-contained runs only. The start size is sampled after warmup, the end size after the drain and before shutdown, because a clean close checkpoints the WAL away.
+2. The WAL file fills to SQLite's default autocheckpoint size (1000 pages, about 4 MB) and stays there, because a checkpoint reuses it rather than truncating it. That is why growth uses the logical size; the file sizes are footprint only.
+3. During the drain the harness mines one L1 block per second at Anvil's own clock and stops after 120 s; `drain_secs` is then reported as not reached.
+4. `drain_secs` is shaped by the environment: the submitter's idle poll (5 s by default), Anvil's safe-head lag (`--slots-in-an-epoch 1`) and the 1 s poll. It does not measure submitter throughput.
+5. Neither metric has a threshold in this phase.
+6. A recovery cascade during the run reuses batch nonces, which makes `drain_secs` meaningless.
+
 ## 4. Benchmark Scenarios
 
 ### 4.1 Profiling Scenarios
 
 1. Same-host baseline (`no injected latency`) for low-noise branch comparisons.
-2. Canonical network-aware scenario.
+2. Canonical network-aware scenario (not implemented; see §4.2).
 3. Throughput/concurrency sweeps to locate knee and overload behavior.
 
 ### 4.2 Canonical Network-Aware Scenario (Target Evaluation)
 
-1. The injected profile must be applied to both HTTP `POST /tx` and WS `GET /ws/subscribe` paths.
-2. Base delay: `+50ms one-way` in each direction (`~100ms RTT`).
-3. Jitter: `+/-10ms` around base delay.
-4. Packet loss: `0%`.
-5. No artificial bandwidth cap.
-6. Packet reordering, duplication, and corruption injection disabled.
-7. Reports must include the network shaping tool and exact shaping config.
+Target evaluation injects `+50ms` one-way (`~100ms RTT`, `+/-10ms` jitter, no loss) on both `POST /tx` and the WS subscription.
+No shaper exists, so every run is a same-host baseline and carries no verdict.
 
-## 5. Targets and Verdicts
+## 5. Targets
 
 ### 5.1 Target Goals
 
@@ -99,21 +111,8 @@ This spec makes that requirement measurable and repeatable.
 
 ### 5.2 Target Evaluation Conditions
 
-The latency goals above are evaluated under these conditions:
-
-1. `rejection_rate == 0%` (equivalently `rejected_count == 0`).
-2. Canonical network-aware scenario is satisfied.
-3. Run is valid per sample-size policy.
-
-### 5.3 Separate Verdicts
-
-1. `ACK_TARGET` is `PASS` when all hold:
-   - target evaluation conditions are satisfied
-   - `ack_latency_ms p99 <= 500ms`
-2. `SOFT_CONFIRM_TARGET` is `PASS` when all hold:
-   - target evaluation conditions are satisfied
-   - `soft_confirm_latency_ms p99 <= 1000ms`
-   - sanity assertions are satisfied
+A run evaluates the goals above only when it has zero rejections, runs under the canonical network-aware scenario (§4.2), and meets the sample-size rule (§3.1).
+The soft-confirm goal also requires the sanity assertions (§3.5) to hold.
 
 ## 6. Required Report Content
 
@@ -123,22 +122,23 @@ Each benchmark report must include:
 2. Accepted/rejected counts and rejection rate.
 3. Accepted TPS and total run duration.
 4. Rejection reason breakdown (when available).
-5. Network profile and shaping method/config.
+5. Network profile (a fixed string; same-host baseline until a shaper exists).
 6. Memory metrics and memory sampling method/interval.
-7. Full run configuration (command, deployment domain, concurrency/arrival settings, timeout settings).
-8. Target verdict lines: `ACK_TARGET` and `SOFT_CONFIRM_TARGET` (when target evaluation is performed).
+7. Storage and drain metrics (self-contained runs).
+8. Full run configuration (command, deployment domain, concurrency/arrival settings, timeout settings).
 9. Sanity assertion status and failure summary (if any).
 10. For sweeps, separate first-knee metrics for any rejection, HTTP non-`200`, `429`, and client-side failure.
 
 ## 7. Mapping to Current Harnesses
 
-1. `ack_latency`: primary path for `ack_latency_ms`.
-2. `round_trip_latency`: primary path for `soft_confirm_latency_ms`.
-3. `sweep`: capacity exploration and overload discovery.
-4. `unit_hot_path`: micro profiling.
+Recipes are in [`justfile`](./justfile).
+
+1. `bench-ack-self` (`sweep` at concurrency 1): `ack_latency_ms`.
+2. `bench-round-trip-self` (`sweep --round-trip` at one concurrency): `soft_confirm_latency_ms`.
+3. `bench-sweep-self`, `bench-capacity-sweep-self` and `bench-rt-sweep-self` (`sweep`): capacity exploration and overload discovery.
+4. `bench-report` and `bench-compare-latest` (`report`, `compare_latest`): summaries and deltas over the saved results.
 
 ## 8. Current Gaps
 
-1. Add first-class support for canonical injected-latency runs.
-2. Ensure reports always include network shaping tool and exact shaping config.
-3. Strengthen tx identity matching for round-trip correlation if workloads ever stop guaranteeing effectively unique sender/payload pairs.
+1. Add first-class support for canonical injected-latency runs; target verdicts (§5) need it.
+2. Strengthen tx identity matching for round-trip correlation if workloads ever stop guaranteeing effectively unique sender/payload pairs.
diff --git a/tests/benchmarks/README.md b/tests/benchmarks/README.md
index 79c3a695..7838c5a9 100644
--- a/tests/benchmarks/README.md
+++ b/tests/benchmarks/README.md
@@ -10,7 +10,7 @@ Benchmark goals, measurement definitions, and reporting requirements live in
 Networked benchmarks sign EIP-712 payloads, so they need to know which sequencer
 instance they are targeting.
 
-- **External target**: pass `--domain-chain-id` and `--domain-verifying-contract` to match the target sequencer deployment.
+- **External target**: pass `--domain-chain-id` and `--domain-verifying-contract` to match the target sequencer deployment. Round-trip runs also read the feed from the sequencer's internal listener (`--internal-endpoint`, default `http://127.0.0.1:3001`).
 - **Self-contained target**: the harness spawns `anvil`, deploys a local `Application` through `ApplicationFactory`, and uses that deployed app address as the verifying contract for both signer and sequencer:
   - chain ID: `31337`
   - verifying contract: dynamically deployed local `Application`
@@ -45,11 +45,10 @@ Direct `cargo` examples:
 ```bash
 # Round-trip latency, self-contained (spawns anvil + sequencer). Runs are
 # time-bounded (`--duration-secs`), not count-bounded.
-cargo run -p benchmarks --bin round_trip_latency --release -- --self-contained --duration-secs 30 --concurrency 4 --max-fee 2000
-cargo run -p benchmarks --bin round_trip_latency --release -- --self-contained --duration-secs 60 --concurrency 16 --max-fee 2000 --evaluate
+cargo run -p benchmarks --bin sweep --release -- --round-trip --self-contained --duration-secs 30 --concurrency-list 4 --max-fee 2000
 
 # Against an external sequencer (pass that deployment's EIP-712 domain):
-cargo run -p benchmarks --bin round_trip_latency --release -- --endpoint http://127.0.0.1:3000 --domain-chain-id 31337 --domain-verifying-contract 0x1111111111111111111111111111111111111111 --duration-secs 30 --concurrency 4 --max-fee 2000
+cargo run -p benchmarks --bin sweep --release -- --round-trip --endpoint http://127.0.0.1:3000 --internal-endpoint http://127.0.0.1:3001 --domain-chain-id 31337 --domain-verifying-contract 0x1111111111111111111111111111111111111111 --duration-secs 30 --concurrency-list 4 --max-fee 2000
 
 # Concurrency sweep — ack latency by default, round-trip with `--round-trip`:
 cargo run -p benchmarks --bin sweep --release -- --self-contained --duration-secs 30 --max-fee 2000 --concurrency-list "1 2 4 8 16 32 64 128"
@@ -62,15 +61,14 @@ cargo run -p benchmarks --bin compare_latest --release -- --results-dir tests/be
 
 ## Benchmarks
 
-- `round_trip_latency`: measures submit-to-broadcast latency (`POST /tx` to the matching `GET /ws/subscribe` event) for accepted txs. Drains existing WS backlog before timing so stale history does not pollute the window.
-- `sweep`: runs a concurrency sweep — ack latency (`POST /tx` acknowledgement) by default, or round-trip with `--round-trip` — and emits a CSV plus capacity summary. Reports separate first-of-each markers:
+- `sweep`: runs a concurrency sweep — ack latency (`POST /tx` acknowledgement) by default, or with `--round-trip` also submit-to-broadcast latency (`POST /tx` to the matching feed event) for accepted txs — and writes its rows and capacity summary to `ack-sweep-<ts>.json` or `rt-sweep-<ts>.json` under `--results-dir` (or to `--json-out`). Reports separate first-of-each markers:
   - first rejection of any kind
   - first HTTP non-`200`
   - first `429`
   - first client-side failure (`io_*`, timeouts, connection failures)
 - `report`: aggregates the JSON artifacts under `--results-dir` into a summary.
-- `compare_latest`: compares the two latest artifacts of a `--kind` (`ack`, `round-trip`, `rt-sweep`, `sweep`, `all`) and prints deltas.
-- `--evaluate` on `round_trip_latency` / `sweep`: prints a first-class target verdict block and stores it in JSON output. Today the verdict is expected to be `NOT_EVALUATED` because the harness only supports the same-host baseline, not the canonical network-aware profile from the spec.
+- `compare_latest`: prints deltas between the two latest artifacts of a `--kind`. `ack` and `round-trip` compare single-concurrency runs, `sweep` and `rt-sweep` multi-concurrency runs, and `all` does all four.
+- `report` and `compare_latest` read only `ack-sweep-*.json` and `rt-sweep-*.json`, and skip with a warning any they cannot parse as the current format; `just --justfile tests/benchmarks/justfile clean` clears old results.
 
 ## Notes
 
@@ -79,8 +77,8 @@ cargo run -p benchmarks --bin compare_latest --release -- --results-dir tests/be
 - Self-contained variants also deploy a local `Application` through `ApplicationFactory`, so they require a canonical machine image at `examples/canonical-app/out/canonical-machine-image`; run `just canonical-build-machine-image` first.
 - Self-contained variants therefore require Foundry's `anvil` binary to be installed locally.
 - `--max-fee` must be at or above the placeholder app's base fee, or every tx is rejected (`422 EXECUTION_REJECTED`) and the run reports no accepted txs. The error message includes the rejection breakdown and the first rejection body, which names the base fee.
-- `round_trip_latency` drains existing WS backlog before timing so stale history does not pollute the measurement window.
-- `sweep --round-trip` bootstraps each latency observation run from the latest snapshot history claim and drains the remaining backlog before measurement.
+- `sweep --round-trip` subscribes from the latest snapshot's history claim and drains the existing backlog before timing, so stale history does not pollute the measurement window.
 - If sweep hits `Too many open files`, increase the shell limit (`ulimit -n 4096`) or use a smaller concurrency list.
 - Self-contained variants automatically build a temp DB, spawn `anvil`, start the sequencer, and persist logs/results under `tests/benchmarks/results`.
+- Self-contained runs end with a drain phase of up to 120 s, mining one L1 block per second, before shutdown. The report adds the logical DB size, the DB and WAL file footprint, and the batch drain time; [`BENCHMARK_SPEC.md`](./BENCHMARK_SPEC.md) §2.5 defines them.
 - For non-self-contained runs, start a sequencer instance first and make sure the benchmark domain matches the sequencer domain.
diff --git a/tests/benchmarks/justfile b/tests/benchmarks/justfile
index 492290b6..d9315c63 100644
--- a/tests/benchmarks/justfile
+++ b/tests/benchmarks/justfile
@@ -22,7 +22,7 @@ bench-ack-self duration="45" max_fee="2000" extra="": ensure-machine-image
 
 bench-round-trip-self duration="45" max_fee="2000" concurrency="1" extra="": ensure-machine-image
     cargo build -p wallet-sequencer --release
-    cargo run -p benchmarks --bin round_trip_latency --release -- --self-contained --duration-secs {{duration}} --max-fee {{max_fee}} --concurrency {{concurrency}} {{extra}}
+    cargo run -p benchmarks --bin sweep --release -- --round-trip --self-contained --duration-secs {{duration}} --max-fee {{max_fee}} --concurrency-list {{concurrency}} --warmup-secs 5 {{extra}}
 
 bench-sweep domain_chain_id verifying_contract duration="45" url="http://127.0.0.1:3000" max_fee="2000" conc_list="1 2 4 8 16 32 64 128 256" extra="":
     cargo run -p benchmarks --bin sweep --release -- --endpoint {{url}} --domain-chain-id {{domain_chain_id}} --domain-verifying-contract {{verifying_contract}} --duration-secs {{duration}} --max-fee {{max_fee}} --concurrency-list "{{conc_list}}" {{extra}}
@@ -35,9 +35,9 @@ bench-rt-sweep-self duration="45" max_fee="2000" conc_list="1 2 4 8" extra="": e
     cargo build -p wallet-sequencer --release
     cargo run -p benchmarks --bin sweep --release -- --round-trip --self-contained --duration-secs {{duration}} --max-fee {{max_fee}} --concurrency-list "{{conc_list}}" --accounts-file {{accounts_file}} {{extra}}
 
-bench-capacity-sweep-self duration="45" max_fee="2000" conc_list="1 2 4 8 16 32 64 128 256 512" out="tests/benchmarks/results/capacity-sweep-self.json" extra="": ensure-machine-image
+bench-capacity-sweep-self duration="45" max_fee="2000" conc_list="1 2 4 8 16 32 64 128 256 512" extra="": ensure-machine-image
     cargo build -p wallet-sequencer --release
-    cargo run -p benchmarks --bin sweep --release -- --self-contained --duration-secs {{duration}} --max-fee {{max_fee}} --concurrency-list {{conc_list}} --json-out {{out}} --accounts-file {{accounts_file}} {{extra}}
+    cargo run -p benchmarks --bin sweep --release -- --self-contained --duration-secs {{duration}} --max-fee {{max_fee}} --concurrency-list {{conc_list}} --accounts-file {{accounts_file}} {{extra}}
 
 bench-report results_dir="tests/benchmarks/results":
     cargo run -p benchmarks --bin report --release -- --results-dir {{results_dir}}
diff --git a/tests/benchmarks/src/ack.rs b/tests/benchmarks/src/ack.rs
index 84d35342..62be52f4 100644
--- a/tests/benchmarks/src/ack.rs
+++ b/tests/benchmarks/src/ack.rs
@@ -15,7 +15,6 @@ use crate::{
     BenchResult,
     domain::BenchmarkDomain,
     rejection::{RejectionOutcome, classify_rejection},
-    runtime,
     stats::{Stats, StatsMs, rejection_rate, summarize, throughput_tx_per_s},
     workload::{WorkloadConfig, build_worker_contexts},
 };
@@ -51,8 +50,6 @@ pub struct AckRunReport {
     pub ack_latency_accepted: Stats,
     pub ack_latency_accepted_ms: StatsMs,
     pub ack_latency_rejected: Option<Stats>,
-    pub memory: Option<runtime::MemoryReport>,
-    pub sequencer_log_path: Option<String>,
 }
 
 struct AckSample {
@@ -186,7 +183,5 @@ pub async fn run_ack_benchmark(config: AckRunConfig) -> BenchResult<AckRunReport
         ack_latency_accepted_ms: ack_stats.to_ms(),
         ack_latency_accepted: ack_stats,
         ack_latency_rejected: rejected_stats,
-        memory: None,
-        sequencer_log_path: None,
     })
 }
diff --git a/tests/benchmarks/src/bin/compare_latest.rs b/tests/benchmarks/src/bin/compare_latest.rs
index 58919cac..0dc864cc 100644
--- a/tests/benchmarks/src/bin/compare_latest.rs
+++ b/tests/benchmarks/src/bin/compare_latest.rs
@@ -2,18 +2,14 @@
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 use benchmarks::{
-    BenchResult, BenchmarkJsonOutput, RoundTripRunReport, SweepRunReport, format_optional_f64,
-    runtime::{DEFAULT_RESULTS_DIR, MemoryReport},
-    throughput_tx_per_s, trailing_number,
+    BenchResult, StatsMs, SweepRow, SweepSummary, format_optional_f64, load_sweep_results,
+    runtime::{DEFAULT_RESULTS_DIR, DrainReport, MemoryReport, StorageReport},
 };
 use clap::{Parser, ValueEnum};
-use serde_json::Value;
-use std::collections::BTreeMap;
-use std::fs;
+use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
-use std::time::Duration;
 
-#[derive(Debug, Clone, Copy, ValueEnum)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
 enum CompareKind {
     Ack,
     RoundTrip,
@@ -22,6 +18,15 @@ enum CompareKind {
     All,
 }
 
+/// `(kind, label, artifact prefix, multi-row)`. Single-concurrency runs are
+/// the baselines; multi-concurrency runs are the sweeps.
+const KINDS: [(CompareKind, &str, &str, bool); 4] = [
+    (CompareKind::Ack, "ACK", "ack-sweep", false),
+    (CompareKind::RoundTrip, "ROUND-TRIP", "rt-sweep", false),
+    (CompareKind::RtSweep, "RT SWEEP", "rt-sweep", true),
+    (CompareKind::Sweep, "ACK SWEEP", "ack-sweep", true),
+];
+
 #[derive(Debug, Parser)]
 #[command(name = "compare_latest")]
 #[command(about = "Compare the latest two benchmark result files")]
@@ -32,558 +37,155 @@ struct Cli {
     kind: CompareKind,
 }
 
-#[derive(Debug, Clone)]
-struct SweepCsvRow {
-    concurrency: u64,
-    accepted_tps: f64,
-    rejected_count: u64,
-    http_rejected_count: u64,
-    p50_ms: f64,
-    p95_ms: f64,
-    p99_ms: f64,
-    p999_ms: f64,
-    client_failure_count: u64,
-    http_429_count: u64,
-}
-
-#[derive(Debug, Clone)]
-struct SweepSummaryView {
-    tps_at_first_any_rejection: Option<f64>,
-    tps_at_first_non_200: Option<f64>,
-    tps_at_first_429: Option<f64>,
-    tps_at_first_client_failure: Option<f64>,
-    max_sustainable_tps_at_0_rejections: Option<f64>,
-}
-
 fn main() -> BenchResult<()> {
     let cli = Cli::parse();
-    match cli.kind {
-        CompareKind::Ack => compare_ack(&cli.results_dir)?,
-        CompareKind::RoundTrip => compare_round_trip(&cli.results_dir)?,
-        CompareKind::RtSweep => compare_rt_sweep(&cli.results_dir)?,
-        CompareKind::Sweep => compare_sweep(&cli.results_dir)?,
-        CompareKind::All => {
-            compare_ack(&cli.results_dir)?;
+    let selected = KINDS
+        .iter()
+        .filter(|(kind, ..)| cli.kind == CompareKind::All || cli.kind == *kind);
+    for (index, (_, label, prefix, multi_row)) in selected.enumerate() {
+        if index > 0 {
             println!();
-            compare_round_trip(&cli.results_dir)?;
-            println!();
-            compare_rt_sweep(&cli.results_dir)?;
-            println!();
-            compare_sweep(&cli.results_dir)?;
         }
+        compare(&cli.results_dir, label, prefix, *multi_row)?;
     }
     Ok(())
 }
 
-fn compare_ack(results_dir: &Path) -> BenchResult<()> {
-    // bench-ack-self now produces ack-sweep-*.json (single-concurrency sweep).
-    let result = latest_two_files(results_dir, "ack-sweep-", ".json");
-    let (old_path, new_path) = match result {
-        Ok(paths) => paths,
-        Err(_) => {
-            println!("ACK: n/a (need at least 2 ack-sweep-*.json files)");
-            return Ok(());
-        }
-    };
-    let old = read_json::<BenchmarkJsonOutput<SweepRunReport, Value>>(&old_path)?;
-    let new = read_json::<BenchmarkJsonOutput<SweepRunReport, Value>>(&new_path)?;
-
-    println!(
-        "ACK latest two:\n  old: {}\n  new: {}",
-        old_path.display(),
-        new_path.display()
-    );
-
-    // Extract c=1 rows for comparison.
-    let old_row = old.report.rows.first();
-    let new_row = new.report.rows.first();
-
-    if let (Some(old_row), Some(new_row)) = (old_row, new_row) {
-        println!(
-            "  old: c={}, {:.2} tx/s, {} accepted, {} rejected, p50={:.3}ms, p99={:.3}ms, p999={:.3}ms",
-            old_row.concurrency,
-            old_row.accepted_tps,
-            old_row.accepted_count,
-            old_row.rejected_count,
-            old_row.p50_ms,
-            old_row.p99_ms,
-            old_row.p999_ms
-        );
-        println!(
-            "  new: c={}, {:.2} tx/s, {} accepted, {} rejected, p50={:.3}ms, p99={:.3}ms, p999={:.3}ms",
-            new_row.concurrency,
-            new_row.accepted_tps,
-            new_row.accepted_count,
-            new_row.rejected_count,
-            new_row.p50_ms,
-            new_row.p99_ms,
-            new_row.p999_ms
-        );
-        println!("  delta:");
-        println!(
-            "    tps: {:+.3} ({:+.2}%)",
-            new_row.accepted_tps - old_row.accepted_tps,
-            pct(new_row.accepted_tps, old_row.accepted_tps)
-        );
-        print_metric_delta("p50", old_row.p50_ms, new_row.p50_ms);
-        print_metric_delta("p99", old_row.p99_ms, new_row.p99_ms);
-        print_metric_delta("p99.9", old_row.p999_ms, new_row.p999_ms);
-    } else {
-        println!("  (empty sweep rows)");
-    }
-
-    print_memory_delta(old.report.memory.as_ref(), new.report.memory.as_ref());
-    Ok(())
-}
-
-fn compare_round_trip(results_dir: &Path) -> BenchResult<()> {
-    let result = latest_two_files(results_dir, "round-trip-latency-", ".json");
-    let (old_path, new_path) = match result {
-        Ok(paths) => paths,
-        Err(_) => {
-            println!("ROUND-TRIP: n/a (need at least 2 round-trip-latency-*.json files)");
-            return Ok(());
-        }
-    };
-    let old = read_json::<BenchmarkJsonOutput<RoundTripRunReport, Value>>(&old_path)?;
-    let new = read_json::<BenchmarkJsonOutput<RoundTripRunReport, Value>>(&new_path)?;
-
-    println!(
-        "ROUND-TRIP latest two:\n  old: {}\n  new: {}",
-        old_path.display(),
-        new_path.display()
-    );
-    print_common(
-        old.report.accepted,
-        old.report.rejected,
-        old.report.total_wall,
-    );
-    print_common_delta(
-        old.report.accepted,
-        old.report.rejected,
-        old.report.total_wall,
-        new.report.accepted,
-        new.report.rejected,
-        new.report.total_wall,
-    );
-    print_stats_delta(
-        "ack latency",
-        &old.report.ack_latency_accepted,
-        &new.report.ack_latency_accepted,
-    );
-    print_stats_delta(
-        "round-trip latency",
-        &old.report.round_trip_latency_accepted,
-        &new.report.round_trip_latency_accepted,
-    );
-    print_memory_delta(old.report.memory.as_ref(), new.report.memory.as_ref());
-    Ok(())
-}
-
-fn compare_sweep(results_dir: &Path) -> BenchResult<()> {
-    let sweep_result = latest_two_files(results_dir, "ack-sweep-", ".csv");
-    let (old_path, new_path) = match sweep_result {
-        Ok(paths) => paths,
-        Err(_) => match latest_two_files(results_dir, "capacity-sweep-self", ".csv") {
-            Ok(paths) => paths,
-            Err(_) => {
-                println!("ACK SWEEP: n/a (need at least 2 sweep CSV files)");
-                return Ok(());
-            }
-        },
-    };
-    let old_rows = read_sweep_rows(&old_path)?;
-    let new_rows = read_sweep_rows(&new_path)?;
-
-    println!(
-        "ACK SWEEP latest two:\n  old: {}\n  new: {}",
-        old_path.display(),
-        new_path.display()
-    );
-
-    let old_by_concurrency = map_sweep_rows(&old_rows);
-    let new_by_concurrency = map_sweep_rows(&new_rows);
-
-    println!("  deltas by concurrency:");
-    println!(
-        "  c,accepted_tps_delta,p50_ms_delta,p95_ms_delta,p99_ms_delta,p999_ms_delta,rejected_delta,client_failure_delta,http_429_delta"
-    );
-
-    let mut all_concurrency: Vec<u64> = old_by_concurrency
-        .keys()
-        .chain(new_by_concurrency.keys())
-        .copied()
+fn compare(results_dir: &Path, label: &str, prefix: &str, multi_row: bool) -> BenchResult<()> {
+    let runs: Vec<_> = load_sweep_results(results_dir, prefix)?
+        .into_iter()
+        .filter(|(_, run)| (run.report.rows.len() > 1) == multi_row)
         .collect();
-    all_concurrency.sort_unstable();
-    all_concurrency.dedup();
-
-    for concurrency in all_concurrency {
-        let old = old_by_concurrency.get(&concurrency);
-        let new = new_by_concurrency.get(&concurrency);
-        if let (Some(old), Some(new)) = (old, new) {
-            println!(
-                "  {},{:+.3},{:+.3},{:+.3},{:+.3},{:+.3},{:+},{:+},{:+}",
-                concurrency,
-                new.accepted_tps - old.accepted_tps,
-                new.p50_ms - old.p50_ms,
-                new.p95_ms - old.p95_ms,
-                new.p99_ms - old.p99_ms,
-                new.p999_ms - old.p999_ms,
-                i128::from(new.rejected_count) - i128::from(old.rejected_count),
-                i128::from(new.client_failure_count) - i128::from(old.client_failure_count),
-                i128::from(new.http_429_count) - i128::from(old.http_429_count),
-            );
-        } else {
-            println!("  {concurrency},n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a");
-        }
-    }
-
-    let old_summary = compute_sweep_summary(old_rows.as_slice());
-    let new_summary = compute_sweep_summary(new_rows.as_slice());
-
-    println!("  summary:");
-    println!(
-        "    max_sustainable_tps_at_0_rejections: old={:.3}, new={:.3}, delta={:+.3}",
-        old_summary
-            .max_sustainable_tps_at_0_rejections
-            .unwrap_or(0.0),
-        new_summary
-            .max_sustainable_tps_at_0_rejections
-            .unwrap_or(0.0),
-        new_summary
-            .max_sustainable_tps_at_0_rejections
-            .unwrap_or(0.0)
-            - old_summary
-                .max_sustainable_tps_at_0_rejections
-                .unwrap_or(0.0)
-    );
-    println!(
-        "    tps_at_first_any_rejection: old={}, new={}",
-        format_optional_f64(old_summary.tps_at_first_any_rejection),
-        format_optional_f64(new_summary.tps_at_first_any_rejection),
-    );
-    println!(
-        "    tps_at_first_non_200: old={}, new={}",
-        format_optional_f64(old_summary.tps_at_first_non_200),
-        format_optional_f64(new_summary.tps_at_first_non_200),
-    );
-    println!(
-        "    tps_at_first_429: old={}, new={}",
-        format_optional_f64(old_summary.tps_at_first_429),
-        format_optional_f64(new_summary.tps_at_first_429),
-    );
-    println!(
-        "    tps_at_first_client_failure: old={}, new={}",
-        format_optional_f64(old_summary.tps_at_first_client_failure),
-        format_optional_f64(new_summary.tps_at_first_client_failure),
-    );
-    Ok(())
-}
-
-#[derive(Debug, Clone)]
-struct RtSweepCsvRow {
-    concurrency: u64,
-    accepted_tps: f64,
-    rejected_count: u64,
-    ack_p50_ms: f64,
-    ack_p99_ms: f64,
-    rt_p50_ms: f64,
-    rt_p99_ms: f64,
-    rt_p999_ms: f64,
-}
-
-fn compare_rt_sweep(results_dir: &Path) -> BenchResult<()> {
-    let result = latest_two_files(results_dir, "rt-sweep-", ".csv");
-    let (old_path, new_path) = match result {
-        Ok(paths) => paths,
-        Err(_) => {
-            println!("RT SWEEP: n/a (need at least 2 rt-sweep-*.csv files)");
-            return Ok(());
-        }
+    let [.., (old_path, old), (new_path, new)] = runs.as_slice() else {
+        let shape = if multi_row { "multi" } else { "single" };
+        println!("{label}: n/a (need at least 2 {shape}-concurrency {prefix}-*.json files)");
+        return Ok(());
     };
-    let old_rows = read_rt_sweep_rows(&old_path)?;
-    let new_rows = read_rt_sweep_rows(&new_path)?;
+    let (old, new) = (&old.report, &new.report);
 
     println!(
-        "RT SWEEP latest two:\n  old: {}\n  new: {}",
+        "{label} latest two:\n  old: {}\n  new: {}",
         old_path.display(),
         new_path.display()
     );
-
-    let old_by_concurrency = map_rt_sweep_rows(&old_rows);
-    let new_by_concurrency = map_rt_sweep_rows(&new_rows);
-
-    println!("  deltas by concurrency:");
-    println!(
-        "  c,tps_delta,ack_p50_delta,ack_p99_delta,rt_p50_delta,rt_p99_delta,rt_p999_delta,rejected_delta"
-    );
-
-    let mut all_concurrency: Vec<u64> = old_by_concurrency
-        .keys()
-        .chain(new_by_concurrency.keys())
-        .copied()
-        .collect();
-    all_concurrency.sort_unstable();
-    all_concurrency.dedup();
-
-    for concurrency in all_concurrency {
-        let old = old_by_concurrency.get(&concurrency);
-        let new = new_by_concurrency.get(&concurrency);
-        if let (Some(old), Some(new)) = (old, new) {
-            println!(
-                "  {},{:+.3},{:+.3},{:+.3},{:+.3},{:+.3},{:+.3},{:+}",
-                concurrency,
-                new.accepted_tps - old.accepted_tps,
-                new.ack_p50_ms - old.ack_p50_ms,
-                new.ack_p99_ms - old.ack_p99_ms,
-                new.rt_p50_ms - old.rt_p50_ms,
-                new.rt_p99_ms - old.rt_p99_ms,
-                new.rt_p999_ms - old.rt_p999_ms,
-                i128::from(new.rejected_count) - i128::from(old.rejected_count),
-            );
-        } else {
-            println!("  {concurrency},n/a,n/a,n/a,n/a,n/a,n/a,n/a");
+    let old_rows: BTreeMap<usize, &SweepRow> =
+        old.rows.iter().map(|row| (row.concurrency, row)).collect();
+    let new_rows: BTreeMap<usize, &SweepRow> =
+        new.rows.iter().map(|row| (row.concurrency, row)).collect();
+    let concurrencies: BTreeSet<usize> = old_rows.keys().chain(new_rows.keys()).copied().collect();
+    for concurrency in concurrencies {
+        match (old_rows.get(&concurrency), new_rows.get(&concurrency)) {
+            (Some(old), Some(new)) => print_row_delta(old, new),
+            _ => println!("  c={concurrency}: n/a (not in both runs)"),
         }
     }
+    if multi_row {
+        print_summary_delta(&old.summary, &new.summary);
+    }
+    print_memory_delta(old.memory.as_ref(), new.memory.as_ref());
+    print_storage_delta(old.storage.as_ref(), new.storage.as_ref());
+    print_drain_delta(old.drain.as_ref(), new.drain.as_ref());
     Ok(())
 }
 
-fn read_rt_sweep_rows(path: &Path) -> BenchResult<Vec<RtSweepCsvRow>> {
-    let content = fs::read_to_string(path)?;
-    let mut lines = content.lines();
-    let Some(header_line) = lines.next() else {
-        return Err(std::io::Error::other(format!("empty CSV file: {}", path.display())).into());
-    };
-    let headers: Vec<&str> = header_line.split(',').collect();
-    let mut header_idx = BTreeMap::new();
-    for (idx, header) in headers.iter().enumerate() {
-        header_idx.insert(*header, idx);
+fn print_row_delta(old: &SweepRow, new: &SweepRow) {
+    println!("  c={} delta (new - old):", new.concurrency);
+    print_metric_delta("accepted_tps", old.accepted_tps, new.accepted_tps);
+    print_stats_ms_delta("ack", &old.ack_ms, &new.ack_ms);
+    if let (Some(old_rt), Some(new_rt)) = (&old.round_trip_ms, &new.round_trip_ms) {
+        print_stats_ms_delta("round_trip", old_rt, new_rt);
     }
-
-    let mut rows = Vec::new();
-    for line in lines {
-        if line.trim().is_empty() {
-            continue;
-        }
-        let cols: Vec<&str> = line.split(',').collect();
-        rows.push(RtSweepCsvRow {
-            concurrency: parse_csv_u64(&cols, &header_idx, "concurrency")?,
-            accepted_tps: parse_csv_f64(&cols, &header_idx, "accepted_tps")?,
-            rejected_count: parse_csv_u64(&cols, &header_idx, "rejected_count")?,
-            ack_p50_ms: parse_csv_f64(&cols, &header_idx, "ack_p50_ms")?,
-            ack_p99_ms: parse_csv_f64(&cols, &header_idx, "ack_p99_ms")?,
-            rt_p50_ms: parse_csv_f64(&cols, &header_idx, "rt_p50_ms")?,
-            rt_p99_ms: parse_csv_f64(&cols, &header_idx, "rt_p99_ms")?,
-            rt_p999_ms: parse_csv_f64(&cols, &header_idx, "rt_p999_ms")?,
-        });
-    }
-    Ok(rows)
+    print_count_delta("rejected", old.rejected_count, new.rejected_count);
+    print_count_delta(
+        "client_failure",
+        old.client_failure_count,
+        new.client_failure_count,
+    );
+    print_count_delta("http_429", old.http_429_count, new.http_429_count);
 }
 
-fn map_rt_sweep_rows(rows: &[RtSweepCsvRow]) -> BTreeMap<u64, RtSweepCsvRow> {
-    let mut out = BTreeMap::new();
-    for row in rows {
-        out.insert(row.concurrency, row.clone());
-    }
-    out
+fn print_stats_ms_delta(name: &str, old: &StatsMs, new: &StatsMs) {
+    print_metric_delta(&format!("{name} p50"), old.p50_ms, new.p50_ms);
+    print_metric_delta(&format!("{name} p95"), old.p95_ms, new.p95_ms);
+    print_metric_delta(&format!("{name} p99"), old.p99_ms, new.p99_ms);
+    print_metric_delta(&format!("{name} p99.9"), old.p999_ms, new.p999_ms);
+    print_metric_delta(&format!("{name} max"), old.max_ms, new.max_ms);
 }
 
-fn latest_two_files(
-    results_dir: &Path,
-    prefix: &str,
-    suffix: &str,
-) -> BenchResult<(PathBuf, PathBuf)> {
-    let mut candidates = Vec::new();
-    for entry in fs::read_dir(results_dir)? {
-        let entry = entry?;
-        let path = entry.path();
-        if !path.is_file() {
-            continue;
-        }
-        let Some(file_name) = path.file_name().and_then(|s| s.to_str()) else {
-            continue;
-        };
-        if file_name.starts_with(prefix) && file_name.ends_with(suffix) {
-            let timestamp = trailing_number(file_name).unwrap_or(0);
-            candidates.push((timestamp, file_name.to_string(), path));
-        }
-    }
-
-    candidates.sort();
-    if candidates.len() < 2 {
-        return Err(std::io::Error::other(format!(
-            "need at least 2 files for pattern {prefix}*{suffix} in {}",
-            results_dir.display()
-        ))
-        .into());
+fn print_summary_delta(old: &SweepSummary, new: &SweepSummary) {
+    println!("  summary:");
+    for (label, old_value, new_value) in [
+        (
+            "max_sustainable_tps_at_0_rejections",
+            old.max_sustainable_tps_at_0_rejections,
+            new.max_sustainable_tps_at_0_rejections,
+        ),
+        (
+            "tps_at_first_any_rejection",
+            old.tps_at_first_any_rejection,
+            new.tps_at_first_any_rejection,
+        ),
+        (
+            "tps_at_first_non_200",
+            old.tps_at_first_non_200,
+            new.tps_at_first_non_200,
+        ),
+        (
+            "tps_at_first_429",
+            old.tps_at_first_429,
+            new.tps_at_first_429,
+        ),
+        (
+            "tps_at_first_client_failure",
+            old.tps_at_first_client_failure,
+            new.tps_at_first_client_failure,
+        ),
+    ] {
+        println!(
+            "    {label}: old={}, new={}",
+            format_optional_f64(old_value),
+            format_optional_f64(new_value)
+        );
     }
-    let old = candidates[candidates.len() - 2].2.clone();
-    let new = candidates[candidates.len() - 1].2.clone();
-    Ok((old, new))
 }
 
-fn read_json<T: for<'de> serde::Deserialize<'de>>(path: &Path) -> BenchResult<T> {
-    let raw = fs::read_to_string(path)?;
-    let parsed = serde_json::from_str::<T>(&raw)?;
-    Ok(parsed)
-}
-
-fn read_sweep_rows(path: &Path) -> BenchResult<Vec<SweepCsvRow>> {
-    let content = fs::read_to_string(path)?;
-    let mut lines = content.lines();
-    let Some(header_line) = lines.next() else {
-        return Err(std::io::Error::other(format!("empty CSV file: {}", path.display())).into());
+fn print_memory_delta(old: Option<&MemoryReport>, new: Option<&MemoryReport>) {
+    let (Some(old), Some(new)) = (old, new) else {
+        return;
     };
-    let headers: Vec<&str> = header_line.split(',').collect();
-    let mut header_idx = BTreeMap::new();
-    for (idx, header) in headers.iter().enumerate() {
-        header_idx.insert(*header, idx);
-    }
-
-    let mut rows = Vec::new();
-    for line in lines {
-        if line.trim().is_empty() {
-            continue;
-        }
-        let cols: Vec<&str> = line.split(',').collect();
-        let concurrency = parse_csv_u64(&cols, &header_idx, "concurrency")?;
-        let accepted_tps = parse_csv_f64(&cols, &header_idx, "accepted_tps")?;
-        let rejected_count = parse_csv_u64(&cols, &header_idx, "rejected_count")?;
-        let http_rejected_count = parse_csv_u64(&cols, &header_idx, "http_rejected_count")?;
-        let p50_ms = parse_csv_f64(&cols, &header_idx, "p50_ms")?;
-        let p95_ms = parse_csv_f64(&cols, &header_idx, "p95_ms")?;
-        let p99_ms = parse_csv_f64(&cols, &header_idx, "p99_ms")?;
-        let p999_ms = parse_csv_f64(&cols, &header_idx, "p999_ms")?;
-        let client_failure_count = parse_csv_u64(&cols, &header_idx, "client_failure_count")?;
-        let http_429_count = parse_csv_u64(&cols, &header_idx, "http_429_count")?;
-        rows.push(SweepCsvRow {
-            concurrency,
-            accepted_tps,
-            rejected_count,
-            http_rejected_count,
-            p50_ms,
-            p95_ms,
-            p99_ms,
-            p999_ms,
-            client_failure_count,
-            http_429_count,
-        });
-    }
-    Ok(rows)
-}
-
-fn parse_csv_u64(cols: &[&str], headers: &BTreeMap<&str, usize>, key: &str) -> BenchResult<u64> {
-    let idx = *headers
-        .get(key)
-        .ok_or_else(|| std::io::Error::other(format!("missing CSV column: {key}")))?;
-    let value = cols
-        .get(idx)
-        .ok_or_else(|| std::io::Error::other(format!("missing CSV value at column: {key}")))?;
-    let parsed = value
-        .parse::<u64>()
-        .map_err(|e| std::io::Error::other(format!("invalid u64 for {key}: {value} ({e})")))?;
-    Ok(parsed)
-}
-
-fn parse_csv_f64(cols: &[&str], headers: &BTreeMap<&str, usize>, key: &str) -> BenchResult<f64> {
-    let idx = *headers
-        .get(key)
-        .ok_or_else(|| std::io::Error::other(format!("missing CSV column: {key}")))?;
-    let value = cols
-        .get(idx)
-        .ok_or_else(|| std::io::Error::other(format!("missing CSV value at column: {key}")))?;
-    let parsed = value
-        .parse::<f64>()
-        .map_err(|e| std::io::Error::other(format!("invalid f64 for {key}: {value} ({e})")))?;
-    Ok(parsed)
-}
-
-fn map_sweep_rows(rows: &[SweepCsvRow]) -> BTreeMap<u64, SweepCsvRow> {
-    let mut out = BTreeMap::new();
-    for row in rows {
-        out.insert(row.concurrency, row.clone());
-    }
-    out
+    println!("  memory delta (new - old):");
+    print_optional_metric_delta("rss_start_mb", old.rss_start_mb, new.rss_start_mb);
+    print_optional_metric_delta("rss_peak_mb", old.rss_peak_mb, new.rss_peak_mb);
+    print_optional_metric_delta("rss_growth_mb", old.rss_growth_mb, new.rss_growth_mb);
 }
 
-fn compute_sweep_summary(rows: &[SweepCsvRow]) -> SweepSummaryView {
-    SweepSummaryView {
-        tps_at_first_any_rejection: rows
-            .iter()
-            .find(|row| row.rejected_count > 0)
-            .map(|row| row.accepted_tps),
-        tps_at_first_non_200: rows
-            .iter()
-            .find(|row| row.http_rejected_count > 0)
-            .map(|row| row.accepted_tps),
-        tps_at_first_429: rows
-            .iter()
-            .find(|row| row.http_429_count > 0)
-            .map(|row| row.accepted_tps),
-        tps_at_first_client_failure: rows
-            .iter()
-            .find(|row| row.client_failure_count > 0)
-            .map(|row| row.accepted_tps),
-        max_sustainable_tps_at_0_rejections: rows
-            .iter()
-            .filter(|row| row.rejected_count == 0)
-            .map(|row| row.accepted_tps)
-            .max_by(|a, b| a.total_cmp(b)),
+fn print_storage_delta(old: Option<&StorageReport>, new: Option<&StorageReport>) {
+    let (Some(old), Some(new)) = (old, new) else {
+        return;
+    };
+    let mb = |bytes: u64| bytes as f64 / (1024.0 * 1024.0);
+    println!("  storage delta (new - old):");
+    if let (Some(old_logical), Some(new_logical)) = (old.logical_db_bytes, new.logical_db_bytes) {
+        print_metric_delta("logical_db_mb", mb(old_logical), mb(new_logical));
     }
+    print_metric_delta("db_mb", mb(old.db_bytes), mb(new.db_bytes));
+    print_metric_delta("wal_mb", mb(old.wal_bytes), mb(new.wal_bytes));
 }
 
-fn print_common(accepted: u64, rejected: u64, total_wall: Duration) {
-    let throughput = throughput_tx_per_s(accepted as usize, total_wall);
-    println!("  old summary:");
-    println!("    accepted: {accepted}");
-    println!("    rejected: {rejected}");
-    println!("    completed_per_s: {:.2} tx/s", throughput);
+fn print_drain_delta(old: Option<&DrainReport>, new: Option<&DrainReport>) {
+    let (Some(old), Some(new)) = (old, new) else {
+        return;
+    };
+    println!("  drain delta (new - old):");
+    print_count_delta("batches_pending", old.batches_pending, new.batches_pending);
+    print_optional_metric_delta("drain_secs", old.drain_secs, new.drain_secs);
 }
 
-fn print_common_delta(
-    old_accepted: u64,
-    old_rejected: u64,
-    old_total_wall: Duration,
-    new_accepted: u64,
-    new_rejected: u64,
-    new_total_wall: Duration,
-) {
-    let old_tps = throughput_tx_per_s(old_accepted as usize, old_total_wall);
-    let new_tps = throughput_tx_per_s(new_accepted as usize, new_total_wall);
-    println!("  new summary:");
+fn print_count_delta(label: &str, old_value: u64, new_value: u64) {
     println!(
-        "    accepted: {new_accepted} (delta {:+})",
-        i128::from(new_accepted) - i128::from(old_accepted)
+        "    {label}: {old_value} -> {new_value} (delta {:+})",
+        i128::from(new_value) - i128::from(old_value)
     );
-    println!(
-        "    rejected: {new_rejected} (delta {:+})",
-        i128::from(new_rejected) - i128::from(old_rejected)
-    );
-    println!(
-        "    completed_per_s: {:.2} tx/s (delta {:+.2}, {:+.2}%)",
-        new_tps,
-        new_tps - old_tps,
-        pct(new_tps, old_tps)
-    );
-}
-
-fn print_stats_delta(name: &str, old: &benchmarks::Stats, new: &benchmarks::Stats) {
-    println!("  {name} delta (new - old):");
-    print_metric_delta("p50", duration_ms(old.p50), duration_ms(new.p50));
-    print_metric_delta("p95", duration_ms(old.p95), duration_ms(new.p95));
-    print_metric_delta("p99", duration_ms(old.p99), duration_ms(new.p99));
-    print_metric_delta("p99.9", duration_ms(old.p999), duration_ms(new.p999));
-    print_metric_delta("max", duration_ms(old.max), duration_ms(new.max));
-}
-
-fn print_memory_delta(old: Option<&MemoryReport>, new: Option<&MemoryReport>) {
-    let (Some(old), Some(new)) = (old, new) else {
-        return;
-    };
-    println!("  memory delta (new - old):");
-    print_optional_metric_delta("rss_start_mb", old.rss_start_mb, new.rss_start_mb);
-    print_optional_metric_delta("rss_peak_mb", old.rss_peak_mb, new.rss_peak_mb);
-    print_optional_metric_delta("rss_growth_mb", old.rss_growth_mb, new.rss_growth_mb);
 }
 
 fn print_metric_delta(label: &str, old_value: f64, new_value: f64) {
@@ -604,10 +206,6 @@ fn print_optional_metric_delta(label: &str, old_value: Option<f64>, new_value: O
     print_metric_delta(label, old_value, new_value);
 }
 
-fn duration_ms(value: Duration) -> f64 {
-    value.as_secs_f64() * 1000.0
-}
-
 fn pct(new_value: f64, old_value: f64) -> f64 {
     if old_value == 0.0 {
         0.0
diff --git a/tests/benchmarks/src/bin/report.rs b/tests/benchmarks/src/bin/report.rs
index 3cfb8deb..b9455a51 100644
--- a/tests/benchmarks/src/bin/report.rs
+++ b/tests/benchmarks/src/bin/report.rs
@@ -2,13 +2,11 @@
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 use benchmarks::{
-    BenchResult, BenchmarkJsonOutput, RoundTripRunReport, RtSweepRunReport, SweepRunReport,
-    runtime::DEFAULT_RESULTS_DIR, trailing_number,
+    BenchResult, BenchmarkJsonOutput, SweepRunReport, load_sweep_results,
+    runtime::{DEFAULT_RESULTS_DIR, DRAIN_DEADLINE},
 };
 use clap::Parser;
-use serde_json::Value;
-use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 use std::process::Command;
 
 #[derive(Debug, Parser)]
@@ -23,17 +21,12 @@ fn main() -> BenchResult<()> {
     let cli = Cli::parse();
     let dir = &cli.results_dir;
 
-    let baseline_rt = load_latest::<RoundTripRunReport>(dir, "round-trip-latency-", ".json");
-    let rt_sweep = load_latest::<RtSweepRunReport>(dir, "rt-sweep-", ".json");
-
-    // Load sweep data: prefer capacity-sweep-self.json (full multi-level sweep),
-    // then fall back to ack-sweep-*.json.
-    let capacity_sweep = load_latest::<SweepRunReport>(dir, "capacity-sweep-self", ".json")
-        .or_else(|| load_latest_multi_row_sweep(dir));
-
-    // For baseline ACK latency, extract c=1 row from the latest ack-sweep file.
-    // This is what bench-ack-self produces (sweep --concurrency-list 1).
-    let baseline_ack_sweep = load_latest::<SweepRunReport>(dir, "ack-sweep-", ".json");
+    let ack_runs = load_sweep_results(dir, "ack-sweep")?;
+    let rt_runs = load_sweep_results(dir, "rt-sweep")?;
+    let baseline_ack = latest(&ack_runs, false);
+    let capacity_sweep = latest(&ack_runs, true);
+    let baseline_rt = latest(&rt_runs, false);
+    let rt_sweep = latest(&rt_runs, true);
 
     println!();
     println!("══════════════════════════════════════════════════════════");
@@ -46,34 +39,30 @@ fn main() -> BenchResult<()> {
     println!("  BASELINE LATENCY (concurrency=1)");
     println!("  ────────────────────────────────────────────");
     // Try to get c=1 data from the baseline ack sweep, or from the capacity sweep.
-    let ack_c1_row = baseline_ack_sweep
-        .as_ref()
-        .and_then(|r| r.report.rows.iter().find(|row| row.concurrency == 1))
-        .or_else(|| {
-            capacity_sweep
-                .as_ref()
-                .and_then(|r| r.report.rows.iter().find(|row| row.concurrency == 1))
-        });
+    let ack_c1_row = baseline_ack
+        .and_then(|r| r.rows.iter().find(|row| row.concurrency == 1))
+        .or_else(|| capacity_sweep.and_then(|r| r.rows.iter().find(|row| row.concurrency == 1)));
     match ack_c1_row {
         Some(row) => {
             println!(
                 "  ACK latency:         p50={:.1}ms   p99={:.1}ms   ({} accepted)",
-                row.p50_ms, row.p99_ms, row.accepted_count
+                row.ack_ms.p50_ms, row.ack_ms.p99_ms, row.accepted_count
             );
         }
         None => println!("  ACK latency:         n/a"),
     }
-    match &baseline_rt {
-        Some(r) => {
-            let ack = &r.report.ack_latency_accepted_ms;
-            let rt = &r.report.round_trip_latency_accepted_ms;
+    let rt_row = baseline_rt
+        .and_then(|r| r.rows.first())
+        .and_then(|row| row.round_trip_ms.as_ref().map(|rt| (row, rt)));
+    match rt_row {
+        Some((row, rt)) => {
             println!(
                 "  Round-trip latency:  p50={:.1}ms   p99={:.1}ms   ({} accepted)",
-                rt.p50_ms, rt.p99_ms, r.report.accepted
+                rt.p50_ms, rt.p99_ms, row.accepted_count
             );
             println!(
                 "    (ACK portion:      p50={:.1}ms   p99={:.1}ms)",
-                ack.p50_ms, ack.p99_ms
+                row.ack_ms.p50_ms, row.ack_ms.p99_ms
             );
         }
         None => println!("  Round-trip latency:  n/a"),
@@ -83,8 +72,11 @@ fn main() -> BenchResult<()> {
     // --- Round-trip latency vs concurrency ---
     println!("  ROUND-TRIP LATENCY vs CONCURRENCY");
     println!("  ────────────────────────────────────────────");
-    if let Some(r) = &rt_sweep {
-        for row in &r.report.rows {
+    if let Some(r) = rt_sweep {
+        for row in &r.rows {
+            let Some(rt) = &row.round_trip_ms else {
+                continue;
+            };
             let rej = if row.rejected_count > 0 {
                 format!("  rej={}", row.rejected_count)
             } else {
@@ -94,10 +86,10 @@ fn main() -> BenchResult<()> {
                 "  c={:<3} {:>7} tx/s  ack p50={:.0}ms p99={:.0}ms  rt p50={:.0}ms p99={:.0}ms{}",
                 row.concurrency,
                 format_tps(row.accepted_tps),
-                row.ack_p50_ms,
-                row.ack_p99_ms,
-                row.rt_p50_ms,
-                row.rt_p99_ms,
+                row.ack_ms.p50_ms,
+                row.ack_ms.p99_ms,
+                rt.p50_ms,
+                rt.p99_ms,
                 rej,
             );
         }
@@ -107,9 +99,9 @@ fn main() -> BenchResult<()> {
     println!();
 
     // --- Sweep curve (throughput + latency) ---
-    if let Some(r) = &capacity_sweep {
-        let rows = &r.report.rows;
-        let max_tps = r.report.summary.max_sustainable_tps_at_0_rejections;
+    if let Some(r) = capacity_sweep {
+        let rows = &r.rows;
+        let max_tps = r.summary.max_sustainable_tps_at_0_rejections;
 
         println!("  THROUGHPUT & LATENCY vs CONCURRENCY");
         println!("  ────────────────────────────────────────────");
@@ -137,8 +129,8 @@ fn main() -> BenchResult<()> {
                 row.concurrency,
                 bar,
                 format_tps(row.accepted_tps),
-                row.p50_ms,
-                row.p99_ms,
+                row.ack_ms.p50_ms,
+                row.ack_ms.p99_ms,
                 rej,
             );
         }
@@ -150,12 +142,10 @@ fn main() -> BenchResult<()> {
         println!();
     }
 
-    // --- Memory ---
-    println!("  MEMORY");
+    // --- Memory & storage ---
+    println!("  MEMORY & STORAGE");
     println!("  ────────────────────────────────────────────");
-    let memory_source = capacity_sweep
-        .as_ref()
-        .and_then(|r| r.report.memory.as_ref());
+    let memory_source = capacity_sweep.and_then(|r| r.memory.as_ref());
     match memory_source {
         Some(mem) => {
             match mem.rss_growth_per_1k_accepted_tx_mb {
@@ -171,6 +161,36 @@ fn main() -> BenchResult<()> {
             println!("  n/a (no memory data available)");
         }
     }
+    match capacity_sweep.and_then(|r| r.storage.as_ref()) {
+        Some(storage) => match storage.logical_db_bytes {
+            Some(logical) => println!(
+                "  DB size:               {:.1} MB logical (file {:.1} MB + WAL {:.1} MB)",
+                mb(logical),
+                mb(storage.db_bytes),
+                mb(storage.wal_bytes)
+            ),
+            None => println!(
+                "  DB size:               {:.1} MB (+ WAL {:.1} MB)",
+                mb(storage.db_bytes),
+                mb(storage.wal_bytes)
+            ),
+        },
+        None => println!("  DB size:               n/a"),
+    }
+    match capacity_sweep.and_then(|r| r.drain.as_ref()) {
+        Some(drain) => match drain.drain_secs {
+            Some(secs) => println!(
+                "  Batch drain:           {} batches in {:.1} s",
+                drain.batches_pending, secs
+            ),
+            None => println!(
+                "  Batch drain:           {} batches, not drained within {} s",
+                drain.batches_pending,
+                DRAIN_DEADLINE.as_secs()
+            ),
+        },
+        None => println!("  Batch drain:           n/a"),
+    }
 
     println!();
     println!("  Methodology: all benchmarks run on localhost (same-host).");
@@ -242,6 +262,10 @@ fn cmd_output(cmd: &str, args: &[&str]) -> Option<String> {
         .and_then(|o| String::from_utf8(o.stdout).ok())
 }
 
+fn mb(bytes: u64) -> f64 {
+    bytes as f64 / (1024.0 * 1024.0)
+}
+
 fn format_tps(tps: f64) -> String {
     if tps >= 1000.0 {
         let thousands = tps / 1000.0;
@@ -255,63 +279,14 @@ fn format_tps(tps: f64) -> String {
     }
 }
 
-fn load_latest<R: serde::de::DeserializeOwned>(
-    dir: &Path,
-    prefix: &str,
-    suffix: &str,
-) -> Option<BenchmarkJsonOutput<R, Value>> {
-    let path = latest_file(dir, prefix, suffix)?;
-    let raw = fs::read_to_string(&path).ok()?;
-    serde_json::from_str(&raw).ok()
-}
-
-/// Load the latest ack-sweep JSON that has more than 1 row (i.e., a real sweep,
-/// not a single-concurrency baseline run).
-fn load_latest_multi_row_sweep(dir: &Path) -> Option<BenchmarkJsonOutput<SweepRunReport, Value>> {
-    let mut candidates: Vec<(u64, PathBuf)> = Vec::new();
-    let entries = fs::read_dir(dir).ok()?;
-    for entry in entries.flatten() {
-        let path = entry.path();
-        if !path.is_file() {
-            continue;
-        }
-        let file_name = path.file_name()?.to_str()?;
-        if file_name.starts_with("ack-sweep-") && file_name.ends_with(".json") {
-            let ts = trailing_number(file_name).unwrap_or(0);
-            candidates.push((ts, path));
-        }
-    }
-    // Sort by timestamp descending.
-    candidates.sort_by_key(|candidate| std::cmp::Reverse(candidate.0));
-    // Return the first one that has more than 1 row.
-    for (_, path) in candidates {
-        let raw = fs::read_to_string(&path).ok()?;
-        if let Ok(parsed) = serde_json::from_str::<BenchmarkJsonOutput<SweepRunReport, Value>>(&raw)
-            && parsed.report.rows.len() > 1
-        {
-            return Some(parsed);
-        }
-    }
-    None
-}
-
-fn latest_file(dir: &Path, prefix: &str, suffix: &str) -> Option<PathBuf> {
-    let mut best: Option<(u64, PathBuf)> = None;
-
-    let entries = fs::read_dir(dir).ok()?;
-    for entry in entries.flatten() {
-        let path = entry.path();
-        if !path.is_file() {
-            continue;
-        }
-        let file_name = path.file_name()?.to_str()?;
-        if file_name.starts_with(prefix) && file_name.ends_with(suffix) {
-            let ts = trailing_number(file_name).unwrap_or(0);
-            if best.as_ref().is_none_or(|(best_ts, _)| ts > *best_ts) {
-                best = Some((ts, path));
-            }
-        }
-    }
-
-    best.map(|(_, path)| path)
+/// The latest run whose row count says it is a sweep (`multi_row`) or a
+/// single-concurrency baseline.
+fn latest(
+    runs: &[(PathBuf, BenchmarkJsonOutput<SweepRunReport>)],
+    multi_row: bool,
+) -> Option<&SweepRunReport> {
+    runs.iter()
+        .rev()
+        .map(|(_, run)| &run.report)
+        .find(|report| (report.rows.len() > 1) == multi_row)
 }
diff --git a/tests/benchmarks/src/bin/round_trip_latency.rs b/tests/benchmarks/src/bin/round_trip_latency.rs
deleted file mode 100644
index 830cfb9b..00000000
--- a/tests/benchmarks/src/bin/round_trip_latency.rs
+++ /dev/null
@@ -1,238 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-use alloy_primitives::Address;
-use benchmarks::{
-    BenchResult, DEFAULT_ENDPOINT, DEFAULT_WORKLOAD_TRANSFER_AMOUNT, DOMAIN_NAME, DOMAIN_VERSION,
-    NetworkProfile, RoundTripRunConfig, WorkloadConfig, WorkloadKind, default_json_output_path,
-    evaluate_soft_confirm_target, parse_address, print_round_trip_report, print_target_evaluation,
-    resolve_external_benchmark_domain, run_round_trip_benchmark,
-    runtime::{
-        DEFAULT_MEMORY_SAMPLE_INTERVAL_MS, DEFAULT_SEQUENCER_BIN, MemorySampler, benchmark_domain,
-        bootstrap_funded_workload, managed_sequencer_config,
-    },
-    write_json_output,
-};
-use clap::Parser;
-use serde_json::json;
-use std::path::Path;
-use std::time::Duration;
-
-/// Conservative upper bound on how many txs a single worker might send during
-/// a benchmark run. Used to pre-fund accounts generously.
-const FUNDING_ESTIMATE_TXS_PER_WORKER: u64 = 100_000;
-
-#[derive(Debug, Parser)]
-#[command(
-    name = "round_trip_latency",
-    about = "round-trip latency benchmark",
-    version,
-    after_help = "Examples:\n  cargo run -p benchmarks --bin round_trip_latency -- --self-contained --duration-secs 30 --concurrency 16 --max-fee 2000\n  cargo run -p benchmarks --bin round_trip_latency -- --self-contained --duration-secs 60 --concurrency 16 --evaluate"
-)]
-struct Args {
-    #[arg(long, default_value = DEFAULT_ENDPOINT)]
-    endpoint: String,
-    #[arg(long, default_value_t = false)]
-    self_contained: bool,
-    #[arg(long, default_value = DEFAULT_SEQUENCER_BIN)]
-    sequencer_bin: String,
-    #[arg(long)]
-    domain_chain_id: Option<u64>,
-    #[arg(long, value_parser = parse_address)]
-    domain_verifying_contract: Option<Address>,
-    #[arg(long, value_enum, default_value_t = WorkloadKind::FundedTransfer)]
-    workload: WorkloadKind,
-    #[arg(long)]
-    accounts_file: Option<String>,
-    #[arg(long, default_value_t = DEFAULT_WORKLOAD_TRANSFER_AMOUNT)]
-    transfer_amount: u64,
-    #[arg(long, default_value_t = 45_u64)]
-    duration_secs: u64,
-    /// Number of concurrent workers (one wallet per worker).
-    #[arg(long, default_value_t = 1_usize)]
-    concurrency: usize,
-    #[arg(long, default_value_t = 2000_u16)]
-    max_fee: u16,
-    #[arg(long, default_value_t = 3_000_u64)]
-    request_timeout_ms: u64,
-    #[arg(long, default_value_t = 5_000_u64)]
-    max_ws_wait_ms: u64,
-    #[arg(long, default_value_t = 5_u64)]
-    warmup_secs: u64,
-    #[arg(long, default_value_t = false)]
-    evaluate: bool,
-    #[arg(long)]
-    json_out: Option<String>,
-}
-
-#[tokio::main]
-async fn main() -> BenchResult<()> {
-    let args = Args::parse();
-    let effective_concurrency = args.concurrency.max(1);
-    let network_profile = NetworkProfile::same_host_baseline();
-    let json_out = args.json_out.clone().or_else(|| {
-        args.self_contained
-            .then(|| default_json_output_path("round-trip-latency"))
-    });
-    let workload = WorkloadConfig {
-        kind: args.workload,
-        accounts_file: args.accounts_file.clone(),
-        transfer_amount: args.transfer_amount,
-    };
-    let mut managed = if args.self_contained {
-        Some(
-            rollups_harness::ManagedSequencer::spawn(managed_sequencer_config(
-                "round-trip-latency-self-contained",
-                &args.sequencer_bin,
-            ))
-            .await?,
-        )
-    } else {
-        None
-    };
-    if let Some(runtime) = managed.as_ref() {
-        let per_worker_counts = vec![FUNDING_ESTIMATE_TXS_PER_WORKER; effective_concurrency];
-        bootstrap_funded_workload(runtime, &workload, &per_worker_counts, args.max_fee).await?;
-    }
-    let domain = if let Some(value) = managed.as_ref() {
-        if args.domain_chain_id.is_some() || args.domain_verifying_contract.is_some() {
-            return Err(std::io::Error::other(
-                "self-contained benchmarks use the deployed local Application; remove explicit --domain-* args",
-            )
-            .into());
-        }
-        benchmark_domain(value)
-    } else {
-        resolve_external_benchmark_domain(args.domain_chain_id, args.domain_verifying_contract)?
-    };
-    let endpoint = managed
-        .as_ref()
-        .map(|value| value.endpoint().to_string())
-        .unwrap_or_else(|| args.endpoint.clone());
-
-    println!(
-        "round-trip config: endpoint={}, self_contained={}, domain_chain_id={}, domain_verifying_contract={}, duration={}s, concurrency={}, max_fee={}, workload={}",
-        endpoint,
-        args.self_contained,
-        domain.chain_id,
-        domain.verifying_contract,
-        args.duration_secs,
-        effective_concurrency,
-        args.max_fee,
-        args.workload.as_str(),
-    );
-
-    let memory_sampler = managed.as_ref().and_then(|value| value.pid()).map(|pid| {
-        MemorySampler::start(
-            pid,
-            Duration::from_millis(DEFAULT_MEMORY_SAMPLE_INTERVAL_MS),
-        )
-    });
-
-    let mut nonce_offsets = vec![0_u64; effective_concurrency];
-
-    if args.warmup_secs > 0 {
-        println!(
-            "running warmup: {}s ({} workers)",
-            args.warmup_secs, effective_concurrency
-        );
-        let warmup_config = RoundTripRunConfig {
-            endpoint: endpoint.clone(),
-            domain,
-            duration: Duration::from_secs(args.warmup_secs),
-            concurrency: effective_concurrency,
-            nonce_offsets: nonce_offsets.clone(),
-            max_fee: args.max_fee,
-            request_timeout_ms: args.request_timeout_ms,
-            max_ws_wait_ms: args.max_ws_wait_ms,
-            workload: workload.clone(),
-        };
-        let warmup_report = run_round_trip_benchmark(warmup_config).await?;
-        // Advance nonce offsets by actual accepted counts from warmup.
-        for (i, advance) in warmup_report.nonce_advances.iter().enumerate() {
-            nonce_offsets[i] += advance;
-        }
-        println!(
-            "warmup complete: accepted={}, rejected={}",
-            warmup_report.accepted, warmup_report.rejected
-        );
-    }
-
-    let config = RoundTripRunConfig {
-        endpoint,
-        domain,
-        duration: Duration::from_secs(args.duration_secs),
-        concurrency: effective_concurrency,
-        nonce_offsets,
-        max_fee: args.max_fee,
-        request_timeout_ms: args.request_timeout_ms,
-        max_ws_wait_ms: args.max_ws_wait_ms,
-        workload: workload.clone(),
-    };
-
-    let mut report_result = run_round_trip_benchmark(config).await;
-    if let Some(path) = managed
-        .as_ref()
-        .map(|value| value.log_path().to_string_lossy().to_string())
-        && let Ok(report) = report_result.as_mut()
-    {
-        report.sequencer_log_path = Some(path);
-    }
-    if let Some(sampler) = memory_sampler {
-        match report_result.as_mut() {
-            Ok(report) => report.memory = Some(sampler.stop(report.accepted).await?),
-            Err(_) => {
-                let _ = sampler.stop(0).await;
-            }
-        }
-    }
-    if let Some(value) = managed.take() {
-        let shutdown_result = value.shutdown().await;
-        if let Err(err) = shutdown_result
-            && report_result.is_ok()
-        {
-            return Err(err);
-        }
-    }
-
-    let report = report_result?;
-    let evaluation = args
-        .evaluate
-        .then(|| evaluate_soft_confirm_target(&report, network_profile.clone()));
-
-    print_round_trip_report(&report);
-    if let Some(value) = evaluation.as_ref() {
-        print_target_evaluation(value);
-    }
-
-    if let Some(path) = json_out.as_ref() {
-        let config_json = json!({
-            "endpoint": report.endpoint,
-            "self_contained": args.self_contained,
-            "domain_name": DOMAIN_NAME,
-            "domain_version": DOMAIN_VERSION,
-            "domain_chain_id": domain.chain_id,
-            "domain_verifying_contract": domain.verifying_contract.to_string(),
-            "duration_secs": args.duration_secs,
-            "warmup_secs": args.warmup_secs,
-            "concurrency": effective_concurrency,
-            "max_fee": args.max_fee,
-            "round_trip_request_timeout_ms": args.request_timeout_ms,
-            "round_trip_max_ws_wait_ms": args.max_ws_wait_ms,
-            "evaluation_requested": args.evaluate,
-            "network_profile": network_profile,
-            "workload": args.workload.as_str(),
-            "accounts_file": args.accounts_file,
-            "transfer_amount": args.transfer_amount,
-        });
-        write_json_output(
-            Path::new(path),
-            "round_trip_latency",
-            &config_json,
-            &report,
-            evaluation.as_ref(),
-        )?;
-        println!("round-trip json: {path}");
-    }
-    Ok(())
-}
diff --git a/tests/benchmarks/src/bin/sweep.rs b/tests/benchmarks/src/bin/sweep.rs
index 57744158..501ff1af 100644
--- a/tests/benchmarks/src/bin/sweep.rs
+++ b/tests/benchmarks/src/bin/sweep.rs
@@ -3,25 +3,24 @@
 
 use alloy_primitives::Address;
 use benchmarks::{
-    AckRunConfig, BenchResult, DEFAULT_ENDPOINT, DEFAULT_WORKLOAD_TRANSFER_AMOUNT, DOMAIN_NAME,
-    DOMAIN_VERSION, NetworkProfile, RoundTripRunConfig, RtSweepMeasurements, RtSweepRow,
-    RtSweepRunReport, SweepMeasurements, SweepRow, SweepRunReport, WorkloadConfig, WorkloadKind,
-    compute_capacity_summary, compute_rt_sweep_summary, default_json_output_path,
-    evaluate_ack_target, parse_address, print_ack_report, print_round_trip_report,
-    print_sweep_report, print_target_evaluation, resolve_external_benchmark_domain,
+    AckRunConfig, BenchResult, DEFAULT_ENDPOINT, DEFAULT_INTERNAL_ENDPOINT,
+    DEFAULT_WORKLOAD_TRANSFER_AMOUNT, DOMAIN_NAME, DOMAIN_VERSION, NETWORK_PROFILE,
+    RoundTripRunConfig, SweepRow, SweepRunReport, WorkloadConfig, WorkloadKind,
+    compute_capacity_summary, default_json_output_path, parse_address, print_ack_report,
+    print_round_trip_report, print_sweep_report, resolve_external_benchmark_domain,
     run_ack_benchmark, run_round_trip_benchmark,
     runtime::{
         DEFAULT_MEMORY_SAMPLE_INTERVAL_MS, DEFAULT_RESULTS_DIR, DEFAULT_SEQUENCER_BIN,
-        MemorySampler, benchmark_domain, bootstrap_funded_workload, managed_sequencer_config,
+        DRAIN_DEADLINE, MemorySampler, benchmark_domain, bootstrap_funded_workload,
+        managed_sequencer_config, measure_drain, sample_storage, storage_report,
     },
-    throughput_tx_per_s, write_json_output, write_rt_sweep_csv, write_sweep_csv,
+    write_json_output,
 };
 use clap::Parser;
 use serde_json::json;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 use std::time::Duration;
-use std::time::{SystemTime, UNIX_EPOCH};
 
 /// Conservative upper bound on how many txs a single worker might send during
 /// a benchmark run. Used to pre-fund accounts generously. If a worker exhausts
@@ -40,6 +39,9 @@ struct Args {
     duration_secs: u64,
     #[arg(long, default_value = DEFAULT_ENDPOINT)]
     endpoint: String,
+    /// The sequencer's internal listener (feed), for round-trip runs.
+    #[arg(long, default_value = DEFAULT_INTERNAL_ENDPOINT)]
+    internal_endpoint: String,
     #[arg(long, default_value_t = false)]
     self_contained: bool,
     #[arg(long, default_value = DEFAULT_SEQUENCER_BIN)]
@@ -76,41 +78,56 @@ struct Args {
     /// Run in round-trip mode (measures WS broadcast latency in addition to ACK).
     #[arg(long, default_value_t = false)]
     round_trip: bool,
+    #[arg(long, default_value_t = 3_000_u64)]
+    request_timeout_ms: u64,
     /// Max wait time (ms) for remaining WS events after workers finish (round-trip mode only).
     #[arg(long, default_value_t = 5_000_u64)]
     max_ws_wait_ms: u64,
     /// Run a warmup phase before the first sweep step.
     #[arg(long, default_value_t = 0_u64)]
     warmup_secs: u64,
-    /// Evaluate latency targets (single-concurrency runs).
-    #[arg(long, default_value_t = false)]
-    evaluate: bool,
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Mode {
+    Ack,
+    RoundTrip,
+}
+
+impl Mode {
+    fn label(self) -> &'static str {
+        match self {
+            Self::Ack => "ack",
+            Self::RoundTrip => "round-trip",
+        }
+    }
+
+    fn artifact_prefix(self) -> &'static str {
+        match self {
+            Self::Ack => "ack-sweep",
+            Self::RoundTrip => "rt-sweep",
+        }
+    }
 }
 
 #[tokio::main]
 async fn main() -> BenchResult<()> {
     let args = Args::parse();
-    let network_profile = NetworkProfile::same_host_baseline();
-    let json_prefix = if args.round_trip {
-        "rt-sweep"
+    let mode = if args.round_trip {
+        Mode::RoundTrip
     } else {
-        "ack-sweep"
+        Mode::Ack
     };
-    let json_out = args.json_out.clone().or_else(|| {
-        args.self_contained
-            .then(|| default_json_output_path(json_prefix))
-    });
+    let json_out = args
+        .json_out
+        .clone()
+        .unwrap_or_else(|| default_json_output_path(&args.results_dir, mode.artifact_prefix()));
     let concurrencies = resolve_concurrency_list(&args)?;
     if concurrencies.is_empty() {
         return Err(std::io::Error::other("concurrency list cannot be empty").into());
     }
 
     std::fs::create_dir_all(args.results_dir.as_str())?;
-    let timestamp = timestamp_string();
-    let csv_path = PathBuf::from(format!(
-        "{}/{}-{}.csv",
-        args.results_dir, json_prefix, timestamp
-    ));
 
     let mut managed = if args.self_contained {
         Some(
@@ -153,6 +170,10 @@ async fn main() -> BenchResult<()> {
         .as_ref()
         .map(|value| value.endpoint().to_string())
         .unwrap_or_else(|| args.endpoint.clone());
+    let internal_endpoint = managed
+        .as_ref()
+        .map(|value| value.internal_endpoint().to_string())
+        .unwrap_or_else(|| args.internal_endpoint.clone());
     let sequencer_log_path = managed
         .as_ref()
         .map(|value| value.log_path().to_string_lossy().to_string());
@@ -163,10 +184,9 @@ async fn main() -> BenchResult<()> {
         )
     });
 
-    let duration = Duration::from_secs(args.duration_secs);
-    let mode_str = if args.round_trip { "round-trip" } else { "ack" };
     println!(
-        "starting {mode_str} sweep: endpoint={} self_contained={} domain_chain_id={} domain_verifying_contract={} duration={}s max_fee={} workload={} concs={:?}",
+        "starting {} sweep: endpoint={} self_contained={} domain_chain_id={} domain_verifying_contract={} duration={}s max_fee={} workload={} concs={:?}",
+        mode.label(),
         endpoint,
         args.self_contained,
         domain.chain_id,
@@ -178,318 +198,186 @@ async fn main() -> BenchResult<()> {
     );
     println!("host fd soft limit (ulimit -n): {}", fd_soft_limit_string());
 
-    let max_workers = concurrencies.iter().copied().max().unwrap_or(1);
+    // Each step resumes every worker's wallet after the ops it got accepted
+    // in earlier steps.
     let mut nonce_offsets = vec![0_u64; max_workers];
-    let mut total_accepted = 0_u64;
+    let step_config =
+        |concurrency: usize, duration: Duration, nonce_offsets: &[u64]| RoundTripRunConfig {
+            endpoint: endpoint.clone(),
+            internal_endpoint: internal_endpoint.clone(),
+            domain,
+            duration,
+            concurrency,
+            nonce_offsets: nonce_offsets[..concurrency].to_vec(),
+            max_fee: args.max_fee,
+            request_timeout_ms: args.request_timeout_ms,
+            max_ws_wait_ms: args.max_ws_wait_ms,
+            workload: workload.clone(),
+        };
 
-    // Warmup phase.
     if args.warmup_secs > 0 {
         let first_concurrency = concurrencies[0];
-        let warmup_duration = Duration::from_secs(args.warmup_secs);
         println!(
             "running warmup: {}s ({} workers)",
             args.warmup_secs, first_concurrency
         );
-
-        let offsets_for_warmup = nonce_offsets[..first_concurrency].to_vec();
-        if args.round_trip {
-            let warmup_config = RoundTripRunConfig {
-                endpoint: endpoint.clone(),
-                domain,
-                duration: warmup_duration,
-                concurrency: first_concurrency,
-                nonce_offsets: offsets_for_warmup,
-                max_fee: args.max_fee,
-                request_timeout_ms: 3_000,
-                max_ws_wait_ms: args.max_ws_wait_ms,
-                workload: workload.clone(),
-            };
-            let warmup_report = run_round_trip_benchmark(warmup_config).await?;
-            for (i, advance) in warmup_report.nonce_advances.iter().enumerate() {
-                nonce_offsets[i] += advance;
-            }
-            println!(
-                "warmup complete: accepted={}, rejected={}",
-                warmup_report.accepted, warmup_report.rejected
-            );
-        } else {
-            let warmup_config = AckRunConfig {
-                endpoint: endpoint.clone(),
-                domain,
-                duration: warmup_duration,
-                concurrency: first_concurrency,
-                nonce_offsets: offsets_for_warmup,
-                max_fee: args.max_fee,
-                request_timeout_ms: 3_000,
-                workload: workload.clone(),
-            };
-            let warmup_report = run_ack_benchmark(warmup_config).await?;
-            for (i, advance) in warmup_report.nonce_advances.iter().enumerate() {
-                nonce_offsets[i] += advance;
-            }
-            println!(
-                "warmup complete: accepted={}, rejected={}",
-                warmup_report.accepted, warmup_report.rejected
-            );
+        let config = step_config(
+            first_concurrency,
+            Duration::from_secs(args.warmup_secs),
+            &nonce_offsets,
+        );
+        let (row, advances) = run_step(mode, config).await?;
+        for (offset, advance) in nonce_offsets.iter_mut().zip(advances) {
+            *offset += advance;
         }
+        println!(
+            "warmup complete: accepted={}, rejected={}",
+            row.accepted_count, row.rejected_count
+        );
     }
 
-    let mut run_error: Option<Box<dyn std::error::Error + Send + Sync>> = None;
-
-    if args.round_trip {
-        let mut rows = Vec::new();
-
-        for concurrency in concurrencies.iter().copied() {
-            println!();
-            println!("=== sweep concurrency={concurrency} (round-trip) ===");
-
-            let offsets_for_step = nonce_offsets[..concurrency].to_vec();
-
-            let config = RoundTripRunConfig {
-                endpoint: endpoint.clone(),
-                domain,
-                duration,
-                concurrency,
-                nonce_offsets: offsets_for_step,
-                max_fee: args.max_fee,
-                request_timeout_ms: 3_000,
-                max_ws_wait_ms: args.max_ws_wait_ms,
-                workload: workload.clone(),
-            };
-            let result = run_round_trip_benchmark(config).await.map(|report| {
-                // Accumulate nonce offsets from actual accepted counts per worker.
-                for (i, advance) in report.nonce_advances.iter().enumerate() {
-                    nonce_offsets[i] += advance;
-                }
-
-                print_round_trip_report(&report);
-                RtSweepRow::new(
-                    concurrency,
-                    throughput_tx_per_s(report.accepted as usize, report.total_wall),
-                    RtSweepMeasurements {
-                        accepted_count: report.accepted,
-                        rejected_count: report.rejected,
-                        rejection_rate: report.rejection_rate,
-                        ack_p50_ms: report.ack_latency_accepted.p50.as_secs_f64() * 1000.0,
-                        ack_p99_ms: report.ack_latency_accepted.p99.as_secs_f64() * 1000.0,
-                        rt_p50_ms: report.round_trip_latency_accepted.p50.as_secs_f64() * 1000.0,
-                        rt_p99_ms: report.round_trip_latency_accepted.p99.as_secs_f64() * 1000.0,
-                        rt_p999_ms: report.round_trip_latency_accepted.p999.as_secs_f64() * 1000.0,
-                        rejection_breakdown: report.rejection_breakdown,
-                    },
-                )
-            });
-
-            match result {
-                Ok(row) => {
-                    total_accepted = total_accepted.saturating_add(row.accepted_count);
-                    rows.push(row);
-                }
-                Err(err) => {
-                    let message = err.to_string();
-                    if message.contains("Too many open files") {
-                        println!();
-                        println!(
-                            "sweep stopped: hit file-descriptor limit at concurrency={concurrency}"
-                        );
-                        println!(
-                            "hint: raise soft limit before running sweep (example: ulimit -n 4096)"
-                        );
-                    }
-                    run_error = Some(err);
-                    break;
+    // After warmup, so storage growth covers the window total_accepted counts.
+    let storage_start = managed.as_ref().map(sample_storage).transpose()?;
+    let duration = Duration::from_secs(args.duration_secs);
+    let mut rows = Vec::new();
+    let mut total_accepted = 0_u64;
+    let mut run_error = None;
+    for concurrency in concurrencies.iter().copied() {
+        println!();
+        println!("=== sweep concurrency={concurrency} ({}) ===", mode.label());
+        match run_step(mode, step_config(concurrency, duration, &nonce_offsets)).await {
+            Ok((row, advances)) => {
+                for (offset, advance) in nonce_offsets.iter_mut().zip(advances) {
+                    *offset += advance;
                 }
+                total_accepted = total_accepted.saturating_add(row.accepted_count);
+                rows.push(row);
             }
-        }
-
-        let mut memory_report = None;
-        if let Some(sampler) = memory_sampler {
-            memory_report = Some(sampler.stop(total_accepted).await?);
-        }
-
-        if let Some(value) = managed.take() {
-            let shutdown_result = value.shutdown().await;
-            if run_error.is_none() && shutdown_result.is_err() {
-                return shutdown_result;
+            Err(err) => {
+                if err.to_string().contains("Too many open files") {
+                    println!();
+                    println!(
+                        "sweep stopped: hit file-descriptor limit at concurrency={concurrency}"
+                    );
+                    println!(
+                        "hint: raise soft limit before running sweep (example: ulimit -n 4096)"
+                    );
+                    println!("or use a smaller conc_list.");
+                }
+                run_error = Some(err);
+                break;
             }
         }
-        if let Some(err) = run_error {
-            return Err(err);
-        }
-
-        write_rt_sweep_csv(csv_path.as_path(), rows.as_slice())?;
-        let summary = compute_rt_sweep_summary(rows.as_slice());
-        let report = RtSweepRunReport {
-            rows,
-            summary,
-            memory: memory_report,
-            sequencer_log_path,
-        };
-
-        println!();
-        println!("sweep csv: {}", csv_path.display());
-        benchmarks::print_rt_sweep_report(&report);
-
-        if let Some(path) = json_out.as_ref() {
-            let config_json = json!({
-                "endpoint": endpoint,
-                "self_contained": args.self_contained,
-                "domain_name": DOMAIN_NAME,
-                "domain_version": DOMAIN_VERSION,
-                "domain_chain_id": domain.chain_id,
-                "domain_verifying_contract": domain.verifying_contract.to_string(),
-                "duration_secs": args.duration_secs,
-                "max_fee": args.max_fee,
-                "results_dir": args.results_dir,
-                "network_profile": network_profile,
-                "workload": args.workload.as_str(),
-                "accounts_file": args.accounts_file,
-                "transfer_amount": args.transfer_amount,
-                "concurrency_list": concurrencies,
-                "csv_path": csv_path,
-                "max_ws_wait_ms": args.max_ws_wait_ms,
-                "warmup_secs": args.warmup_secs,
-            });
-            write_json_output(
-                Path::new(path),
-                "rt_sweep",
-                &config_json,
-                &report,
-                Option::<&serde_json::Value>::None,
-            )?;
-            println!("sweep json: {path}");
-        }
-    } else {
-        // ACK mode (default).
-        let mut rows = Vec::new();
+    }
 
-        for concurrency in concurrencies.iter().copied() {
+    let memory = match memory_sampler {
+        Some(sampler) => Some(sampler.stop(total_accepted).await?),
+        None => None,
+    };
+    // Before shutdown: a clean close checkpoints the WAL away, and the data
+    // dir is deleted with the runtime.
+    let (storage, drain) = match (managed.as_ref(), storage_start) {
+        (Some(runtime), Some(start)) if run_error.is_none() => {
             println!();
-            println!("=== sweep concurrency={concurrency} ===");
-
-            let offsets_for_step = nonce_offsets[..concurrency].to_vec();
-
-            let config = AckRunConfig {
-                endpoint: endpoint.clone(),
-                domain,
-                duration,
-                concurrency,
-                nonce_offsets: offsets_for_step,
-                max_fee: args.max_fee,
-                request_timeout_ms: 3_000,
-                workload: workload.clone(),
-            };
-            let result = run_ack_benchmark(config).await.map(|report| {
-                // Accumulate nonce offsets from actual accepted counts per worker.
-                for (i, advance) in report.nonce_advances.iter().enumerate() {
-                    nonce_offsets[i] += advance;
-                }
-                print_ack_report(&report);
-
-                // Evaluate target if requested and this is a single-concurrency run.
-                if args.evaluate && concurrencies.len() == 1 {
-                    let evaluation = evaluate_ack_target(&report, network_profile.clone());
-                    print_target_evaluation(&evaluation);
-                }
-
-                SweepRow::new(
-                    concurrency,
-                    throughput_tx_per_s(report.accepted as usize, report.total_wall),
-                    SweepMeasurements {
-                        accepted_count: report.accepted,
-                        rejected_count: report.rejected,
-                        rejection_rate: report.rejection_rate,
-                        p50_ms: report.ack_latency_accepted.p50.as_secs_f64() * 1000.0,
-                        p95_ms: report.ack_latency_accepted.p95.as_secs_f64() * 1000.0,
-                        p99_ms: report.ack_latency_accepted.p99.as_secs_f64() * 1000.0,
-                        p999_ms: report.ack_latency_accepted.p999.as_secs_f64() * 1000.0,
-                        rejection_breakdown: report.rejection_breakdown,
-                    },
-                )
-            });
-
-            match result {
-                Ok(row) => {
-                    total_accepted = total_accepted.saturating_add(row.accepted_count);
-                    rows.push(row);
-                }
+            println!(
+                "draining sealed batches (up to {}s)",
+                DRAIN_DEADLINE.as_secs()
+            );
+            let measured = async {
+                let drain = measure_drain(runtime).await?;
+                let end = sample_storage(runtime)?;
+                BenchResult::Ok((storage_report(start, end, total_accepted), drain))
+            }
+            .await;
+            match measured {
+                Ok((storage, drain)) => (Some(storage), Some(drain)),
                 Err(err) => {
-                    let message = err.to_string();
-                    if message.contains("Too many open files") {
-                        println!();
-                        println!(
-                            "sweep stopped: hit file-descriptor limit at concurrency={concurrency}"
-                        );
-                        println!(
-                            "hint: raise soft limit before running sweep (example: ulimit -n 4096)"
-                        );
-                        println!("or use a smaller conc_list.");
-                    }
                     run_error = Some(err);
-                    break;
+                    (None, None)
                 }
             }
         }
-
-        let mut memory_report = None;
-        if let Some(sampler) = memory_sampler {
-            memory_report = Some(sampler.stop(total_accepted).await?);
+        _ => (None, None),
+    };
+    if let Some(value) = managed.take() {
+        let shutdown_result = value.shutdown().await;
+        if run_error.is_none() && shutdown_result.is_err() {
+            return shutdown_result;
         }
+    }
+    if let Some(err) = run_error {
+        return Err(err);
+    }
 
-        if let Some(value) = managed.take() {
-            let shutdown_result = value.shutdown().await;
-            if run_error.is_none() && shutdown_result.is_err() {
-                return shutdown_result;
-            }
-        }
-        if let Some(err) = run_error {
-            return Err(err);
-        }
+    let report = SweepRunReport {
+        summary: compute_capacity_summary(rows.as_slice()),
+        rows,
+        memory,
+        storage,
+        drain,
+        sequencer_log_path,
+    };
 
-        write_sweep_csv(csv_path.as_path(), rows.as_slice())?;
-        let summary = compute_capacity_summary(rows.as_slice());
-        let report = SweepRunReport {
-            rows,
-            summary,
-            memory: memory_report,
-            sequencer_log_path,
-        };
+    println!();
+    print_sweep_report(&report);
+
+    let config_json = json!({
+        "mode": mode.label(),
+        "endpoint": endpoint,
+        "internal_endpoint": internal_endpoint,
+        "self_contained": args.self_contained,
+        "domain_name": DOMAIN_NAME,
+        "domain_version": DOMAIN_VERSION,
+        "domain_chain_id": domain.chain_id,
+        "domain_verifying_contract": domain.verifying_contract.to_string(),
+        "duration_secs": args.duration_secs,
+        "warmup_secs": args.warmup_secs,
+        "max_fee": args.max_fee,
+        "request_timeout_ms": args.request_timeout_ms,
+        "max_ws_wait_ms": args.max_ws_wait_ms,
+        "results_dir": args.results_dir,
+        "network_profile": NETWORK_PROFILE,
+        "workload": args.workload.as_str(),
+        "accounts_file": args.accounts_file,
+        "transfer_amount": args.transfer_amount,
+        "concurrency_list": concurrencies,
+    });
+    write_json_output(
+        Path::new(&json_out),
+        mode.artifact_prefix(),
+        &config_json,
+        &report,
+    )?;
+    println!("sweep json: {json_out}");
 
-        println!();
-        println!("sweep csv: {}", csv_path.display());
-        print_sweep_report(&report);
+    Ok(())
+}
 
-        if let Some(path) = json_out.as_ref() {
-            let config_json = json!({
-                "endpoint": endpoint,
-                "self_contained": args.self_contained,
-                "domain_name": DOMAIN_NAME,
-                "domain_version": DOMAIN_VERSION,
-                "domain_chain_id": domain.chain_id,
-                "domain_verifying_contract": domain.verifying_contract.to_string(),
-                "duration_secs": args.duration_secs,
-                "max_fee": args.max_fee,
-                "results_dir": args.results_dir,
-                "network_profile": network_profile,
-                "workload": args.workload.as_str(),
-                "accounts_file": args.accounts_file,
-                "transfer_amount": args.transfer_amount,
-                "concurrency_list": concurrencies,
-                "csv_path": csv_path,
-                "warmup_secs": args.warmup_secs,
-            });
-            write_json_output(
-                Path::new(path),
-                "sweep",
-                &config_json,
-                &report,
-                Option::<&serde_json::Value>::None,
-            )?;
-            println!("sweep json: {path}");
+/// Runs one step, warmup or measured, and prints its report. Returns the row
+/// and each worker's accepted-op count.
+async fn run_step(mode: Mode, config: RoundTripRunConfig) -> BenchResult<(SweepRow, Vec<u64>)> {
+    match mode {
+        Mode::Ack => {
+            let report = run_ack_benchmark(AckRunConfig {
+                endpoint: config.endpoint,
+                domain: config.domain,
+                duration: config.duration,
+                concurrency: config.concurrency,
+                nonce_offsets: config.nonce_offsets,
+                max_fee: config.max_fee,
+                request_timeout_ms: config.request_timeout_ms,
+                workload: config.workload,
+            })
+            .await?;
+            print_ack_report(&report);
+            Ok((SweepRow::from_ack(&report), report.nonce_advances))
+        }
+        Mode::RoundTrip => {
+            let report = run_round_trip_benchmark(config).await?;
+            print_round_trip_report(&report);
+            Ok((SweepRow::from_round_trip(&report), report.nonce_advances))
         }
     }
-
-    Ok(())
 }
 
 fn resolve_concurrency_list(args: &Args) -> BenchResult<Vec<usize>> {
@@ -550,14 +438,6 @@ fn parse_concurrency_range(value: &str) -> BenchResult<Vec<usize>> {
     Ok(out)
 }
 
-fn timestamp_string() -> String {
-    let secs = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs();
-    secs.to_string()
-}
-
 fn fd_soft_limit_string() -> String {
     #[cfg(unix)]
     {
diff --git a/tests/benchmarks/src/domain.rs b/tests/benchmarks/src/domain.rs
index 1998a1af..8adb9d2a 100644
--- a/tests/benchmarks/src/domain.rs
+++ b/tests/benchmarks/src/domain.rs
@@ -8,6 +8,8 @@ use serde::{Deserialize, Serialize};
 use crate::{BenchResult, support::io_err};
 
 pub const DEFAULT_ENDPOINT: &str = "http://127.0.0.1:3000";
+/// The sequencer's internal listener, where the feed is served.
+pub const DEFAULT_INTERNAL_ENDPOINT: &str = "http://127.0.0.1:3001";
 #[derive(Debug, Clone, Copy, Serialize, Deserialize)]
 pub struct BenchmarkDomain {
     pub chain_id: u64,
diff --git a/tests/benchmarks/src/evaluation.rs b/tests/benchmarks/src/evaluation.rs
deleted file mode 100644
index 39fb57bf..00000000
--- a/tests/benchmarks/src/evaluation.rs
+++ /dev/null
@@ -1,214 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-use serde::{Deserialize, Serialize};
-
-use crate::{AckRunReport, RoundTripRunReport};
-
-pub const TARGET_EVALUATION_MIN_ACCEPTED_COUNT: u64 = 5_000;
-pub const DIAGNOSTIC_P999_MIN_ACCEPTED_COUNT: u64 = 10_000;
-pub const ACK_P99_TARGET_MS: f64 = 500.0;
-pub const SOFT_CONFIRM_P99_TARGET_MS: f64 = 1_000.0;
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum NetworkProfileKind {
-    SameHostBaseline,
-    CanonicalNetworkAware,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct NetworkProfile {
-    pub kind: NetworkProfileKind,
-    pub shaping_method: String,
-    pub shaping_config: String,
-}
-
-impl NetworkProfile {
-    pub fn same_host_baseline() -> Self {
-        Self {
-            kind: NetworkProfileKind::SameHostBaseline,
-            shaping_method: "none".to_string(),
-            shaping_config:
-                "no injected latency; benchmark client connects directly to the target sequencer"
-                    .to_string(),
-        }
-    }
-
-    fn is_canonical_target_scenario(&self) -> bool {
-        matches!(self.kind, NetworkProfileKind::CanonicalNetworkAware)
-    }
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum TargetVerdict {
-    Pass,
-    Fail,
-    NotEvaluated,
-}
-
-impl TargetVerdict {
-    fn as_line(self) -> &'static str {
-        match self {
-            Self::Pass => "PASS",
-            Self::Fail => "FAIL",
-            Self::NotEvaluated => "NOT_EVALUATED",
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum P999Confidence {
-    DiagnosticLowConfidence,
-    Sufficient,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TargetEvaluation {
-    pub label: String,
-    pub verdict: TargetVerdict,
-    pub threshold_p99_ms: f64,
-    pub observed_p99_ms: f64,
-    pub observed_p999_ms: f64,
-    pub meets_latency_threshold: bool,
-    pub zero_rejection: bool,
-    pub sample_size_valid: bool,
-    pub accepted_count: u64,
-    pub rejected_count: u64,
-    pub p999_confidence: P999Confidence,
-    pub network_profile: NetworkProfile,
-    pub reason: Option<String>,
-}
-
-pub fn evaluate_ack_target(
-    report: &AckRunReport,
-    network_profile: NetworkProfile,
-) -> TargetEvaluation {
-    build_target_evaluation(
-        "ACK_TARGET",
-        report.accepted,
-        report.rejected,
-        report.ack_latency_accepted.p99.as_secs_f64() * 1000.0,
-        report.ack_latency_accepted.p999.as_secs_f64() * 1000.0,
-        ACK_P99_TARGET_MS,
-        network_profile,
-    )
-}
-
-pub fn evaluate_soft_confirm_target(
-    report: &RoundTripRunReport,
-    network_profile: NetworkProfile,
-) -> TargetEvaluation {
-    build_target_evaluation(
-        "SOFT_CONFIRM_TARGET",
-        report.accepted,
-        report.rejected,
-        report.round_trip_latency_accepted.p99.as_secs_f64() * 1000.0,
-        report.round_trip_latency_accepted.p999.as_secs_f64() * 1000.0,
-        SOFT_CONFIRM_P99_TARGET_MS,
-        network_profile,
-    )
-}
-
-pub fn print_target_evaluation(evaluation: &TargetEvaluation) {
-    if let Some(reason) = evaluation.reason.as_ref() {
-        println!(
-            "{}: {} ({reason})",
-            evaluation.label,
-            evaluation.verdict.as_line()
-        );
-    } else {
-        println!("{}: {}", evaluation.label, evaluation.verdict.as_line());
-    }
-    println!(
-        "  observed_p99_ms: {:.3} (threshold {:.3})",
-        evaluation.observed_p99_ms, evaluation.threshold_p99_ms
-    );
-    println!("  observed_p99.9_ms: {:.3}", evaluation.observed_p999_ms);
-    println!(
-        "  latency_threshold_met: {}",
-        evaluation.meets_latency_threshold
-    );
-    println!("  zero_rejection: {}", evaluation.zero_rejection);
-    println!("  sample_size_valid: {}", evaluation.sample_size_valid);
-    println!("  accepted_count: {}", evaluation.accepted_count);
-    println!("  rejected_count: {}", evaluation.rejected_count);
-    println!(
-        "  p99.9_confidence: {}",
-        match evaluation.p999_confidence {
-            P999Confidence::DiagnosticLowConfidence => "diagnostic-low-confidence",
-            P999Confidence::Sufficient => "sufficient",
-        }
-    );
-    println!(
-        "  network_profile: {:?} ({})",
-        evaluation.network_profile.kind, evaluation.network_profile.shaping_method
-    );
-}
-
-fn build_target_evaluation(
-    label: &str,
-    accepted_count: u64,
-    rejected_count: u64,
-    observed_p99_ms: f64,
-    observed_p999_ms: f64,
-    threshold_p99_ms: f64,
-    network_profile: NetworkProfile,
-) -> TargetEvaluation {
-    let zero_rejection = rejected_count == 0;
-    let sample_size_valid = accepted_count >= TARGET_EVALUATION_MIN_ACCEPTED_COUNT;
-    let meets_latency_threshold = observed_p99_ms <= threshold_p99_ms;
-    let p999_confidence = if accepted_count >= DIAGNOSTIC_P999_MIN_ACCEPTED_COUNT {
-        P999Confidence::Sufficient
-    } else {
-        P999Confidence::DiagnosticLowConfidence
-    };
-
-    let (verdict, reason) = if !network_profile.is_canonical_target_scenario() {
-        (
-            TargetVerdict::NotEvaluated,
-            Some(
-                "canonical network-aware scenario is not configured in this harness yet"
-                    .to_string(),
-            ),
-        )
-    } else if !sample_size_valid {
-        (
-            TargetVerdict::NotEvaluated,
-            Some(format!(
-                "accepted_count={} is below the target-evaluation minimum of {}",
-                accepted_count, TARGET_EVALUATION_MIN_ACCEPTED_COUNT
-            )),
-        )
-    } else if !zero_rejection {
-        (
-            TargetVerdict::NotEvaluated,
-            Some(format!(
-                "rejected_count={} but target evaluation requires zero rejections",
-                rejected_count
-            )),
-        )
-    } else if meets_latency_threshold {
-        (TargetVerdict::Pass, None)
-    } else {
-        (TargetVerdict::Fail, None)
-    };
-
-    TargetEvaluation {
-        label: label.to_string(),
-        verdict,
-        threshold_p99_ms,
-        observed_p99_ms,
-        observed_p999_ms,
-        meets_latency_threshold,
-        zero_rejection,
-        sample_size_valid,
-        accepted_count,
-        rejected_count,
-        p999_confidence,
-        network_profile,
-        reason,
-    }
-}
diff --git a/tests/benchmarks/src/lib.rs b/tests/benchmarks/src/lib.rs
index 01d84230..4970c731 100644
--- a/tests/benchmarks/src/lib.rs
+++ b/tests/benchmarks/src/lib.rs
@@ -3,11 +3,9 @@
 
 mod ack;
 mod domain;
-mod evaluation;
 mod rejection;
 mod report;
 mod round_trip;
-mod rt_sweep;
 pub mod runtime;
 mod stats;
 mod support;
@@ -16,32 +14,21 @@ mod workload;
 
 pub use ack::{AckRunConfig, AckRunReport, run_ack_benchmark};
 pub use domain::{
-    BenchmarkDomain, DEFAULT_ENDPOINT, parse_address, resolve_external_benchmark_domain,
-};
-pub use evaluation::{
-    ACK_P99_TARGET_MS, DIAGNOSTIC_P999_MIN_ACCEPTED_COUNT, NetworkProfile, NetworkProfileKind,
-    P999Confidence, SOFT_CONFIRM_P99_TARGET_MS, TARGET_EVALUATION_MIN_ACCEPTED_COUNT,
-    TargetEvaluation, TargetVerdict, evaluate_ack_target, evaluate_soft_confirm_target,
-    print_target_evaluation,
+    BenchmarkDomain, DEFAULT_ENDPOINT, DEFAULT_INTERNAL_ENDPOINT, parse_address,
+    resolve_external_benchmark_domain,
 };
 pub use report::{
-    BenchmarkJsonOutput, default_json_output_path, print_ack_report, print_memory_report,
-    print_round_trip_report, write_json_output,
+    BenchmarkJsonOutput, NETWORK_PROFILE, default_json_output_path, load_sweep_results,
+    print_ack_report, print_memory_report, print_round_trip_report, write_json_output,
 };
 pub use round_trip::{RoundTripRunConfig, RoundTripRunReport, run_round_trip_benchmark};
-pub use rt_sweep::{
-    RtSweepMeasurements, RtSweepRow, RtSweepRunReport, RtSweepSummary, compute_rt_sweep_summary,
-    print_rt_sweep_report, write_csv as write_rt_sweep_csv,
-};
 pub use sequencer_core::{DOMAIN_NAME, DOMAIN_VERSION};
 pub use stats::{
     Stats, StatsMs, format_optional_f64, print_stats, rejection_rate, summarize,
     throughput_tx_per_s,
 };
-pub use support::trailing_number;
 pub use sweep::{
-    SweepMeasurements, SweepRow, SweepRunReport, SweepSummary, compute_capacity_summary,
-    print_sweep_report, write_csv as write_sweep_csv,
+    SweepRow, SweepRunReport, SweepSummary, compute_capacity_summary, print_sweep_report,
 };
 pub use workload::{DEFAULT_WORKLOAD_TRANSFER_AMOUNT, WorkloadConfig, WorkloadKind};
 
diff --git a/tests/benchmarks/src/report.rs b/tests/benchmarks/src/report.rs
index 8288c95c..f26cfbaf 100644
--- a/tests/benchmarks/src/report.rs
+++ b/tests/benchmarks/src/report.rs
@@ -4,34 +4,35 @@
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::fs;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use crate::{
-    AckRunReport, BenchResult, RoundTripRunReport, TargetEvaluation, runtime,
+    AckRunReport, BenchResult, RoundTripRunReport, SweepRunReport, runtime,
     stats::{format_optional_f64, print_stats, throughput_tx_per_s},
+    support::trailing_number,
 };
 
+/// Spec §4.2: no shaper exists, so every run is this profile.
+pub const NETWORK_PROFILE: &str =
+    "same-host baseline: no injected latency; the client connects directly to the sequencer";
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct BenchmarkJsonOutput<R, E = TargetEvaluation> {
+pub struct BenchmarkJsonOutput<R> {
     pub benchmark: String,
     pub config: Value,
     pub report: R,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub evaluation: Option<E>,
 }
 
-pub fn write_json_output<C, R, E>(
+pub fn write_json_output<C, R>(
     path: &Path,
     benchmark: &str,
     config: &C,
     report: &R,
-    evaluation: Option<&E>,
 ) -> BenchResult<()>
 where
     C: Serialize,
     R: Serialize,
-    E: Serialize,
 {
     if let Some(parent) = path.parent() {
         fs::create_dir_all(parent)?;
@@ -40,18 +41,55 @@ where
         benchmark: benchmark.to_string(),
         config: serde_json::to_value(config)?,
         report,
-        evaluation,
     };
     fs::write(path, serde_json::to_vec_pretty(&payload)?)?;
     Ok(())
 }
 
-pub fn default_json_output_path(prefix: &str) -> String {
+pub fn default_json_output_path(results_dir: &str, prefix: &str) -> String {
     let ts = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map(|value| value.as_secs())
         .unwrap_or(0);
-    format!("{}/{prefix}-{ts}.json", runtime::DEFAULT_RESULTS_DIR)
+    format!("{results_dir}/{prefix}-{ts}.json")
+}
+
+/// Sweep results named `<prefix>-<unix secs>.json` under `dir`, oldest
+/// first. Files that do not parse as the current format are skipped with a
+/// warning; a missing `dir` yields an empty list.
+pub fn load_sweep_results(
+    dir: &Path,
+    prefix: &str,
+) -> BenchResult<Vec<(PathBuf, BenchmarkJsonOutput<SweepRunReport>)>> {
+    let entries = match fs::read_dir(dir) {
+        Ok(entries) => entries,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(err) => return Err(err.into()),
+    };
+    let file_prefix = format!("{prefix}-");
+    let mut candidates = Vec::new();
+    for entry in entries {
+        let path = entry?.path();
+        let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+            continue;
+        };
+        if path.is_file() && name.starts_with(&file_prefix) && name.ends_with(".json") {
+            candidates.push((trailing_number(name).unwrap_or(0), name.to_string(), path));
+        }
+    }
+    candidates.sort();
+
+    let mut runs = Vec::with_capacity(candidates.len());
+    for (_, _, path) in candidates {
+        match serde_json::from_str(&fs::read_to_string(&path)?) {
+            Ok(run) => runs.push((path, run)),
+            Err(err) => eprintln!(
+                "skipping {}: not a current sweep result ({err})",
+                path.display()
+            ),
+        }
+    }
+    Ok(runs)
 }
 
 pub fn print_ack_report(report: &AckRunReport) {
@@ -81,12 +119,6 @@ pub fn print_ack_report(report: &AckRunReport) {
     if let Some(stats) = report.ack_latency_rejected.as_ref() {
         print_stats("ack_latency_rejected", stats);
     }
-    if let Some(memory) = report.memory.as_ref() {
-        print_memory_report(memory);
-    }
-    if let Some(path) = report.sequencer_log_path.as_ref() {
-        println!("sequencer_log_path: {path}");
-    }
 }
 
 pub fn print_round_trip_report(report: &RoundTripRunReport) {
@@ -125,12 +157,6 @@ pub fn print_round_trip_report(report: &RoundTripRunReport) {
         "round_trip_latency_accepted",
         &report.round_trip_latency_accepted,
     );
-    if let Some(memory) = report.memory.as_ref() {
-        print_memory_report(memory);
-    }
-    if let Some(path) = report.sequencer_log_path.as_ref() {
-        println!("sequencer_log_path: {path}");
-    }
 }
 
 pub fn print_memory_report(memory: &runtime::MemoryReport) {
@@ -152,3 +178,29 @@ pub fn print_memory_report(memory: &runtime::MemoryReport) {
         format_optional_f64(memory.rss_growth_per_1k_accepted_tx_mb)
     );
 }
+
+pub fn print_storage_report(storage: &runtime::StorageReport) {
+    println!("storage:");
+    match storage.logical_db_bytes {
+        Some(bytes) => println!("  logical_db_bytes: {bytes}"),
+        None => println!("  logical_db_bytes: n/a"),
+    }
+    println!("  db_bytes: {}", storage.db_bytes);
+    println!("  wal_bytes: {}", storage.wal_bytes);
+    println!(
+        "  growth_bytes_per_1k_accepted: {}",
+        format_optional_f64(storage.growth_bytes_per_1k_accepted)
+    );
+}
+
+pub fn print_drain_report(drain: &runtime::DrainReport) {
+    println!("drain:");
+    println!("  batches_pending: {}", drain.batches_pending);
+    match drain.drain_secs {
+        Some(secs) => println!("  drain_secs: {secs:.1}"),
+        None => println!(
+            "  drain_secs: not reached within {}s",
+            runtime::DRAIN_DEADLINE.as_secs()
+        ),
+    }
+}
diff --git a/tests/benchmarks/src/round_trip.rs b/tests/benchmarks/src/round_trip.rs
index 44348587..ab71624f 100644
--- a/tests/benchmarks/src/round_trip.rs
+++ b/tests/benchmarks/src/round_trip.rs
@@ -17,7 +17,6 @@ use crate::{
     BenchResult,
     domain::BenchmarkDomain,
     rejection::{RejectionOutcome, classify_rejection},
-    runtime,
     stats::{Stats, StatsMs, rejection_rate, summarize, throughput_tx_per_s},
     support::io_err,
     workload::{WorkloadConfig, build_worker_contexts},
@@ -29,6 +28,8 @@ const DEFAULT_BACKLOG_DRAIN_MAX_MS: u64 = 2_000;
 #[derive(Debug, Clone)]
 pub struct RoundTripRunConfig {
     pub endpoint: String,
+    /// The internal listener the feed is read from.
+    pub internal_endpoint: String,
     pub domain: BenchmarkDomain,
     pub duration: Duration,
     pub concurrency: usize,
@@ -63,8 +64,6 @@ pub struct RoundTripRunReport {
     pub ack_latency_rejected: Option<Stats>,
     pub round_trip_latency_accepted: Stats,
     pub round_trip_latency_accepted_ms: StatsMs,
-    pub memory: Option<runtime::MemoryReport>,
-    pub sequencer_log_path: Option<String>,
 }
 
 struct RoundTripAckSample {
@@ -83,9 +82,16 @@ pub async fn run_round_trip_benchmark(
         SequencerClient::new_with_timeout(config.endpoint.clone(), timeout).map_err(|e| {
             crate::support::io_err(format!("invalid endpoint '{}': {e}", config.endpoint))
         })?;
+    let feed_client = SequencerClient::new_with_timeout(config.internal_endpoint.clone(), timeout)
+        .map_err(|e| {
+            crate::support::io_err(format!(
+                "invalid internal endpoint '{}': {e}",
+                config.internal_endpoint
+            ))
+        })?;
     // This observer tracks latency only; it holds no application state to restore.
-    let claim = client.latest_snapshot().await?.claim;
-    let ws_subscribe_url = client.ws_subscribe_url(claim);
+    let claim = feed_client.latest_snapshot().await?.claim;
+    let ws_subscribe_url = feed_client.ws_subscribe_url(claim);
     let domain = config.domain.eip712_domain();
 
     let workers = config.concurrency;
@@ -100,7 +106,7 @@ pub async fn run_round_trip_benchmark(
     )?;
 
     // Connect WS and drain backlog.
-    let mut ws = client.subscribe(claim).await.map_err(|err| {
+    let mut ws = feed_client.subscribe(claim).await.map_err(|err| {
         io_err(format!(
             "ws connect failed: url={ws_subscribe_url}, error={err}"
         ))
@@ -313,8 +319,6 @@ pub async fn run_round_trip_benchmark(
         ack_latency_rejected: rejected_stats,
         round_trip_latency_accepted_ms: round_trip_stats.to_ms(),
         round_trip_latency_accepted: round_trip_stats,
-        memory: None,
-        sequencer_log_path: None,
     })
 }
 
diff --git a/tests/benchmarks/src/rt_sweep.rs b/tests/benchmarks/src/rt_sweep.rs
deleted file mode 100644
index d0ac3af3..00000000
--- a/tests/benchmarks/src/rt_sweep.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-// (c) Cartesi and individual authors (see AUTHORS)
-// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
-
-use serde::{Deserialize, Serialize};
-use std::collections::BTreeMap;
-use std::fs;
-use std::path::Path;
-
-use crate::{BenchResult, report::print_memory_report, runtime};
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct RtSweepRow {
-    pub concurrency: usize,
-    pub accepted_tps: f64,
-    pub accepted_count: u64,
-    pub rejected_count: u64,
-    pub rejection_rate: f64,
-    pub ack_p50_ms: f64,
-    pub ack_p99_ms: f64,
-    pub rt_p50_ms: f64,
-    pub rt_p99_ms: f64,
-    pub rt_p999_ms: f64,
-    pub rejection_breakdown: BTreeMap<String, u64>,
-}
-
-#[derive(Debug, Clone)]
-pub struct RtSweepMeasurements {
-    pub accepted_count: u64,
-    pub rejected_count: u64,
-    pub rejection_rate: f64,
-    pub ack_p50_ms: f64,
-    pub ack_p99_ms: f64,
-    pub rt_p50_ms: f64,
-    pub rt_p99_ms: f64,
-    pub rt_p999_ms: f64,
-    pub rejection_breakdown: BTreeMap<String, u64>,
-}
-
-impl RtSweepRow {
-    pub fn new(concurrency: usize, accepted_tps: f64, m: RtSweepMeasurements) -> Self {
-        Self {
-            concurrency,
-            accepted_tps,
-            accepted_count: m.accepted_count,
-            rejected_count: m.rejected_count,
-            rejection_rate: m.rejection_rate,
-            ack_p50_ms: m.ack_p50_ms,
-            ack_p99_ms: m.ack_p99_ms,
-            rt_p50_ms: m.rt_p50_ms,
-            rt_p99_ms: m.rt_p99_ms,
-            rt_p999_ms: m.rt_p999_ms,
-            rejection_breakdown: m.rejection_breakdown,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct RtSweepSummary {
-    pub max_sustainable_tps_at_0_rejections: Option<f64>,
-    pub tps_at_first_any_rejection: Option<f64>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct RtSweepRunReport {
-    pub rows: Vec<RtSweepRow>,
-    pub summary: RtSweepSummary,
-    pub memory: Option<runtime::MemoryReport>,
-    pub sequencer_log_path: Option<String>,
-}
-
-pub fn compute_rt_sweep_summary(rows: &[RtSweepRow]) -> RtSweepSummary {
-    let max_sustainable_tps_at_0_rejections = rows
-        .iter()
-        .filter(|row| row.rejected_count == 0)
-        .map(|row| row.accepted_tps)
-        .max_by(|a, b| a.total_cmp(b));
-
-    let tps_at_first_any_rejection = rows
-        .iter()
-        .find(|row| row.rejected_count > 0)
-        .map(|row| row.accepted_tps);
-
-    RtSweepSummary {
-        max_sustainable_tps_at_0_rejections,
-        tps_at_first_any_rejection,
-    }
-}
-
-pub fn write_csv(path: &Path, rows: &[RtSweepRow]) -> BenchResult<()> {
-    let mut out = String::from(
-        "concurrency,accepted_tps,accepted_count,rejected_count,rejection_rate,ack_p50_ms,ack_p99_ms,rt_p50_ms,rt_p99_ms,rt_p999_ms\n",
-    );
-    for row in rows {
-        out.push_str(
-            format!(
-                "{},{:.6},{},{},{:.6},{:.6},{:.6},{:.6},{:.6},{:.6}\n",
-                row.concurrency,
-                row.accepted_tps,
-                row.accepted_count,
-                row.rejected_count,
-                row.rejection_rate,
-                row.ack_p50_ms,
-                row.ack_p99_ms,
-                row.rt_p50_ms,
-                row.rt_p99_ms,
-                row.rt_p999_ms,
-            )
-            .as_str(),
-        );
-    }
-    fs::write(path, out)?;
-    Ok(())
-}
-
-pub fn print_rt_sweep_report(report: &RtSweepRunReport) {
-    println!(
-        "max_sustainable_tps_at_0_rejections: {}",
-        format_optional(report.summary.max_sustainable_tps_at_0_rejections)
-    );
-    println!(
-        "tps_at_first_any_rejection: {}",
-        format_optional(report.summary.tps_at_first_any_rejection)
-    );
-    if let Some(memory) = report.memory.as_ref() {
-        print_memory_report(memory);
-    }
-    if let Some(path) = report.sequencer_log_path.as_ref() {
-        println!("sequencer_log_path: {path}");
-    }
-}
-
-fn format_optional(value: Option<f64>) -> String {
-    match value {
-        Some(v) => format!("{v:.2}"),
-        None => "not reached".to_string(),
-    }
-}
diff --git a/tests/benchmarks/src/runtime.rs b/tests/benchmarks/src/runtime.rs
index 381d79e0..6d4385ea 100644
--- a/tests/benchmarks/src/runtime.rs
+++ b/tests/benchmarks/src/runtime.rs
@@ -5,7 +5,7 @@ use alloy_primitives::U256;
 use sequencer_core::fee::fee_to_linear;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
-use std::time::Duration;
+use std::time::{Duration, Instant};
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
 
@@ -215,3 +215,140 @@ fn sample_rss_mb(pid: u32) -> Option<f64> {
     let rss_kib = text.trim().parse::<f64>().ok()?;
     Some(rss_kib / 1024.0)
 }
+
+/// How long a self-contained run waits, after the load stops, for its sealed
+/// batches to be accepted on L1.
+pub const DRAIN_DEADLINE: Duration = Duration::from_secs(120);
+const DRAIN_POLL_INTERVAL: Duration = Duration::from_secs(1);
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct StorageReport {
+    /// `None` in results written before the logical size was measured.
+    #[serde(default)]
+    pub logical_db_bytes: Option<u64>,
+    pub db_bytes: u64,
+    pub wal_bytes: u64,
+    pub growth_bytes_per_1k_accepted: Option<f64>,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct StorageSample {
+    logical_bytes: u64,
+    db_bytes: u64,
+    wal_bytes: u64,
+}
+
+/// Footprint (the SQLite file and its WAL, 0 when absent) and logical size.
+pub fn sample_storage(runtime: &ManagedSequencer) -> BenchResult<StorageSample> {
+    let db_path = runtime.db_path();
+    let mut wal_path = db_path.clone().into_os_string();
+    wal_path.push("-wal");
+    let wal_bytes = match std::fs::metadata(&wal_path) {
+        Ok(metadata) => metadata.len(),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => 0,
+        Err(err) => return Err(err.into()),
+    };
+    Ok(StorageSample {
+        logical_bytes: runtime.logical_db_bytes()?,
+        db_bytes: std::fs::metadata(&db_path)?.len(),
+        wal_bytes,
+    })
+}
+
+pub fn storage_report(
+    start: StorageSample,
+    end: StorageSample,
+    accepted_count: u64,
+) -> StorageReport {
+    // Logical bytes: the WAL file sits at its autocheckpoint size and the main
+    // file grows only when a checkpoint copies pages back, so file sizes are
+    // footprint, not growth. Signed, because deletes can free pages.
+    let growth_bytes = end.logical_bytes as f64 - start.logical_bytes as f64;
+    // Same floor as the RSS metric: below it, one-time growth dominates.
+    let growth_bytes_per_1k_accepted =
+        (accepted_count >= 1000).then(|| growth_bytes / (accepted_count as f64 / 1000.0));
+    StorageReport {
+        logical_db_bytes: Some(end.logical_bytes),
+        db_bytes: end.db_bytes,
+        wal_bytes: end.wal_bytes,
+        growth_bytes_per_1k_accepted,
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DrainReport {
+    pub batches_pending: u64,
+    /// `None` when the backlog did not drain within [`DRAIN_DEADLINE`].
+    pub drain_secs: Option<f64>,
+}
+
+/// Time from now, with the load stopped, until `safe_accepted_batches` holds
+/// the highest valid sealed batch nonce read now. The open batch is excluded,
+/// so this measures the submission backlog, not the batch-open window. Mines
+/// one L1 block per second at Anvil's own clock.
+pub async fn measure_drain(runtime: &ManagedSequencer) -> BenchResult<DrainReport> {
+    let started = Instant::now();
+    let frontier = runtime.batch_nonce_frontier()?;
+    let Some(target) = frontier.sealed else {
+        return Ok(DrainReport {
+            batches_pending: 0,
+            drain_secs: Some(0.0),
+        });
+    };
+    let accepted_through = frontier.safe_accepted.map_or(0, |nonce| nonce + 1);
+    let batches_pending = (target + 1).saturating_sub(accepted_through);
+    if batches_pending == 0 {
+        return Ok(DrainReport {
+            batches_pending,
+            drain_secs: Some(0.0),
+        });
+    }
+
+    while started.elapsed() < DRAIN_DEADLINE {
+        runtime.mine_l1_block_at_wall_clock().await?;
+        tokio::time::sleep(DRAIN_POLL_INTERVAL).await;
+        let accepted = runtime.batch_nonce_frontier()?.safe_accepted;
+        if accepted.is_some_and(|nonce| nonce >= target) {
+            return Ok(DrainReport {
+                batches_pending,
+                drain_secs: Some(started.elapsed().as_secs_f64()),
+            });
+        }
+    }
+    Ok(DrainReport {
+        batches_pending,
+        drain_secs: None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{StorageReport, StorageSample, storage_report};
+
+    const MIB: u64 = 1024 * 1024;
+
+    #[test]
+    fn storage_growth_comes_from_the_logical_size_not_the_footprint() {
+        let sample = |logical_bytes| StorageSample {
+            logical_bytes,
+            db_bytes: 4 * MIB,
+            wal_bytes: 4 * MIB,
+        };
+        // Unchanged footprint: a file-size basis would report 0.
+        let report = storage_report(sample(MIB), sample(3 * MIB), 2000);
+        assert_eq!(report.growth_bytes_per_1k_accepted, Some(MIB as f64));
+        assert_eq!(report.logical_db_bytes, Some(3 * MIB));
+
+        let report = storage_report(sample(MIB), sample(3 * MIB), 999);
+        assert_eq!(report.growth_bytes_per_1k_accepted, None);
+    }
+
+    #[test]
+    fn results_written_before_the_logical_size_still_load() {
+        let old: StorageReport = serde_json::from_str(
+            r#"{"db_bytes":1,"wal_bytes":2,"growth_bytes_per_1k_accepted":null}"#,
+        )
+        .expect("an old storage report loads");
+        assert_eq!(old.logical_db_bytes, None);
+    }
+}
diff --git a/tests/benchmarks/src/sweep.rs b/tests/benchmarks/src/sweep.rs
index 32982695..c709a961 100644
--- a/tests/benchmarks/src/sweep.rs
+++ b/tests/benchmarks/src/sweep.rs
@@ -3,19 +3,20 @@
 
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
-use std::fs;
-use std::path::Path;
 
 use crate::{
-    BenchResult,
+    AckRunReport, RoundTripRunReport,
     rejection::{
         client_failure_count, has_http_429, has_http_rejection, http_429_count,
         http_rejection_count,
     },
-    report::print_memory_report,
+    report::{print_drain_report, print_memory_report, print_storage_report},
     runtime,
+    stats::{StatsMs, throughput_tx_per_s},
 };
 
+/// One measured step of a sweep. `round_trip_ms` is set only in round-trip
+/// mode.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SweepRow {
     pub concurrency: usize,
@@ -26,53 +27,60 @@ pub struct SweepRow {
     pub http_429_count: u64,
     pub client_failure_count: u64,
     pub rejection_rate: f64,
-    pub p50_ms: f64,
-    pub p95_ms: f64,
-    pub p99_ms: f64,
-    pub p999_ms: f64,
-    pub rejection_breakdown: BTreeMap<String, u64>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct SweepMeasurements {
-    pub accepted_count: u64,
-    pub rejected_count: u64,
-    pub rejection_rate: f64,
-    pub p50_ms: f64,
-    pub p95_ms: f64,
-    pub p99_ms: f64,
-    pub p999_ms: f64,
+    pub ack_ms: StatsMs,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub round_trip_ms: Option<StatsMs>,
     pub rejection_breakdown: BTreeMap<String, u64>,
 }
 
 impl SweepRow {
-    pub fn new(concurrency: usize, accepted_tps: f64, metrics: SweepMeasurements) -> Self {
-        let SweepMeasurements {
-            accepted_count,
-            rejected_count,
-            rejection_rate,
-            p50_ms,
-            p95_ms,
-            p99_ms,
-            p999_ms,
-            rejection_breakdown,
-        } = metrics;
-        let http_rejected_count = http_rejection_count(&rejection_breakdown);
-        let http_429_count = http_429_count(&rejection_breakdown);
-        let client_failure_count = client_failure_count(rejected_count, &rejection_breakdown);
+    pub fn from_ack(report: &AckRunReport) -> Self {
+        Self::new(
+            report.concurrency,
+            throughput_tx_per_s(report.accepted as usize, report.total_wall),
+            report.accepted,
+            report.rejected,
+            report.rejection_rate,
+            report.rejection_breakdown.clone(),
+            report.ack_latency_accepted_ms.clone(),
+        )
+    }
+
+    pub fn from_round_trip(report: &RoundTripRunReport) -> Self {
+        Self {
+            round_trip_ms: Some(report.round_trip_latency_accepted_ms.clone()),
+            ..Self::new(
+                report.concurrency,
+                throughput_tx_per_s(report.accepted as usize, report.total_wall),
+                report.accepted,
+                report.rejected,
+                report.rejection_rate,
+                report.rejection_breakdown.clone(),
+                report.ack_latency_accepted_ms.clone(),
+            )
+        }
+    }
+
+    fn new(
+        concurrency: usize,
+        accepted_tps: f64,
+        accepted_count: u64,
+        rejected_count: u64,
+        rejection_rate: f64,
+        rejection_breakdown: BTreeMap<String, u64>,
+        ack_ms: StatsMs,
+    ) -> Self {
         Self {
             concurrency,
             accepted_tps,
             accepted_count,
             rejected_count,
-            http_rejected_count,
-            http_429_count,
-            client_failure_count,
+            http_rejected_count: http_rejection_count(&rejection_breakdown),
+            http_429_count: http_429_count(&rejection_breakdown),
+            client_failure_count: client_failure_count(rejected_count, &rejection_breakdown),
             rejection_rate,
-            p50_ms,
-            p95_ms,
-            p99_ms,
-            p999_ms,
+            ack_ms,
+            round_trip_ms: None,
             rejection_breakdown,
         }
     }
@@ -104,6 +112,8 @@ pub struct SweepRunReport {
     pub rows: Vec<SweepRow>,
     pub summary: SweepSummary,
     pub memory: Option<runtime::MemoryReport>,
+    pub storage: Option<runtime::StorageReport>,
+    pub drain: Option<runtime::DrainReport>,
     pub sequencer_log_path: Option<String>,
 }
 
@@ -143,34 +153,6 @@ pub fn compute_capacity_summary(rows: &[SweepRow]) -> SweepSummary {
     }
 }
 
-pub fn write_csv(path: &Path, rows: &[SweepRow]) -> BenchResult<()> {
-    let mut out = String::from(
-        "concurrency,accepted_tps,accepted_count,rejected_count,http_rejected_count,http_429_count,client_failure_count,rejection_rate,p50_ms,p95_ms,p99_ms,p999_ms\n",
-    );
-    for row in rows {
-        out.push_str(
-            format!(
-                "{},{:.6},{},{},{},{},{},{:.6},{:.6},{:.6},{:.6},{:.6}\n",
-                row.concurrency,
-                row.accepted_tps,
-                row.accepted_count,
-                row.rejected_count,
-                row.http_rejected_count,
-                row.http_429_count,
-                row.client_failure_count,
-                row.rejection_rate,
-                row.p50_ms,
-                row.p95_ms,
-                row.p99_ms,
-                row.p999_ms,
-            )
-            .as_str(),
-        );
-    }
-    fs::write(path, out)?;
-    Ok(())
-}
-
 pub fn print_sweep_report(report: &SweepRunReport) {
     println!(
         "tps_at_first_any_rejection: {}",
@@ -195,6 +177,12 @@ pub fn print_sweep_report(report: &SweepRunReport) {
     if let Some(memory) = report.memory.as_ref() {
         print_memory_report(memory);
     }
+    if let Some(storage) = report.storage.as_ref() {
+        print_storage_report(storage);
+    }
+    if let Some(drain) = report.drain.as_ref() {
+        print_drain_report(drain);
+    }
     if let Some(path) = report.sequencer_log_path.as_ref() {
         println!("sequencer_log_path: {path}");
     }
@@ -209,53 +197,44 @@ fn format_optional(value: Option<f64>) -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::{SweepMeasurements, SweepRow, compute_capacity_summary};
+    use super::{SweepRow, compute_capacity_summary};
+    use crate::stats::StatsMs;
     use std::collections::BTreeMap;
 
+    fn ms(value: f64) -> StatsMs {
+        StatsMs {
+            count: 1,
+            min_ms: value,
+            max_ms: value,
+            mean_ms: value,
+            p50_ms: value,
+            p95_ms: value,
+            p99_ms: value,
+            p999_ms: value,
+        }
+    }
+
     #[test]
     fn capacity_summary_tracks_http_and_client_failures_separately() {
         let rows = vec![
-            SweepRow::new(
-                1,
-                10.0,
-                SweepMeasurements {
-                    accepted_count: 100,
-                    rejected_count: 0,
-                    rejection_rate: 0.0,
-                    p50_ms: 0.5,
-                    p95_ms: 1.0,
-                    p99_ms: 1.0,
-                    p999_ms: 1.0,
-                    rejection_breakdown: BTreeMap::new(),
-                },
-            ),
+            SweepRow::new(1, 10.0, 100, 0, 0.0, BTreeMap::new(), ms(1.0)),
             SweepRow::new(
                 2,
                 20.0,
-                SweepMeasurements {
-                    accepted_count: 100,
-                    rejected_count: 1,
-                    rejection_rate: 1.0,
-                    p50_ms: 1.0,
-                    p95_ms: 2.0,
-                    p99_ms: 2.0,
-                    p999_ms: 2.0,
-                    rejection_breakdown: BTreeMap::from([("io_connect".to_string(), 1_u64)]),
-                },
+                100,
+                1,
+                1.0,
+                BTreeMap::from([("io_connect".to_string(), 1_u64)]),
+                ms(2.0),
             ),
             SweepRow::new(
                 3,
                 30.0,
-                SweepMeasurements {
-                    accepted_count: 100,
-                    rejected_count: 1,
-                    rejection_rate: 1.0,
-                    p50_ms: 1.5,
-                    p95_ms: 3.0,
-                    p99_ms: 3.0,
-                    p999_ms: 3.0,
-                    rejection_breakdown: BTreeMap::from([("http_429".to_string(), 1_u64)]),
-                },
+                100,
+                1,
+                1.0,
+                BTreeMap::from([("http_429".to_string(), 1_u64)]),
+                ms(3.0),
             ),
         ];
 
diff --git a/tests/benchmarks/src/workload.rs b/tests/benchmarks/src/workload.rs
index 8acf4f6c..d30b3475 100644
--- a/tests/benchmarks/src/workload.rs
+++ b/tests/benchmarks/src/workload.rs
@@ -3,10 +3,10 @@
 
 use alloy_primitives::{Address, U256};
 use alloy_sol_types::Eip712Domain;
-use app_core::application::{MAX_METHOD_PAYLOAD_BYTES, Method, Transfer, default_private_keys};
+use app_core::application::{MAX_METHOD_PAYLOAD_BYTES, Method, Transfer};
 use clap::ValueEnum;
 use k256::ecdsa::SigningKey;
-use rollups_harness::{address_from_signing_key, sign_user_op_hex};
+use rollups_harness::{address_from_signing_key, default_private_keys, sign_user_op_hex};
 use sequencer_core::api::TxRequest;
 use sequencer_core::fee::fee_to_linear;
 use sequencer_core::user_op::UserOp;
diff --git a/tests/e2e/Cargo.toml b/tests/e2e/Cargo.toml
index 05c72d1a..f14a1645 100644
--- a/tests/e2e/Cargo.toml
+++ b/tests/e2e/Cargo.toml
@@ -24,9 +24,9 @@ sequencer-rust-client = { path = "../../sdk/rust-client" }
 alloy-primitives = { workspace = true }
 alloy-sol-types = { workspace = true }
 futures = "0.3"
-libtest-mimic = "0.6.1"
+libtest-mimic = { workspace = true }
 ssz = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt-multi-thread", "time", "net", "process", "io-util", "signal"] }
 serde_json = { workspace = true }
 tempfile = { workspace = true }
-tar = "0.4"
+tar = { workspace = true }
diff --git a/tests/e2e/src/bin/devnet_stack.rs b/tests/e2e/src/bin/devnet_stack.rs
index d91bde77..cd367cba 100644
--- a/tests/e2e/src/bin/devnet_stack.rs
+++ b/tests/e2e/src/bin/devnet_stack.rs
@@ -39,7 +39,11 @@ async fn main() -> HarnessResult<()> {
 
     eprintln!();
     eprintln!("=== Devnet stack is up ===");
-    eprintln!("Sequencer HTTP:  {}", runtime.endpoint());
+    eprintln!("Sequencer HTTP:  {} (public)", runtime.endpoint());
+    eprintln!(
+        "Sequencer API:   {} (internal)",
+        runtime.internal_endpoint()
+    );
     eprintln!("L1 RPC:          {}", runtime.l1_endpoint());
     eprintln!("App address:     {}", runtime.app_address());
     eprintln!("InputBox:        {}", runtime.input_box_address());
@@ -51,7 +55,7 @@ async fn main() -> HarnessResult<()> {
     );
     eprintln!(
         "export CARTESI_WATCHDOG_SEQUENCER_URL={}",
-        runtime.endpoint()
+        runtime.internal_endpoint()
     );
     eprintln!(
         "export CARTESI_WATCHDOG_BLOCKCHAIN_HTTP_ENDPOINT={}",
@@ -77,7 +81,7 @@ async fn main() -> HarnessResult<()> {
     eprintln!("The accepted checkpoint (genesis is comparable at block 0):");
     eprintln!(
         "  curl -s {}/finalized_state/inclusion_block",
-        runtime.endpoint()
+        runtime.internal_endpoint()
     );
     eprintln!();
     eprintln!("Run watchdog (from repo root, after `just watchdog-lua-deps`):");
diff --git a/tests/e2e/src/cold_replica.rs b/tests/e2e/src/cold_replica.rs
index cc1e23fe..0edfd1bd 100644
--- a/tests/e2e/src/cold_replica.rs
+++ b/tests/e2e/src/cold_replica.rs
@@ -35,7 +35,7 @@ async fn run_with<A: Application>(runtime: &mut ManagedSequencer) -> ScenarioRes
 }
 
 async fn run_scenario<A: Application>(runtime: &mut ManagedSequencer) -> ScenarioResult<()> {
-    let client = SequencerClient::new(runtime.endpoint())?;
+    let client = SequencerClient::new(runtime.internal_endpoint())?;
     let genesis = client.latest_snapshot().await?;
     assert_eq!(genesis.claim.next_input.get(), 0);
     let mut reference_ws = WsClient::connect(&client, genesis.claim).await?;
@@ -150,7 +150,7 @@ async fn run_scenario<A: Application>(runtime: &mut ManagedSequencer) -> Scenari
     drop(reference_ws);
     runtime.stop().await?;
     runtime.respawn().await?;
-    let client = SequencerClient::new(runtime.endpoint())?;
+    let client = SequencerClient::new(runtime.internal_endpoint())?;
     let mut replica_ws = WsClient::connect(&client, restart_claim).await?;
     let mut reference_ws = WsClient::connect(&client, restart_claim).await?;
     replica_ws
@@ -192,7 +192,7 @@ async fn run_scenario<A: Application>(runtime: &mut ManagedSequencer) -> Scenari
 
     // Respawn chooses a fresh listener. The claim comes exclusively from the
     // downloaded snapshot and consumed inputs, never the harness's DB helpers.
-    let client = SequencerClient::new(runtime.endpoint())?;
+    let client = SequencerClient::new(runtime.internal_endpoint())?;
     assert!(matches!(
         client.subscribe(stale_claim).await,
         Err(SubscribeError::History(
@@ -239,7 +239,7 @@ async fn run_scenario<A: Application>(runtime: &mut ManagedSequencer) -> Scenari
     let balance_before = recovered_reference.current_user_balance(alice_address);
     // The fixed oracle keeps this quote valid across frame rotations. Derive the
     // expected debit before receiving the event so wrong feed fees cannot agree by replay.
-    let quote = client.get_fee().await?;
+    let quote = SequencerClient::new(runtime.endpoint())?.get_fee().await?;
     assert_eq!(quote.fee, quote.recommended_fee);
     let amount = U256::from(6_000);
     let expected_balance = balance_before - amount - fee_to_linear(quote.fee);
@@ -352,7 +352,7 @@ pub(crate) fn assert_same_state<A: Application>(
 
 async fn wait_for_accepted_snapshot(runtime: &ManagedSequencer) -> ScenarioResult<()> {
     for _ in 0..40 {
-        runtime.mine_live_l1_blocks(1).await?;
+        runtime.mine_l1_block_at_wall_clock().await?;
         if runtime
             .finalized_inclusion_block()
             .await?
diff --git a/tests/e2e/src/lib.rs b/tests/e2e/src/lib.rs
index 8a9889eb..c42bd065 100644
--- a/tests/e2e/src/lib.rs
+++ b/tests/e2e/src/lib.rs
@@ -11,13 +11,48 @@ use c_wallet_engine as _;
 use std::future::Future;
 use std::pin::Pin;
 
-use rollups_harness::ManagedSequencer;
+use rollups_harness::{
+    ManagedSequencer, ManagedSequencerConfig, default_c_wallet_sequencer_config,
+    default_devnet_sequencer_config,
+};
 
 pub type MimicResult = Result<(), libtest_mimic::Failed>;
 pub type ScenarioResult<T> = Result<T, Box<dyn std::error::Error + Send + Sync>>;
 pub type ScenarioFuture<'a> = Pin<Box<dyn Future<Output = ScenarioResult<()>> + Send + 'a>>;
 pub type ScenarioFn = for<'a> fn(&'a mut ManagedSequencer) -> ScenarioFuture<'a>;
 
+/// Which sequencer binary a scenario runs against.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Host {
+    Rust,
+    C,
+}
+
+#[derive(Clone, Copy)]
+pub struct Scenario {
+    pub name: &'static str,
+    pub host: Host,
+    pub run: ScenarioFn,
+    /// Overrides applied to the host's default spawn config.
+    pub configure: fn(&mut ManagedSequencerConfig),
+}
+
+impl Scenario {
+    pub fn with(self, configure: fn(&mut ManagedSequencerConfig)) -> Self {
+        Self { configure, ..self }
+    }
+
+    pub fn spawn_config(&self) -> ManagedSequencerConfig {
+        let log_prefix = format!("rollups-e2e-{}", self.name);
+        let mut config = match self.host {
+            Host::Rust => default_devnet_sequencer_config(log_prefix),
+            Host::C => default_c_wallet_sequencer_config(log_prefix),
+        };
+        (self.configure)(&mut config);
+        config
+    }
+}
+
 pub fn run_trial<F, Fut>(scenario_name: &str, scenario: F) -> MimicResult
 where
     F: FnOnce() -> Fut,
diff --git a/tests/e2e/src/main.rs b/tests/e2e/src/main.rs
index 9b0e521c..9e530393 100644
--- a/tests/e2e/src/main.rs
+++ b/tests/e2e/src/main.rs
@@ -3,9 +3,7 @@
 
 use libtest_mimic::{Arguments, Trial};
 use rollups_e2e::run_trial;
-use rollups_harness::{
-    ManagedSequencer, default_c_wallet_sequencer_config, default_devnet_sequencer_config,
-};
+use rollups_harness::ManagedSequencer;
 
 fn main() {
     let mut args = Arguments::from_args();
@@ -13,28 +11,12 @@ fn main() {
 
     let trials: Vec<Trial> = rollups_e2e::test_cases::test_cases()
         .into_iter()
-        .map(|(name, scenario)| {
-            Trial::test(name, move || {
-                let log_prefix = format!("rollups-e2e-{name}");
-                let mut spawn_config = if name.starts_with("c_host_") {
-                    default_c_wallet_sequencer_config(log_prefix)
-                } else {
-                    default_devnet_sequencer_config(log_prefix)
-                };
-                let scenario_name = name.strip_prefix("c_host_").unwrap_or(name);
-                if scenario_name == "watchdog_genesis_compare_test"
-                    || scenario_name == "deposit_transfer_withdrawal_test"
-                    || scenario_name == "watchdog_divergence_drill_test"
-                {
-                    spawn_config.faketime = false;
-                } else if scenario_name == "fixed_fee_oracle_sets_frame_fee_test" {
-                    // 100 → recommended fee 1456, under the wallet client's
-                    // DEFAULT_MAX_FEE (2500) so transfers still admit.
-                    spawn_config.fee_oracle_fixed_log_gas_price = Some(100);
-                }
-                run_trial(name, || async move {
+        .map(|scenario| {
+            Trial::test(scenario.name, move || {
+                let spawn_config = scenario.spawn_config();
+                run_trial(scenario.name, || async move {
                     let mut runtime = ManagedSequencer::spawn(spawn_config).await?;
-                    let scenario_result = scenario(&mut runtime).await;
+                    let scenario_result = (scenario.run)(&mut runtime).await;
                     // Post-test schema invariants: assert the DB's structural
                     // invariants only if the scenario succeeded — otherwise
                     // we'd mask the original failure with downstream
diff --git a/tests/e2e/src/test_cases.rs b/tests/e2e/src/test_cases.rs
index 371c79fb..f7052896 100644
--- a/tests/e2e/src/test_cases.rs
+++ b/tests/e2e/src/test_cases.rs
@@ -3,10 +3,11 @@
 
 use std::time::Duration;
 
-use crate::{ScenarioFn, ScenarioResult};
+use crate::{Host, Scenario, ScenarioFn, ScenarioResult};
 use alloy_primitives::{Address, U256};
 use rollups_harness::{
-    ManagedSequencer, RecoveryCheckpoint, RecoverySetupParams, ReplayWalletApp,
+    DEVNET_PREEMPTIVE_MARGIN_BLOCKS, DEVNET_SECONDS_PER_BLOCK, ManagedSequencer,
+    ManagedSequencerConfig, RecoveryCheckpoint, RecoverySetupParams, ReplayWalletApp,
     RespawnAttemptOutcome, RespawnPolicy, TcpProxy, TestSigner, WalletL1Client, WalletL2Client,
     WsClient, sign_user_op_hex,
 };
@@ -56,11 +57,12 @@ const FRAME_CLOCK_POLL_INTERVAL: Duration = Duration::from_millis(250);
 
 // ── Zone-math constants for the outage-matrix and recovery tests ─────────
 //
-// These derive from the sequencer's default config so a change to
-// `MAX_WAIT_BLOCKS`, `CARTESI_SEQUENCER_PREEMPTIVE_MARGIN_BLOCKS`, or `CARTESI_SEQUENCER_SECONDS_PER_BLOCK`
-// flows through here automatically. The compile-time asserts below catch any
-// drift that would invalidate the zone framing of the tests (e.g., a per-retry
-// advance that no longer crosses MAX_WAIT in the orchestrator loop).
+// These derive from `MAX_WAIT_BLOCKS` (sequencer-core) and the timing the
+// harness passes to the sequencer (`DEVNET_PREEMPTIVE_MARGIN_BLOCKS`,
+// `DEVNET_SECONDS_PER_BLOCK`), so a change to either flows through here. The
+// compile-time asserts below catch drift that would break the zone framing
+// (e.g., a per-retry advance that no longer crosses MAX_WAIT in the
+// orchestrator loop).
 //
 // The picks (PRE / DANGER / PAST_STALE) are deliberately well inside their
 // zones to give tests slack against scheduling jitter and timing drift.
@@ -69,20 +71,10 @@ const FRAME_CLOCK_POLL_INTERVAL: Duration = Duration::from_millis(250);
 /// `sequencer_core::MAX_WAIT_BLOCKS`.
 const MAX_WAIT_BLOCKS: u64 = sequencer_core::MAX_WAIT_BLOCKS;
 
-/// Default `CARTESI_SEQUENCER_PREEMPTIVE_MARGIN_BLOCKS` from `runtime/config.rs`. The
-/// harness spawn path does not override this flag, so the binary uses the
-/// configured default. If the default changes, update here so
-/// `DANGER_THRESHOLD_BLOCKS` stays aligned.
-const DEFAULT_PREEMPTIVE_MARGIN_BLOCKS: u64 = 300;
-
-/// Default `CARTESI_SEQUENCER_SECONDS_PER_BLOCK` from `runtime/config.rs`. The harness
-/// `advance_wall_and_mine` also assumes this value internally.
-const DEFAULT_SECONDS_PER_BLOCK: u64 = 12;
-
 /// Derived: the preemptive-recovery danger threshold. Below this we're safe;
 /// above it (but below `MAX_WAIT_BLOCKS`) is the danger zone where the
 /// sequencer triggers flush + shutdown but no cascade.
-const DANGER_THRESHOLD_BLOCKS: u64 = MAX_WAIT_BLOCKS - DEFAULT_PREEMPTIVE_MARGIN_BLOCKS;
+const DANGER_THRESHOLD_BLOCKS: u64 = MAX_WAIT_BLOCKS - DEVNET_PREEMPTIVE_MARGIN_BLOCKS;
 
 /// Pre-danger pick — well below `DANGER_THRESHOLD_BLOCKS` so background drift
 /// can't accidentally tip a test into the danger zone.
@@ -104,9 +96,9 @@ const PAST_STALE_BLOCKS: u64 = 1250;
 /// compile-time check below pins the load-bearing relationship.
 const RESPAWN_RETRY_ADVANCE_BLOCKS: u64 = 100;
 
-/// Convert a block count to wall-clock duration assuming the default block time.
+/// Convert a block count to wall-clock duration at the harness block time.
 const fn blocks_as_duration(blocks: u64) -> Duration {
-    Duration::from_secs(blocks * DEFAULT_SECONDS_PER_BLOCK)
+    Duration::from_secs(blocks * DEVNET_SECONDS_PER_BLOCK)
 }
 
 // Compile-time guards: drift in the constants above that breaks the test
@@ -132,7 +124,7 @@ const _: () = {
         PAST_STALE_BLOCKS > MAX_WAIT_BLOCKS,
         "PAST_STALE_BLOCKS must exceed MAX_WAIT_BLOCKS (cascade must fire)",
     );
-    // Load-bearing for .x: starting from a closed
+    // Load-bearing for the `respawn_until_stable` tests: starting from a closed
     // in-danger batch, one retry advance must push it past MAX_WAIT_BLOCKS
     // so cascade fires before max_attempts is exhausted. If
     // `RESPAWN_RETRY_ADVANCE_BLOCKS` shrinks or `MAX_WAIT_BLOCKS` grows
@@ -151,92 +143,128 @@ struct ExpectedWalletState {
     nonce: u32,
 }
 
-pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
+fn rust(name: &'static str, run: ScenarioFn) -> Scenario {
+    Scenario {
+        name,
+        host: Host::Rust,
+        run,
+        configure: no_overrides,
+    }
+}
+
+fn c_host(name: &'static str, run: ScenarioFn) -> Scenario {
+    Scenario {
+        name,
+        host: Host::C,
+        run,
+        configure: no_overrides,
+    }
+}
+
+fn no_overrides(_: &mut ManagedSequencerConfig) {}
+
+/// Wall-clock-neutral scenarios run without libfaketime.
+fn real_clock(config: &mut ManagedSequencerConfig) {
+    config.faketime = false;
+}
+
+/// Recommended fee 1456, under the wallet client's max fee (2500), so
+/// transfers still admit.
+fn fixed_fee_oracle(config: &mut ManagedSequencerConfig) {
+    config.fee_oracle_fixed_log_gas_price = Some(FIXED_LOG_GAS_PRICE);
+}
+
+const FIXED_LOG_GAS_PRICE: i16 = 100;
+
+pub fn test_cases() -> Vec<Scenario> {
     vec![
-        (
+        c_host(
             "c_host_cold_replica_snapshot_backlog_live_recovery_test",
             |runtime| Box::pin(crate::cold_replica::run_c(runtime)),
         ),
-        ("c_host_setup_recovery_round_trip_test", |runtime| {
+        c_host("c_host_setup_recovery_round_trip_test", |runtime| {
             Box::pin(run_setup_recovery_round_trip_test::<c_app_engine::EngineApp>(runtime))
         }),
-        ("c_host_deposit_transfer_withdrawal_test", |runtime| {
+        c_host("c_host_deposit_transfer_withdrawal_test", |runtime| {
             Box::pin(run_deposit_transfer_withdrawal_test(runtime))
-        }),
-        ("c_host_recovery_after_stale_batches_test", |runtime| {
+        })
+        .with(real_clock),
+        c_host("c_host_recovery_after_stale_batches_test", |runtime| {
             Box::pin(run_recovery_after_stale_batches_test(runtime))
         }),
-        ("c_host_restart_and_replay_test", |runtime| {
+        c_host("c_host_restart_and_replay_test", |runtime| {
             Box::pin(run_restart_and_replay_test(runtime))
         }),
-        (
+        rust(
             "cold_replica_snapshot_backlog_live_recovery_test",
             |runtime| Box::pin(crate::cold_replica::run(runtime)),
         ),
-        ("deposit_transfer_withdrawal_test", |runtime| {
+        rust("deposit_transfer_withdrawal_test", |runtime| {
             Box::pin(run_deposit_transfer_withdrawal_test(runtime))
-        }),
-        ("direct_input_not_safe_yet_test", |runtime| {
+        })
+        .with(real_clock),
+        rust("direct_input_not_safe_yet_test", |runtime| {
             Box::pin(run_direct_input_not_safe_yet_test(runtime))
         }),
-        ("rejected_user_op_not_broadcast_test", |runtime| {
+        rust("rejected_user_op_not_broadcast_test", |runtime| {
             Box::pin(run_rejected_user_op_not_broadcast_test(runtime))
         }),
-        ("reconnect_from_offset_test", |runtime| {
+        rust("reconnect_from_offset_test", |runtime| {
             Box::pin(run_reconnect_from_offset_test(runtime))
         }),
-        ("restart_and_replay_test", |runtime| {
+        rust("restart_and_replay_test", |runtime| {
             Box::pin(run_restart_and_replay_test(runtime))
         }),
-        ("unsupported_token_deposit_noop_test", |runtime| {
+        rust("unsupported_token_deposit_noop_test", |runtime| {
             Box::pin(run_unsupported_token_deposit_noop_test(runtime))
         }),
-        ("fee_below_minimum_rejected_test", |runtime| {
+        rust("fee_below_minimum_rejected_test", |runtime| {
             Box::pin(run_fee_below_minimum_rejected_test(runtime))
         }),
-        ("fixed_fee_oracle_sets_frame_fee_test", |runtime| {
+        rust("fixed_fee_oracle_sets_frame_fee_test", |runtime| {
             Box::pin(run_fixed_fee_oracle_sets_frame_fee_test(runtime))
-        }),
-        ("forged_signature_rejected_test", |runtime| {
+        })
+        .with(fixed_fee_oracle),
+        rust("forged_signature_rejected_test", |runtime| {
             Box::pin(run_forged_signature_rejected_test(runtime))
         }),
-        ("concurrent_user_ops_test", |runtime| {
+        rust("concurrent_user_ops_test", |runtime| {
             Box::pin(run_concurrent_user_ops_test(runtime))
         }),
-        ("multi_deposit_reconciliation_test", |runtime| {
+        rust("multi_deposit_reconciliation_test", |runtime| {
             Box::pin(run_multi_deposit_reconciliation_test(runtime))
         }),
-        (
+        rust(
             "restart_after_committed_tx_replays_cleanly_test",
             |runtime| Box::pin(run_restart_after_committed_tx_replays_cleanly_test(runtime)),
         ),
-        ("recovery_after_stale_batches_test", |runtime| {
+        rust("recovery_after_stale_batches_test", |runtime| {
             Box::pin(run_recovery_after_stale_batches_test(runtime))
         }),
-        ("setup_recovery_round_trip_test", |runtime| {
+        rust("setup_recovery_round_trip_test", |runtime| {
             Box::pin(run_setup_recovery_round_trip_test::<
                 app_core::application::WalletApp,
             >(runtime))
         }),
-        ("sequencer_outage_pre_danger_no_recovery_test", |runtime| {
+        rust("sequencer_outage_pre_danger_no_recovery_test", |runtime| {
             Box::pin(run_sequencer_outage_pre_danger_no_recovery_test(runtime))
         }),
-        ("sequencer_outage_danger_zone_tip_cascade_test", |runtime| {
+        rust("sequencer_outage_danger_zone_tip_cascade_test", |runtime| {
             Box::pin(run_sequencer_outage_danger_zone_tip_cascade_test(runtime))
         }),
-        ("provider_outage_past_stale_cascades_test", |runtime| {
+        rust("provider_outage_past_stale_cascades_test", |runtime| {
             Box::pin(run_provider_outage_past_stale_cascades_test(runtime))
         }),
-        ("provider_outage_wall_clock_refuses_boot_test", |runtime| {
+        rust("provider_outage_wall_clock_refuses_boot_test", |runtime| {
             Box::pin(run_provider_outage_wall_clock_refuses_boot_test(runtime))
         }),
-        (
+        rust(
             "warm_restart_from_fresh_persisted_facts_with_l1_down_test",
             |runtime| {
                 Box::pin(run_warm_restart_from_fresh_persisted_facts_with_l1_down_test(runtime))
             },
         ),
-        (
+        rust(
             "wall_clock_backward_jump_retries_then_recovers_test",
             |runtime| {
                 Box::pin(run_wall_clock_backward_jump_retries_then_recovers_test(
@@ -244,10 +272,10 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        ("stalled_safe_head_startup_refuses_boot_test", |runtime| {
+        rust("stalled_safe_head_startup_refuses_boot_test", |runtime| {
             Box::pin(run_stalled_safe_head_startup_refuses_boot_test(runtime))
         }),
-        (
+        rust(
             "provider_outage_pre_danger_sequencer_continues_test",
             |runtime| {
                 Box::pin(run_provider_outage_pre_danger_sequencer_continues_test(
@@ -255,7 +283,7 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        (
+        rust(
             "provider_outage_danger_zone_sequencer_self_exits_test",
             |runtime| {
                 Box::pin(run_provider_outage_danger_zone_sequencer_self_exits_test(
@@ -263,10 +291,10 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        ("provider_outage_short_hiccup_no_recovery_test", |runtime| {
+        rust("provider_outage_short_hiccup_no_recovery_test", |runtime| {
             Box::pin(run_provider_outage_short_hiccup_no_recovery_test(runtime))
         }),
-        (
+        rust(
             "both_down_danger_zone_sequencer_first_refuses_boot_test",
             |runtime| {
                 Box::pin(run_both_down_danger_zone_sequencer_first_refuses_boot_test(
@@ -274,13 +302,13 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        (
+        rust(
             "both_down_danger_zone_proxy_first_restart_cycle_recovers_test",
             |runtime| {
                 Box::pin(run_both_down_danger_zone_proxy_first_restart_cycle_recovers_test(runtime))
             },
         ),
-        (
+        rust(
             "sequencer_outage_danger_zone_coupled_restart_cycle_recovers_test",
             |runtime| {
                 Box::pin(
@@ -288,7 +316,7 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 )
             },
         ),
-        (
+        rust(
             "provider_outage_danger_zone_mid_run_exit_then_restart_cycle_recovers_test",
             |runtime| {
                 Box::pin(
@@ -298,22 +326,22 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 )
             },
         ),
-        (
+        rust(
             "first_boot_l1_unreachable_never_synced_refuses_boot_test",
             |runtime| {
                 Box::pin(run_first_boot_l1_unreachable_never_synced_refuses_boot_test(runtime))
             },
         ),
-        ("delayed_inclusion_cascades_on_restart_test", |runtime| {
+        rust("delayed_inclusion_cascades_on_restart_test", |runtime| {
             Box::pin(run_delayed_inclusion_cascades_on_restart_test(runtime))
         }),
-        ("aging_open_tip_runtime_danger_zone_exit_test", |runtime| {
+        rust("aging_open_tip_runtime_danger_zone_exit_test", |runtime| {
             Box::pin(run_aging_open_tip_runtime_danger_zone_exit_test(runtime))
         }),
-        ("stalled_safe_head_live_exit_test", |runtime| {
+        rust("stalled_safe_head_live_exit_test", |runtime| {
             Box::pin(run_stalled_safe_head_live_exit_test(runtime))
         }),
-        (
+        rust(
             "ws_reconnect_with_invalidated_claim_is_refused_test",
             |runtime| {
                 Box::pin(run_ws_reconnect_with_invalidated_claim_is_refused_test(
@@ -321,10 +349,10 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        ("ws_subscribe_ahead_of_head_is_refused_test", |runtime| {
+        rust("ws_subscribe_ahead_of_head_is_refused_test", |runtime| {
             Box::pin(run_ws_subscribe_ahead_of_head_is_refused_test(runtime))
         }),
-        (
+        rust(
             "recovery_drains_safe_but_undrained_direct_input_test",
             |runtime| {
                 Box::pin(run_recovery_drains_safe_but_undrained_direct_input_test(
@@ -332,22 +360,22 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        (
+        rust(
             "recovery_batch_opens_empty_when_no_direct_inputs_pending_test",
             |runtime| {
                 Box::pin(run_recovery_batch_opens_empty_when_no_direct_inputs_pending_test(runtime))
             },
         ),
-        ("replay_matches_live_for_mixed_workload_test", |runtime| {
+        rust("replay_matches_live_for_mixed_workload_test", |runtime| {
             Box::pin(run_replay_matches_live_for_mixed_workload_test(runtime))
         }),
-        (
+        rust(
             "provider_outage_input_reader_retries_after_reconnect_test",
             |runtime| {
                 Box::pin(run_provider_outage_input_reader_retries_after_reconnect_test(runtime))
             },
         ),
-        (
+        rust(
             "first_boot_no_identity_l1_unreachable_refuses_boot_test",
             |runtime| {
                 Box::pin(run_first_boot_no_identity_l1_unreachable_refuses_boot_test(
@@ -355,7 +383,7 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        (
+        rust(
             "chain_id_mismatch_via_live_rpc_refuses_boot_test",
             |runtime| {
                 Box::pin(run_chain_id_mismatch_via_live_rpc_refuses_boot_test(
@@ -363,7 +391,7 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 ))
             },
         ),
-        (
+        rust(
             "nonce_zero_recovery_invalidates_then_accepts_at_nonce_zero_test",
             |runtime| {
                 Box::pin(
@@ -371,14 +399,16 @@ pub fn test_cases() -> Vec<(&'static str, ScenarioFn)> {
                 )
             },
         ),
-        ("watchdog_genesis_compare_test", |runtime| {
+        rust("watchdog_genesis_compare_test", |runtime| {
             Box::pin(crate::watchdog_compare::run_watchdog_genesis_compare_test(
                 runtime,
             ))
-        }),
-        ("watchdog_divergence_drill_test", |runtime| {
+        })
+        .with(real_clock),
+        rust("watchdog_divergence_drill_test", |runtime| {
             Box::pin(run_watchdog_divergence_drill_test(runtime))
-        }),
+        })
+        .with(real_clock),
     ]
 }
 
@@ -462,7 +492,7 @@ async fn mine_until_finalized_advances(
     floor: u64,
 ) -> ScenarioResult<u64> {
     for _ in 0..PROMOTION_POLL_ATTEMPTS {
-        runtime.mine_live_l1_blocks(1).await?;
+        runtime.mine_l1_block_at_wall_clock().await?;
         tokio::time::sleep(PROMOTION_POLL_INTERVAL).await;
         if let Some(inclusion_block) = runtime.finalized_inclusion_block().await?
             && inclusion_block > floor
@@ -480,7 +510,7 @@ async fn mine_until_batch_is_safe_accepted(
     runtime: &ManagedSequencer,
 ) -> ScenarioResult<(u64, Option<u64>)> {
     for _ in 0..ACCEPTANCE_POLL_ATTEMPTS {
-        runtime.mine_live_l1_blocks(1).await?;
+        runtime.mine_l1_block_at_wall_clock().await?;
         tokio::time::sleep(ACCEPTANCE_POLL_INTERVAL).await;
         let accepted = runtime.count_safe_accepted_batches()?;
         if accepted.0 > 0 {
@@ -790,8 +820,11 @@ async fn run_reconnect_from_offset_test(runtime: &mut ManagedSequencer) -> Scena
     alice_l2.transfer(bob_address, transfer_amount).await?;
     bob_l2.withdraw(withdrawal_amount).await?;
 
-    let mut resumed_ws =
-        WsClient::connect(&SequencerClient::new(runtime.endpoint())?, reconnect_claim).await?;
+    let mut resumed_ws = WsClient::connect(
+        &SequencerClient::new(runtime.internal_endpoint())?,
+        reconnect_claim,
+    )
+    .await?;
     replay.apply(resumed_ws.expect_user_op_from(alice_address).await?)?;
     replay.apply(resumed_ws.expect_user_op_from(bob_address).await?)?;
 
@@ -1031,8 +1064,7 @@ async fn run_fee_below_minimum_rejected_test(runtime: &mut ManagedSequencer) ->
 async fn run_fixed_fee_oracle_sets_frame_fee_test(
     runtime: &mut ManagedSequencer,
 ) -> ScenarioResult<()> {
-    const FIXED_LOG_GAS_PRICE: u16 = 100;
-    const EXPECTED_FRAME_FEE: u16 = FIXED_LOG_GAS_PRICE + 296 + 20 + 419 + 621;
+    const EXPECTED_FRAME_FEE: u16 = FIXED_LOG_GAS_PRICE as u16 + 296 + 20 + 419 + 621;
 
     assert_eq!(
         runtime.first_frame_fee()?,
@@ -1396,7 +1428,7 @@ async fn run_recovery_after_stale_batches_test(
     Ok(())
 }
 
-// ── Cockroach recovery: setup --recovery round-trip (PR5) ────────
+// ── Cockroach recovery: setup --recovery round-trip ────────
 //
 // The affirmative end-to-end test of cockroach recovery: build state, promote a
 // real finalized snapshot (the checkpoint), wipe the DB, rebuild it from the
@@ -1452,7 +1484,7 @@ async fn run_setup_recovery_round_trip_test<A: Application>(
     // Drive the batch to seal + be accepted + promoted, and capture the
     // resulting finalized snapshot as the recovery checkpoint.
     let checkpoint = drive_promotion_and_capture(runtime).await?;
-    let old_claim = SequencerClient::new(runtime.endpoint())?
+    let old_claim = SequencerClient::new(runtime.internal_endpoint())?
         .latest_snapshot()
         .await?
         .claim;
@@ -1476,7 +1508,7 @@ async fn run_setup_recovery_round_trip_test<A: Application>(
 
     // A rebuilt database cannot authorize the old replica, even when its
     // numerical generation/count match. Restore and subscribe in the new era.
-    let client = SequencerClient::new(runtime.endpoint())?;
+    let client = SequencerClient::new(runtime.internal_endpoint())?;
     assert!(matches!(
         client.subscribe(old_claim).await,
         Err(SubscribeError::History(
@@ -1684,12 +1716,9 @@ async fn run_sequencer_outage_pre_danger_no_recovery_test(
 //     ops are rolled back (this is the documented "soft confirmations may
 //     be invalidated under recovery" semantics).
 //
-// This exercises the Tip-recovery-without-flush path specifically. Earlier
-// behavior used `MAX_WAIT_BLOCKS` for the Tip threshold and would have
-// preserved the user op until current_safe_block crossed `MAX_WAIT_BLOCKS`;
-// the policy is now to invalidate at `danger_threshold` so the system
-// stops issuing pre-confirmations on a Tip that's already operationally
-// suspect.
+// This exercises the Tip-recovery-without-flush path. The Tip is invalidated at
+// `danger_threshold`, not `MAX_WAIT_BLOCKS`, so the system stops issuing soft
+// confirmations on a Tip that is already operationally suspect.
 
 async fn run_sequencer_outage_danger_zone_tip_cascade_test(
     runtime: &mut ManagedSequencer,
@@ -2475,7 +2504,7 @@ async fn run_provider_outage_danger_zone_sequencer_self_exits_test(
 //
 // What this tests that the longer-disconnect provider-outage test doesn't: the longer test disconnects for a
 // 500-block L1 advance + 150 transfers worth of real time, exercising the
-// inclusion lane under load.  instead exercises the "pure retry
+// inclusion lane under load. This test instead exercises the "pure retry
 // loop" path: **no** L1 advance, **no** faketime advance, just a few seconds
 // of real-time wall-clock downtime across at least one
 // `idle_poll_interval_ms` (default 5 s) so the submitter definitely attempts
@@ -2569,13 +2598,14 @@ async fn run_provider_outage_short_hiccup_no_recovery_test(
 // Both down, sequencer returns first into the danger zone, refuses
 // to boot.
 //
-// Companion to  (past-stale cascades through proxy): this is the
-// *danger-zone* window of the same setup. Sequencer is stopped AND the proxy
-// is disconnected; wall-clock and L1 advance into the danger zone but stay
-// below `MAX_WAIT_BLOCKS`; the sequencer comes back first while L1 is still
-// unreachable. Startup's wall-clock fallback must see "past danger" and
-// refuse the boot — advancing the safe head off stale data would risk
-// issuing soft confirmations against a state that may already be doomed.
+// Companion to `run_provider_outage_past_stale_cascades_test` (past-stale
+// cascades through proxy): this is the *danger-zone* window of the same
+// setup. Sequencer is stopped AND the proxy is disconnected; wall-clock and
+// L1 advance into the danger zone but stay below `MAX_WAIT_BLOCKS`; the
+// sequencer comes back first while L1 is still unreachable. Startup's
+// wall-clock fallback must see "past danger" and refuse the boot — advancing
+// the safe head off stale data would risk issuing soft confirmations against
+// a state that may already be doomed.
 //
 // No cascade is expected yet (we haven't crossed MAX_WAIT_BLOCKS). The test
 // stops at the refuse-to-boot assertion — the full reconnect+recovery cycle
@@ -2646,12 +2676,12 @@ async fn run_both_down_danger_zone_sequencer_first_refuses_boot_test(
 // Both down, proxy returns first, then sequencer — restart cycle
 // converges.
 //
-// Complement to  (sequencer first): here L1 comes back before the
-// sequencer does. Once the sequencer restarts, startup recovery sees L1
-// reachable and the Tip aged past `danger_threshold`, so `check_danger`
-// returns `TipInDanger(idx)` and the guarded `RecoverTip` phase cascades the
-// Tip and opens a fresh one. Convergence
-// typically happens on the first respawn.
+// Complement to `run_both_down_danger_zone_sequencer_first_refuses_boot_test`
+// (sequencer first): here L1 comes back before the sequencer does. Once the
+// sequencer restarts, startup recovery sees L1 reachable and the Tip aged
+// past `danger_threshold`, so `check_danger` returns `TipInDanger(idx)` and
+// the guarded `RecoverTip` phase cascades the Tip and opens a fresh one.
+// Convergence typically happens on the first respawn.
 //
 // Other paths can fire under different timings — e.g., the lane might
 // close the Tip into a nonced closed batch during boot, the submitter
@@ -2660,10 +2690,8 @@ async fn run_both_down_danger_zone_sequencer_first_refuses_boot_test(
 // canonical. The test asserts only convergence to `Stable`, not which
 // specific path fires.
 //
-// The key invariant this tests that the existing .x tests don't: the full
-// *restart-loop* works. Earlier tests stopped at "first respawn exits"
-// because the harness lacked an orchestrator-restart primitive; now we have
-// `respawn_until_stable`, so we can drive the loop to convergence.
+// The key invariant this tests that the other outage tests don't: the full
+// *restart-loop* works, driven to convergence by `respawn_until_stable`.
 async fn run_both_down_danger_zone_proxy_first_restart_cycle_recovers_test(
     runtime: &mut ManagedSequencer,
 ) -> ScenarioResult<()> {
@@ -2875,15 +2903,17 @@ async fn run_sequencer_outage_danger_zone_coupled_restart_cycle_recovers_test(
     Ok(())
 }
 
-//  follow-up — Provider outage into the danger zone while the
-// sequencer is running, mid-run danger-detected exit, then reconnect + restart
-// cycle converges.
+// Follow-up to `run_provider_outage_danger_zone_sequencer_self_exits_test`:
+// provider outage into the danger zone while the sequencer is running, mid-run
+// danger-detected exit, then reconnect + restart cycle converges.
 //
 // The provider-outage danger-zone test stops at "refuse to reboot while proxy still
 // disconnected". This completes that story: after the sequencer self-exits
 // mid-run via its live wall-clock fallback and the proxy reconnects, the
 // orchestrator restart cycle eventually converges — same
-// `respawn_until_stable` pattern as .
+// `respawn_until_stable` pattern as
+// `run_sequencer_outage_danger_zone_coupled_restart_cycle_recovers_test` and
+// `run_both_down_danger_zone_proxy_first_restart_cycle_recovers_test`.
 //
 // Ordering detail: the wall-clock advance only advances the sequencer's
 // clock; the proxy has been disconnecting Anvil traffic, so Anvil's block
@@ -3051,14 +3081,12 @@ async fn run_first_boot_l1_unreachable_never_synced_refuses_boot_test(
 // in `populate_safe_accepted_batches` and `find_first_batch_in_danger`
 // flags it — cascade fires.
 //
-// This is the structural sibling of  (open-batch variant) for
-// closed+submitted batches. The `find_first_batch_in_danger` path has two
-// flavors: "open batch got old"  and "closed batch submission
-// got lost" (this one). Both need to cascade correctly;  had e2e
-// coverage, the closed-submitted variant had none.
+// This is the closed-and-submitted sibling of `run_recovery_after_stale_batches_test`
+// (open-batch variant): `find_first_batch_in_danger` must cascade both "open batch
+// got old" and "closed batch submission got lost" (this one).
 //
 // Setup shape: we use Anvil's `setAutomine(false)` + `dropAllPendingTxs`
-// (new T2 harness primitives) to hold the sequencer's batch-submission tx
+// (harness primitives) to hold the sequencer's batch-submission tx
 // out of the chain, then drop it entirely — cleaner than the mempool-hold
 // approach, because `anvil_mine(N)` with a pending tx would include it in
 // the first mined block, not the Nth. Dropping simulates gateway packet
@@ -3069,12 +3097,9 @@ async fn run_delayed_inclusion_cascades_on_restart_test(
     // Past-stale: 1250 blocks > MAX_WAIT_BLOCKS (1200).
     const PAST_STALE: Duration = blocks_as_duration(PAST_STALE_BLOCKS);
     // Enough transfers to trigger at least one size-based batch close.
-    // Matches 's sizing (≈100 B/op × 150 ops ≈ 15 KB > 12 KB target).
+    // Same sizing as `run_provider_outage_pre_danger_sequencer_continues_test`
+    // (≈100 B/op × 150 ops ≈ 15 KB > 12 KB target).
     const TRANSFERS_TO_FORCE_BATCH_CLOSE: usize = 150;
-    // After the last transfer, wait for the submitter's next tick so it
-    // picks up the closed batch and sends the L1 tx to the (now-held)
-    // mempool. Default `idle_poll_interval` is 5 s.
-    const WAIT_FOR_SUBMITTER_TICK: Duration = Duration::from_secs(7);
 
     let alice = TestSigner::from_default(1)?;
     let bob = TestSigner::from_default(2)?;
@@ -3115,9 +3140,9 @@ async fn run_delayed_inclusion_cascades_on_restart_test(
         replay_before.apply(ws.expect_user_op_from(alice_address).await?)?;
     }
 
-    // Give the submitter tick time to fire and put the batch-submission
-    // tx into the (held) mempool.
-    tokio::time::sleep(WAIT_FOR_SUBMITTER_TICK).await;
+    // Wait for the submitter's tick to put the batch-submission tx into the
+    // (held) mempool.
+    runtime.wait_for_pending_batch_submission().await?;
 
     let batches_after_close = runtime.count_batches()?;
     assert!(
@@ -3140,7 +3165,7 @@ async fn run_delayed_inclusion_cascades_on_restart_test(
 
     // Re-enable auto-mining AND mine L1 throughout the recovery boot. Startup
     // recovery's mempool flush submits a no-op at the stranded wallet-nonce slot
-    // and blocks until that slot is *safe* (`safe_nonce >= watermark + 1`).
+    // and blocks until that slot is *safe* (`safe_wallet_nonce >= watermark + 1`).
     // Auto-mining alone lands the no-op but mints no further blocks, so Anvil's
     // `safe` tag never advances past it and the boot would hang; the boot miner
     // supplies the steady block production a live chain would (see
@@ -3316,13 +3341,13 @@ async fn run_aging_open_tip_runtime_danger_zone_exit_test(
 // Provider reachable, safe head frozen, live freshness check fires and the
 // running detector self-exits.
 //
-// Runtime twin of . Tests that the wall-clock-adjusted danger arm
-// fires at runtime when L1 stays reachable but the safe head stops
-// advancing. We don't pre-age the Tip — the detector now exits on
-// `DangerStatus::TipInDanger` independently, which would conflate test signals.
-// Instead, we let the Tip stay fresh and jump the wall clock past
-// `danger_threshold * SECONDS_PER_BLOCK` so the wall-clock arm saturates
-// to threshold 0 and catches the fresh Tip via `find_first_batch_in_danger`.
+// Runtime twin of `run_stalled_safe_head_startup_refuses_boot_test`. Tests that
+// the wall-clock-adjusted danger arm fires at runtime when L1 stays reachable
+// but the safe head stops advancing. We don't pre-age the Tip — the detector
+// now exits on `DangerStatus::TipInDanger` independently, which would conflate
+// test signals. Instead, we let the Tip stay fresh and jump the wall clock past
+// `danger_threshold * SECONDS_PER_BLOCK` so the wall-clock arm saturates to
+// threshold 0 and catches the fresh Tip via `find_first_batch_in_danger`.
 async fn run_stalled_safe_head_live_exit_test(
     runtime: &mut ManagedSequencer,
 ) -> ScenarioResult<()> {
@@ -3421,7 +3446,7 @@ async fn run_ws_reconnect_with_invalidated_claim_is_refused_test(
     runtime.respawn().await?;
 
     assert!(matches!(
-        SequencerClient::new(runtime.endpoint())?
+        SequencerClient::new(runtime.internal_endpoint())?
             .subscribe(resume_claim)
             .await,
         Err(sequencer_rust_client::SubscribeError::History(
@@ -3443,7 +3468,7 @@ async fn run_ws_subscribe_ahead_of_head_is_refused_test(
 ) -> ScenarioResult<()> {
     let claim = runtime.history_claim(u64::MAX)?;
     assert!(matches!(
-        SequencerClient::new(runtime.endpoint())?
+        SequencerClient::new(runtime.internal_endpoint())?
             .subscribe(claim)
             .await,
         Err(sequencer_rust_client::SubscribeError::History(
@@ -3531,9 +3556,11 @@ async fn run_recovery_drains_safe_but_undrained_direct_input_test(
 
 // Recovery batch opens empty when no direct inputs are pending.
 //
-// Negative control for : same overall shape but with no L1 deposit
-// before respawn. The recovery batch's `leading_range` is `[0, 0)` and the
-// batch's first frame is empty. WS replay delivers nothing.
+// Negative control for
+// `run_recovery_drains_safe_but_undrained_direct_input_test`: same overall
+// shape but with no L1 deposit before respawn. The recovery batch's
+// `leading_range` is `[0, 0)` and the batch's first frame is empty. WS replay
+// delivers nothing.
 async fn run_recovery_batch_opens_empty_when_no_direct_inputs_pending_test(
     runtime: &mut ManagedSequencer,
 ) -> ScenarioResult<()> {
@@ -3565,7 +3592,7 @@ async fn run_recovery_batch_opens_empty_when_no_direct_inputs_pending_test(
 // replay must produce an identical per-user state.
 //
 // This is the `Application` trait's fundamental contract (see
-// `AGENTS.md` §Application-Trait-Contract). Without it, restart
+// `docs/protocol/application-contract.md`). Without it, restart
 // replay and WS catch-up aren't equivalent to live execution — the
 // whole soft-confirmation model collapses.
 //
@@ -3777,11 +3804,10 @@ async fn run_provider_outage_input_reader_retries_after_reconnect_test(
 // Distinct from `run_first_boot_l1_unreachable_never_synced_refuses_boot_test`
 // (already covered): that test exercises the run reducer's wall-clock fallback,
 // which only runs after setup has succeeded once (so deployment identity is
-// pinned). This test targets
-// the earlier failure: the
-// `InputReader::new` discovery step where the sequencer asks L1 for the
-// InputBox address. With no deployment identity, that call has no
-// fallback and the boot fails before recovery logic runs.
+// pinned). This test targets the earlier failure: setup's L1 discovery, which
+// first checks the chain id and then asks L1 for the InputBox address. With no
+// deployment identity, those reads have no fallback and the boot fails before
+// recovery logic runs.
 //
 // The harness simulates "no deployment identity" by `reset_database()` after
 // a normal boot has populated it (truly first-ever boot would also lack
@@ -3798,8 +3824,8 @@ async fn run_first_boot_no_identity_l1_unreachable_refuses_boot_test(
     runtime.stop().await?;
     runtime.reset_database()?;
 
-    // Route through a disconnected proxy so InputReader::new fails with
-    // a provider error.
+    // Route through a disconnected proxy so setup's first L1 read (the chain
+    // id) fails with a provider error.
     let proxy = TcpProxy::spawn(runtime.l1_endpoint()).await?;
     runtime.set_l1_endpoint_override(Some(proxy.endpoint()));
     proxy.disconnect();
@@ -3892,9 +3918,9 @@ async fn run_chain_id_mismatch_via_live_rpc_refuses_boot_test(
 // it checks that NULL-parent batches have nonce 0 and that valid-path
 // nonces form a contiguous `0..N`. So this test asserts those
 // observable consequences plus the explicit `safe_accepted_batches`
-// post-condition for .
+// post-condition for reused-nonce acceptance.
 //
-// Setup uses T2 (auto-mining off + drop) so the first batch's L1
+// Setup turns auto-mining off and drops the mempool so the first batch's L1
 // submission is dropped before reaching the chain — guaranteeing it
 // never reaches `Gold` before being cascaded.
 async fn run_nonce_zero_recovery_invalidates_then_accepts_at_nonce_zero_test(
@@ -3902,11 +3928,9 @@ async fn run_nonce_zero_recovery_invalidates_then_accepts_at_nonce_zero_test(
 ) -> ScenarioResult<()> {
     // Past stale to ensure the cascade fires.
     const PAST_STALE: Duration = blocks_as_duration(PAST_STALE_BLOCKS);
-    // Force a size-triggered batch close. Same sizing as .
+    // Force a size-triggered batch close. Same sizing as
+    // `run_delayed_inclusion_cascades_on_restart_test`.
     const TRANSFERS_TO_FORCE_CLOSE: usize = 150;
-    // Submitter idle_poll_interval = 5 s; allow one tick for the batch
-    // to enter the (held) mempool.
-    const WAIT_FOR_SUBMITTER_TICK: Duration = Duration::from_secs(7);
 
     let alice = TestSigner::from_default(1)?;
     let bob = TestSigner::from_default(2)?;
@@ -3939,9 +3963,9 @@ async fn run_nonce_zero_recovery_invalidates_then_accepts_at_nonce_zero_test(
             replay_before.apply(ws.expect_user_op_from(alice_address).await?)?;
         }
 
-        // Let the submitter tick fire and put the (nonce-0) batch's L1
-        // tx into the held mempool.
-        tokio::time::sleep(WAIT_FOR_SUBMITTER_TICK).await;
+        // Wait for the submitter's tick to put the (nonce-0) batch's L1 tx
+        // into the held mempool.
+        runtime.wait_for_pending_batch_submission().await?;
     }
 
     runtime.stop().await?;
@@ -3958,7 +3982,7 @@ async fn run_nonce_zero_recovery_invalidates_then_accepts_at_nonce_zero_test(
 
     runtime.respawn().await?;
 
-    //  assertions: the only existing batch (the original nonce-0
+    // Nonce-0 recovery assertions: the only existing batch (the original nonce-0
     // one) was cascaded, and a recovery batch was opened. The recovery
     // batch's invariants (NULL parent → nonce 0) are checked structurally
     // by the post-test `assert_schema_invariants` hook.
diff --git a/tests/e2e/src/watchdog_compare.rs b/tests/e2e/src/watchdog_compare.rs
index 5f5e41dd..058d67fd 100644
--- a/tests/e2e/src/watchdog_compare.rs
+++ b/tests/e2e/src/watchdog_compare.rs
@@ -91,7 +91,10 @@ impl Watchdog {
             .env("CARTESI_WATCHDOG_LUA_ROOT", &workspace)
             .env("CARTESI_WATCHDOG_LUA_DEPS", &lua_deps)
             .env("CARTESI_WATCHDOG_STATE_DIR", &self.state_dir)
-            .env("CARTESI_WATCHDOG_SEQUENCER_URL", runtime.endpoint())
+            .env(
+                "CARTESI_WATCHDOG_SEQUENCER_URL",
+                runtime.internal_endpoint(),
+            )
             .env(
                 "CARTESI_WATCHDOG_BLOCKCHAIN_HTTP_ENDPOINT",
                 runtime.l1_endpoint(),
@@ -150,7 +153,7 @@ impl Watchdog {
 
 /// The sequencer's accepted block and comparison-file digest.
 async fn sequencer_digest(runtime: &ManagedSequencer) -> ScenarioResult<(u64, String)> {
-    let url = format!("{}/finalized_state/digest", runtime.endpoint());
+    let url = format!("{}/finalized_state/digest", runtime.internal_endpoint());
     let (status, body, _) = http_get(&url)
         .await
         .map_err(|err| format!("GET {url}: {err}"))?;
@@ -187,7 +190,7 @@ pub async fn run_watchdog_genesis_compare_test(
     let expected_snapshot = wallet_snapshot::encode(&WalletApp::new(WalletConfig::devnet()));
 
     eprintln!("[watchdog-harness] step 1/4: the sequencer serves the devnet genesis state");
-    let finalized_url = format!("{}/finalized_state", runtime.endpoint());
+    let finalized_url = format!("{}/finalized_state", runtime.internal_endpoint());
     let (_status, body, headers) =
         wait_for_finalized_state(finalized_url.as_str(), Duration::from_secs(30)).await?;
     let inclusion_block = header_u64(&headers, "x-inclusion-block")
@@ -237,7 +240,7 @@ pub async fn run_watchdog_non_genesis_compare_test(
     let image = machine_image(DEVNET_MACHINE_IMAGE)?;
 
     eprintln!("[watchdog-harness] step 1/3: wait for a non-genesis accepted checkpoint");
-    let finalized_url = format!("{}/finalized_state", runtime.endpoint());
+    let finalized_url = format!("{}/finalized_state", runtime.internal_endpoint());
     wait_for_non_genesis_finalized_state(finalized_url.as_str(), runtime, Duration::from_secs(60))
         .await?;
     let (block, _) = sequencer_digest(runtime).await?;
@@ -269,7 +272,7 @@ pub async fn run_watchdog_divergence_drill_test(
     let trusted = machine_image(DEVNET_MACHINE_IMAGE)?;
     let wrong = machine_image(SEPOLIA_MACHINE_IMAGE)?;
 
-    let finalized_url = format!("{}/finalized_state", runtime.endpoint());
+    let finalized_url = format!("{}/finalized_state", runtime.internal_endpoint());
     wait_for_non_genesis_finalized_state(finalized_url.as_str(), runtime, Duration::from_secs(60))
         .await?;
     let (block, _) = sequencer_digest(runtime).await?;
diff --git a/tests/fixtures/consensus_vectors_v1.json b/tests/fixtures/consensus_vectors_v1.json
new file mode 100644
index 00000000..5e66191a
--- /dev/null
+++ b/tests/fixtures/consensus_vectors_v1.json
@@ -0,0 +1,930 @@
+{
+  "about": "Consensus vectors pinned on Rust 1.95.0 / alloy-core 1.6.1, before the W3b toolchain and dependency moves. Never regenerated: on any later commit a mismatch is a finding to explain, not a reason to update this file. Bytes are 0x-prefixed hex; uint256 values are 0x-prefixed hex quantities.",
+  "eip712": {
+    "domain_encode_type": "EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)",
+    "domain_type_hash": "0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f",
+    "encode_type": "UserOp(uint32 nonce,uint16 max_fee,bytes data)",
+    "type_hash": "0x794b86e861930e59e62ce17b915511462a70fd7518920d37d23766ce03bf6cb5",
+    "domains": [
+      {
+        "name": "canonical_test",
+        "chain_id": 31337,
+        "verifying_contract": "0x0000000000000000000000000000000000000000",
+        "separator": "0x330487f13dc661ab8fe297ef0a70f998ab234b53e3ead2e450c80b22395571c3"
+      },
+      {
+        "name": "sepolia_app",
+        "chain_id": 11155111,
+        "verifying_contract": "0x0123456789abcDEF0123456789abCDef01234567",
+        "separator": "0x2a2f994d3223f807b1de0a508576e48e49bef3fb0fb1eae8c9db0fac5c8e2b7e"
+      }
+    ],
+    "user_ops": [
+      {
+        "name": "empty_data",
+        "domain": "canonical_test",
+        "nonce": 0,
+        "max_fee": 0,
+        "data": "0x",
+        "struct_hash": "0x0adb11d43608ba5495540efc8110e57e3bd16cdc5acfbb4b878978c891a26629",
+        "signing_hash": "0xcc60e745cef998b09a8e9658cda76670df34346af0f299ddfa0a5aa0641e3aae"
+      },
+      {
+        "name": "four_bytes",
+        "domain": "canonical_test",
+        "nonce": 1,
+        "max_fee": 100,
+        "data": "0xdeadbeef",
+        "struct_hash": "0xda26caef39bdb65184b64ac6c7d6ed6273ac9119a6c418858d4b4786f4523e38",
+        "signing_hash": "0xdb014760580d2de614eae36089d0d09d7f8d87b9e03045573226c8ebcee48087"
+      },
+      {
+        "name": "two_hundred_bytes",
+        "domain": "canonical_test",
+        "nonce": 2,
+        "max_fee": 200,
+        "data": "0x030a11181f262d343b424950575e656c737a81888f969da4abb2b9c0c7ced5dce3eaf1f8ff060d141b222930373e454c535a61686f767d848b9299a0a7aeb5bcc3cad1d8dfe6edf4fb020910171e252c333a41484f565d646b727980878e959ca3aab1b8bfc6cdd4dbe2e9f0f7fe050c131a21282f363d444b525960676e757c838a91989fa6adb4bbc2c9d0d7dee5ecf3fa01080f161d242b323940474e555c636a71787f868d949ba2a9b0b7bec5ccd3dae1e8eff6fd040b121920272e353c434a51585f666d74",
+        "struct_hash": "0x4e6e8192e33e744c4cfb3462263126735e45e6e0239b70fd38ea36267745bd49",
+        "signing_hash": "0x63f0fd4940e600f68a5cd0f7294351afa052fbec58f03b2b666ebdf94c85d4df"
+      },
+      {
+        "name": "nonce_u32_max",
+        "domain": "canonical_test",
+        "nonce": 4294967295,
+        "max_fee": 1,
+        "data": "0x01",
+        "struct_hash": "0xc0ab5d4c2667fa8b0dc49bae86e056d3a6f10ba4b5e32cfb8bc08d78f3012872",
+        "signing_hash": "0x0a598fa1ccfbd54f376cb6902f6752d81a92c8ae2d54935cab86ab402794432d"
+      },
+      {
+        "name": "max_fee_u16_max",
+        "domain": "canonical_test",
+        "nonce": 7,
+        "max_fee": 65535,
+        "data": "0x02",
+        "struct_hash": "0x601501fb53f1f11256b641bcc27cbb651803297acf6b55f2e2ae6563a4ec84da",
+        "signing_hash": "0x4eed33ceb9f6ba501a6c481e8563c13e27ac4a06d4dd9ea3250a2276f38ffdbe"
+      },
+      {
+        "name": "four_bytes_sepolia_app",
+        "domain": "sepolia_app",
+        "nonce": 1,
+        "max_fee": 100,
+        "data": "0xdeadbeef",
+        "struct_hash": "0xda26caef39bdb65184b64ac6c7d6ed6273ac9119a6c418858d4b4786f4523e38",
+        "signing_hash": "0xe34abab31e6e31f4023ac0b4c8a87229765b805513fb7e8041f3d752437c4453"
+      }
+    ]
+  },
+  "keccak256": [
+    {
+      "name": "empty",
+      "input": "0x",
+      "digest": "0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470"
+    },
+    {
+      "name": "abc",
+      "input": "0x616263",
+      "digest": "0x4e03657aea45a94fc7d47ba826c8d667c0d1e6e33a64a036ec44f58fa12d6c45"
+    },
+    {
+      "name": "bytes_135",
+      "input": "0x030a11181f262d343b424950575e656c737a81888f969da4abb2b9c0c7ced5dce3eaf1f8ff060d141b222930373e454c535a61686f767d848b9299a0a7aeb5bcc3cad1d8dfe6edf4fb020910171e252c333a41484f565d646b727980878e959ca3aab1b8bfc6cdd4dbe2e9f0f7fe050c131a21282f363d444b525960676e757c838a91989fa6ad",
+      "digest": "0x00ef96af9cf4b24c7f269d922294444a197d0a33638c2e56634c57e892103a8f"
+    },
+    {
+      "name": "bytes_136",
+      "input": "0x030a11181f262d343b424950575e656c737a81888f969da4abb2b9c0c7ced5dce3eaf1f8ff060d141b222930373e454c535a61686f767d848b9299a0a7aeb5bcc3cad1d8dfe6edf4fb020910171e252c333a41484f565d646b727980878e959ca3aab1b8bfc6cdd4dbe2e9f0f7fe050c131a21282f363d444b525960676e757c838a91989fa6adb4",
+      "digest": "0x742061bcad767ed4c4f5883b1dcb1aad11afdcc140dc469d953759b127b9f9ed"
+    },
+    {
+      "name": "bytes_137",
+      "input": "0x030a11181f262d343b424950575e656c737a81888f969da4abb2b9c0c7ced5dce3eaf1f8ff060d141b222930373e454c535a61686f767d848b9299a0a7aeb5bcc3cad1d8dfe6edf4fb020910171e252c333a41484f565d646b727980878e959ca3aab1b8bfc6cdd4dbe2e9f0f7fe050c131a21282f363d444b525960676e757c838a91989fa6adb4bb",
+      "digest": "0xe3371f61e770abf254c34239c3b0099ad90594507415bc81dd0a10b9692bbf2a"
+    },
+    {
+      "name": "bytes_272",
+      "input": "0x030a11181f262d343b424950575e656c737a81888f969da4abb2b9c0c7ced5dce3eaf1f8ff060d141b222930373e454c535a61686f767d848b9299a0a7aeb5bcc3cad1d8dfe6edf4fb020910171e252c333a41484f565d646b727980878e959ca3aab1b8bfc6cdd4dbe2e9f0f7fe050c131a21282f363d444b525960676e757c838a91989fa6adb4bbc2c9d0d7dee5ecf3fa01080f161d242b323940474e555c636a71787f868d949ba2a9b0b7bec5ccd3dae1e8eff6fd040b121920272e353c434a51585f666d747b828990979ea5acb3bac1c8cfd6dde4ebf2f900070e151c232a31383f464d545b626970777e858c939aa1a8afb6bdc4cbd2d9e0e7eef5fc030a11181f262d343b424950575e656c",
+      "digest": "0xac141fd7b0a0ffcd2e967254d508da3ec616596493c36fa304425647d90e6de5"
+    }
+  ],
+  "signature": {
+    "private_key": "0x0101010101010101010101010101010101010101010101010101010101010101",
+    "address": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1",
+    "domain": "canonical_test",
+    "user_op": {
+      "nonce": 0,
+      "max_fee": 0,
+      "data": "0x017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888"
+    },
+    "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+    "variants": [
+      {
+        "name": "as_signed",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+        "guest": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1",
+        "ingress": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1"
+      },
+      {
+        "name": "v_0",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b800",
+        "guest": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd",
+        "ingress": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd"
+      },
+      {
+        "name": "v_1",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b801",
+        "guest": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1",
+        "ingress": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1"
+      },
+      {
+        "name": "v_2",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b802",
+        "guest": null,
+        "ingress": null
+      },
+      {
+        "name": "v_27",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81b",
+        "guest": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd",
+        "ingress": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd"
+      },
+      {
+        "name": "v_28",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+        "guest": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1",
+        "ingress": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1"
+      },
+      {
+        "name": "v_35",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b823",
+        "guest": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd",
+        "ingress": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd"
+      },
+      {
+        "name": "v_36",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b824",
+        "guest": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1",
+        "ingress": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1"
+      },
+      {
+        "name": "v_255",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b8ff",
+        "guest": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd",
+        "ingress": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd"
+      },
+      {
+        "name": "high_s_twin",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46aa2c9b629f38cc5ff6b32eeafe41341e7c8f174f4edc67a40bc08bf048e654b891b",
+        "guest": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1",
+        "ingress": "0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1"
+      },
+      {
+        "name": "high_s_same_v",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46aa2c9b629f38cc5ff6b32eeafe41341e7c8f174f4edc67a40bc08bf048e654b891c",
+        "guest": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd",
+        "ingress": "0xC286de05CD43E12cD2887FA74E2325F0C6E7A4Cd"
+      },
+      {
+        "name": "sixty_four_bytes",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b8",
+        "guest": null,
+        "ingress": null
+      },
+      {
+        "name": "r_zero",
+        "signature": "0x00000000000000000000000000000000000000000000000000000000000000005d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+        "guest": null,
+        "ingress": null
+      },
+      {
+        "name": "s_zero",
+        "signature": "0xdc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a00000000000000000000000000000000000000000000000000000000000000001c",
+        "guest": null,
+        "ingress": null
+      },
+      {
+        "name": "r_at_order",
+        "signature": "0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641415d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+        "guest": null,
+        "ingress": null
+      }
+    ]
+  },
+  "ssz": {
+    "spill_batch": {
+      "nonce": 0,
+      "frames": [
+        {
+          "safe_block": 10,
+          "fee_price": 0,
+          "user_ops": []
+        },
+        {
+          "safe_block": 11,
+          "fee_price": 257,
+          "user_ops": []
+        },
+        {
+          "safe_block": 12,
+          "fee_price": 514,
+          "user_ops": []
+        },
+        {
+          "safe_block": 13,
+          "fee_price": 771,
+          "user_ops": []
+        },
+        {
+          "safe_block": 14,
+          "fee_price": 100,
+          "user_ops": [
+            {
+              "nonce": 0,
+              "max_fee": 100,
+              "data": "0x0101000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0x1c85ee3d07a0821ef7a776650c80189b0d8b4e13c8ef7943dfd90abef99b0c754e6c7720754748f50894437ebc9a597233397f26ddb00ec3e957ed07234626191b"
+            },
+            {
+              "nonce": 1,
+              "max_fee": 101,
+              "data": "0x0102000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0x20a59bd6086eafac900a33a265bf2d6b8dbdbefc2a265bc17e98b62859a8235c42547b3f35a1ff4522fe113ea2bcb5232767a10a8f648536490dd7c4e719670b1b"
+            },
+            {
+              "nonce": 2,
+              "max_fee": 102,
+              "data": "0x0103000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0x4ac96b0e87ae8e1a387a16e2f3e9a48791ba8150162a24650537e7806f9608046283b5a4fa7678c42e1b86fd6083b15b33fd9d03727b0d9c5925eca77d7cccb91b"
+            },
+            {
+              "nonce": 3,
+              "max_fee": 103,
+              "data": "0x0104000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0x162abcc045983f3559a5665003391d9a67a587ffb90ccd84341591808ec0166a54d4c2b9ec89b29c8fdf2009acab2f3c2698e123ff5d3a9b497f8be9f86949191c"
+            },
+            {
+              "nonce": 4,
+              "max_fee": 104,
+              "data": "0x0105000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0x3ebd3564052098f1834c001930dd350d6b24e2777774d89d0f5c0cd9e6584ad65b5d971d93abc25053ab73f974b93cb5afd587e13b24576901a194e43092fd281b"
+            },
+            {
+              "nonce": 5,
+              "max_fee": 105,
+              "data": "0x0106000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0x59567102b241f0243c8db87fd2fb2f4fb7760034aa4a96ca033b72dd81df800877ba4332099d1f319ab8f207b11ad6f55aefb8bf982343cc93c532b8df315af11c"
+            },
+            {
+              "nonce": 6,
+              "max_fee": 106,
+              "data": "0x0107000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0xb526da98cf904b35df6db767d1f07d36fd0a027e8ca58c3cedbe64c46720fe4815de8686b8267fb4038df1307c3fa01a35b0c722d4054d40e42e9ffe60b0b5fc1c"
+            },
+            {
+              "nonce": 7,
+              "max_fee": 107,
+              "data": "0x0108000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0xd43fb66cf0e5c18c8334a00ece9f5455b17f9aba8c45e712acbea097b4acbfc85ae6c8bcb5721f8519b8b94abcdac1f0678da4748b027fc0230403fde5ea98c91c"
+            },
+            {
+              "nonce": 8,
+              "max_fee": 108,
+              "data": "0x0109000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888",
+              "signature": "0xa44a6cb4dbf77b359fab9c9d9cd8b298e4fdf7a1742575b3cf2a39563a2d83f50c2926072410c723f1c837cec9eb9e90edf9393bf29015ae625fd09be25b3cdb1c"
+            }
+          ]
+        },
+        {
+          "safe_block": 15,
+          "fee_price": 1285,
+          "user_ops": []
+        },
+        {
+          "safe_block": 16,
+          "fee_price": 1542,
+          "user_ops": []
+        },
+        {
+          "safe_block": 17,
+          "fee_price": 1799,
+          "user_ops": []
+        },
+        {
+          "safe_block": 18,
+          "fee_price": 2056,
+          "user_ops": []
+        }
+      ],
+      "encoded": "0x00000000000000000c0000002400000032000000400000004e0000005c00000032050000400500004e0500005c0500000e0000000a0000000000000000000e0000000b0000000000000001010e0000000c0000000000000002020e0000000d0000000000000003030e0000000e00000000000000640024000000a80000002c010000b001000034020000b80200003c030000c0030000440400000000000064000e0000004300000001010000000000000000000000000000000000000000000000000000000000000088888888888888888888888888888888888888881c85ee3d07a0821ef7a776650c80189b0d8b4e13c8ef7943dfd90abef99b0c754e6c7720754748f50894437ebc9a597233397f26ddb00ec3e957ed07234626191b0100000065000e00000043000000010200000000000000000000000000000000000000000000000000000000000000888888888888888888888888888888888888888820a59bd6086eafac900a33a265bf2d6b8dbdbefc2a265bc17e98b62859a8235c42547b3f35a1ff4522fe113ea2bcb5232767a10a8f648536490dd7c4e719670b1b0200000066000e0000004300000001030000000000000000000000000000000000000000000000000000000000000088888888888888888888888888888888888888884ac96b0e87ae8e1a387a16e2f3e9a48791ba8150162a24650537e7806f9608046283b5a4fa7678c42e1b86fd6083b15b33fd9d03727b0d9c5925eca77d7cccb91b0300000067000e000000430000000104000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888162abcc045983f3559a5665003391d9a67a587ffb90ccd84341591808ec0166a54d4c2b9ec89b29c8fdf2009acab2f3c2698e123ff5d3a9b497f8be9f86949191c0400000068000e0000004300000001050000000000000000000000000000000000000000000000000000000000000088888888888888888888888888888888888888883ebd3564052098f1834c001930dd350d6b24e2777774d89d0f5c0cd9e6584ad65b5d971d93abc25053ab73f974b93cb5afd587e13b24576901a194e43092fd281b0500000069000e00000043000000010600000000000000000000000000000000000000000000000000000000000000888888888888888888888888888888888888888859567102b241f0243c8db87fd2fb2f4fb7760034aa4a96ca033b72dd81df800877ba4332099d1f319ab8f207b11ad6f55aefb8bf982343cc93c532b8df315af11c060000006a000e000000430000000107000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888b526da98cf904b35df6db767d1f07d36fd0a027e8ca58c3cedbe64c46720fe4815de8686b8267fb4038df1307c3fa01a35b0c722d4054d40e42e9ffe60b0b5fc1c070000006b000e000000430000000108000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888d43fb66cf0e5c18c8334a00ece9f5455b17f9aba8c45e712acbea097b4acbfc85ae6c8bcb5721f8519b8b94abcdac1f0678da4748b027fc0230403fde5ea98c91c080000006c000e000000430000000109000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888a44a6cb4dbf77b359fab9c9d9cd8b298e4fdf7a1742575b3cf2a39563a2d83f50c2926072410c723f1c837cec9eb9e90edf9393bf29015ae625fd09be25b3cdb1c0e0000000f0000000000000005050e000000100000000000000006060e000000110000000000000007070e00000012000000000000000808"
+    }
+  },
+  "wallet_outputs": {
+    "token": "0x95d0c8A7d11342299807A2Fc19ac44C2321cCc68",
+    "sender": "0x7777777777777777777777777777777777777777",
+    "recipient": "0x8888888888888888888888888888888888888888",
+    "cases": [
+      {
+        "amount": "0x1",
+        "deposit_notice": "0xd19f477d00000000000000000000000095d0c8a7d11342299807a2fc19ac44c2321ccc6800000000000000000000000077777777777777777777777777777777777777770000000000000000000000000000000000000000000000000000000000000001",
+        "transfer_notice": "0x98830f8d000000000000000000000000777777777777777777777777777777777777777700000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000001",
+        "erc20_transfer": "0xa9059cbb00000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000001"
+      },
+      {
+        "amount": "0x10000000000000001",
+        "deposit_notice": "0xd19f477d00000000000000000000000095d0c8a7d11342299807a2fc19ac44c2321ccc6800000000000000000000000077777777777777777777777777777777777777770000000000000000000000000000000000000000000000010000000000000001",
+        "transfer_notice": "0x98830f8d000000000000000000000000777777777777777777777777777777777777777700000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000010000000000000001",
+        "erc20_transfer": "0xa9059cbb00000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000010000000000000001"
+      },
+      {
+        "amount": "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "deposit_notice": "0xd19f477d00000000000000000000000095d0c8a7d11342299807a2fc19ac44c2321ccc680000000000000000000000007777777777777777777777777777777777777777ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "transfer_notice": "0x98830f8d00000000000000000000000077777777777777777777777777777777777777770000000000000000000000008888888888888888888888888888888888888888ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "erc20_transfer": "0xa9059cbb0000000000000000000000008888888888888888888888888888888888888888ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+      }
+    ]
+  },
+  "fee": {
+    "max_exponent": 17101,
+    "table": [
+      ["0x0200000000000000", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0x0404000000000000", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0x0818201000000000", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0x1071c46707040100", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0x21f1f3e9e88a9fdd", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0x48642d6345d6b722", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0xa540db81e090d212", "0x0000000000000001", "0x0000000000000000", "0x0000000000000000"],
+      ["0xb52e6267a9c41374", "0x0000000000000002", "0x0000000000000000", "0x0000000000000000"],
+      ["0x54f4292cc0341bbd", "0x0000000000000007", "0x0000000000000000", "0x0000000000000000"],
+      ["0xc18b645664e97742", "0x0000000000000035", "0x0000000000000000", "0x0000000000000000"],
+      ["0xb60b04f629f898ab", "0x0000000000000b49", "0x0000000000000000", "0x0000000000000000"],
+      ["0x4629a786bdd375fa", "0x00000000007f6ade", "0x0000000000000000", "0x0000000000000000"],
+      ["0x79e549182d192a6d", "0x00003f6b3526706c", "0x0000000000000000", "0x0000000000000000"],
+      ["0x7f3a4c7881787119", "0x64804eff3bb1395d", "0x000000000fb5f10e", "0x0000000000000000"],
+      ["0xe3d136d7ec593e8d", "0x50c3a57adca65b2a", "0x5822dda8c6c1ba0e", "0x00f6d38e711d40ba"]
+    ],
+    "fee_to_linear": [
+      {
+        "exponent": 0,
+        "fixed": "0x10000000000000000",
+        "linear": "0x1"
+      },
+      {
+        "exponent": 1,
+        "fixed": "0x10200000000000000",
+        "linear": "0x1"
+      },
+      {
+        "exponent": 200,
+        "fixed": "0x4bdea1c0ae1fadf2f",
+        "linear": "0x4"
+      },
+      {
+        "exponent": 17101,
+        "fixed": "0xff853cbad77d81420c3129ed78d03683ecdfc2c89dd67c9494e3ba8934ba46d3",
+        "linear": "0xff853cbad77d81420c3129ed78d03683ecdfc2c89dd67c94"
+      }
+    ]
+  },
+  "evm_advance": {
+    "calldata": "0x415bf3630000000000000000000000000000000000000000000000000000000000aa36a70000000000000000000000000123456789abcdef0123456789abcdef012345670000000000000000000000003332de61a8bb9ac84893b2f552fe81c9a6dc54190000000000000000000000000000000000000000000000000000000001234567000000000000000000000000000000000000000000000000000000006553f1000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20000000000000000000000000000000000000000000000000000000000000002a00000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002aabb000000000000000000000000000000000000000000000000000000000000",
+    "fields": {
+      "chain_id": "0xaa36a7",
+      "app_contract": "0x0123456789abcDEF0123456789abCDef01234567",
+      "msg_sender": "0x3332DE61a8BB9aC84893b2f552Fe81C9a6dC5419",
+      "block_number": "0x1234567",
+      "block_timestamp": "0x6553f100",
+      "prev_randao": "0x0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20",
+      "index": "0x2a",
+      "payload": "0xaabb"
+    },
+    "variants": [
+      {
+        "name": "trailing_zero_word",
+        "calldata": "0x415bf3630000000000000000000000000000000000000000000000000000000000aa36a70000000000000000000000000123456789abcdef0123456789abcdef012345670000000000000000000000003332de61a8bb9ac84893b2f552fe81c9a6dc54190000000000000000000000000000000000000000000000000000000001234567000000000000000000000000000000000000000000000000000000006553f1000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20000000000000000000000000000000000000000000000000000000000000002a00000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002aabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+        "accepted": true
+      },
+      {
+        "name": "dirty_bytes_padding",
+        "calldata": "0x415bf3630000000000000000000000000000000000000000000000000000000000aa36a70000000000000000000000000123456789abcdef0123456789abcdef012345670000000000000000000000003332de61a8bb9ac84893b2f552fe81c9a6dc54190000000000000000000000000000000000000000000000000000000001234567000000000000000000000000000000000000000000000000000000006553f1000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20000000000000000000000000000000000000000000000000000000000000002a00000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002aabb000000000000000000000000000000000000000000000000000000000001",
+        "accepted": true
+      },
+      {
+        "name": "dirty_address_padding",
+        "calldata": "0x415bf3630000000000000000000000000000000000000000000000000000000000aa36a70000000000000000000000000123456789abcdef0123456789abcdef01234567ff00000000000000000000003332de61a8bb9ac84893b2f552fe81c9a6dc54190000000000000000000000000000000000000000000000000000000001234567000000000000000000000000000000000000000000000000000000006553f1000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20000000000000000000000000000000000000000000000000000000000000002a00000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002aabb000000000000000000000000000000000000000000000000000000000000",
+        "accepted": true
+      }
+    ]
+  },
+  "guest": {
+    "chain_id": 31337,
+    "app_contract": "0x0000000000000000000000000000000000000000",
+    "senders": {
+      "portal": "0x3332DE61a8BB9aC84893b2f552Fe81C9a6dC5419",
+      "sequencer": "0xa0Ee7A142d267C1f36714E4a8F75612F20a79720"
+    },
+    "first_input_envelope": "0x415bf3630000000000000000000000000000000000000000000000000000000000007a6900000000000000000000000000000000000000000000000000000000000000000000000000000000000000003332de61a8bb9ac84893b2f552fe81c9a6dc5419000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000004895d0c8a7d11342299807a2fc19ac44c2321ccc681a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000000000000000000000000000000000000000003e8000000000000000000000000000000000000000000000000",
+    "payloads": {
+      "deposit_alice": "0x95d0c8a7d11342299807a2fc19ac44c2321ccc681a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000000000000000000000000000000000000000003e8",
+      "drain_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000",
+      "sig_as_signed_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+      "sig_high_s_same_v_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46aa2c9b629f38cc5ff6b32eeafe41341e7c8f174f4edc67a40bc08bf048e654b891c",
+      "sig_high_s_twin_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46aa2c9b629f38cc5ff6b32eeafe41341e7c8f174f4edc67a40bc08bf048e654b891b",
+      "sig_r_at_order_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641415d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+      "sig_r_zero_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d00000000000000000000000000000000000000000000000000000000000000888888888888888888888888888888888888888800000000000000000000000000000000000000000000000000000000000000005d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+      "sig_s_zero_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a00000000000000000000000000000000000000000000000000000000000000001c",
+      "sig_sixty_four_bytes_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b8",
+      "sig_v_0_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b800",
+      "sig_v_1_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b801",
+      "sig_v_255_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b8ff",
+      "sig_v_27_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81b",
+      "sig_v_28_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+      "sig_v_2_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b802",
+      "sig_v_35_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b823",
+      "sig_v_36_batch": "0x00000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b824",
+      "spill_batch": "0x00000000000000000c0000002400000032000000400000004e0000005c00000032050000400500004e0500005c0500000e0000000a0000000000000000000e0000000b0000000000000001010e0000000c0000000000000002020e0000000d0000000000000003030e0000000e00000000000000640024000000a80000002c010000b001000034020000b80200003c030000c0030000440400000000000064000e0000004300000001010000000000000000000000000000000000000000000000000000000000000088888888888888888888888888888888888888881c85ee3d07a0821ef7a776650c80189b0d8b4e13c8ef7943dfd90abef99b0c754e6c7720754748f50894437ebc9a597233397f26ddb00ec3e957ed07234626191b0100000065000e00000043000000010200000000000000000000000000000000000000000000000000000000000000888888888888888888888888888888888888888820a59bd6086eafac900a33a265bf2d6b8dbdbefc2a265bc17e98b62859a8235c42547b3f35a1ff4522fe113ea2bcb5232767a10a8f648536490dd7c4e719670b1b0200000066000e0000004300000001030000000000000000000000000000000000000000000000000000000000000088888888888888888888888888888888888888884ac96b0e87ae8e1a387a16e2f3e9a48791ba8150162a24650537e7806f9608046283b5a4fa7678c42e1b86fd6083b15b33fd9d03727b0d9c5925eca77d7cccb91b0300000067000e000000430000000104000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888162abcc045983f3559a5665003391d9a67a587ffb90ccd84341591808ec0166a54d4c2b9ec89b29c8fdf2009acab2f3c2698e123ff5d3a9b497f8be9f86949191c0400000068000e0000004300000001050000000000000000000000000000000000000000000000000000000000000088888888888888888888888888888888888888883ebd3564052098f1834c001930dd350d6b24e2777774d89d0f5c0cd9e6584ad65b5d971d93abc25053ab73f974b93cb5afd587e13b24576901a194e43092fd281b0500000069000e00000043000000010600000000000000000000000000000000000000000000000000000000000000888888888888888888888888888888888888888859567102b241f0243c8db87fd2fb2f4fb7760034aa4a96ca033b72dd81df800877ba4332099d1f319ab8f207b11ad6f55aefb8bf982343cc93c532b8df315af11c060000006a000e000000430000000107000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888b526da98cf904b35df6db767d1f07d36fd0a027e8ca58c3cedbe64c46720fe4815de8686b8267fb4038df1307c3fa01a35b0c722d4054d40e42e9ffe60b0b5fc1c070000006b000e000000430000000108000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888d43fb66cf0e5c18c8334a00ece9f5455b17f9aba8c45e712acbea097b4acbfc85ae6c8bcb5721f8519b8b94abcdac1f0678da4748b027fc0230403fde5ea98c91c080000006c000e000000430000000109000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888a44a6cb4dbf77b359fab9c9d9cd8b298e4fdf7a1742575b3cf2a39563a2d83f50c2926072410c723f1c837cec9eb9e90edf9393bf29015ae625fd09be25b3cdb1c0e0000000f0000000000000005050e000000100000000000000006060e000000110000000000000007070e00000012000000000000000808",
+      "transfer_batch": "0x01000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e00000043000000017d000000000000000000000000000000000000000000000000000000000000008888888888888888888888888888888888888888dc2528a0578bf931525b5770e77a7103ceb32ea315176ecca1b2386a3bc4f46a5d3649d60c733a0094cd11501becbe16f1bd67f1c18225fb03c99f8841d0f5b81c",
+      "withdrawal_batch": "0x01000000000000000c000000040000000e0000000a000000000000000000040000000000000000000e0000002f000000007d00000000000000000000000000000000000000000000000000000000000000f429270312f288812d5278931600bb8555b33979e672c3264680cbcd9fc5496b1fcea49af69cd866ea1fd806bce9947446cc9a9bec8b960e90f52f9ca6d930bd1c"
+    },
+    "outputs": {
+      "deposit_notice_alice": {
+        "notice": "0xd19f477d00000000000000000000000095d0c8a7d11342299807a2fc19ac44c2321ccc680000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000000000000000000000000000000000000000003e8"
+      },
+      "spill_transfer_notice_1": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000001"
+      },
+      "spill_transfer_notice_2": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000002"
+      },
+      "spill_transfer_notice_3": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000003"
+      },
+      "spill_transfer_notice_4": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000004"
+      },
+      "spill_transfer_notice_5": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000005"
+      },
+      "spill_transfer_notice_6": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000006"
+      },
+      "spill_transfer_notice_7": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000007"
+      },
+      "spill_transfer_notice_8": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000008"
+      },
+      "spill_transfer_notice_9": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f100000000000000000000000088888888888888888888888888888888888888880000000000000000000000000000000000000000000000000000000000000009"
+      },
+      "transfer_notice_alice_bob": {
+        "notice": "0x98830f8d0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f10000000000000000000000008888888888888888888888888888888888888888000000000000000000000000000000000000000000000000000000000000007d"
+      },
+      "withdrawal_voucher_alice": {
+        "voucher": {
+          "destination": "0x95d0c8A7d11342299807A2Fc19ac44C2321cCc68",
+          "payload": "0xa9059cbb0000000000000000000000001a642f0e3c3af545e7acbd38b07251b3990914f1000000000000000000000000000000000000000000000000000000000000007d",
+          "value": "0x0"
+        }
+      }
+    },
+    "scenarios": [
+      {
+        "name": "deposit",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "drain_batch"
+          }
+        ]
+      },
+      {
+        "name": "transfer",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "drain_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "withdrawal",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "drain_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["withdrawal_voucher_alice"],
+            "payload": "withdrawal_batch"
+          }
+        ]
+      },
+      {
+        "name": "spill_batch",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 20,
+            "from": "sequencer",
+            "outputs": [
+              "deposit_notice_alice",
+              "spill_transfer_notice_1",
+              "spill_transfer_notice_2",
+              "spill_transfer_notice_3",
+              "spill_transfer_notice_4",
+              "spill_transfer_notice_5",
+              "spill_transfer_notice_6",
+              "spill_transfer_notice_7",
+              "spill_transfer_notice_8",
+              "spill_transfer_notice_9"
+            ],
+            "payload": "spill_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_as_signed",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice", "transfer_notice_alice_bob"],
+            "payload": "sig_as_signed_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": [],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_0",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_v_0_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_1",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice", "transfer_notice_alice_bob"],
+            "payload": "sig_v_1_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": [],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_2",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_v_2_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_27",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_v_27_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_28",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice", "transfer_notice_alice_bob"],
+            "payload": "sig_v_28_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": [],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_35",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_v_35_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_36",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice", "transfer_notice_alice_bob"],
+            "payload": "sig_v_36_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": [],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_v_255",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_v_255_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_high_s_twin",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice", "transfer_notice_alice_bob"],
+            "payload": "sig_high_s_twin_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": [],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_high_s_same_v",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_high_s_same_v_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_sixty_four_bytes",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_sixty_four_bytes_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_r_zero",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_r_zero_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_s_zero",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_s_zero_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      },
+      {
+        "name": "signature_r_at_order",
+        "steps": [
+          {
+            "block": 10,
+            "from": "portal",
+            "outputs": [],
+            "payload": "deposit_alice"
+          },
+          {
+            "block": 10,
+            "from": "sequencer",
+            "outputs": ["deposit_notice_alice"],
+            "payload": "sig_r_at_order_batch"
+          },
+          {
+            "block": 11,
+            "from": "sequencer",
+            "outputs": ["transfer_notice_alice_bob"],
+            "payload": "transfer_batch"
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/tests/fixtures/l1_partition_vector.json b/tests/fixtures/l1_partition_vector.json
index c669f68f..fa3c4fb6 100644
--- a/tests/fixtures/l1_partition_vector.json
+++ b/tests/fixtures/l1_partition_vector.json
@@ -1,17 +1,10 @@
 {
-  "long_block_range_error_codes": ["-32005", "-32012", "-32600", "-32602", "-32616"],
   "scenarios": [
     {
-      "name": "bisect_on_default_infura_code",
+      "name": "split_on_failure",
       "start_block": 1,
       "end_block": 4,
-      "fail_ranges": [
-        {
-          "from": 1,
-          "to": 4,
-          "message": "RPC error -32005: query returned more than allowed"
-        }
-      ],
+      "fail_ranges": [{ "from": 1, "to": 4 }],
       "expect_calls": [[1, 4], [1, 2], [3, 4]],
       "expect_ok": true
     },
@@ -32,27 +25,13 @@
       "expect_ok": true
     },
     {
-      "name": "non_retryable_error_aborts",
-      "start_block": 1,
-      "end_block": 4,
-      "fail_ranges": [
-        {
-          "from": 1,
-          "to": 4,
-          "message": "connection refused"
-        }
-      ],
-      "expect_calls": [[1, 4]],
-      "expect_ok": false
-    },
-    {
-      "name": "nested_bisect_alchemy_code",
+      "name": "nested_split",
       "start_block": 1,
       "end_block": 8,
       "fail_ranges": [
-        { "from": 1, "to": 8, "message": "error -32600: block range too large" },
-        { "from": 1, "to": 4, "message": "error -32600: block range too large" },
-        { "from": 1, "to": 2, "message": "error -32600: block range too large" }
+        { "from": 1, "to": 8 },
+        { "from": 1, "to": 4 },
+        { "from": 1, "to": 2 }
       ],
       "expect_calls": [
         [1, 8],
@@ -66,72 +45,66 @@
       "expect_ok": true
     },
     {
-      "name": "bisect_on_proxy_range_exceeded_code",
+      "name": "odd_width_left_half_gets_the_extra_block",
       "start_block": 100,
       "end_block": 200,
-      "fail_ranges": [
-        {
-          "from": 100,
-          "to": 200,
-          "message": "-32012: getLogs request exceeded max allowed range"
-        }
-      ],
+      "fail_ranges": [{ "from": 100, "to": 200 }],
       "expect_calls": [[100, 200], [100, 150], [151, 200]],
       "expect_ok": true
     },
     {
-      "name": "single_block_fail_no_split",
+      "name": "single_block_failure_aborts",
       "start_block": 7,
       "end_block": 7,
-      "fail_ranges": [
-        {
-          "from": 7,
-          "to": 7,
-          "message": "error -32616: range limit"
-        }
-      ],
+      "fail_ranges": [{ "from": 7, "to": 7 }],
       "expect_calls": [[7, 7]],
       "expect_ok": false
     },
     {
-      "name": "terminal_error_in_left_half_aborts_before_right",
+      "name": "persistent_failure_walks_only_the_left_spine",
       "start_block": 1,
       "end_block": 8,
       "fail_ranges": [
-        {
-          "from": 1,
-          "to": 8,
-          "message": "error -32600: block range too large"
-        },
-        {
-          "from": 1,
-          "to": 4,
-          "message": "connection refused"
-        }
+        { "from": 1, "to": 8 },
+        { "from": 1, "to": 4 },
+        { "from": 1, "to": 2 },
+        { "from": 1, "to": 1 }
+      ],
+      "expect_calls": [[1, 8], [1, 4], [1, 2], [1, 1]],
+      "expect_ok": false
+    },
+    {
+      "name": "right_leaf_failure_fails_the_whole_scan",
+      "start_block": 1,
+      "end_block": 4,
+      "fail_ranges": [
+        { "from": 1, "to": 4 },
+        { "from": 3, "to": 4 },
+        { "from": 4, "to": 4 }
       ],
-      "expect_calls": [[1, 8], [1, 4]],
+      "expect_calls": [[1, 4], [1, 2], [3, 4], [3, 3], [4, 4]],
       "expect_ok": false
     }
   ],
   "log_sort": {
     "unsorted": [
-      {
-        "blockNumber": "0x2",
-        "transactionIndex": "0x0",
-        "logIndex": "0x5"
-      },
-      {
-        "blockNumber": "0x1",
-        "transactionIndex": "0x9",
-        "logIndex": "0x0"
-      },
-      {
-        "blockNumber": "0x2",
-        "transactionIndex": "0x0",
-        "logIndex": "0x1"
-      }
+      { "blockNumber": "0x10", "transactionIndex": "0x0", "logIndex": "0x10" },
+      { "blockNumber": "0x11", "transactionIndex": "0x1", "logIndex": "0x0" },
+      { "blockNumber": "0x9", "transactionIndex": "0x9", "logIndex": "0x0" },
+      { "blockNumber": "0x11", "transactionIndex": "0x0", "logIndex": "0x4" },
+      { "blockNumber": "0x10", "transactionIndex": "0x0", "logIndex": "0x5" }
+    ],
+    "expect_sorted": [
+      { "blockNumber": "0x9", "transactionIndex": "0x9", "logIndex": "0x0" },
+      { "blockNumber": "0x10", "transactionIndex": "0x0", "logIndex": "0x5" },
+      { "blockNumber": "0x10", "transactionIndex": "0x0", "logIndex": "0x10" },
+      { "blockNumber": "0x11", "transactionIndex": "0x0", "logIndex": "0x4" },
+      { "blockNumber": "0x11", "transactionIndex": "0x1", "logIndex": "0x0" }
     ],
-    "expect_block_order": ["0x1", "0x2", "0x2"],
-    "expect_log_index_order": ["0x0", "0x1", "0x5"]
+    "refuse": [
+      { "missing": "blockNumber", "log": { "transactionIndex": "0x0", "logIndex": "0x0" } },
+      { "missing": "transactionIndex", "log": { "blockNumber": "0x2", "logIndex": "0x0" } },
+      { "missing": "logIndex", "log": { "blockNumber": "0x2", "transactionIndex": "0x0" } }
+    ]
   }
 }
diff --git a/tests/fixtures/wallet_snapshot_empty.hex b/tests/fixtures/wallet_snapshot_empty.hex
index eff8c92d..26ccd897 100644
--- a/tests/fixtures/wallet_snapshot_empty.hex
+++ b/tests/fixtures/wallet_snapshot_empty.hex
@@ -1 +1 @@
-3332de61a8bb9ac84893b2f552fe81c9a6dc54191c7d4b196cb0c7b01d743fbc6116a902379c723816d5ff3fdd14e2a86fba77cbce6b3cd9c32b8ff3540000005400000000000000000000000000000000000000
+3332de61a8bb9ac84893b2f552fe81c9a6dc54191c7d4b196cb0c7b01d743fbc6116a902379c723879b88d2f598d8d001832d69f5201332a3f1e14c8540000005400000000000000000000000000000000000000
diff --git a/tests/harness/Cargo.toml b/tests/harness/Cargo.toml
index 28befde2..a681a802 100644
--- a/tests/harness/Cargo.toml
+++ b/tests/harness/Cargo.toml
@@ -19,9 +19,9 @@ futures-util = { workspace = true }
 k256 = { workspace = true }
 rusqlite = { workspace = true }
 reqwest = { workspace = true, features = ["json"] }
-tar = "0.4"
-toml = "0.8"
-sequencer-core = { path = "../../sequencer-core" }
+tar = { workspace = true }
+toml = { workspace = true }
+sequencer-core = { path = "../../sequencer-core", features = ["test-support"] }
 sequencer-rust-client = { path = "../../sdk/rust-client" }
 serde = { workspace = true }
 serde_json = { workspace = true }
diff --git a/examples/app-core/anvil_accounts.txt b/tests/harness/anvil_accounts.txt
similarity index 100%
rename from examples/app-core/anvil_accounts.txt
rename to tests/harness/anvil_accounts.txt
diff --git a/tests/harness/src/anvil_accounts.rs b/tests/harness/src/anvil_accounts.rs
new file mode 100644
index 00000000..66fdef5f
--- /dev/null
+++ b/tests/harness/src/anvil_accounts.rs
@@ -0,0 +1,27 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//! Anvil's default funded accounts, `<address> <private_key>` per line, in
+//! account-index order.
+
+use std::sync::OnceLock;
+
+const ANVIL_ACCOUNTS: &str =
+    include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/anvil_accounts.txt"));
+
+/// Private keys of Anvil's default accounts; index `i` is Anvil account `i`.
+pub fn default_private_keys() -> &'static [String] {
+    static KEYS: OnceLock<Vec<String>> = OnceLock::new();
+    KEYS.get_or_init(|| {
+        ANVIL_ACCOUNTS
+            .lines()
+            .filter(|line| !line.trim().is_empty())
+            .map(|line| {
+                line.split_whitespace()
+                    .nth(1)
+                    .expect("anvil_accounts.txt: `<address> <private_key>` per line")
+                    .to_owned()
+            })
+            .collect()
+    })
+}
diff --git a/tests/harness/src/lib.rs b/tests/harness/src/lib.rs
index b43f1aa1..dd5461dc 100644
--- a/tests/harness/src/lib.rs
+++ b/tests/harness/src/lib.rs
@@ -1,6 +1,7 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
+mod anvil_accounts;
 pub mod paths;
 pub mod proxy;
 pub mod replay;
@@ -12,14 +13,16 @@ pub mod ws;
 
 pub type HarnessResult<T> = Result<T, Box<dyn std::error::Error + Send + Sync>>;
 
+pub use anvil_accounts::default_private_keys;
 pub use proxy::TcpProxy;
 pub use replay::ReplayWalletApp;
-pub use rollups::{DEVNET_CHAIN_ID, DevnetRollupsStack};
+pub use rollups::{DEVNET_CHAIN_ID, DEVNET_SECONDS_PER_BLOCK, DevnetRollupsStack};
 pub use sequencer::{
-    BatchCounts, DEFAULT_DEVNET_SEQUENCER_BIN, DEFAULT_TEST_LOGS_DIR, ManagedSequencer,
-    ManagedSequencerConfig, RecoveryCheckpoint, RecoverySetupParams, RespawnAttemptOutcome,
-    RespawnPolicy, StackChildExit, default_c_wallet_sequencer_config,
-    default_devnet_sequencer_config, devnet_sequencer_config_no_faketime,
+    BatchCounts, BatchNonceFrontier, DEFAULT_DEVNET_SEQUENCER_BIN, DEFAULT_TEST_LOGS_DIR,
+    DEVNET_PREEMPTIVE_MARGIN_BLOCKS, ManagedSequencer, ManagedSequencerConfig, RecoveryCheckpoint,
+    RecoverySetupParams, RespawnAttemptOutcome, RespawnPolicy, StackChildExit,
+    default_c_wallet_sequencer_config, default_devnet_sequencer_config,
+    devnet_sequencer_config_no_faketime,
 };
 pub use wallet::{
     TestSigner, WalletL1Client, WalletL2Client, address_from_signing_key, sign_user_op_hex,
diff --git a/tests/harness/src/proxy.rs b/tests/harness/src/proxy.rs
index 778325b3..568356bf 100644
--- a/tests/harness/src/proxy.rs
+++ b/tests/harness/src/proxy.rs
@@ -1,38 +1,10 @@
 // (c) Cartesi and individual authors (see AUTHORS)
 // SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
-//! TCP proxy with programmatic `disconnect()` / `reconnect()` for outage
-//! simulation in tests.
-//!
-//! Layout:
-//!
-//! ```text
-//! Sequencer ──→ TcpProxy (127.0.0.1:proxy_port) ──→ Anvil (upstream)
-//!                       ↑
-//!                 disconnect() / reconnect()
-//!                 controlled from test code
-//! ```
-//!
-//! Behavior:
-//!
-//! - `disconnect()` flips an internal flag. All existing forwarded connections
-//!   are torn down (their forwarding tasks observe the flag and exit, dropping
-//!   the sockets). New connection attempts still succeed at the TCP accept
-//!   level, but are immediately closed. To the sequencer, this looks like the
-//!   upstream aggressively resets every connection — the same client-visible
-//!   behavior as a node that went down.
-//!
-//! - `reconnect()` flips the flag back. Subsequent connections forward
-//!   normally; the sequencer's next retry after backoff reconnects as if the
-//!   upstream is back.
-//!
-//! - Anvil (the real upstream) stays running behind the proxy the whole time,
-//!   so the test can bypass the proxy to mine blocks on it directly via a
-//!   separate client connected to the upstream port. That's how we simulate
-//!   "L1 advanced while the sequencer's gateway was down."
-//!
-//! The proxy listens on `127.0.0.1:0` by default, picking an ephemeral port
-//! the OS hands out; the actual port is read back via `endpoint()`.
+//! TCP proxy for L1 outage tests. `disconnect()` tears down every forwarded
+//! connection and closes new ones on accept, which the sequencer sees as a dead
+//! node; `reconnect()` resumes forwarding. Anvil keeps running upstream, so a test
+//! can mine on it directly (`upstream_addr`) while the sequencer is cut off.
 
 use std::net::SocketAddr;
 use std::sync::Arc;
diff --git a/tests/harness/src/rollups.rs b/tests/harness/src/rollups.rs
index 8f9741b5..ec375b9c 100644
--- a/tests/harness/src/rollups.rs
+++ b/tests/harness/src/rollups.rs
@@ -12,11 +12,12 @@ use alloy::providers::{Provider, ProviderBuilder};
 use alloy::rpc::types::{BlockNumberOrTag, TransactionRequest};
 use alloy::signers::local::PrivateKeySigner;
 use alloy_primitives::{Address, B256, Bytes, U256};
-use app_core::application::{WalletConfig, default_private_keys};
+use app_core::application::WalletConfig;
 use cartesi_rollups_contracts::application_factory::ApplicationFactory::{self, WithdrawalConfig};
 use tokio::process::{Child, Command};
 
 use crate::HarnessResult;
+use crate::default_private_keys;
 use crate::paths;
 use crate::util::{
     build_local_endpoint, ensure_exists, io_other, path_as_str, send_graceful_terminate,
@@ -24,6 +25,9 @@ use crate::util::{
 };
 
 pub const DEVNET_CHAIN_ID: u64 = 31_337;
+/// L1 block time: Anvil mines outages at this interval, and the harness passes
+/// it to the sequencer as `--seconds-per-block`.
+pub const DEVNET_SECONDS_PER_BLOCK: u64 = 12;
 
 const DEFAULT_ANVIL_START_TIMEOUT: Duration = Duration::from_secs(10);
 const DEFAULT_ANVIL_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(3);
@@ -43,18 +47,35 @@ impl DevnetRollupsStack {
     pub async fn spawn(log_prefix: &str, logs_dir: &Path) -> HarnessResult<Self> {
         let anvil = ManagedAnvil::spawn(log_prefix, logs_dir).await?;
         let mock_erc20_address = deploy_devnet_mock_erc20(anvil.endpoint.as_str()).await?;
-        let app_address = deploy_devnet_application(
+        let (app_address, deployment_block) = deploy_devnet_application(
             anvil.endpoint.as_str(),
             anvil.application_factory_address,
             anvil.input_box_address,
         )
         .await?;
 
-        Ok(Self {
+        let stack = Self {
             anvil,
             app_address,
             mock_erc20_address,
-        })
+        };
+        // `setup` pins only a deployment at or below the L1 safe head
+        // (`DeploymentNotYetSafe`); Anvil's safe head trails latest by
+        // `--slots-in-an-epoch` blocks. Mined as one burst; the interval keeps
+        // timestamps distinct.
+        let safe = stack.l1_safe_block_number().await?;
+        stack
+            .mine_live_l1_blocks(deployment_block.saturating_sub(safe))
+            .await?;
+        let safe = stack.l1_safe_block_number().await?;
+        if safe < deployment_block {
+            return Err(io_other(format!(
+                "Anvil safe head {safe} did not reach the application deployment block \
+                 {deployment_block}"
+            ))
+            .into());
+        }
+        Ok(stack)
     }
 
     pub fn l1_endpoint(&self) -> &str {
@@ -93,14 +114,23 @@ impl DevnetRollupsStack {
     }
 
     /// Mine ordinary live-chain progress without simulating a 12-second outage
-    /// per block. The one-second interval keeps Anvil timestamps monotone while
-    /// wall-clock-paced polling avoids tripping the clock-usability guard.
+    /// per block. The one-second interval keeps a burst's timestamps strictly
+    /// increasing (Anvil stamps an interval-less burst with one timestamp), but
+    /// it is added on top of elapsed time: a loop that calls this once per
+    /// second runs L1 at twice wall-clock speed. Pace with
+    /// [`Self::mine_l1_block_at_wall_clock`] instead.
     pub async fn mine_live_l1_blocks(&self, block_count: u64) -> HarnessResult<()> {
         self.anvil
-            .mine_blocks_with_interval(block_count, LIVE_L1_BLOCK_INTERVAL_SECONDS)
+            .mine_blocks_with_interval(block_count, Some(LIVE_L1_BLOCK_INTERVAL_SECONDS))
             .await
     }
 
+    /// Mine one block stamped at Anvil's own clock, so mining paced once per
+    /// wall-clock second keeps L1 time coupled to the sequencer's clock.
+    pub async fn mine_l1_block_at_wall_clock(&self) -> HarnessResult<()> {
+        self.anvil.mine_blocks_with_interval(1, None).await
+    }
+
     pub async fn l1_safe_block_number(&self) -> HarnessResult<u64> {
         let provider = ProviderBuilder::new()
             .connect(self.anvil.endpoint.as_str())
@@ -126,6 +156,25 @@ impl DevnetRollupsStack {
         self.anvil.drop_all_pending_txs().await
     }
 
+    /// Wait until `sender` has a transaction in Anvil's mempool, i.e. its
+    /// pending nonce is ahead of its latest one.
+    pub async fn wait_for_pending_tx_from(
+        &self,
+        sender: Address,
+        timeout: Duration,
+    ) -> HarnessResult<()> {
+        let deadline = tokio::time::Instant::now() + timeout;
+        while !self.anvil.has_pending_tx_from(sender).await? {
+            if tokio::time::Instant::now() >= deadline {
+                return Err(
+                    io_other(format!("no pending tx from {sender} within {timeout:?}")).into(),
+                );
+            }
+            tokio::time::sleep(Duration::from_millis(200)).await;
+        }
+        Ok(())
+    }
+
     pub async fn shutdown(self) -> HarnessResult<()> {
         self.anvil.shutdown().await
     }
@@ -250,23 +299,21 @@ impl ManagedAnvil {
 
     async fn mine_blocks(&self, block_count: u64) -> HarnessResult<()> {
         // L1 block-time coupling: each mined block advances the L1
-        // timestamp by `SECONDS_PER_BLOCK` (Ethereum mainnet parity, also
-        // what `ManagedSequencer::advance_wall_and_mine` assumes when
-        // pairing faketime advances with block counts).
+        // timestamp by `DEVNET_SECONDS_PER_BLOCK`, which
+        // `ManagedSequencer::advance_wall_and_mine` pairs with faketime.
         //
         // Without the explicit `interval`, anvil defaults to 1s/block —
         // which then desyncs from faketime, making large advances trip
         // spurious `L1ViewStale` even when wall clock and L1 should move
         // together. See `ManagedSequencer::advance_wall_and_mine`.
-        const SECONDS_PER_BLOCK: u64 = 12;
-        self.mine_blocks_with_interval(block_count, SECONDS_PER_BLOCK)
+        self.mine_blocks_with_interval(block_count, Some(DEVNET_SECONDS_PER_BLOCK))
             .await
     }
 
     async fn mine_blocks_with_interval(
         &self,
         block_count: u64,
-        interval_seconds: u64,
+        interval_seconds: Option<u64>,
     ) -> HarnessResult<()> {
         if block_count == 0 {
             return Ok(());
@@ -277,7 +324,7 @@ impl ManagedAnvil {
             .await
             .map_err(|err| io_other(format!("failed to connect anvil provider: {err}")))?;
         provider
-            .anvil_mine(Some(block_count), Some(interval_seconds))
+            .anvil_mine(Some(block_count), interval_seconds)
             .await
             .map_err(|err| {
                 io_other(format!(
@@ -310,6 +357,24 @@ impl ManagedAnvil {
             .map_err(|err| io_other(format!("failed to drop all pending txs: {err}")))?;
         Ok(())
     }
+
+    async fn has_pending_tx_from(&self, sender: Address) -> HarnessResult<bool> {
+        let provider = ProviderBuilder::new()
+            .connect(self.endpoint.as_str())
+            .await
+            .map_err(|err| io_other(format!("failed to connect anvil provider: {err}")))?;
+        let latest = provider
+            .get_transaction_count(sender)
+            .latest()
+            .await
+            .map_err(|err| io_other(format!("failed to read latest nonce of {sender}: {err}")))?;
+        let pending = provider
+            .get_transaction_count(sender)
+            .pending()
+            .await
+            .map_err(|err| io_other(format!("failed to read pending nonce of {sender}: {err}")))?;
+        Ok(pending > latest)
+    }
 }
 
 /// Reads a plaintext `deployments/<chain>/<Contract>.txt` artifact (the
@@ -487,11 +552,12 @@ async fn deploy_mock_erc20_from_default_funder(endpoint: &str) -> HarnessResult<
     })
 }
 
+/// The application's address and its deployment block.
 async fn deploy_devnet_application(
     endpoint: &str,
     application_factory_address: Address,
     input_box_address: Address,
-) -> HarnessResult<Address> {
+) -> HarnessResult<(Address, u64)> {
     let private_key = default_private_keys()
         .first()
         .ok_or_else(|| io_other("missing default Anvil private key"))?;
@@ -551,8 +617,11 @@ async fn deploy_devnet_application(
     if !receipt.status() {
         return Err(io_other("application deployment transaction reverted").into());
     }
+    let deployment_block = receipt
+        .block_number
+        .ok_or_else(|| io_other("application deployment receipt missing block number"))?;
 
-    Ok(application_address)
+    Ok((application_address, deployment_block))
 }
 
 fn load_template_hash(machine_image_path: &Path) -> HarnessResult<B256> {
diff --git a/tests/harness/src/sequencer.rs b/tests/harness/src/sequencer.rs
index a783bb3c..133bf7b1 100644
--- a/tests/harness/src/sequencer.rs
+++ b/tests/harness/src/sequencer.rs
@@ -10,15 +10,15 @@ use std::time::Duration;
 use alloy::providers::{Provider, ProviderBuilder};
 use alloy::rpc::types::Filter;
 use alloy_sol_types::SolEvent;
-use app_core::application::default_private_keys;
 use cartesi_rollups_contracts::input_box::InputBox::InputAdded;
 use sequencer_rust_client::SequencerClient;
 use tempfile::TempDir;
 use tokio::process::{Child, Command};
 
 use crate::HarnessResult;
+use crate::default_private_keys;
 use crate::paths;
-use crate::rollups::{DEVNET_CHAIN_ID, DevnetRollupsStack};
+use crate::rollups::{DEVNET_CHAIN_ID, DEVNET_SECONDS_PER_BLOCK, DevnetRollupsStack};
 use crate::util::{
     build_local_endpoint, io_other, path_as_str, send_graceful_terminate, timestamped_log_path,
     wait_for_http_readiness,
@@ -43,6 +43,9 @@ const BOOT_L1_MINE_INTERVAL: Duration = Duration::from_secs(1);
 /// 10: restart and expect recovery); this is the harness counterpart to that.
 const RECOVERY_BOOT_START_TIMEOUT: Duration = Duration::from_secs(45);
 const DEFAULT_SEQUENCER_RUST_LOG: &str = "info";
+/// Passed to `setup` and `run` as `--preemptive-margin-blocks`, so the e2e
+/// zone math owns the value.
+pub const DEVNET_PREEMPTIVE_MARGIN_BLOCKS: u64 = 300;
 pub const DEFAULT_DEVNET_SEQUENCER_BIN: &str = "target/debug/wallet-sequencer-devnet";
 pub const DEFAULT_TEST_LOGS_DIR: &str = "tests/e2e/results";
 
@@ -58,7 +61,7 @@ pub struct ManagedSequencerConfig {
     /// manipulate wall clock). Requires libfaketime in PATH when true.
     pub faketime: bool,
     /// Fixed fee-oracle exponent pinned by the `setup` phase for Anvil/devnet.
-    pub fee_oracle_fixed_log_gas_price: Option<u16>,
+    pub fee_oracle_fixed_log_gas_price: Option<i16>,
 }
 
 /// Snapshot of the `batches` table. Returned by
@@ -70,6 +73,16 @@ pub struct BatchCounts {
     pub invalidated: u64,
 }
 
+/// Highest batch nonce sealed locally and highest accepted on safe L1.
+/// Returned by [`ManagedSequencer::batch_nonce_frontier`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct BatchNonceFrontier {
+    /// Highest nonce among valid sealed batches.
+    pub sealed: Option<u64>,
+    /// Highest nonce in `safe_accepted_batches`.
+    pub safe_accepted: Option<u64>,
+}
+
 /// Drive the next respawn's `setup` phase into `--recovery` mode against a
 /// captured checkpoint. Set via [`ManagedSequencer::set_recovery_setup`] before
 /// wiping the DB and respawning.
@@ -143,6 +156,7 @@ pub struct ManagedSequencer {
     _data_dir: TempDir,
     data_dir_path: PathBuf,
     endpoint: String,
+    internal_endpoint: String,
     log_path: PathBuf,
     /// Overrides the `--eth-rpc-url` the sequencer uses. When `None`, the
     /// sequencer dials Anvil directly. When `Some(url)`, it dials the
@@ -179,7 +193,7 @@ pub struct ManagedSequencer {
     max_batch_open_seconds: Option<u64>,
     /// Fixed fee-oracle exponent forwarded to each `setup` spawn. See
     /// [`ManagedSequencerConfig::fee_oracle_fixed_log_gas_price`].
-    fee_oracle_fixed_log_gas_price: Option<u16>,
+    fee_oracle_fixed_log_gas_price: Option<i16>,
 }
 
 pub fn default_devnet_sequencer_config(log_prefix: impl Into<String>) -> ManagedSequencerConfig {
@@ -244,6 +258,7 @@ impl ManagedSequencer {
         let SpawnedSequencerProcess {
             child,
             endpoint,
+            internal_endpoint,
             log_path,
         } = spawn_sequencer_process(
             sequencer_bin.as_path(),
@@ -277,6 +292,7 @@ impl ManagedSequencer {
             _data_dir: data_dir,
             data_dir_path,
             endpoint,
+            internal_endpoint,
             log_path,
             l1_endpoint_override: None,
             chain_id_override: None,
@@ -321,9 +337,9 @@ impl ManagedSequencer {
     /// Why this exists: a *recovery* boot whose persisted state names a wallet
     /// nonce that L1 never accepted — e.g. a batch-submission tx was dropped
     /// from the mempool ([`Self::drop_all_pending_txs`]) — runs the mempool
-    /// flush during startup. The flush submits a no-op at the stranded nonce
-    /// slot and blocks until that slot becomes *safe* (`safe_nonce >=
-    /// watermark + 1`, I14). Re-enabling auto-mining is not enough:
+    /// flush during startup. The flush submits a no-op at the stranded
+    /// wallet-nonce slot and blocks until that slot becomes *safe*
+    /// (`safe_wallet_nonce >= watermark + 1`, I14). Re-enabling auto-mining is not enough:
     /// auto-mining lands the no-op tx but mints no *further* blocks, so Anvil's
     /// `safe` tag never advances past it and the flush waits until the boot
     /// hits the readiness timeout. In production the chain keeps producing
@@ -424,7 +440,7 @@ impl ManagedSequencer {
         let response = reqwest::Client::new()
             .get(format!(
                 "{}/finalized_state/inclusion_block",
-                self.endpoint()
+                self.internal_endpoint()
             ))
             .timeout(Duration::from_secs(5))
             .send()
@@ -499,7 +515,7 @@ impl ManagedSequencer {
     /// `checkpoint.toml` receipt, outside the paths cleared by reset_database.
     pub async fn capture_finalized_checkpoint(&self) -> HarnessResult<RecoveryCheckpoint> {
         let response = reqwest::Client::new()
-            .get(format!("{}/finalized_snapshot", self.endpoint()))
+            .get(format!("{}/finalized_snapshot", self.internal_endpoint()))
             .timeout(Duration::from_secs(30))
             .send()
             .await?
@@ -589,6 +605,33 @@ impl ManagedSequencer {
         Ok((count as u64, min_nonce.map(|n| n as u64)))
     }
 
+    /// Read-only; safe to call while the sequencer is running.
+    pub fn batch_nonce_frontier(&self) -> HarnessResult<BatchNonceFrontier> {
+        let conn = rusqlite::Connection::open_with_flags(
+            self.db_path().as_path(),
+            rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY,
+        )
+        .map_err(|err| io_other(format!("open DB read-only: {err}")))?;
+
+        let sealed: Option<i64> = conn
+            .query_row(
+                "SELECT MAX(nonce) FROM batches \
+                 WHERE sealed_at_ms IS NOT NULL AND invalidated_at_ms IS NULL",
+                [],
+                |row| row.get(0),
+            )
+            .map_err(|err| io_other(format!("max sealed batch nonce: {err}")))?;
+        let safe_accepted: Option<i64> = conn
+            .query_row("SELECT MAX(nonce) FROM safe_accepted_batches", [], |row| {
+                row.get(0)
+            })
+            .map_err(|err| io_other(format!("max safe-accepted batch nonce: {err}")))?;
+        Ok(BatchNonceFrontier {
+            sealed: sealed.map(|n| n as u64),
+            safe_accepted: safe_accepted.map(|n| n as u64),
+        })
+    }
+
     /// The batch-tree anchor nonce, read from the run DB read-only: `N'` after
     /// cockroach recovery, `0` for a genesis deployment. Lets a recovery e2e
     /// assert the rebuilt tree is rooted at the checkpoint's resume nonce (I16).
@@ -857,10 +900,16 @@ impl ManagedSequencer {
         Ok(())
     }
 
+    /// The public listener: `/tx`, `/fee`, `/nonce`, `/domain`.
     pub fn endpoint(&self) -> &str {
         self.endpoint.as_str()
     }
 
+    /// The internal listener: subscriptions, history, snapshots and health.
+    pub fn internal_endpoint(&self) -> &str {
+        self.internal_endpoint.as_str()
+    }
+
     pub fn pid(&self) -> Option<u32> {
         self.child.id()
     }
@@ -877,6 +926,17 @@ impl ManagedSequencer {
         self.data_dir_path.as_path()
     }
 
+    pub fn db_path(&self) -> PathBuf {
+        self.data_dir_path.join("sequencer.db")
+    }
+
+    /// Live bytes in the database: pages in use, including pages still in the
+    /// WAL and excluding free pages. File sizes show neither. Read while the
+    /// sequencer runs, so the WAL index is there for the read-only connection.
+    pub fn logical_db_bytes(&self) -> HarnessResult<u64> {
+        logical_db_bytes_at(self.db_path().as_path())
+    }
+
     pub fn domain_chain_id(&self) -> u64 {
         DEVNET_CHAIN_ID
     }
@@ -939,6 +999,12 @@ impl ManagedSequencer {
         self.rollups.mine_live_l1_blocks(block_count).await
     }
 
+    /// Mine one block at Anvil's own clock; see
+    /// [`DevnetRollupsStack::mine_l1_block_at_wall_clock`](crate::DevnetRollupsStack::mine_l1_block_at_wall_clock).
+    pub async fn mine_l1_block_at_wall_clock(&self) -> HarnessResult<()> {
+        self.rollups.mine_l1_block_at_wall_clock().await
+    }
+
     pub async fn l1_safe_block_number(&self) -> HarnessResult<u64> {
         self.rollups.l1_safe_block_number().await
     }
@@ -961,15 +1027,26 @@ impl ManagedSequencer {
         self.rollups.drop_all_pending_txs().await
     }
 
+    /// Wait until the sequencer's batch submitter has a transaction in the
+    /// mempool. With auto-mining off, that is the batch submission held out
+    /// of the chain.
+    pub async fn wait_for_pending_batch_submission(&self) -> HarnessResult<()> {
+        // Several idle ticks of the submitter (5 s by default).
+        const TIMEOUT: Duration = Duration::from_secs(30);
+        self.rollups
+            .wait_for_pending_tx_from(app_core::application::DEVNET_SEQUENCER_ADDRESS, TIMEOUT)
+            .await
+    }
+
     /// Advance both the sequencer's wall clock and the L1 chain by `duration`,
-    /// maintaining the block-time coupling invariant (`seconds_per_block`,
-    /// default 12 for Ethereum mainnet parity).
+    /// maintaining the block-time coupling invariant
+    /// ([`DEVNET_SECONDS_PER_BLOCK`], which the harness passes to the sequencer).
     ///
     /// This is the primary tool for simulating elapsed outage time. Effective
     /// **immediately** — works whether the sequencer is running or stopped:
     ///   - The faketime rc file is updated; the running sequencer's next time
     ///     call (or a post-respawn first call) sees the shifted clock.
-    ///   - Anvil mines `duration.as_secs() / SECONDS_PER_BLOCK` blocks.
+    ///   - Anvil mines `duration.as_secs() / DEVNET_SECONDS_PER_BLOCK` blocks.
     ///
     /// **Cumulative**: calling with `1h` twice totals `+2h`, not `+1h`. Use
     /// [`Self::set_faketime_offset`] to jump to a specific offset or reset.
@@ -977,14 +1054,9 @@ impl ManagedSequencer {
     /// Tests that need decoupled wall-clock vs L1 (e.g., the `saturating_sub`
     /// backward-jump test) should use [`Self::set_faketime_offset`] and
     /// [`Self::mine_l1_blocks`] directly.
-    ///
-    /// Assumes `CARTESI_SEQUENCER_SECONDS_PER_BLOCK = 12`. If a test changes that via env,
-    /// this helper's block count will be wrong — prefer the direct dials in
-    /// that case.
     pub async fn advance_wall_and_mine(&mut self, duration: Duration) -> HarnessResult<()> {
-        const SECONDS_PER_BLOCK: u64 = 12;
         let secs = duration.as_secs();
-        let blocks = secs / SECONDS_PER_BLOCK;
+        let blocks = secs / DEVNET_SECONDS_PER_BLOCK;
         self.mine_l1_blocks(blocks).await?;
         self.cumulative_offset_secs = self.cumulative_offset_secs.saturating_add(secs);
         let rc = self
@@ -1188,6 +1260,7 @@ impl ManagedSequencer {
         let SpawnedSequencerProcess {
             child,
             endpoint,
+            internal_endpoint,
             log_path,
         } = spawn_sequencer_process(
             self.sequencer_bin.as_path(),
@@ -1208,6 +1281,7 @@ impl ManagedSequencer {
         .await?;
         self.child = child;
         self.endpoint = endpoint;
+        self.internal_endpoint = internal_endpoint;
         self.log_path = log_path;
         Ok(())
     }
@@ -1279,8 +1353,9 @@ impl ManagedSequencer {
         rollups_result
     }
 
+    /// A client for the internal listener, where the feed lives.
     fn sequencer_client(&self) -> HarnessResult<SequencerClient> {
-        SequencerClient::new_with_timeout(self.endpoint.clone(), Duration::from_secs(5))
+        SequencerClient::new_with_timeout(self.internal_endpoint.clone(), Duration::from_secs(5))
             .map_err(|err| io_other(format!("failed to create sequencer client: {err}")).into())
     }
 
@@ -1311,9 +1386,21 @@ impl ManagedSequencer {
 
 use alloy_primitives::Address;
 
+/// The timing flags the e2e zone math depends on, passed explicitly so an
+/// exported `CARTESI_SEQUENCER_*` variable cannot shift them.
+fn timing_args() -> [String; 4] {
+    [
+        "--preemptive-margin-blocks".into(),
+        DEVNET_PREEMPTIVE_MARGIN_BLOCKS.to_string(),
+        "--seconds-per-block".into(),
+        DEVNET_SECONDS_PER_BLOCK.to_string(),
+    ]
+}
+
 struct SpawnedSequencerProcess {
     child: Child,
     endpoint: String,
+    internal_endpoint: String,
     log_path: PathBuf,
 }
 
@@ -1336,6 +1423,23 @@ fn read_info_next_batch_nonce(dump_dir: &Path) -> HarnessResult<u64> {
     Err(io_other(format!("info.toml missing next_batch_nonce: {info_path:?}")).into())
 }
 
+/// `(page_count - freelist_count) * page_size`, read in one statement so all
+/// three come from the same snapshot.
+fn logical_db_bytes_at(db_path: &Path) -> HarnessResult<u64> {
+    let conn =
+        rusqlite::Connection::open_with_flags(db_path, rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY)
+            .map_err(|err| io_other(format!("open DB read-only: {err}")))?;
+    let bytes: i64 = conn
+        .query_row(
+            "SELECT (page_count - freelist_count) * page_size \
+             FROM pragma_page_count(), pragma_freelist_count(), pragma_page_size()",
+            [],
+            |row| row.get(0),
+        )
+        .map_err(|err| io_other(format!("read logical DB size: {err}")))?;
+    u64::try_from(bytes).map_err(|_| io_other(format!("negative logical DB size: {bytes}")).into())
+}
+
 #[allow(clippy::too_many_arguments)]
 async fn spawn_sequencer_process(
     sequencer_bin: &Path,
@@ -1350,27 +1454,23 @@ async fn spawn_sequencer_process(
     mine_l1_during_boot: bool,
     recovery: Option<&RecoverySetupParams>,
     max_batch_open_seconds: Option<u64>,
-    fee_oracle_fixed_log_gas_price: Option<u16>,
+    fee_oracle_fixed_log_gas_price: Option<i16>,
     genesis_bin: Option<&Path>,
 ) -> HarnessResult<SpawnedSequencerProcess> {
     let (endpoint, http_addr) = build_local_endpoint()?;
+    let (internal_endpoint, internal_http_addr) = build_local_endpoint()?;
     let log_path = timestamped_log_path(logs_dir, log_prefix);
 
     // Dedicated batch submitter = anvil account 9 (NOT the deployer/funder,
-    // account 0). `setup`'s detection gate refuses when the
-    // submitter's wallet nonce is unsettled; the deployer's deploy-tx tail is
-    // not safe at setup time, so reusing it false-positives. Account 9 starts
-    // at nonce 0. Must match `DEVNET_SEQUENCER_ADDRESS` (app-core); a debug
+    // account 0). `setup`'s detection gate refuses when the submitter's wallet
+    // nonce is unsettled, so the submitter must not share a key with the
+    // deployer or with an e2e wallet whose transactions are in flight. Account
+    // 9 starts at nonce 0. Must match `DEVNET_SEQUENCER_ADDRESS` (app-core); an
     // assert below pins that. Account 9 is the highest standard funded anvil
     // account, so it stays clear of the e2e wallets (0–3) and the bench
     // workload (indices 0..concurrency).
     const DEVNET_SUBMITTER_ACCOUNT_INDEX: usize = 9;
-    let batch_submitter_key = default_private_keys()
-        .get(DEVNET_SUBMITTER_ACCOUNT_INDEX)
-        .cloned()
-        .unwrap_or_else(|| {
-            "0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6".to_string()
-        });
+    let batch_submitter_key = default_private_keys()[DEVNET_SUBMITTER_ACCOUNT_INDEX].clone();
     // `setup` takes the submitter *address* (it never signs); `run` takes the
     // key. Derive the address from the key so the harness configures both
     // consistently.
@@ -1463,7 +1563,8 @@ async fn spawn_sequencer_process(
         .arg("--app-address")
         .arg(rollups.app_address().to_string())
         .arg("--batch-submitter-address")
-        .arg(&batch_submitter_address);
+        .arg(&batch_submitter_address)
+        .args(timing_args());
     if let Some(recovery) = recovery {
         // Recovery setup rebuilds the wiped DB from a checkpoint: it signs (the
         // flush), so it takes the key, plus the checkpoint block + dump dir.
@@ -1513,7 +1614,7 @@ async fn spawn_sequencer_process(
                 ))
                 .into());
             }
-            let _ = rollups.mine_live_l1_blocks(1).await;
+            let _ = rollups.mine_l1_block_at_wall_clock().await;
             tokio::time::sleep(BOOT_L1_MINE_INTERVAL).await;
         }
     } else {
@@ -1566,12 +1667,15 @@ async fn spawn_sequencer_process(
         .arg("run")
         .arg("--http-addr")
         .arg(http_addr)
+        .arg("--internal-http-addr")
+        .arg(internal_http_addr)
         .arg("--data-dir")
         .arg(path_as_str(data_dir)?)
         .arg("--eth-rpc-url")
         .arg(eth_rpc_url)
         .arg("--batch-submitter-private-key")
-        .arg(&batch_submitter_key);
+        .arg(&batch_submitter_key)
+        .args(timing_args());
     if let Some(secs) = max_batch_open_seconds {
         run_cmd
             .arg("--max-batch-open-seconds")
@@ -1601,7 +1705,7 @@ async fn spawn_sequencer_process(
                 // Transient RPC hiccups mid-boot are non-fatal — the next tick
                 // retries. A genuine mining failure manifests as the boot
                 // timing out, reported by the readiness arm.
-                let _ = rollups.mine_live_l1_blocks(1).await;
+                let _ = rollups.mine_l1_block_at_wall_clock().await;
             }
         };
         tokio::select! {
@@ -1624,6 +1728,7 @@ async fn spawn_sequencer_process(
     Ok(SpawnedSequencerProcess {
         child,
         endpoint,
+        internal_endpoint,
         log_path,
     })
 }
@@ -1746,7 +1851,49 @@ fn find_libfaketime_in_dirs(lib_dirs: &[PathBuf], candidates: &[&str]) -> Option
 mod tests {
     use std::fs;
 
-    use super::{candidate_libfaketime_dirs, find_libfaketime_in_dirs};
+    use super::{candidate_libfaketime_dirs, find_libfaketime_in_dirs, logical_db_bytes_at};
+
+    /// The logical size counts pages still in the WAL and drops freed pages,
+    /// so it falls after a DELETE while the file, never vacuumed, does not.
+    #[test]
+    fn logical_db_size_counts_wal_pages_and_excludes_free_pages() {
+        let temp = tempfile::TempDir::new().expect("tempdir");
+        let path = temp.path().join("logical.db");
+        let conn = rusqlite::Connection::open(&path).expect("open DB");
+        conn.pragma_update(None, "journal_mode", "WAL")
+            .expect("WAL mode");
+        conn.execute_batch(
+            "CREATE TABLE t(b BLOB);
+             WITH RECURSIVE n(i) AS (SELECT 1 UNION ALL SELECT i + 1 FROM n WHERE i < 2000)
+             INSERT INTO t SELECT zeroblob(1000) FROM n;",
+        )
+        .expect("fill table");
+
+        // Under the autocheckpoint size, so the rows live only in the WAL.
+        let in_wal = logical_db_bytes_at(&path).expect("logical size");
+        assert!(in_wal >= 2000 * 1000, "WAL pages are counted: {in_wal}");
+        assert!(
+            fs::metadata(&path).expect("stat").len() < in_wal,
+            "the main file does not hold the rows yet"
+        );
+
+        conn.execute_batch("PRAGMA wal_checkpoint(TRUNCATE);")
+            .expect("checkpoint");
+        let logical = logical_db_bytes_at(&path).expect("logical size");
+        let file = fs::metadata(&path).expect("stat").len();
+
+        conn.execute_batch("DELETE FROM t; PRAGMA wal_checkpoint(TRUNCATE);")
+            .expect("delete and checkpoint");
+        let logical_after = logical_db_bytes_at(&path).expect("logical size");
+        assert!(
+            logical_after < logical / 4,
+            "freed pages are excluded: {logical_after} vs {logical}"
+        );
+        assert!(
+            fs::metadata(&path).expect("stat").len() >= file,
+            "the file does not shrink without VACUUM"
+        );
+    }
 
     #[cfg(target_os = "linux")]
     #[test]
diff --git a/tests/harness/src/util.rs b/tests/harness/src/util.rs
index be361c7d..ecc8edf0 100644
--- a/tests/harness/src/util.rs
+++ b/tests/harness/src/util.rs
@@ -27,8 +27,8 @@ pub(crate) fn path_as_str(path: &Path) -> HarnessResult<&str> {
         .ok_or_else(|| io_other(format!("path is not valid UTF-8: {}", path.display())).into())
 }
 
-// NOTE: There is a small TOCTOU race between releasing this port and the spawned
-// process binding to it. Fixing properly would require the sequencer binary to
+// NOTE: There is a small TOCTOU race between releasing these ports and the
+// spawned process binding to them. Fixing properly would require the sequencer binary to
 // support `--http-port 0` and report its actual port, which is out of scope.
 pub(crate) fn build_local_endpoint() -> HarnessResult<(String, String)> {
     let listener = std::net::TcpListener::bind("127.0.0.1:0")?;
diff --git a/tests/harness/src/wallet.rs b/tests/harness/src/wallet.rs
index 96eeccbe..6f6bcb64 100644
--- a/tests/harness/src/wallet.rs
+++ b/tests/harness/src/wallet.rs
@@ -8,17 +8,17 @@ use alloy::providers::{DynProvider, Provider, ProviderBuilder};
 use alloy::rpc::types::TransactionRequest;
 use alloy::signers::local::PrivateKeySigner;
 use alloy::sol;
-use alloy_primitives::{Address, Signature, U256};
-use alloy_sol_types::{Eip712Domain, SolStruct};
-use app_core::application::{Method, Transfer, Withdrawal, default_private_keys};
+use alloy_primitives::{Address, U256};
+use alloy_sol_types::Eip712Domain;
+use app_core::application::{Method, Transfer, Withdrawal};
 use cartesi_rollups_contracts::erc20_portal::Erc20Portal;
 use k256::ecdsa::SigningKey;
-use k256::ecdsa::signature::hazmat::PrehashSigner;
 use sequencer_core::api::{TxRequest, TxResponse};
 use sequencer_core::user_op::UserOp;
 use sequencer_rust_client::SequencerClient;
 
 use crate::HarnessResult;
+use crate::default_private_keys;
 use crate::util::io_other;
 
 const DEFAULT_SEQUENCER_CLIENT_TIMEOUT: Duration = Duration::from_secs(5);
@@ -324,24 +324,7 @@ pub fn sign_user_op_hex(
     domain: &Eip712Domain,
     user_op: &UserOp,
 ) -> HarnessResult<String> {
-    let hash = user_op.eip712_signing_hash(domain);
-    let k256_sig = signing_key
-        .sign_prehash(hash.as_slice())
-        .map_err(|err| io_other(format!("failed to sign user op hash: {err}")))?;
-
-    let expected_sender = address_from_signing_key(signing_key);
-    let signature = [false, true]
-        .into_iter()
-        .map(|parity| Signature::from_signature_and_parity(k256_sig, parity))
-        .find(|candidate| {
-            candidate
-                .recover_address_from_prehash(&hash)
-                .ok()
-                .map(|value| value == expected_sender)
-                .unwrap_or(false)
-        })
-        .ok_or_else(|| io_other("failed to derive recoverable signature parity"))?;
-
+    let signature = sequencer_core::test_support::sign_user_op(signing_key, domain, user_op);
     Ok(alloy_primitives::hex::encode_prefixed(signature.as_bytes()))
 }
 
diff --git a/toolchain-pins.env b/toolchain-pins.env
index 5ba947a0..28514258 100644
--- a/toolchain-pins.env
+++ b/toolchain-pins.env
@@ -2,25 +2,44 @@
 # Workflows load this via .github/actions/load-toolchain-pins.
 # Release tag (git v*) is the sequencer / watchdog / CM image bundle version.
 
-RUST_TOOLCHAIN=1.95.0
-
 XGENEXT2FS_VERSION=v1.5.6
 XGENEXT2FS_SHA256_AMD64=996e4e68a638b5dc5967d3410f92ecb8d2f41e32218bbe0f8b4c4474d7eebc59
 XGENEXT2FS_SHA256_ARM64=e5aca81164b762bbe5447bacef41e4fa9e357fd9c8f44e519c5206227d43144d
 
 # Must match the cartesi-machine used to build canonical-machine-image-* tarballs
 # and the watchdog OCI image (in-process cartesi Lua module + CLI).
-CARTESI_MACHINE_VERSION=v0.21.0
-CARTESI_MACHINE_SHA256_AMD64=5f13034f43454c340062c677146daabe77c587cee1bd60342c95b8ad8f1463a3
-CARTESI_MACHINE_SHA256_ARM64=866f0bde2db53b9b8e6a6eac85e5ad4116338379fa25cdfcc5e4bf835f948bb1
+CARTESI_MACHINE_VERSION=v0.22.0
+CARTESI_MACHINE_SHA256_AMD64=906ae4cd0524ef254ea9a83712e6ad353c36123acae21628fb93c1c47955429a
+CARTESI_MACHINE_SHA256_ARM64=212710b5ad74e469368cd5f54b006eebde1e8620833acca5be9a845cf74ab2cc
 
-# machine-linux-image release paired with CARTESI_MACHINE_VERSION (canonical-app justfile).
-CARTESI_LINUX_IMAGE_RELEASE=v0.21.0
-CARTESI_LINUX_KERNEL_FILENAME=linux-6.5.13-ctsi-2-v0.21.0.bin
+# cartesi/linux release paired with CARTESI_MACHINE_VERSION (LINUX_TAG in the
+# emulator's dependencies.lock at that tag); canonical-app justfile.
+CARTESI_LINUX_RELEASE=v6.18.56-ctsi-1
+CARTESI_LINUX_KERNEL_FILENAME=linux-6.18.56-ctsi-1.bin
+# The kernel feeds the canonical template hash; downloads must match this pin.
+CARTESI_LINUX_KERNEL_SHA512=8905c32026de7e893f9523be54afbfd455c38dfbcb1f2bbcefa69fb6c3a7305ecb29c2565f895ac4bccc8e4fcd5ffe74437a533db1670c93278e2e115539a016
 
 # lua-cURLv3 is vendored in-tree under watchdog/third_party/lua-curl/src (no pin
 # to track -- the compiled bytes are the in-tree source). See its UPSTREAM file.
 
+# Build tools installed by taiki-e/install-action (checksum-verified).
+JUST_VERSION=1.58.0
+CROSS_VERSION=0.2.5
+# cargo-deny for CI's cargo-deny job; deny.toml holds the policy.
+CARGO_DENY_VERSION=0.20.2
+
 # Redocly CLI for `redocly lint openapi.yaml`; keep equal to the dev flake's
 # nixpkgs `redocly`.
 REDOCLY_CLI_VERSION=2.17.0
+
+# Foundry (anvil, forge) for CI. The rollups-contracts release publishes its
+# devnet Anvil dump per Anvil version; the root justfile names it after this.
+FOUNDRY_VERSION=v1.5.1
+
+# Must equal the cartesi-rollups-contracts pin in Cargo.toml and the dump
+# named in tests/harness/src/paths.rs (checked by verify-toolchain-pins.sh).
+ROLLUPS_CONTRACTS_VERSION=3.0.0-alpha.10
+
+# machine-guest-tools release whose libcmt is vendored in sdk/guest/libcmt-sys;
+# both rootfs Dockerfiles install it (ARG defaults: checked, not read).
+MACHINE_GUEST_TOOLS_VERSION=0.18.0
diff --git a/watchdog/Dockerfile b/watchdog/Dockerfile
index 9da3b0c8..17337d84 100644
--- a/watchdog/Dockerfile
+++ b/watchdog/Dockerfile
@@ -2,7 +2,7 @@
 # Build args RELEASE_TAG, GIT_COMMIT, and cartesi-machine pins must match toolchain-pins.env
 # and the canonical-machine-image-* tarballs produced in the same release.
 
-# cartesi-machine v0.21 libs require glibc >= 2.38 (bookworm is 2.36).
+# cartesi-machine v0.22 libs require glibc >= 2.38 (bookworm is 2.36).
 ARG DEBIAN_VERSION=trixie-slim
 FROM debian:${DEBIAN_VERSION} AS build
 
diff --git a/watchdog/bootstrap.lua b/watchdog/bootstrap.lua
index 1f95cca9..f741f3d5 100644
--- a/watchdog/bootstrap.lua
+++ b/watchdog/bootstrap.lua
@@ -1,14 +1,8 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- `init`: store a trusted canonical machine as the first checkpoint and
---- persist the configuration.
----
---- The bootstrap machine must wait for an input, yield the configured state
---- source, and be a trusted start (`canonical.trusted_start`). The InputBox is
---- derived from the application. Init is idempotent on a complete state
---- directory and refuses one initialized for a different deployment or state
---- source.
+--- `init`: store a trusted canonical machine as the first checkpoint and persist
+--- the configuration (docs/watchdog/README.md#commands).
 
 local canonical = require("watchdog.canonical")
 local config = require("watchdog.config")
@@ -22,6 +16,8 @@ function bootstrap.run(cfg, deps)
 
     local existing = store:read_json("config.json")
     if existing then
+        -- The same diagnosis `tick` would give a hand-edited config.
+        config.load(store.dir, existing, {})
         local wanted = config.persisted(cfg)
         wanted.chain_id = cfg.chain_id or existing.chain_id
         if not config.same_identity(existing, wanted) then
@@ -35,9 +31,20 @@ function bootstrap.run(cfg, deps)
         return { kind = "already_initialized", head = head }
     end
 
-    -- No config.json: nothing here is initialized, so any checkpoint is an
-    -- interrupted init's.
-    store:remove("checkpoints")
+    -- No config.json. An interrupted init leaves at most its own checkpoint,
+    -- at the bootstrap block; an agreed head is always later, so one here
+    -- means config.json was lost, and deleting the head would discard agreement.
+    for _, checkpoint in ipairs(store:checkpoints()) do
+        if checkpoint.block ~= cfg.bootstrap_block then
+            errors.operator("%s has checkpoint %s but no config.json; restore config.json or wipe the directory",
+                store.dir, checkpoint.dir)
+        end
+    end
+    local checkpoints = store:path("checkpoints")
+    if cfg.bootstrap_dir:sub(1, #checkpoints + 1) == checkpoints .. "/" then
+        errors.operator("CARTESI_WATCHDOG_CM_SNAPSHOT_DIR %s is inside %s, which init replaces",
+            cfg.bootstrap_dir, checkpoints)
+    end
     local work = store:reset_work()
 
     local rpc_chain_id = l1:chain_id()
@@ -51,8 +58,24 @@ function bootstrap.run(cfg, deps)
     machine.check_source(cfg.bootstrap_dir, cfg.state_source)
     local input_count = canonical.trusted_start(machine, l1, cfg.bootstrap_dir, cfg.bootstrap_block).input_count
 
-    local head = store:checkpoint_dir(cfg.bootstrap_block, input_count)
     machine.clone(cfg.bootstrap_dir, work .. "/bootstrap")
+    -- Open the clone as the first tick will open the head, so a machine the
+    -- emulator cannot run in place fails init instead of every comparing tick.
+    local ok, err = pcall(function()
+        machine.open(work .. "/bootstrap", work .. "/probe"):close()
+    end)
+    if not ok then
+        local class, message = errors.classify(err)
+        if class ~= "operator" then
+            error(err, 0)
+        end
+        errors.operator("the tick cannot run %s in place: %s; make its files writable (chmod -R u+w %s, "
+            .. "or on a read-only filesystem a copy that CARTESI_WATCHDOG_CM_SNAPSHOT_DIR names) and re-run init",
+            cfg.bootstrap_dir, message, cfg.bootstrap_dir)
+    end
+    store:remove("work", "probe")
+    store:remove("checkpoints")
+    local head = store:checkpoint_dir(cfg.bootstrap_block, input_count)
     machine.publish(work .. "/bootstrap", head)
     store:write_json(config.persisted(cfg), "config.json")
     return {
diff --git a/watchdog/config.lua b/watchdog/config.lua
index 3db0ec13..1fa145e7 100644
--- a/watchdog/config.lua
+++ b/watchdog/config.lua
@@ -7,7 +7,6 @@
 --- come from the environment at run time.
 
 local errors = require("watchdog.errors")
-local l1 = require("watchdog.l1")
 
 local config = {}
 
@@ -74,20 +73,6 @@ function config.format_state_source(source)
     return source.kind == "range" and ("range:" .. source.label) or source.kind
 end
 
-local function error_codes(value)
-    if value == nil then
-        return l1.DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES
-    end
-    local codes = {}
-    for code in value:gmatch("[^,%s]+") do
-        codes[#codes + 1] = code
-    end
-    if #codes == 0 then
-        errors.operator("CARTESI_WATCHDOG_LONG_BLOCK_RANGE_ERROR_CODES lists no codes")
-    end
-    return codes
-end
-
 --- Everything `init` needs. `chain_id` is nil unless pinned in the
 --- environment; init then takes it from the RPC. The InputBox is derived from
 --- the application at init.
@@ -104,7 +89,6 @@ function config.from_init_env(env)
             "CARTESI_WATCHDOG_APP_ADDRESS"
         ),
         state_source = config.parse_state_source(required(get, "CARTESI_WATCHDOG_STATE_SOURCE")),
-        long_block_range_error_codes = error_codes(optional(get, "CARTESI_WATCHDOG_LONG_BLOCK_RANGE_ERROR_CODES")),
         bootstrap_dir = absolute_path(
             required(get, "CARTESI_WATCHDOG_CM_SNAPSHOT_DIR"),
             "CARTESI_WATCHDOG_CM_SNAPSHOT_DIR"
@@ -126,7 +110,6 @@ function config.persisted(cfg)
         app_address = cfg.app_address,
         state_source = config.format_state_source(cfg.state_source),
         bootstrap_block = cfg.bootstrap_block,
-        long_block_range_error_codes = cfg.long_block_range_error_codes,
     }
 end
 
@@ -145,10 +128,6 @@ function config.load(state_dir, document, env)
         errors.operator("%s/config.json is not a version %d watchdog config; wipe the state directory and re-run init",
             state_dir, config.VERSION)
     end
-    local codes = document.long_block_range_error_codes
-    if type(codes) ~= "table" or #codes == 0 then
-        errors.operator("config.json lists no long_block_range_error_codes")
-    end
     return {
         state_dir = state_dir,
         sequencer_url = optional(get, "CARTESI_WATCHDOG_SEQUENCER_URL") or document.sequencer_url,
@@ -158,7 +137,6 @@ function config.load(state_dir, document, env)
         app_address = config.normalize_address(document.app_address, "config.json app_address"),
         state_source = config.parse_state_source(document.state_source),
         bootstrap_block = block_number(document.bootstrap_block, "config.json bootstrap_block"),
-        long_block_range_error_codes = codes,
     }
 end
 
diff --git a/watchdog/errors.lua b/watchdog/errors.lua
index 5a485254..cdbf0590 100644
--- a/watchdog/errors.lua
+++ b/watchdog/errors.lua
@@ -1,16 +1,9 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- Failure classes. Expected failures are raised as tables with a class;
---- anything else raised (a failed assertion, a Lua error) is an internal
---- fault. Divergences are tick outcomes, never errors.
----
---- - transient: the L1 RPC or the sequencer's HTTP API; it may recover by the
----   next scheduled tick.
---- - operator: configuration, the state directory, or an image: only an
----   operator can fix it.
---- - internal (anything else raised): a fault of the watchdog or its host,
----   filesystem failures such as a full disk included.
+--- Failure classes (docs/watchdog/README.md#commands): `transient`, `operator`,
+--- and `internal` for anything else raised, filesystem failures included.
+--- Divergences are tick outcomes, never errors.
 
 local errors = {}
 
diff --git a/watchdog/http.lua b/watchdog/http.lua
index dcfe61a5..25eb8c80 100644
--- a/watchdog/http.lua
+++ b/watchdog/http.lua
@@ -1,11 +1,10 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- HTTP client over the vendored lua-curl (`lcurl`). Requests return a
---- response table, or `nil, message` when no response arrived.
----
---- Small requests share a total timeout. Downloads stream to a file and are
---- bounded by a stall limit instead, since their size is the application's.
+--- HTTP client over the vendored lua-curl (`lcurl`). Requests return a response
+--- table, or `nil, message` naming the method but never the URL, which carries
+--- the L1 provider's credentials. Small requests share a total timeout; downloads
+--- stream to a file under a stall limit, since their size is the application's.
 
 local http = {}
 
@@ -70,7 +69,7 @@ function http.new()
         local status = performed and easy:getinfo_response_code() or nil
         easy:close()
         if not performed then
-            return nil, string.format("%s %s failed: %s", opts.body and "POST" or "GET", opts.url, tostring(err))
+            return nil, string.format("%s failed: %s", opts.body and "POST" or "GET", tostring(err))
         end
         return { status = status, headers = parse_headers(header_lines) }
     end
diff --git a/watchdog/incident.lua b/watchdog/incident.lua
index 01b0080c..80b2ec93 100644
--- a/watchdog/incident.lua
+++ b/watchdog/incident.lua
@@ -1,17 +1,10 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- The divergence latch. Latching creates `incident/` and writes the latch
---- record `incident/divergence.json`, and nothing else: the directory is the
---- latch, so a record lost to a crash or a full disk still latches (as
---- `unreadable_marker`). The tick then signals the divergence, and only then
---- collects evidence into `incident/`, each item on its own, with progress in
---- `incident/evidence.json`: a slow or failed collection can neither delay
---- nor undo the latch. While latched every tick exits 2 without work, until
---- an operator clears it with `clear`, which archives the incident instead of
---- deleting anything. Clearing is always safe: if the cause persists, the next
---- tick latches again. The incident runbook (docs/watchdog/incident-runbook.md)
---- owns the procedure.
+--- The divergence latch, its evidence, and `clear`
+--- (docs/watchdog/README.md#divergence-latch). The `incident/` directory is the
+--- latch; evidence is collected only after the tick has signalled, so a slow or
+--- failed collection can neither delay nor undo the latch.
 
 local lfs = require("lfs")
 local errors = require("watchdog.errors")
@@ -109,11 +102,8 @@ end
 ---                    sequencer's file, then kept as canonical.bin
 ---   machine          a stored machine directory, kept as incident/canonical
 ---   publish          function(from, to) that durably moves a stored machine
---- `incident/evidence.json` records each item as it ends: its path or result,
---- or `<item>_missing` with the reason. Its `collection` is `running`, then
---- `finished`; a latched tick marks a collection it finds `running` as
---- `interrupted`. Final file names are complete by construction (renames);
---- `*.tmp` files are partial. Never raises; returns the index.
+--- Records each item in `incident/evidence.json` as it ends
+--- (docs/watchdog/README.md#divergence-latch). Never raises; returns the index.
 function incident.collect(store, event, evidence)
     local index = { collection = "running" }
     local function save()
diff --git a/watchdog/jsonrpc.lua b/watchdog/jsonrpc.lua
index 5e7fcbe0..a41f9cc6 100644
--- a/watchdog/jsonrpc.lua
+++ b/watchdog/jsonrpc.lua
@@ -2,7 +2,7 @@
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 --- Minimal Ethereum JSON-RPC client. Calls return `result` or `nil, message`:
---- the L1 reader inspects provider error codes to split long log ranges.
+--- the L1 reader splits a log range whose query failed.
 
 local jsonrpc = {}
 
@@ -34,7 +34,7 @@ function jsonrpc.new(http, json, url)
             params = params,
         }), { ["content-type"] = "application/json" })
         if not response then
-            return nil, http_err
+            return nil, method .. ": " .. tostring(http_err)
         end
         local ok, decoded = pcall(json.decode, response.body)
         if response.status < 200 or response.status >= 300 then
diff --git a/watchdog/justfile b/watchdog/justfile
index ce7f3245..01de9c12 100644
--- a/watchdog/justfile
+++ b/watchdog/justfile
@@ -18,7 +18,7 @@ test-e2e: lua-deps test-guest-image
     {{lua}} watchdog/tests/e2e.lua
 
 lint:
-    cd watchdog && luacheck --no-color *.lua tests/*.lua
+    cd watchdog && luacheck --no-color *.lua tests/*.lua tests/fixtures/*.lua
 
 # Build the vendored native Lua modules (lcurl, lfs) into .deps/lua.
 lua-deps:
diff --git a/watchdog/l1.lua b/watchdog/l1.lua
index 1a96aeca..614abe8b 100644
--- a/watchdog/l1.lua
+++ b/watchdog/l1.lua
@@ -1,15 +1,10 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- The application's InputBox inputs, read from L1 and proven complete.
----
---- `inputs(from, to, first_index, on_input)` yields every input of blocks
---- `from..to` in order, and guarantees there is no gap: indices run
---- contiguously from `first_index`, and the InputBox's own count at `to`
---- (read with `getNumberOfInputs` pinned at that block) equals the next index.
---- A provider that silently truncates a log range therefore fails the tick
---- instead of producing a false comparison. Long ranges are split on the
---- provider error codes that mean "range too large", like the Rust reader.
+--- The application's InputBox inputs, read from L1 and proven complete
+--- (docs/watchdog/README.md#l1-completeness). Range splitting and log order
+--- match the Rust reader (sequencer/src/l1/partition.rs), and
+--- tests/fixtures/l1_partition_vector.json pins both.
 
 local abi = require("watchdog.abi")
 local errors = require("watchdog.errors")
@@ -19,11 +14,6 @@ local l1 = {}
 
 l1.INPUT_ADDED_TOPIC = "0xc05d337121a6e8605c6ec0b72aa29c4210ffe6e5b9cefdd6a7058188a8f66f98"
 
--- Bare codes, matching the sequencer's DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES.
--- `-32005` / `-32012` are provider-overloaded (rate-limit vs range); both sides
--- accept that.
-l1.DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES = { "-32005", "-32012", "-32600", "-32602", "-32616" }
-
 local GET_NUMBER_OF_INPUTS = "0x61a93c87" -- InputBox.getNumberOfInputs(address)
 local GET_TEMPLATE_HASH = "0x61b12c66" -- Application.getTemplateHash()
 local GET_INPUT_BOX = "0x00aace9a" -- Application.getInputBox()
@@ -40,7 +30,7 @@ local function log_position(log, field)
     return value
 end
 
-local function sort_logs(logs)
+function l1.sort_logs(logs)
     local keys = {}
     for _, log in ipairs(logs) do
         keys[log] = {
@@ -61,19 +51,9 @@ local function sort_logs(logs)
     end)
 end
 
-local function mentions_any(message, codes)
-    for _, code in ipairs(codes) do
-        if tostring(message):find(code, 1, true) then
-            return true
-        end
-    end
-    return false
-end
-
 --- `params`: app_address, chain_id, and optionally input_box_address (derived
---- from the application when absent) and long_block_range_error_codes.
+--- from the application when absent).
 function l1.new(rpc, params)
-    local codes = params.long_block_range_error_codes or l1.DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES
     local topics = { l1.INPUT_ADDED_TOPIC, "0x" .. address_word(params.app_address) }
     local input_box = params.input_box_address
     local reader = {}
@@ -194,7 +174,7 @@ function l1.new(rpc, params)
                 topics = topics,
             })
             if logs == nil then
-                if lo < hi and mentions_any(err, codes) then
+                if lo < hi then
                     local mid = lo + (hi - lo) // 2
                     scan(lo, mid)
                     if not stopped then
@@ -204,7 +184,7 @@ function l1.new(rpc, params)
                 end
                 errors.transient("L1 RPC: %s", tostring(err))
             end
-            sort_logs(logs)
+            l1.sort_logs(logs)
             for _, log in ipairs(logs) do
                 local ok, input = pcall(abi.decode_input_added_log, log)
                 if not ok then
diff --git a/watchdog/machine.lua b/watchdog/machine.lua
index 59b383bb..3aa8db62 100644
--- a/watchdog/machine.lua
+++ b/watchdog/machine.lua
@@ -1,11 +1,9 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- The canonical Cartesi Machine, driven in-process with the reference rollup
---- host semantics (docs/cartesi-machine.md#rollup-host-semantics): every input
---- runs on a clone-backed snapshot of the working checkpoint; a rejected input
---- restores the snapshot; any stop other than an accept is a permanent fixed
---- point. Checkpoints are stored machine directories published with fsync.
+--- The canonical Cartesi Machine, driven in-process with the rollup host
+--- semantics of Dave's sling node and the CLI's epoch driver
+--- (docs/cartesi-machine.md#rollup-host-semantics).
 
 local errors = require("watchdog.errors")
 
@@ -20,6 +18,8 @@ function machine.new(cartesi)
 
     local SHARING_ALL = cartesi.SHARING_ALL
     local SHARING_NONE = cartesi.SHARING_NONE
+    local HALT = cartesi.HTIF_DEV_HALT
+    local YIELD = cartesi.HTIF_DEV_YIELD
     local MANUAL = cartesi.HTIF_YIELD_CMD_MANUAL
     local RX_ACCEPTED = cartesi.HTIF_YIELD_MANUAL_REASON_RX_ACCEPTED
     local RX_REJECTED = cartesi.HTIF_YIELD_MANUAL_REASON_RX_REJECTED
@@ -28,36 +28,61 @@ function machine.new(cartesi)
 
     local api = {}
 
-    --- Where a machine at rest stands, from register reads only. `accepted`
-    --- is the only state that can take another request.
+    --- An exception's payload is evidence only: one declared past the TX
+    --- buffer cannot be read, and the yield is an exception all the same.
+    local function exception_message(m)
+        local ok, _, _, data = pcall(m.receive_cmio_request, m)
+        if ok then
+            return data
+        end
+        return string.format("<unavailable: declared length %d>", m:read_reg("htif_tohost_data"))
+    end
+
+    --- Where a machine at rest stands, from register reads only, in the
+    --- step's order (sling's `MachineStf::terminal_fixed` and
+    --- `manual_yield_reason`, dave@dbcca7d4): a pending yield, classified by
+    --- tohost's device, command and reason, then a halt, then an exhausted
+    --- budget. The emulator's break reason ranks a halt first; only a preset
+    --- image sets both flags. `accepted` alone can take another request.
     local function status(m)
-        if not math.ult(m:read_reg("mcycle"), m:read_reg("imcyclemax")) then
-            return { kind = "mcycle_overflow" }
+        if m:read_reg("iflags_Y") ~= 0 then
+            local dev = m:read_reg("htif_tohost_dev")
+            local cmd = m:read_reg("htif_tohost_cmd")
+            local reason = m:read_reg("htif_tohost_reason")
+            if dev == YIELD and cmd == MANUAL then
+                if reason == RX_ACCEPTED then
+                    return { kind = "accepted" }
+                elseif reason == RX_REJECTED then
+                    return { kind = "rejected" }
+                elseif reason == TX_EXCEPTION then
+                    return { kind = "exception", message = exception_message(m) }
+                end
+            end
+            return { kind = "unexpected_yield", dev = dev, cmd = cmd, reason = reason }
         end
         if m:read_reg("iflags_H") ~= 0 then
-            return { kind = "halted", exit_code = m:read_reg("htif_tohost_data") >> 1 }
-        end
-        if m:read_reg("iflags_Y") ~= 0 then
-            local cmd, reason, data = m:receive_cmio_request()
-            if cmd == MANUAL and reason == RX_ACCEPTED then
-                return { kind = "accepted" }
-            elseif cmd == MANUAL and reason == RX_REJECTED then
-                return { kind = "rejected" }
-            elseif cmd == MANUAL and reason == TX_EXCEPTION then
-                return { kind = "exception", message = data }
+            -- After an input delivered to a preset halted machine, tohost
+            -- still holds the yield header, which carries no exit code.
+            local exit_code
+            if m:read_reg("htif_tohost_dev") == HALT then
+                exit_code = m:read_reg("htif_tohost_data") >> 1
             end
-            return { kind = "unexpected_yield", cmd = cmd, reason = reason }
+            return { kind = "halted", exit_code = exit_code }
+        end
+        if not math.ult(m:read_reg("mcycle"), m:read_reg("imcyclemax")) then
+            return { kind = "mcycle_overflow" }
         end
         return { kind = "running" }
     end
 
     local function describe(st)
         if st.kind == "halted" then
-            return "halt with exit code " .. tostring(st.exit_code)
+            return st.exit_code and ("halt with exit code " .. st.exit_code) or "halt"
         elseif st.kind == "exception" then
             return string.format("exception %q", tostring(st.message))
         elseif st.kind == "unexpected_yield" then
-            return string.format("unexpected yield (cmd %s, reason %s)", tostring(st.cmd), tostring(st.reason))
+            return string.format("unexpected yield (dev %s, cmd %s, reason %s)", tostring(st.dev), tostring(st.cmd),
+                tostring(st.reason))
         end
         return st.kind
     end
@@ -81,6 +106,9 @@ function machine.new(cartesi)
             elseif reason ~= cartesi.BREAK_REASON_YIELDED_SOFTLY
                 and reason ~= cartesi.BREAK_REASON_CONSOLE_OUTPUT
             then
+                -- At the MCYCLE_MAX target, with a console that neither
+                -- buffers output nor reads input, v0.22 returns no other
+                -- reason: a new one is a tripwire.
                 error("machine run stopped for unexpected break reason " .. tostring(reason))
             end
         end
@@ -145,8 +173,17 @@ function machine.new(cartesi)
         return found
     end
 
+    --- Send a response the machine must take, failing loud on the silent no-op
+    --- the references carry on from (docs/cartesi-machine.md#rollup-host-semantics).
+    --- Callers send only at a yield `status` reads as accepted, and only delivery
+    --- clears iflags.Y, so the assert sees a no-op only where iflags.Y was set.
+    local function deliver(m, reason, data, revert_root)
+        m:send_cmio_response(reason, data, revert_root)
+        assert(m:read_reg("iflags_Y") == 0, "the machine did not take the cmio response")
+    end
+
     local function inspect_state(m)
-        m:send_cmio_response(cartesi.HTIF_YIELD_REASON_INSPECT_STATE, "state")
+        deliver(m, cartesi.HTIF_YIELD_REASON_INSPECT_STATE, "state")
         local reports = {}
         run_to_stop(m, function(reason, data)
             if reason == TX_REPORT then
@@ -202,7 +239,8 @@ function machine.new(cartesi)
 
     --- An executor advances a private working clone of `head_dir` in place.
     --- Each input snapshots the working directory first (`<working>.revert`),
-    --- exactly like the reference CLI's `--revert-mode=stored`.
+    --- as the CLI's `--revert-mode=stored` does, without its per-input
+    --- `sync_stored`: `work/` is scratch, and only a published head is durable.
     local Executor = {}
     Executor.__index = Executor
 
@@ -225,7 +263,7 @@ function machine.new(cartesi)
         m:destroy()
         m:clone_stored(self.working, self.snapshot)
         m:load(self.working, RUNTIME, SHARING_ALL)
-        m:send_cmio_response(cartesi.HTIF_YIELD_REASON_ADVANCE_STATE, input, revert_root)
+        deliver(m, cartesi.HTIF_YIELD_REASON_ADVANCE_STATE, input, revert_root)
         run_to_stop(m)
         local st = status(m)
         if st.kind == "rejected" then
diff --git a/watchdog/main.lua b/watchdog/main.lua
index 5969dcc8..631e2e8d 100644
--- a/watchdog/main.lua
+++ b/watchdog/main.lua
@@ -1,14 +1,8 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- Watchdog commands (docs/watchdog/README.md#commands):
----
----   init    store a trusted bootstrap machine; persist the configuration
----   tick    one compare cycle; exit 0 ok/idle, 1 warning, 2 divergence
----   status  JSON summary of the state directory
----   clear   --block <B> --reason <text>: archive the latched divergence at B
----   replay  --from <dir> --from-block <A> --to-block <B> --out <dir>:
----           re-derive canonical state into a new directory
+--- Command dispatch, exit codes, `last_tick.json` and `status.prom`
+--- (docs/watchdog/README.md#commands).
 
 package.path = "./?.lua;./?/init.lua;" .. package.path
 do
@@ -93,8 +87,8 @@ local function block_flag(flags, name)
     return value
 end
 
---- The state directory; only commands that write it may create it, so a
---- mistyped path fails `status` and `replay` instead of creating a directory.
+--- The state directory; only `init` and `tick` may create it, so a mistyped
+--- path fails `status`, `replay` and `clear` instead of creating a directory.
 local function open_store(state_dir, create)
     local lfs = require("lfs")
     if lfs.attributes(state_dir, "mode") ~= "directory" then
@@ -149,7 +143,7 @@ end
 
 function commands.clear(flags, env)
     local state_dir = config.state_dir(env)
-    local store = open_store(state_dir, true)
+    local store = open_store(state_dir)
     local archive = incident.clear(store, block_flag(flags, "block"), flag(flags, "reason"), now())
     log("clear: incident archived at %s", archive)
     return EXIT_OK, { archived = archive }
diff --git a/watchdog/replay.lua b/watchdog/replay.lua
index 6e1543d3..ee582ed1 100644
--- a/watchdog/replay.lua
+++ b/watchdog/replay.lua
@@ -3,9 +3,7 @@
 
 --- `replay`: re-derive canonical state from a trusted stored machine into a
 --- new directory, with the same executor and L1 reader as `tick`, and report
---- its digest. It never touches the state directory. Incident triage uses it
---- to check whether the canonical side is reproducible, and to produce a
---- canonical checkpoint at a chosen block for recovery.
+--- its digest. It never touches the state directory.
 
 local canonical = require("watchdog.canonical")
 local errors = require("watchdog.errors")
diff --git a/watchdog/sequencer-watchdog b/watchdog/sequencer-watchdog
index 4fd2ebad..3639ff1c 100755
--- a/watchdog/sequencer-watchdog
+++ b/watchdog/sequencer-watchdog
@@ -13,19 +13,14 @@ fi
 lua_root="${CARTESI_WATCHDOG_LUA_ROOT:-/opt/watchdog/lua}"
 lua_bin="${CARTESI_WATCHDOG_LUA_BIN:-lua5.4}"
 
-# Deb-installed cartesi bindings under /usr/lib — appended *after* the
-# container's own paths (Dockerfile ENV / operator override) so
-# /opt/watchdog/lib/lcurl.so is found first. Prepending broke lcurl
-# discovery in published images. Lua 5.4 prefers the versioned
-# LUA_{C,}PATH_5_4 variables when set, so derive the effective base from
-# versioned-or-unversioned before composing.
+# Append the deb-installed cartesi bindings under /usr/lib after the
+# container's own paths (Dockerfile ENV or an operator override), so the
+# image's /opt/watchdog/lib/lcurl.so is found first. Lua 5.4 prefers
+# LUA_{C,}PATH_5_4 when set, so the base is the versioned variable, else the plain one.
 _cartesi_lua_cpath="/usr/lib/lua/5.4/?.so;/usr/lib/lua/5.4/?/init.so"
 _cartesi_lua_path="/usr/share/lua/5.4/?.lua;/usr/share/lua/5.4/?/init.lua"
 
-# Strip trailing semicolons from $1, then append $2 with an explicit `;`,
-# and finish with `;;` so Lua still expands its defaults at the end.
-# Use `case` (not `[[ == *... ]]`) to trim - a semicolon inside `[[ ]]`
-# is a reserved `;;` token and is easy to mis-quote.
+# Join $1 and $2 with one `;` and end with `;;`, so Lua still appends its defaults.
 join_lua_search_path() {
   local base="$1"
   local extra="$2"
@@ -55,7 +50,15 @@ cd "${lua_root}"
 
 if [[ "$#" -gt 0 && ( "$1" == "init" || "$1" == "tick" || "$1" == "clear" ) ]]; then
   : "${CARTESI_WATCHDOG_STATE_DIR:?CARTESI_WATCHDOG_STATE_DIR is required}"
-  mkdir -p "$CARTESI_WATCHDOG_STATE_DIR"
+  # `clear` acts on an existing incident, so a missing directory is a mistyped path.
+  if [[ "$1" == "clear" ]]; then
+    if [[ ! -d "$CARTESI_WATCHDOG_STATE_DIR" ]]; then
+      echo "state directory $CARTESI_WATCHDOG_STATE_DIR does not exist" >&2
+      exit 1
+    fi
+  else
+    mkdir -p "$CARTESI_WATCHDOG_STATE_DIR"
+  fi
   command -v flock >/dev/null || { echo "flock is required (util-linux)" >&2; exit 1; }
   exec 9>"$CARTESI_WATCHDOG_STATE_DIR/run.lock"
   if ! flock -n 9; then
diff --git a/watchdog/sequencer.lua b/watchdog/sequencer.lua
index f4f787af..5c5b6923 100644
--- a/watchdog/sequencer.lua
+++ b/watchdog/sequencer.lua
@@ -22,7 +22,7 @@ function sequencer.new(http, json, base_url)
             errors.transient("sequencer %s: %s", route, tostring(err))
         end
         if response.status < 200 or response.status >= 300 then
-            errors.transient("sequencer %s: HTTP %d %s", route, response.status, response.body or "")
+            errors.transient("sequencer %s: HTTP %d %s", route, response.status, (response.body or ""):sub(1, 200))
         end
         return response
     end
diff --git a/watchdog/store.lua b/watchdog/store.lua
index 4c1a0e68..c496477a 100644
--- a/watchdog/store.lua
+++ b/watchdog/store.lua
@@ -1,24 +1,10 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- The watchdog state directory:
----
----     config.json                  deployment identity and state source (init)
----     checkpoints/<block>-<count>/ stored machines the sequencer agreed with;
----                                  the newest is the head
----     work/                        scratch for the running command
----     incident/                    the latched divergence and its evidence,
----                                  if any
----     incidents/<id>/              cleared incidents
----     last_tick.json, status.prom  the last tick's outcome
----
---- A checkpoint's name carries its L1 block and the number of InputBox inputs
---- through that block, and the machine layer publishes it with an atomic,
---- fsynced rename: the head needs no pointer file. JSON files are written
---- atomically but without fsync; each is either rebuilt by the next command
---- (a lost latch record still latches as `unreadable_marker`, a lost tick
---- record is rewritten) or written once by init, which is re-run after a
---- crash; `incident/evidence.json` is a best-effort index of the evidence.
+--- The watchdog state directory (docs/watchdog/README.md#state-directory). A
+--- checkpoint's name carries its L1 block and InputBox input count, and the
+--- machine layer publishes it with an atomic, fsynced rename, so the head needs
+--- no pointer file.
 
 local lfs = require("lfs")
 local errors = require("watchdog.errors")
@@ -63,7 +49,10 @@ local function remove_tree(path)
                 remove_tree(path .. "/" .. entry)
             end
         end
-        assert(lfs.rmdir(path))
+        local removed, err = lfs.rmdir(path)
+        if not removed then
+            error(string.format("cannot remove %s: %s", path, tostring(err)), 0)
+        end
     else
         assert(os.remove(path))
     end
@@ -80,8 +69,8 @@ local function read_file(path)
     return data
 end
 
---- Write `path` through `path.tmp` and a rename. A failed write removes the
---- partial file, so a full disk is not left fuller.
+--- Write `path` through `path.tmp` and a rename, without fsync. A failed write
+--- removes the partial file, so a full disk is not left fuller.
 function store.write_file_atomic(path, data)
     local tmp = path .. ".tmp"
     local file = assert(io.open(tmp, "wb"))
diff --git a/watchdog/test-guest/README.md b/watchdog/test-guest/README.md
index 1f8f2dcf..05b314e2 100644
--- a/watchdog/test-guest/README.md
+++ b/watchdog/test-guest/README.md
@@ -2,8 +2,10 @@
 
 A small Cartesi Machine guest that drives every outcome the watchdog's rollup
 host must handle ([rollup host semantics](../../docs/cartesi-machine.md#rollup-host-semantics)).
-Tests run it in the real emulator and use the `cartesi-machine` CLI as the
-oracle.
+`watchdog/tests/e2e.lua` (`just test-watchdog-e2e`) runs it through the
+watchdog's executor and through the `cartesi-machine` CLI and requires equal
+root hashes; [Cartesi Machine facts](../../docs/cartesi-machine.md#the-cli-as-a-test-oracle)
+says what the CLI cannot tell an oracle.
 
 ## Behavior
 
@@ -23,7 +25,7 @@ NVRAM is all zero.
 | Advance payload | Outcome |
 |---|---|
 | `reject` | writes 0xFF over bytes 0..64, then `RX_REJECTED` |
-| `exception` | `TX_EXCEPTION` with payload `test-guest exception` |
+| `exception` | `TX_EXCEPTION` with payload `test-guest exception`; a host that resumes it anyway makes it halt with payload 101 |
 | `halt` | exits with status 7; the machine halts with payload 7 |
 | starts with `report` | one report carrying the payload, then accepted |
 | anything else | accepted |
@@ -33,12 +35,10 @@ NVRAM is all zero.
 | `state` | one report with the whole 64 KiB NVRAM |
 | anything else | one report `unsupported` |
 
-The image also carries two musl stand-ins for guest-tools binaries, which are
-linked against glibc and do not run on Alpine: `/usr/bin/nvram` (`nvram.sh`),
-which the CLI's init lines call to find each NVRAM's `/dev/uioN`, and
-`/usr/sbin/xhalt` (`src/bin/xhalt.rs`), which cartesi-init calls to halt with
-the entrypoint's exit status. The guest resolves its own device from the label
-the same way. trolley has no exception call, so the guest raises the exception
+The image carries musl stand-ins for two glibc guest-tools binaries
+([why](../../docs/cartesi-machine.md#the-guest-side)): `/usr/bin/nvram`
+(`nvram.sh`) and `/usr/sbin/xhalt` (`src/bin/xhalt.rs`). The guest resolves its
+own NVRAM device from the label as `nvram.sh` does, and raises its exception
 through `libcmt-sys` directly.
 
 ## Build
@@ -54,64 +54,3 @@ This cleans `out/`, cross-builds both binaries, builds the rootfs, and stores
 the template at `watchdog/test-guest/out/test-machine-image` (64 MiB RAM,
 `--nvram=label:state,length:64Ki,user:dapp`, `--assert-rolling-template`). The
 build is deterministic: rebuilding prints the same `--final-hash`.
-
-## Oracle checks
-
-Advance inputs are `EvmAdvance` calldata (selector `0x415bf363`); inspect
-queries are raw bytes. Run from the repository root inside `direnv exec . bash`:
-
-```bash
-IMG=$PWD/watchdog/test-guest/out/test-machine-image
-W=$(mktemp -d)
-adv() { # adv <payload>: writes $W/<payload>.bin
-  cast calldata 'EvmAdvance(uint256,address,address,uint256,uint256,uint256,uint256,bytes)' \
-    31337 0x0000000000000000000000000000000000000a11 0x0000000000000000000000000000000000005e4d \
-    100 1700000000 0 0 "$(cast from-utf8 "$1")" | xxd -r -p > "$W/$1.bin"
-}
-for p in hello 'world!' reject exception halt; do adv "$p"; done
-printf state > "$W/query-state"
-check() { # check <run> <payload>...; QUERY=<file> inspects afterwards, MODE=stored clones
-  local dir=$W/$1 i=0 inspect=() load=(--load="$IMG" --remote-spawn --remote-shutdown)
-  shift; mkdir -p "$dir"
-  for p in "$@"; do cp "$W/$p.bin" "$dir/input-$i.bin"; i=$((i + 1)); done
-  if [ -n "${QUERY:-}" ]; then
-    inspect=(--cmio-inspect-state=query:"$W/$QUERY",report:"$dir/query-report-%o.bin")
-  fi
-  if [ "${MODE:-}" = stored ]; then
-    cp -R "$IMG" "$dir/m"
-    load=(--load="$dir/m",sharing:all --revert-mode=stored)
-  fi
-  cartesi-machine "${load[@]}" \
-    --cmio-advance-state=input:"$dir/input-%i.bin",input_index_begin:0,input_index_end:$i,check_outputs_merkle_root:false,output:"$dir/output-%o-input-%i.bin",rejected_output:"$dir/rejected-output-%o-input-%i.bin",output_proof:,report:"$dir/input-%i-report-%o.bin",outputs_merkle_root:,outputs_merkle_root_proof:,print_input_state_hashes \
-    "${inspect[@]}" --final-hash
-}
-QUERY=query-state check a hello 'world!'
-QUERY=query-state check b hello reject 'world!'
-QUERY=query-state MODE=stored check b-stored hello reject 'world!'
-check c hello exception 'world!'
-check d hello halt 'world!'
-```
-
-The guest ignores input metadata. Keeping it fixed makes an input's bytes a
-function of its payload alone, which matters for comparing root hashes across
-runs: the CMIO RX buffer keeps the last input, so it is part of the state.
-
-| Run | CLI exit | Result |
-|---|---|---|
-| `a` | 0 | `query-report-0.bin` is the 64 KiB layout: count 2, total 11, L 6, `world!` |
-| `b`, `b-stored` | 0 | `rx-rejected`; input 2 starts from the pre-reject root; report and final hash equal `a`'s |
-| `c` | 1 | `tx-exception`, `cmio exception with payload: "test-guest exception"`; input 2 never runs |
-| `d` | 7 | `Halted with payload: 7`; input 2 never runs |
-
-Loading a stored result with `cartesi.new():load(dir)` and reading the `state`
-range with `read_memory` returns the same bytes as the `state` report.
-
-`--no-revert` cannot run past a reject: the emulator refuses the next advance
-because the machine is not at an `RX_ACCEPTED` yield. Storing right after the
-reject shows the 0xFF bytes in the NVRAM.
-
-The emulator gates only advances on the yield reason, so the CLI still delivers
-an inspect query to `c`'s exception yield. The guest treats that resume as a
-protocol violation and halts with payload 101 inside the discarded inspect
-snapshot: the CLI exits 101, writes no report, and prints `c`'s final hash.
-After a halt (`d`) the CLI skips the query.
diff --git a/watchdog/test-guest/justfile b/watchdog/test-guest/justfile
index 93f8ba33..867dfefa 100644
--- a/watchdog/test-guest/justfile
+++ b/watchdog/test-guest/justfile
@@ -2,6 +2,7 @@ set shell := ["bash", "-euo", "pipefail", "-c"]
 
 cartesi_machine_version := `sed -n 's/^CARTESI_MACHINE_VERSION=v//p' ../../toolchain-pins.env`
 linux_kernel_filename := `grep '^CARTESI_LINUX_KERNEL_FILENAME=' ../../toolchain-pins.env | cut -d= -f2`
+linux_kernel_sha512 := `grep '^CARTESI_LINUX_KERNEL_SHA512=' ../../toolchain-pins.env | cut -d= -f2`
 
 # The kernel is the canonical image's; `just canonical download-deps` fetches
 # and verifies it.
@@ -23,7 +24,7 @@ default:
 
 build-guest:
     mkdir -p {{out_dir}}
-    SOURCE_DATE_EPOCH={{source_date_epoch}} CARGO_PROFILE_RELEASE_STRIP=symbols CARGO_TARGET_DIR={{target_dir}} CROSS_CONFIG=Cross.toml DOCKER_DEFAULT_PLATFORM=linux/amd64 cross build --package watchdog-test-guest --bins --target {{target}} --release
+    SOURCE_DATE_EPOCH={{source_date_epoch}} CARGO_PROFILE_RELEASE_STRIP=symbols CARGO_TARGET_DIR={{target_dir}} CROSS_CONFIG=Cross.toml DOCKER_DEFAULT_PLATFORM=linux/amd64 cross build --locked --package watchdog-test-guest --bins --target {{target}} --release
     cp {{target_dir}}/{{target}}/release/watchdog-test-guest {{dapp_binary}}
     cp {{target_dir}}/{{target}}/release/xhalt {{xhalt_binary}}
 
@@ -38,7 +39,7 @@ build-rootfs: build-guest
 # Stores the template at the first accept yield, with an all-zero NVRAM `state`.
 build-image: clean build-rootfs
     test -s {{linux_kernel}} || { echo "missing {{linux_kernel}}; run 'just canonical download-deps'"; exit 1; }
-    cd {{kernel_dir}} && shasum -a 512 -c {{linux_kernel_filename}}.sha512 >/dev/null
+    echo "{{linux_kernel_sha512}}  {{linux_kernel}}" | shasum -a 512 -c - >/dev/null
     cartesi-machine \
       --assert-version={{cartesi_machine_version}} \
       --ram-length=64Mi \
diff --git a/watchdog/test-guest/nvram.sh b/watchdog/test-guest/nvram.sh
index 63cb536d..ece04883 100755
--- a/watchdog/test-guest/nvram.sh
+++ b/watchdog/test-guest/nvram.sh
@@ -14,5 +14,6 @@ case $node in /uio@*) ;; *) fail "label '$1' is not an NVRAM ($node)" ;; esac
 start=$(od -An -v -tx1 -N8 "/proc/device-tree$node/reg" | tr -d ' \n')
 [ ${#start} -eq 16 ] || fail "cannot read reg of $node"
 set -- "/sys/devices/platform/$(printf '%x' "0x$start").uio/uio"/uio*
-[ $# -eq 1 ] && [ -e "$1" ] || fail "cannot find the uio device of $node"
+[ $# -eq 1 ] || fail "cannot find the uio device of $node"
+[ -e "$1" ] || fail "cannot find the uio device of $node"
 echo "/dev/${1##*/}"
diff --git a/watchdog/tests/e2e.lua b/watchdog/tests/e2e.lua
index b5d21fb3..d19e08a4 100644
--- a/watchdog/tests/e2e.lua
+++ b/watchdog/tests/e2e.lua
@@ -1,10 +1,11 @@
 -- (c) Cartesi and individual authors (see AUTHORS)
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
---- Watchdog tests against the real Cartesi Machine. The test guest
---- (watchdog/test-guest) drives every rollup host outcome; the reference
---- `cartesi-machine` CLI is the oracle for the executor. Run from the repo
---- root with the canonical and test guest images built:
+--- Watchdog tests against the real Cartesi Machine: the test guest and sling's
+--- bare-metal seam machines drive the rollup host outcomes. The reference
+--- `cartesi-machine` CLI is the oracle, and the step's rule where the CLI aborts
+--- or departs from it.
+--- Run from the repo root with the canonical and test guest images built:
 ---   lua5.4 watchdog/tests/e2e.lua [name filter]
 
 package.path = "./?.lua;./?/init.lua;" .. package.path
@@ -12,6 +13,7 @@ package.cpath = (os.getenv("CARTESI_WATCHDOG_LUA_DEPS") or ".deps/lua") .. "/?.s
 
 local abi = require("watchdog.abi")
 local bootstrap = require("watchdog.bootstrap")
+local cartesi = require("cartesi")
 local config = require("watchdog.config")
 local incident = require("watchdog.incident")
 local json = require("watchdog.json").new()
@@ -87,7 +89,7 @@ local function oracle(image, payloads)
         support.write(string.format("%s/input-%d.bin", dir, i - 1), input(i - 1, payload))
     end
     local command = string.format("cartesi-machine --load=%s --remote-spawn --remote-shutdown "
-        .. "--cmio-advance-state=input:%s/input-%%i.bin,input_index_begin:0,input_index_end:%d,"
+        .. "--cmio-advance-state=input:%s/input-%%i.bin,input_file_index_begin:0,input_file_index_end:%d,"
         .. "check_outputs_merkle_root:false,output:,rejected_output:,output_proof:,report:,"
         .. "outputs_merkle_root:,outputs_merkle_root_proof: --final-hash=%s/final.bin >%s/cli.log 2>&1",
         image, dir, #payloads, dir, dir)
@@ -137,6 +139,173 @@ test("executor reports a halt with the guest's exit code, like the CLI", functio
     eq(hex(root), hex(oracle(image, { "hello", "halt", "world!" })))
 end)
 
+-- ── Bare-metal seams ──────────────────────────────────────────────────────
+
+--- The seam guest of sling's `MachineStf` tests (dave@dbcca7d4): it clears
+--- fromhost, yields the tohost word in x19, then yields x20 each time it
+--- resumes. With imcyclemax = 3 the x19 yield lands on the budget's last cycle.
+local SEAM_PROGRAM = string.pack("<I4I4I4I4I4",
+    0x400082b7, -- lui t0, 0x40008 (HTIF base)
+    0x0002b423, -- sd zero, 8(t0) (fromhost)
+    0x0132b023, -- sd x19, 0(t0) (tohost)
+    0x0142b023, -- sd x20, 0(t0) (tohost)
+    0xffdff06f) -- j -4
+
+local RX_ACCEPTED = cartesi.HTIF_YIELD_MANUAL_REASON_RX_ACCEPTED
+local RX_REJECTED = cartesi.HTIF_YIELD_MANUAL_REASON_RX_REJECTED
+local TX_EXCEPTION = cartesi.HTIF_YIELD_MANUAL_REASON_TX_EXCEPTION
+
+--- A whole tohost word, declaring `length` bytes of data.
+local function tohost(dev, cmd, reason, length)
+    return (dev << cartesi.HTIF_DEV_SHIFT) | (cmd << cartesi.HTIF_CMD_SHIFT) | (reason << cartesi.HTIF_REASON_SHIFT)
+        | (length or 0)
+end
+
+local function manual_yield(reason, length)
+    return tohost(cartesi.HTIF_DEV_YIELD, cartesi.HTIF_YIELD_CMD_MANUAL, reason, length)
+end
+
+--- A stored machine with 4 KiB of RAM and no image, created with
+--- `registers` and run from the start of RAM until `program` stops.
+local function bare_machine(registers, program)
+    local m = cartesi.new():create({ ram = { length = 4096 }, processor = { registers = registers } })
+    if program then
+        m:write_memory(cartesi.AR_RAM_START, program)
+        m:run(cartesi.MCYCLE_MAX)
+    end
+    local dir = support.tmpdir() .. "/machine"
+    m:store(dir)
+    m:destroy()
+    return dir
+end
+
+local function seam_machine(imcyclemax, x19, x20)
+    return bare_machine({ pc = cartesi.AR_RAM_START, imcyclemax = imcyclemax, x19 = x19, x20 = x20 },
+        SEAM_PROGRAM)
+end
+
+test("executor takes inputs after an acceptance on the budget's last cycle, like the CLI", function()
+    -- An accept declares its 32-byte outputs root, which the CLI reads.
+    local accepted = manual_yield(RX_ACCEPTED, cartesi.HASH_SIZE)
+    local dir = seam_machine(3, accepted, accepted)
+    local work = support.tmpdir()
+    local executor = machine.open(dir, work .. "/working")
+    local mcycles = {}
+    for i = 1, 2 do
+        eq(executor:advance(input(i - 1, "seam")).kind, "accepted")
+        mcycles[i] = executor.m:read_reg("mcycle")
+    end
+    executor:close()
+    -- Delivery renewed the budget: the first input ran the x20 yield, the
+    -- second jumped back and yielded again.
+    eq(table.concat(mcycles, " "), "4 6")
+    eq(hex(machine.root_hash(work .. "/working")), hex(oracle(dir, { "seam", "seam" })))
+end)
+
+for _, case in ipairs({
+    { stop = "whose budget runs out before its yield", imcyclemax = 2, x19 = RX_ACCEPTED,
+        refusal = "is at mcycle_overflow" },
+    { stop = "at an exception on its budget's last cycle", imcyclemax = 3, x19 = TX_EXCEPTION,
+        refusal = "is at exception" },
+    { stop = "at an unexpected yield on its budget's last cycle", imcyclemax = 3, x19 = 0x7f,
+        refusal = "is at unexpected yield" },
+    { stop = "at a rejection on its budget's last cycle", imcyclemax = 3, x19 = RX_REJECTED,
+        refusal = "is at rejected" },
+}) do
+    test("open refuses a seam machine " .. case.stop, function()
+        local dir = seam_machine(case.imcyclemax, manual_yield(case.x19), manual_yield(RX_ACCEPTED))
+        raises("operator", case.refusal, function()
+            machine.open(dir, support.tmpdir() .. "/working")
+        end)
+    end)
+end
+
+test("executor fails loud on an input the machine does not take", function()
+    local dir = seam_machine(cartesi.MCYCLE_MAX, manual_yield(RX_ACCEPTED), manual_yield(TX_EXCEPTION))
+    local executor = machine.open(dir, support.tmpdir() .. "/working")
+    eq(executor:advance(input(0, "seam")).kind, "exception")
+    -- An advance at an exception is the emulator's silent no-op.
+    raises("internal", "did not take", function()
+        executor:advance(input(1, "seam"))
+    end)
+    executor:close()
+end)
+
+--- A tohost `word` declaring one byte past the TX buffer, which a guest that
+--- bypasses libcmt can yield and `receive_cmio_request` refuses. The CLI
+--- aborts reading it, so the step's rule is the oracle: an accept takes the
+--- next input, and a reject restores the input's revert root hash.
+local function oversized(word)
+    return word | ((1 << cartesi.AR_CMIO_TX_BUFFER_LOG2_SIZE) + 1)
+end
+
+test("executor takes inputs at accepts that declare data past the TX buffer, as the step does", function()
+    local accepted = oversized(manual_yield(RX_ACCEPTED))
+    local executor = machine.open(seam_machine(cartesi.MCYCLE_MAX, accepted, accepted),
+        support.tmpdir() .. "/working")
+    eq(executor:advance(input(0, "seam")).kind, "accepted")
+    eq(executor:advance(input(1, "seam")).kind, "accepted")
+    executor:close()
+end)
+
+test("executor reverts a rejection that declares data past the TX buffer, as the step does", function()
+    local dir = seam_machine(cartesi.MCYCLE_MAX, manual_yield(RX_ACCEPTED), oversized(manual_yield(RX_REJECTED)))
+    local working = support.tmpdir() .. "/working"
+    local executor = machine.open(dir, working)
+    eq(executor:advance(input(0, "seam")).kind, "rejected")
+    executor:close()
+    eq(hex(machine.root_hash(working)), hex(machine.root_hash(dir)))
+end)
+
+test("executor stops at an exception that declares data past the TX buffer", function()
+    local dir = seam_machine(cartesi.MCYCLE_MAX, manual_yield(RX_ACCEPTED), oversized(manual_yield(TX_EXCEPTION)))
+    local executor = machine.open(dir, support.tmpdir() .. "/working")
+    local status = executor:advance(input(0, "seam"))
+    executor:close()
+    eq(status.kind, "exception")
+    eq(status.message, "<unavailable: declared length 2097153>")
+end)
+
+-- Execution sets iflags.Y only at a manual yield; only a template presets it
+-- under another command or device, and the step treats that as a fixed point.
+for _, case in ipairs({
+    { header = "an automatic yield's command",
+        tohost = tohost(cartesi.HTIF_DEV_YIELD, cartesi.HTIF_YIELD_CMD_AUTOMATIC, RX_ACCEPTED) },
+    { header = "the console device",
+        tohost = tohost(cartesi.HTIF_DEV_CONSOLE, cartesi.HTIF_YIELD_CMD_MANUAL, RX_ACCEPTED) },
+}) do
+    test("open refuses a preset yield under " .. case.header, function()
+        local dir = bare_machine({ iflags = { Y = 1 }, htif = { tohost = case.tohost } })
+        raises("operator", "is at unexpected yield", function()
+            machine.open(dir, support.tmpdir() .. "/working")
+        end)
+    end)
+end
+
+test("executor delivers an input to a preset halted machine with an accept pending, as the step does", function()
+    local dir = bare_machine({ iflags = { H = 1, Y = 1 }, htif = { tohost = manual_yield(RX_ACCEPTED) } })
+    local raw = input(0, "seam")
+    local working = support.tmpdir() .. "/working"
+    local executor = machine.open(dir, working)
+    local status = executor:advance(raw)
+    executor:close()
+    eq(status.kind, "halted")
+    eq(status.exit_code, nil)
+    -- The CLI ends the epoch at the halt, so the step's delivery is the oracle.
+    local m = cartesi.new()
+    m:load(dir, {}, cartesi.SHARING_NONE)
+    local before = m:get_root_hash()
+    m:send_cmio_response(cartesi.HTIF_YIELD_REASON_ADVANCE_STATE, raw, before)
+    local delivered = m:get_root_hash()
+    m:destroy()
+    assert(delivered ~= before, "the oracle did not deliver the input")
+    eq(hex(machine.root_hash(working)), hex(delivered))
+    -- An inspect query cannot run on a halted machine.
+    raises("operator", "inspect query 'state' ended at halt", function()
+        machine.check_source(dir, { kind = "inspect" })
+    end)
+end)
+
 -- ── State sources ─────────────────────────────────────────────────────────
 
 test("range and inspect sources read the same guest state", function()
@@ -178,7 +347,6 @@ local function deployment(inputs, source)
         input_box_address = support.INPUT_BOX,
         app_address = support.APP,
         state_source = config.parse_state_source(source or "range:state"),
-        long_block_range_error_codes = l1_mod.DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES,
         bootstrap_dir = image,
         bootstrap_block = 0,
     }
@@ -268,6 +436,35 @@ test("replay re-derives the digest a tick agreed on", function()
     eq(result.input_count, 3)
 end)
 
+test("init refuses a bootstrap machine the tick cannot run in place", function()
+    local image = support.tmpdir() .. "/image"
+    machine.clone(require_image(GUEST_IMAGE), image)
+    -- Only the RAM file: the clone hard-links the image's read-only PMAs file,
+    -- so a recursive chmod would change the shared test guest image.
+    local ram = image .. "/0000000080000000-*.bin"
+    assert(os.execute("chmod a-w " .. ram))
+    local rpc = support.fake_rpc({}, { template_hash = "0x" .. hex(machine.root_hash(image)) })
+    local store = store_mod.open(support.tmpdir(), json)
+    local ok, err = pcall(bootstrap.run, {
+        state_source = { kind = "range", label = "state" },
+        input_box_address = support.INPUT_BOX,
+        app_address = support.APP,
+        bootstrap_dir = image,
+        bootstrap_block = 0,
+    }, { store = store, machine = machine, l1 = l1_mod.new(rpc, { input_box_address = support.INPUT_BOX,
+        app_address = support.APP, chain_id = support.CHAIN_ID }) })
+    assert(os.execute("chmod u+w " .. ram))
+    eq(ok, false)
+    local message = raises("operator", "chmod -R u+w " .. image, function()
+        error(err, 0)
+    end)
+    -- Root bypasses file modes, so the emulator refuses the mode itself.
+    assert(message:find("Permission denied", 1, true) or message:find("cannot be shared for writing", 1, true),
+        message)
+    eq(store:exists("config.json"), false)
+    eq(#store:checkpoints(), 0)
+end)
+
 test("init refuses a bootstrap machine that is not the template", function()
     local image = require_image(GUEST_IMAGE)
     local rpc = support.fake_rpc({}, { template_hash = "0x" .. string.rep("00", 32) })
@@ -277,7 +474,6 @@ test("init refuses a bootstrap machine that is not the template", function()
             state_source = { kind = "range", label = "state" },
             input_box_address = support.INPUT_BOX,
             app_address = support.APP,
-            long_block_range_error_codes = l1_mod.DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES,
             bootstrap_dir = image,
             bootstrap_block = 0,
         }, { store = store, machine = machine, l1 = l1_mod.new(rpc, { input_box_address = support.INPUT_BOX,
diff --git a/watchdog/tests/run.lua b/watchdog/tests/run.lua
index 959591d4..42d954d2 100644
--- a/watchdog/tests/run.lua
+++ b/watchdog/tests/run.lua
@@ -15,6 +15,7 @@ local errors = require("watchdog.errors")
 local incident = require("watchdog.incident")
 local json = require("watchdog.json").new()
 local l1_mod = require("watchdog.l1")
+local machine_mod = require("watchdog.machine")
 local metrics = require("watchdog.metrics")
 local store_mod = require("watchdog.store")
 local support = require("watchdog.tests.support")
@@ -154,6 +155,36 @@ test("jsonrpc keeps a JSON-RPC error sent with an HTTP error status", function()
     eq(err, "eth_getLogs: HTTP 400: -32602: range too large")
 end)
 
+test("http and jsonrpc name no part of a failed request's URL", function()
+    local stub_error = "[CURL-EASY][COULDNT_CONNECT] Couldn't connect to server (7)"
+    local noop = function() end
+    local real = package.loaded.lcurl
+    -- luacheck: push ignore 122 (a stub for lcurl, restored below)
+    package.loaded.lcurl = {
+        easy = function()
+            return {
+                setopt_post = noop,
+                setopt_postfields = noop,
+                setopt_timeout = noop,
+                perform = function()
+                    error(stub_error, 0)
+                end,
+                close = noop,
+            }
+        end,
+    }
+    local client = require("watchdog.http").new()
+    package.loaded.lcurl = real
+    -- luacheck: pop
+    local url = "https://user:PASSWORD@rpc.example/v3/PATHSECRET?key=QUERYSECRET"
+    local response, err = client:post(url, "{}", {})
+    eq(response, nil)
+    eq(err, "POST failed: " .. stub_error)
+    eq(select(2, client:get(url)), "GET failed: " .. stub_error)
+    local _, rpc_err = require("watchdog.jsonrpc").new(client, json, url):call("eth_chainId", {})
+    eq(rpc_err, "eth_chainId: POST failed: " .. stub_error)
+end)
+
 test("l1 requires the safe head to reach the target", function()
     local reader = l1_reader({}, { safe_head = 10 })
     reader:require_safe_head(10)
@@ -164,13 +195,10 @@ end)
 
 test("l1 splits log ranges exactly like the shared Rust partition vector", function()
     local vector = json.decode(support.read("tests/fixtures/l1_partition_vector.json"))
-    for i, code in ipairs(vector.long_block_range_error_codes) do
-        eq(l1_mod.DEFAULT_LONG_BLOCK_RANGE_ERROR_CODES[i], code, "default code " .. i)
-    end
     for _, scenario in ipairs(vector.scenarios) do
         local failures = {}
         for _, f in ipairs(scenario.fail_ranges) do
-            failures[f.from .. ":" .. f.to] = f.message
+            failures[f.from .. ":" .. f.to] = "injected failure"
         end
         local reader, rpc = l1_reader({}, {
             fail = function(lo, hi)
@@ -187,6 +215,26 @@ test("l1 splits log ranges exactly like the shared Rust partition vector", funct
     end
 end)
 
+test("l1 orders and refuses logs exactly like the shared Rust log-sort vector", function()
+    local log_sort = json.decode(support.read("tests/fixtures/l1_partition_vector.json")).log_sort
+    local logs = {}
+    for i, log in ipairs(log_sort.unsorted) do
+        logs[i] = log
+    end
+    l1_mod.sort_logs(logs)
+    eq(#logs, #log_sort.expect_sorted, "sorted length")
+    for i, expected in ipairs(log_sort.expect_sorted) do
+        for _, field in ipairs({ "blockNumber", "transactionIndex", "logIndex" }) do
+            eq(logs[i][field], expected[field], "position " .. i .. " " .. field)
+        end
+    end
+    for _, case in ipairs(log_sort.refuse) do
+        raises("transient", "InputAdded log without a valid " .. case.missing, function()
+            l1_mod.sort_logs({ case.log })
+        end)
+    end
+end)
+
 -- ── config ────────────────────────────────────────────────────────────────
 
 local function init_env(overrides)
@@ -212,7 +260,6 @@ test("config reads init settings and normalizes addresses", function()
     eq(cfg.state_source.label, "state")
     eq(cfg.bootstrap_block, 0)
     eq(cfg.chain_id, nil)
-    eq(#cfg.long_block_range_error_codes, 5)
 end)
 
 test("config rejects relative paths, bad sources, and missing settings", function()
@@ -241,6 +288,9 @@ test("config round-trips through config.json and keeps endpoints at run time", f
     eq(loaded.input_box_address, support.INPUT_BOX)
     eq(config.format_state_source(loaded.state_source), "range:state")
     assert(config.same_identity(document, config.persisted(cfg)))
+    -- A v2 config.json may carry fields config.load does not read; they are ignored.
+    document.long_block_range_error_codes = { "-32005" }
+    config.load("/var/lib/watchdog", document, {})
     raises("operator", "not a version 2 watchdog config", function()
         document.version = 1
         config.load("/var/lib/watchdog", document, {})
@@ -274,6 +324,35 @@ end)
 
 -- ── incident ──────────────────────────────────────────────────────────────
 
+test("store names the directory it cannot remove", function()
+    local lfs = require("lfs")
+    local dir = support.tmpdir() .. "/stuck"
+    assert(lfs.mkdir(dir))
+    local rmdir = lfs.rmdir
+    lfs.rmdir = function()
+        return nil, "Directory not empty"
+    end
+    local ok, err = pcall(store_mod.remove_tree, dir)
+    lfs.rmdir = rmdir
+    eq(ok, false)
+    eq(select(1, errors.classify(err)), "internal")
+    eq(select(2, errors.classify(err)), "cannot remove " .. dir .. ": Directory not empty")
+end)
+
+test("sequencer keeps the first 200 bytes of an error body", function()
+    local http = {
+        get = function()
+            return { status = 500, body = string.rep("x", 1000) }
+        end,
+    }
+    local ok, err = pcall(function()
+        return require("watchdog.sequencer").new(http, json, "http://sequencer"):inclusion_block()
+    end)
+    eq(ok, false)
+    eq(select(1, errors.classify(err)), "transient")
+    eq(select(2, errors.classify(err)), "sequencer /finalized_state/inclusion_block: HTTP 500 " .. string.rep("x", 200))
+end)
+
 test("store removes its temporary file when a write fails", function()
     local dir = support.tmpdir()
     local open = io.open
@@ -408,6 +487,119 @@ test("incident records a failed item with its reason and keeps collecting", func
     eq(incident.marker(store).target_block, 7)
 end)
 
+-- ── machine ───────────────────────────────────────────────────────────────
+
+--- A fake `cartesi` module whose machines read their registers, the pending
+--- yield's header included, from `regs`, for the facade's status checks. Like
+--- the emulator, `receive_cmio_request` refuses data past the 2 MiB TX buffer.
+local function fake_cartesi(regs)
+    local cartesi = {
+        SHARING_ALL = 1,
+        SHARING_NONE = 0,
+        HTIF_DEV_HALT = 0,
+        HTIF_DEV_CONSOLE = 1,
+        HTIF_DEV_YIELD = 2,
+        HTIF_YIELD_CMD_AUTOMATIC = 0,
+        HTIF_YIELD_CMD_MANUAL = 1,
+        HTIF_YIELD_MANUAL_REASON_RX_ACCEPTED = 1,
+        HTIF_YIELD_MANUAL_REASON_RX_REJECTED = 2,
+        HTIF_YIELD_MANUAL_REASON_TX_EXCEPTION = 4,
+        HTIF_YIELD_AUTOMATIC_REASON_TX_REPORT = 4,
+        HTIF_YIELD_REASON_INSPECT_STATE = 1,
+    }
+    function cartesi.new()
+        return {
+            load = function() end,
+            destroy = function() end,
+            read_reg = function(_, name)
+                return assert(regs[name], name)
+            end,
+            receive_cmio_request = function()
+                if regs.htif_tohost_data > 1 << 21 then
+                    error("CMIO request data is too large")
+                end
+                return regs.htif_tohost_cmd, regs.htif_tohost_reason, ""
+            end,
+            get_initial_config = function()
+                return { nvram = { { label = "state", start = 0x1000, length = 0x1000 } } }
+            end,
+            send_cmio_response = function() end,
+        }
+    end
+    return cartesi
+end
+
+test("machine ranks a halt or manual yield on the budget's last cycle above overflow", function()
+    local regs = { mcycle = 7, imcyclemax = 7, iflags_H = 0, iflags_Y = 1,
+        htif_tohost_dev = 2, htif_tohost_cmd = 1, htif_tohost_reason = 1, htif_tohost_data = 2 }
+    local m = machine_mod.new(fake_cartesi(regs))
+    local range = { kind = "range", label = "state" }
+    m.check_source("/img", range)
+    regs.iflags_Y = 0
+    raises("operator", "is at mcycle_overflow", function()
+        m.check_source("/img", range)
+    end)
+    regs.iflags_H, regs.htif_tohost_dev = 1, 0
+    raises("operator", "is at halt with exit code 1", function()
+        m.check_source("/img", range)
+    end)
+end)
+
+test("machine ranks a pending input yield above a halt, as the step does", function()
+    -- Only a preset image sets both flags.
+    local regs = { mcycle = 0, imcyclemax = 7, iflags_H = 1, iflags_Y = 1,
+        htif_tohost_dev = 2, htif_tohost_cmd = 1, htif_tohost_reason = 1, htif_tohost_data = 2 }
+    local m = machine_mod.new(fake_cartesi(regs))
+    local range = { kind = "range", label = "state" }
+    m.check_source("/img", range)
+    regs.htif_tohost_reason = 2
+    raises("operator", "is at rejected", function()
+        m.check_source("/img", range)
+    end)
+    -- Once delivery clears iflags.Y, tohost still holds the yield header,
+    -- which carries no exit code.
+    regs.iflags_Y = 0
+    raises("operator", "is at halt, not waiting", function()
+        m.check_source("/img", range)
+    end)
+end)
+
+test("machine fails loud when the machine does not take a cmio response", function()
+    -- The fake's send leaves iflags.Y set, as the emulator's no-op does.
+    local m = machine_mod.new(fake_cartesi({ mcycle = 0, imcyclemax = 7, iflags_H = 0, iflags_Y = 1,
+        htif_tohost_dev = 2, htif_tohost_cmd = 1, htif_tohost_reason = 1, htif_tohost_data = 0 }))
+    raises("internal", "did not take", function()
+        m.check_source("/img", { kind = "inspect" })
+    end)
+end)
+
+test("machine classifies a pending yield from the HTIF header, never its declared length", function()
+    -- Every header declares one byte past the TX buffer.
+    local regs = { mcycle = 0, imcyclemax = 7, iflags_H = 0, iflags_Y = 1, htif_tohost_data = (1 << 21) + 1 }
+    local cartesi = fake_cartesi(regs)
+    local m = machine_mod.new(cartesi)
+    local YIELD, MANUAL = cartesi.HTIF_DEV_YIELD, cartesi.HTIF_YIELD_CMD_MANUAL
+    local RX_ACCEPTED = cartesi.HTIF_YIELD_MANUAL_REASON_RX_ACCEPTED
+    local function check(dev, cmd, reason)
+        regs.htif_tohost_dev, regs.htif_tohost_cmd, regs.htif_tohost_reason = dev, cmd, reason
+        m.check_source("/img", { kind = "range", label = "state" })
+    end
+    check(YIELD, MANUAL, RX_ACCEPTED)
+    raises("operator", "is at rejected", function()
+        check(YIELD, MANUAL, cartesi.HTIF_YIELD_MANUAL_REASON_RX_REJECTED)
+    end)
+    raises("operator", 'is at exception "<unavailable: declared length 2097153>"', function()
+        check(YIELD, MANUAL, cartesi.HTIF_YIELD_MANUAL_REASON_TX_EXCEPTION)
+    end)
+    -- Only a preset template carries iflags.Y under another command or device.
+    raises("operator", "is at unexpected yield (dev 2, cmd 0, reason 1)", function()
+        check(YIELD, cartesi.HTIF_YIELD_CMD_AUTOMATIC, RX_ACCEPTED)
+    end)
+    raises("operator", "is at unexpected yield (dev 1, cmd 1, reason 1)", function()
+        check(cartesi.HTIF_DEV_CONSOLE, MANUAL, RX_ACCEPTED)
+    end)
+end)
+
 -- ── tick ──────────────────────────────────────────────────────────────────
 
 local function tick_with(store, inputs, sequencer_state, script, rpc_opts, bootstrap_block)
@@ -616,6 +808,51 @@ test("bootstrap requires the template when no input precedes the block", functio
     eq(store:exists("config.json"), false)
 end)
 
+test("bootstrap refuses a machine the tick cannot run in place", function()
+    local store = store_mod.open(support.tmpdir(), json)
+    raises("operator", "Permission denied; make its files writable (chmod -R u+w ", function()
+        bootstrap_with(store, {}, {}, { open_error = "cannot load stored machine: Permission denied" })
+    end)
+    eq(store:exists("config.json"), false)
+    eq(#store:checkpoints(), 0)
+end)
+
+test("bootstrap validates an existing config like tick would", function()
+    local store = store_mod.open(support.tmpdir(), json)
+    bootstrap_with(store, {})
+    local document = store:read_json("config.json")
+    document.bootstrap_block = -1
+    store:write_json(document, "config.json")
+    raises("operator", "config.json bootstrap_block must be a non-negative integer", function()
+        bootstrap_with(store, {})
+    end)
+end)
+
+test("bootstrap refuses to delete an agreed head beside a missing config", function()
+    local store = support.state_dir(json, 9, 2, "agreed")
+    raises("operator", "but no config.json", function()
+        bootstrap_with(store, { CARTESI_WATCHDOG_CM_SNAPSHOT_SAFE_BLOCK = "5" })
+    end)
+    eq(store:head().block, 9)
+end)
+
+test("bootstrap refuses a snapshot inside the directory it replaces", function()
+    local store = store_mod.open(support.tmpdir(), json)
+    local cfg = config.from_init_env(init_env({}))
+    cfg.state_dir = store.dir
+    cfg.bootstrap_dir = store:path("checkpoints", "copied")
+    raises("operator", "which init replaces", function()
+        bootstrap.run(cfg, { store = store, machine = support.fake_machine(), l1 = l1_reader({}) })
+    end)
+end)
+
+test("bootstrap restarts an interrupted init", function()
+    local store = support.state_dir(json, 5, 0, "partial")
+    local result = bootstrap_with(store, { CARTESI_WATCHDOG_CM_SNAPSHOT_SAFE_BLOCK = "5" }, { { block = 3 } })
+    eq(result.kind, "initialized")
+    eq(store:head().input_count, 1)
+end)
+
 test("bootstrap refuses a pinned chain id the RPC does not serve", function()
     local store = store_mod.open(support.tmpdir(), json)
     raises("operator", "CARTESI_WATCHDOG_BLOCKCHAIN_ID is 5", function()
@@ -706,6 +943,11 @@ test("main tick exits 0/2 and records last_tick.json and status.prom", function(
     eq(run({ "clear", "--block", "12", "--reason", "drill" }), 1)
     eq(run({ "clear", "--block=13", "--reason=drill" }, nil, sink()), 0)
     eq(incident.marker(store), nil)
+
+    local missing = store.dir .. "-mistyped"
+    eq(main.run({ "clear", "--block=13", "--reason=drill" },
+        { env = { CARTESI_WATCHDOG_STATE_DIR = missing }, stdout = sink() }), 1)
+    eq(require("lfs").attributes(missing, "mode"), nil)
 end)
 
 test("main tick keeps exit 2 while latched even when nothing else can run", function()
diff --git a/watchdog/tests/support.lua b/watchdog/tests/support.lua
index de69aadf..9409b043 100644
--- a/watchdog/tests/support.lua
+++ b/watchdog/tests/support.lua
@@ -201,8 +201,9 @@ end
 
 --- A machine facade whose stored machines are directories holding a
 --- `state` file. `script.statuses[i]` is the status of the i-th advanced
---- input (default `accepted`). `script.publish_error` makes `publish` raise it.
---- `sha256` is the identity, so fake digests are readable.
+--- input (default `accepted`). `script.publish_error` makes `publish` raise it;
+--- `script.open_error` makes `open` raise it as an operator error, as a failed
+--- load does. `sha256` is the identity, so fake digests are readable.
 function support.fake_machine(script)
     script = script or {}
     local fake = { advanced = 0 }
@@ -210,6 +211,9 @@ function support.fake_machine(script)
         return dir .. "/state"
     end
     function fake.open(head_dir, working_dir)
+        if script.open_error then
+            errors.operator(script.open_error)
+        end
         assert(lfs.mkdir(working_dir))
         support.write(state_path(working_dir), support.read(state_path(head_dir)) or "")
         return {
diff --git a/watchdog/tick.lua b/watchdog/tick.lua
index 8ccb2606..5d0f9520 100644
--- a/watchdog/tick.lua
+++ b/watchdog/tick.lua
@@ -2,23 +2,6 @@
 -- SPDX-License-Identifier: Apache-2.0 (see LICENSE)
 
 --- One compare cycle (docs/watchdog/README.md#the-tick).
----
---- The replay target is the block the sequencer's digest describes, fetched
---- before replaying, so a long replay can never chase a moving target. The
---- head only advances past a block the sequencer agreed with; anything else
---- latches a divergence and returns its evidence.
----
---- The accepted block regresses only relative to a block the sequencer agreed
---- with. Until the first agreement the head is just the bootstrap machine, and
---- a sequencer behind it has not reached it yet.
----
---- A divergence latches before anything else, and the tick reports it even
---- when `incident/` cannot be created (`latch_error`) or only its record
---- cannot be written (`record_error`; the latch holds). Its evidence is
---- returned as `evidence`, for the caller to collect after it has signalled.
----
---- Outcomes: `latched` (already latched; no work), `idle` (nothing new),
---- `agreed` (head advanced), `diverged` (newly found). Failures raise.
 
 local canonical = require("watchdog.canonical")
 local errors = require("watchdog.errors")
@@ -27,7 +10,11 @@ local store_mod = require("watchdog.store")
 
 local tick = {}
 
---- `deps`: store, machine, sequencer, l1, now().
+--- `deps`: store, machine, sequencer, l1, now(). Returns `{ kind }`: `latched`
+--- (no work), `idle`, `agreed` (head advanced), or `diverged`, latched before
+--- anything else and reported even with `latch_error` (`incident/` not created)
+--- or `record_error` (only its record not written); its `evidence` is for the
+--- caller to collect after it has signalled. Failures raise.
 function tick.run(cfg, deps)
     local store, machine, sequencer = deps.store, deps.machine, deps.sequencer
 
@@ -54,7 +41,8 @@ function tick.run(cfg, deps)
         return { kind = "diverged", incident = event, record_error = record_error, evidence = evidence }
     end
 
-    --- Nothing to compare at `block`, or a regression.
+    --- Nothing to compare at `block`, or a regression. Only an agreed block can
+    --- regress; a sequencer behind the never-agreed bootstrap head has not reached it.
     local function behind(block)
         if block == head.block then
             return { kind = "idle", head = head }
@@ -68,6 +56,7 @@ function tick.run(cfg, deps)
     if polled <= head.block then
         return behind(polled)
     end
+    -- The target is fixed before replaying, so a long replay never chases a moving one.
     local target = sequencer:digest()
     if target.inclusion_block <= head.block then
         return behind(target.inclusion_block)